Fast Feature Fool: A data independent approach to universal adversarial perturbations

By Konda Reddy Mopuri, Utsav Garg, R. Venkatesh Babu. 2017

228 citations recorded by the source corpus.

State-of-the-art object recognition Convolutional Neural Networks (CNNs) are shown to be fooled by image agnostic perturbations, called universal adversarial perturbations. It is also observed that these perturbations generalize across multiple networks trained on the same target data. However, these algorithms require training data on which the CNNs were trained and compute adversarial perturbations via complex optimization. The fooling performance of these approaches is directly proportional to the amount of available training data. This makes them unsuitable for practical attacks since its unreasonable for an attacker to have access to the training data. In this paper, for the first time, we propose a novel data independent approach to generate image agnostic perturbations for a range of CNNs trained for object recognition. We further show that these perturbations are transferable across multiple network architectures trained either on same or different data. In the absence of data, our method generates universal adversarial perturbations efficiently via fooling the features learned at multiple layers thereby causing CNNs to misclassify. Experiments demonstrate impressive fooling rates and surprising transferability for the proposed universal perturbations generated without any training data.

Subfields: Artificial Intelligence, Signal Processing

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Signal Processing

Citations in the corpus

Spatially Transformed Adversarial Examples (2018, background): “…et al., 2015; Carlini & Wagner, 2017a; Moosavi-Dezfooli et al., 2015; Papernot et al., 2016b; Biggio et al., 2013; Kurakin et al., 2016); while having zero knowledge about them in the black-box setting (Papernot et al., 2016a; Liu et al., 2017; Moosavi-Dezfooli et al., 2016; Mopuri et al., 2017).”
Threat of Adversarial Attacks on Deep Learning in Computer Vision: A Survey (2018, methodology): “[134] developed a data-independent approach to generate universal adversarial perturbations for the deep network models.”
Ask, Acquire, and Attack: Data-free UAP Generation using Class Impressions (2018, methodology): “However the data-free approaches (e.g. FFF [17]), with a goal to understand the true stability of the the models, indirectly craft UAPs (e.g. activation loss of FFF [17]) instead of using a direct fooling objective.”
A Survey on Neural Network Interpretability (2020, background): “surface/critical points [33]–[36]? Why DNNs generalizes so well with just simple regularization [37]–[39]? What about DNNs’ robustness/stability [40]–[45]? There are also studies about how to generate adversarial examples [46], [47] and detect adversarial inputs [48].”
A Survey on Security Threats and Defensive Techniques of Machine Learning: A Data Driven View (2018, background): “Hence, an attacker can easily launch impersonate attacks by modifying some key features [66], [67].”
Exploring the Space of Black-box Attacks on Deep Neural Networks (2017, unknown): “In the literature, a number of these zero-query attacks have been carried out with varying degrees of success (Papernot et al., 2016; Liu et al., 2017; Moosavi-Dezfooli et al., 2016; Mopuri et al., 2017).”
Universal Adversarial Training (2018, background): “These universal perturbations are slightly weaker than the data dependent approaches (Mopuri, Garg, and Babu, 2017; Mopuri, Gane-shan, and Radhakrishnan, 2018).”
Deep Neural Network Concepts for Background Subtraction: A Systematic Review and Comparative Evaluation (2018, background): “dataset. 2.3 Theoretical Aspects Theoretical aspects concern mainly the understanding and the provability of DNNs [145,194,195,219], but also their properties in presence of adversarial perturbations [34,137,138,139,140,186,231],andtheirrobustnessinpresenceofnoisylabels[189]. For this, the principle”
A Self-supervised Approach for Adversarial Robustness (2020, methodology): “In the case of FFF [12], we train the adversarial noise for 10K iterations to maximize the response at the activation layers of VGG-16 [15].”
Cross-Domain Transferability of Adversarial Perturbations (2019, methodology): “To reduce dependency on the input data samples, [13] maximizes layer activations of the source network while [14] extracts deluding perturbations using class impressions relying on the source label space.”
Learning Universal Adversarial Perturbations with Generative Models (2017, methodology): “Note that the Mopuri et al. [22] method for crafting UAPs is only optimized under the (cid”
Regional Homogeneity: Towards Learning Transferable Universal Adversarial Perturbations Against Defenses (2019, background): “Researchers also explore to produce universal adversarial perturbations by different methods [27, 39] or on different tasks [24, 42].”
Generative Adversarial Perturbations (2017, background): “[38] presents a data independent approach for generating image-agnostic perturbations.”
A Geometric Perspective on the Transferability of Adversarial Directions (2018, background): “While there has been a signiﬁcant amount of work on designing adversarial attacks (Grosse et al., 2016; Moosavi Dezfooli et al., 2016; Mopuri et al., 2017; Hendrik Metzen et al., 2017; Papernot et al., 2016) and defenses against these attacks (Madry et al., 2017; Sinha et al., 2017), theoretical…”