Wasserstein Adversarial Examples via Projected Sinkhorn Iterations

By Eric Wong, Frank R. Schmidt, J. Kolter. 2019

226 citations recorded by the source corpus.

A rapidly growing area of work has studied the existence of adversarial examples, datapoints which have been perturbed to fool a classifier, but the vast majority of these works have focused primarily on threat models defined by $\ell_p$ norm-bounded perturbations. In this paper, we propose a new threat model for adversarial attacks based on the Wasserstein distance. In the image classification setting, such distances measure the cost of moving pixel mass, which naturally cover "standard" image manipulations such as scaling, rotation, translation, and distortion (and can potentially be applied to other settings as well). To generate Wasserstein adversarial examples, we develop a procedure for projecting onto the Wasserstein ball, based upon a modified version of the Sinkhorn iteration. The resulting algorithm can successfully attack image classification models, bringing traditional CIFAR10 models down to 3% accuracy within a Wasserstein ball with radius 0.1 (i.e., moving 10% of the image mass 1 pixel), and we demonstrate that PGD-based adversarial training can improve this adversarial accuracy to 76%. In total, this work opens up a new direction of study in adversarial robustness, more formally considering convex metrics that accurately capture the invariances that we typically believe should exist in classifiers. Code for all experiments in the paper is available at this https URL.

Subfields: Artificial Intelligence, Safety, Robustness & Interpretability

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Safety, Robustness & Interpretability

Citations in the corpus

Measuring Robustness to Natural Distribution Shifts in Image Classification (2020, background): “Encouragingly, the past few years have seen substantial progress in robustness to these distribution shifts, e.g., see [13, 28, 34, 55, 57, 66, 93, 96, 105, 114, 115] among many others.”
Adversarial Examples on Object Recognition (2020, methodology): “This behavior is achieved using an un-directed DNN that back-propagates the errors in both directions – each direction of the network has its own biases and the weights are shared.”
High-Frequency Component Helps Explain the Generalization of Convolutional Neural Networks (2019, background): “, 2018), yet shall be aware that newer works are introduced proliferatively (e.g., Ilyas et al., 2018; Yan et al., 2018; Guo et al., 2018b; Alaifari et al., 2019; Xiao et al., 2019; Song et al., 2019; Farnia et al., 2019; Wong et al., 2019).”
Automatic Text Evaluation through the Lens of Wasserstein Barycenters (2021, background): “…(Arjovsky et al., 2017; Tolstikhin et al., 2018; Gulrajani et al., 2017), domain adaptation (Courty et al., 2017), clustering (Ho et al., 2017; Ye et al., 2017), adversarial examples (Wong et al., 2019), robustness (Staerman et al., 2021) or NLP (Kusner et al., 2015; Zhao et al., 2019b; Singh…”
Advances in adversarial attacks and defenses in computer vision: A survey (2021, background): “The works related to achieving perturbation imperceptibility based on preserving semantics of the target image [122]–[125] and preserving the structural information [126], [127] are motivated by this argument, see Fig.”
Minimally distorted Adversarial Examples with a Fast Adaptive Boundary Attack (2019, background): “…to create adversarial examples (typically some lp-norm, but others have become popular as well, e.g. (Brown et al., 2017; Engstrom et al., 2017; Wong et al., 2019)), whether they aim at the minimal adversarial perturbation (Carlini & Wagner, 2017a; Chen et al., 2018; Croce et al., 2019) or…”
Overfitting in adversarially robust deep learning (2020, methodology): “…works have also expanded the general PGD adversarial training algorithm to different threat models including image transformations (Engstrom et al., 2017; Xiao et al., 2018a), different distance metrics (Wong et al., 2019), and multiple threat models (Maini et al., 2019; Tram`er & Boneh, 2019).”
RobustBench: a standardized adversarial robustness benchmark (2020, background): “It is an active area of research to develop threat models 92 which are more aligned with the human perception such as spatial perturbations [39, 37], Wasserstein93 bounded perturbations [137, 57], perturbations of the image colors [72] or `p-perturbations in the 94 latent space of a neural network [”
MetaPoison: Practical General-purpose Clean-label Data Poisoning (2020, background): “A number of perceptually aligned perturbation models have been proposed (Engstrom et al., 2019; Wong et al., 2019; Ghiasi et al., 2020).”