Adversarial Attack across Datasets
arXiv:2110.07718
Abstract
Existing transfer attack methods commonly assume that the attacker knows the training set (e.g., the label set, the input size) of the black-box victim models, which is usually unrealistic because in some cases the attacker cannot know this information. In this paper, we define a Generalized Transferable Attack (GTA) problem where the attacker doesn't know this information and is acquired to attack any randomly encountered images that may come from unknown datasets. To solve the GTA problem, we propose a novel Image Classification Eraser (ICE) that trains a particular attacker to erase classification information of any images from arbitrary datasets. Experiments on several datasets demonstrate that ICE greatly outperforms existing transfer attacks on GTA, and show that ICE uses similar texture-like noises to perturb different images from different datasets. Moreover, fast fourier transformation analysis indicates that the main components in each ICE noise are three sine waves for the R, G, and B image channels. Inspired by this interesting finding, we then design a novel Sine Attack (SA) method to optimize the three sine waves. Experiments show that SA performs comparably to ICE, indicating that the three sine waves are effective and enough to break DNNs under the GTA setting.
References in corpus (7)
- ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Models
- Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks
- Skip Connections Matter: On the Transferability of Adversarial Examples Generated with ResNets
- Guided Adversarial Attack for Evaluating and Enhancing Adversarial Defenses
- Stronger and Faster Wasserstein Adversarial Attacks
- Practical No-box Adversarial Attacks against DNNs
- Training Meta-Surrogate Model for Transferable Adversarial Attack