Adversarial Attacks with Time-Scale Representations

Abstract

We propose a novel framework for real-time black-box universal attacks which disrupts activations of early convolutional layers in deep learning models. Our hypothesis is that perturbations produced in the wavelet space disrupt early convolutional layers more effectively than perturbations performed in the time domain. The main challenge in adversarial attacks is to preserve low frequency image content while minimally changing the most meaningful high frequency content. To address this, we formulate an optimization problem using time-scale (wavelet) representations as a dual space in three steps. First, we project original images into orthonormal sub-spaces for low and high scales via wavelet coefficients. Second, we perturb wavelet coefficients for high scale projection using a generator network. Third, we generate new adversarial images by projecting back the original coefficients from the low scale and the perturbed coefficients from the high scale sub-space. We provide a theoretical framework that guarantees a dual mapping from time and time-scale domain representations. We compare our results with state-of-the-art black-box attacks from generative-based and gradient-based models. We also verify efficacy against multiple defense methods such as JPEG compression, Guided Denoiser and Comdefend. Our results show that wavelet-based perturbations consistently outperform time-based attacks thus providing new insights into vulnerabilities of deep learning models and could potentially lead to robust architectures or new defense and attack mechanisms by leveraging time-scale representations.

References in corpus (16)

• Very Deep Convolutional Networks for Large-Scale Image Recognition
• Densely Connected Convolutional Networks
• ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Models
• Understanding Deep Convolutional Networks
• On Evaluating Adversarial Robustness
• On the (Statistical) Detection of Adversarial Examples
• Defense-GAN: Protecting Classifiers Against Adversarial Attacks Using Generative Models
• A General Framework for Adversarial Examples with Objectives
• Improving Black-box Adversarial Attacks with a Transfer-based Prior
• Guessing Smart: Biased Sampling for Efficient Black-Box Adversarial Attacks
• Fast Feature Fool: A data independent approach to universal adversarial perturbations
• UPSET and ANGRI : Breaking High Performance Image Classifiers
• Universal adversarial perturbations
• Characterizing Adversarial Examples Based on Spatial Consistency Information for Semantic Segmentation
• Regional Homogeneity: Towards Learning Transferable Universal Adversarial Perturbations Against Defenses
• Adversarial Robustness Assessment: Why both $L_0$ and $L_{\infty }$ Attacks Are Necessary