Meta Gradient Adversarial Attack

Abstract

In recent years, research on adversarial attacks has become a hot spot. Although current literature on the transfer-based adversarial attack has achieved promising results for improving the transferability to unseen black-box models, it still leaves a long way to go. Inspired by the idea of meta-learning, this paper proposes a novel architecture called Meta Gradient Adversarial Attack (MGAA), which is plug-and-play and can be integrated with any existing gradient-based attack method for improving the cross-model transferability. Specifically, we randomly sample multiple models from a model zoo to compose different tasks and iteratively simulate a white-box attack and a black-box attack in each task. By narrowing the gap between the gradient directions in white-box and black-box attacks, the transferability of adversarial examples on the black-box setting can be improved. Extensive experiments on the CIFAR10 and ImageNet datasets show that our architecture outperforms the state-of-the-art methods for both black-box and white-box attack settings.

arXiv comment13 pages, 2 figures, 12 tables. Accepted by ICCV2021

References in corpus (14)

• ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Models
• Towards Deep Learning Models Resistant to Adversarial Attacks
• Certified Defenses against Adversarial Examples
• On First-Order Meta-Learning Algorithms
• Shake-Shake regularization
• Defense-GAN: Protecting Classifiers Against Adversarial Attacks Using Generative Models
• A study of the effect of JPG compression on adversarial images
• Stochastic Activation Pruning for Robust Adversarial Defense
• Mitigating Adversarial Effects Through Randomization
• Learning to Generalize: Meta-Learning for Domain Generalization
• Query-Efficient Hard-label Black-box Attack:An Optimization-based Approach
• Improving the Transferability of Adversarial Examples with Resized-Diverse-Inputs, Diversity-Ensemble and Region Fitting
• Robust Local Features for Improving the Generalization of Adversarial Training
• Enhancing Adversarial Defense by k-Winners-Take-All