Regional Homogeneity: Towards Learning Transferable Universal Adversarial Perturbations Against Defenses

By Yingwei Li, Song Bai, Cihang Xie, Zhenyu A. Liao, Xiaohui Shen, Alan L. Yuille. 2019

59 citations recorded by the source corpus.

This paper focuses on learning transferable adversarial examples specifically against defense models (models to defense adversarial attacks). In particular, we show that a simple universal perturbation can fool a series of state-of-the-art defenses. Adversarial examples generated by existing attacks are generally hard to transfer to defense models. We observe the property of regional homogeneity in adversarial perturbations and suggest that the defenses are less robust to regionally homogeneous perturbations. Therefore, we propose an effective transforming paradigm and a customized gradient transformer module to transform existing perturbations into regionally homogeneous ones. Without explicitly forcing the perturbations to be universal, we observe that a well-trained gradient transformer module tends to output input-independent gradients (hence universal) benefiting from the under-fitting phenomenon. Thorough experiments demonstrate that our work significantly outperforms the prior art attacking algorithms (either image-dependent or universal ones) by an average improvement of 14.0% when attacking 9 defenses in the black-box setting. In addition to the cross-model transferability, we also verify that regionally homogeneous perturbations can well transfer across different vision tasks (attacking with the semantic segmentation task and testing on the object detection task).

Subfields: Artificial Intelligence, Molecular Biology, Safety, Robustness & Interpretability

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Molecular Biology

In Safety, Robustness & Interpretability

Citations in the corpus

Adversarial Example Games (2020, background): “Other notable approaches to craft blackbox transfer attacks learning ghost networks [48], transforming whitebox gradients with small ResNets [50], and transferability properties of linear classifiers and 2-layer ReLu Networks [17].”
A Survey On Universal Adversarial Attack (2021, background): “The authors of [Li et al., 2020b] investigate the regional homogeneity of UAPs.”
Advances in adversarial attacks and defenses in computer vision: A survey (2021, background): “We also find an example of improving transferability of universal adversarial perturbations [114].”
Cross-Domain Transferability of Adversarial Perturbations (2019, methodology): “Inference: Inference is performed on ImageNet validation set (val-set) (50k samples), a subset (5k samples) of ImageNet proposed by [11] and ImageNet-NeurIPS [31] (1k samples) dataset.”
Node Similarity Preserving Graph Convolutional Networks (2020, background): “Traditional deep neural networks can be easily fooled by adversarial attacks [19, 20, 36].”