Skip Connections Matter: On the Transferability of Adversarial Examples Generated with ResNets

By Dongxian Wu, Yisen Wang, Shutao Xia, James Bailey, Xingjun Ma. 2020

364 citations recorded by the source corpus.

Skip connections are an essential component of current state-of-the-art deep neural networks (DNNs) such as ResNet, WideResNet, DenseNet, and ResNeXt. Despite their huge success in building deeper and more powerful DNNs, we identify a surprising \emph{security weakness} of skip connections in this paper. Use of skip connections \textit{allows easier generation of highly transferable adversarial examples}. Specifically, in ResNet-like (with skip connections) neural networks, gradients can backpropagate through either skip connections or residual modules. We find that using more gradients from the skip connections rather than the residual modules according to a decay factor, allows one to craft adversarial examples with high transferability. Our method is termed \emph{Skip Gradient Method} (SGM). We conduct comprehensive transfer attacks against state-of-the-art DNNs including ResNets, DenseNets, Inceptions, Inception-ResNet, Squeeze-and-Excitation Network (SENet) and robustly trained DNNs. We show that employing SGM on the gradient flow can greatly improve the transferability of crafted attacks in almost all cases. Furthermore, SGM can be easily combined with existing black-box attack techniques, and obtain high improvements over state-of-the-art transferability methods. Our findings not only motivate new research into the architectural vulnerability of DNNs, but also open up further challenges for the design of secure DNN architectures.

Subfields: Artificial Intelligence, Materials Chemistry, Safety, Robustness & Interpretability

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Materials Chemistry

In Safety, Robustness & Interpretability

Citations in the corpus

Adversarial Example Games (2020, methodology): “Throughout our experiments we rely on four standard blackbox transfert attack strategies adapted to the NoBox setting: the Momentum-Iterative Attack (MI-Attack) [24], the Input Diversity (DI-Attack) [73], the Translation-Invariant (TID-Attack) [25] and the Skip Gradient Method (SGMAttack) [71].”
Ensemble Adversarial Training: Attacks and Defenses (2017, background): “Yet, subsequent work (Dong et al., 2019; Xie et al., 2019b; Wu et al., 2020) After the ﬁrst round, we released our model publicly, which enabled other users to launch white-box attacks against it.”
Boosting Decision-Based Black-Box Adversarial Attacks with Random Sign Flip (2020, background): “One approach to make black-box attacks feasible is to utilize the transferability of adversarial examples [33, 34, 38, 39, 46].”
Bag of Tricks for Adversarial Training (2020, background): “Interestingly, Wu et al. (2020) demonstrate that residual connections allow easier generation of highly transferable adversarial examples, while in our case this weakness for the standardly trained models may turn out to strengthen the adversarially trained models.”
Understanding Adversarial Attacks on Deep Learning Based Medical Image Analysis Systems (2019, methodology): “While there also exists other attacking methods (Wu et al., 2020), in this paper, we focus on the four state-of-the-art attacks mentioned above: FGSM, BIM, PGD and CW.”
Neural Attention Distillation: Erasing Backdoor Triggers from Deep Neural Networks (2021, background): “At test time, state-of-the-art DNN models can be fooled into making incorrect predictions with small adversarial perturbations (Madry et al., 2018; Carlini & Wagner, 2017; Wu et al., 2020; Jiang et al., 2020).”
Adversarial Weight Perturbation Helps Robust Generalization (2020, background): “…computer vision [13], speech recognition [47], and natural language processing [10], they could be easily fooled to conﬁdently make incorrect predictions by adversarial examples that are crafted by adding intentionally small and human-imperceptible perturbations to normal examples [42, 12, 52, 4].”
Reflection Backdoor: A Natural Backdoor Attack on Deep Neural Networks (2020, background): “fool state-of-the-art DNNs with high success rate [19,58,44,64,65,67,28,29].”
Improving Adversarial Robustness Requires Revisiting Misclassified Examples (2020, background): “…al., 2017) and natural language processing (Devlin et al., 2018; Zeng et al., 2019), deep neural networks (DNNs) are extremely vulnerable to adversarial examples crafted by adding small adversarial perturbations to natural examples (Szegedy et al., 2013; Goodfellow et al., 2015; Wu et al., 2020).”
Advances in adversarial attacks and defenses in computer vision: A survey (2021, neutral): “[324] identified adversarial vulnerabilities of skip-connections.”
Clean-Label Backdoor Attacks on Video Recognition Models (2020, background): “Despite great success, DNNs have been criticized due to their low transparency, poor interpretability, and more importantly vulnerabilities to adversarial attacks [25, 8, 16, 30, 32, 31] and backdoor attacks [9, 2, 15, 28, 33].”
On Improving Adversarial Transferability of Vision Transformers (2021, positive): “[40] exploit skip connections of ResNets to improve black-box attacks, Guo et al.”