EAD: Elastic-Net Attacks to Deep Neural Networks via Adversarial Examples

By Pin-Yu Chen, Yash Sharma, Huan Zhang, Jinfeng Yi, Cho-Jui Hsieh. 2017

689 citations recorded by the source corpus.

Recent studies have highlighted the vulnerability of deep neural networks (DNNs) to adversarial examples — a visually indistinguishable adversarial image can easily be crafted to cause a well-trained model to misclassify. Existing methods for crafting adversarial examples are based on L2 and L∞ distortion metrics. However, despite the fact that L1 distortion accounts for the total variation and encourages sparsity in the perturbation, little has been developed for crafting L1-based adversarial examples. In this paper, we formulate the process of attacking DNNs via adversarial examples as an elastic-net regularized optimization problem. Our elastic-net attacks to DNNs (EAD) feature L1-oriented adversarial examples and include the state-of-the-art L2 attack as a special case. Experimental results on MNIST, CIFAR10 and ImageNet show that EAD can yield a distinct set of adversarial examples with small L1 distortion and attains similar attack performance to the state-of-the-art methods in different attack scenarios. More importantly, EAD leads to improved attack transferability and complements adversarial training for DNNs, suggesting novel insights on leveraging L1 distortion in adversarial machine learning and security implications of DNNs.

Subfields: Artificial Intelligence, Safety, Robustness & Interpretability, Privacy & Security

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Safety, Robustness & Interpretability

In Privacy & Security

Citations in the corpus

Adversarial Training and Robustness for Multiple Perturbations (2019, methodology): “Our attack is competitive with the more expensive EAD attack [8] (see Appendix C).”
Attacking the Madry Defense Model with L1-based Adversarial Examples (2017, methodology): “EAD generalizes the state-of-the-art C&W L2 attack (Carlini & Wagner, 2017) by performing elastic-net regularization, linearly combining the L1 and L2 penalty functions (Chen et al., 2017).”
Theoretical evidence for adversarial robustness through randomization: the case of the Exponential family (2019, methodology): “To evaluate our models under attack, we use three powerful iterative attacks with different norms: ElasticNet attack (EAD) [8] with `1 distortion, Carlini&Wagner attack (C&W) [6] with `2 distortion and Projected Gradient Descent attack (PGD) [27] with `∞ distortion.”
Evaluating the Robustness of Neural Networks: An Extreme Value Theory Approach (2018, methodology): “Adversarial examples can also be crafted from a black-box network model using an ensemble approach (Liu et al., 2016), training a substitute model (Papernot et al., 2017), or employing zeroth-order optimization based attacks (Chen et al., 2017c).”
Certified Defenses against Adversarial Examples (2018, background): “There are also other attacks based on, e.g., saliency maps (Papernot et al., 2016a), KL divergence (Miyato et al., 2015), and elastic net optimization (Chen et al., 2017); many of these attacks are collated in the cleverhans repository (Goodfellow et al., 2016).”
Towards Robust Neural Networks via Random Self-ensemble (2017, background): “Several variances are proposed recently [3, 14], but most of them are following the similar framework.”
Technical Report on the CleverHans v2.1.0 Adversarial Examples Library (2016, methodology): “The Elastic Net Method (EAD) was introduced by Chen et al. [7].”
Attacking Visual Language Grounding with Adversarial Examples: A Case Study on Neural Image Captioning (2017, background): “Popular choices are the L ∞ , L 2 and L 1 distortions (Kurakin et al., 2017; Carlini and Wagner, 2017; Chen et al., 2018); and (ii) an attack loss function accounting for the success of adversarial examples.”
Towards Fast Computation of Certified Robustness for ReLU Networks (2018, methodology): “Comparison of our proposed certified lower bounds Fast-Lin and Fast-Lip, LP and LP-Full, the estimated lower bounds by CLEVER, the exact minimum distortion by Reluplex, and the upper bounds by Attack algorithms (CW `∞ for p = ∞, CW `2 for p = 2, and EAD for p = 1) on 2, 3 layers toy MNIST networks w”
Seq2Sick: Evaluating the Robustness of Sequence-to-Sequence Models with Adversarial Examples (2018, background): “Since then, a number of approaches have surfaced regarding adversarial attacks on CNNs, such as using gradient-based methods [2, 11, 12, 13, 14, 15], score-based methods [16, 17, 18], transfer-based methods [19], and decision-based methods [20].”
Transfer of Adversarial Robustness Between Perturbation Types (2019, methodology): “L ∞ (Goodfellow et al., 2014), L 2 (Carlini & Wagner, 2017), L 1 (Chen et al., 2018), elastic deformations (Xiao et al., 2018), and JPEG (Shin & Song, 2017)–against adversarially trained ResNet-50 models on a 100-class subset of full-resolution ImageNet.”
Adversarial Robustness vs. Model Compression, or Both? (2019, background): “, structure and weight parameters) [7, 8, 50, 44]; or black-box accesses where the adversary can only make queries and observe outputs [9, 22].”
Is Robustness the Cost of Accuracy? - A Comprehensive Study on the Robustness of 18 Deep Image Classification Models (2018, background): “– EAD-L1 attack EAD-L1 attack [41] refers to the Elastic-Net Attacks to DNNs, which is a more general formulation than C&W attack.”
Evaluating Robustness of Neural Networks with Mixed Integer Programming (2017, background): “The most prevalent distance metrics in the literature for generating adversarial examples are the l1 [8, 9], l2 [37], and l∞ [17, 32] norms.”
Skip Connections Matter: On the Transferability of Adversarial Examples Generated with ResNets (2020, methodology): “There are also other types of white-box attacks including sparsity-based methods such as Jacobian-based Saliency Map Attack (JSMA) (Papernot et al., 2016), sparse attack (Modas et al., 2019), one-pixel attack (Su et al., 2019), and optimization-based methods such as Carlini and Wagner (CW) (Carlini ”
A Panda? No, It's a Sloth: Slowdown Attacks on Adaptive Multi-Exit Neural Network Inference (2020, neutral): “35 (Chen et al., 2017); for Tiny ImageNet, || v || ∞ ≤ (cid:15) = 0 .”