Evading Defenses to Transferable Adversarial Examples by Translation-Invariant Attacks

By Yinpeng Dong, Tianyu Pang, Hang Su, Jun Zhu. 2019

1,121 citations recorded by the source corpus.

Deep neural networks are vulnerable to adversarial examples, which can mislead classifiers by adding imperceptible perturbations. An intriguing property of adversarial examples is their good transferability, making black-box attacks feasible in real-world applications. Due to the threat of adversarial attacks, many methods have been proposed to improve the robustness. Several state-of-the-art defenses are shown to be robust against transferable adversarial examples. In this paper, we propose a translation-invariant attack method to generate more transferable adversarial examples against the defense models. By optimizing a perturbation over an ensemble of translated images, the generated adversarial example is less sensitive to the white-box model being attacked and has better transferability. To improve the efficiency of attacks, we further show that our method can be implemented by convolving the gradient at the untranslated image with a pre-defined kernel. Our method is generally applicable to any gradient-based attack method. Extensive experiments on the ImageNet dataset validate the effectiveness of the proposed method. Our best attack fools eight state-of-the-art defenses at an 82% success rate on average based only on the transferability, demonstrating the insecurity of the current defense techniques.

Subfields: Artificial Intelligence, Computer Vision and Pattern Recognition, Safety, Robustness & Interpretability

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Vision and Pattern Recognition

In Safety, Robustness & Interpretability

Citations in the corpus

Adversarial Example Games (2020, methodology): “Indeed, this setting—as well as the general notion of transferring attacks between classiﬁers—has generated an increasing amount of empirical interest [22, 49, 70, 68], though the ﬁeld currently lacks the necessary theoretical foundations to understand the feasibility of such attacks.”
Ensemble Adversarial Training: Attacks and Defenses (2017, background): “, 2018), data-augmentation (Xie et al., 2019b; Dong et al., 2019) or gradients from a residual network’s “skip connections” (Wu et al.”
Skip Connections Matter: On the Transferability of Adversarial Examples Generated with ResNets (2020, methodology): “%) than reported in (Dong et al., 2019) (84.8%), even if only 3 source models are used here and the source models ( e.g. RN34, RN152 and DN201) are all of different architecture to IncV3 target model ((Dong et al., 2019) uses 6 source models including even the IncV3 model).”
Feature Importance-aware Transferable Adversarial Attacks (2021, methodology): “, TIDIM [6], PIDIM [8] and PITIDIM [8].”
Nesterov Accelerated Gradient and Scale Invariance for Adversarial Attacks (2019, methodology): “We compare our SI-NI-TI-DIM with MI-FGSM (Dong et al., 2018), which is the top-1 attack solu-tion in the NIPS 2017 competition, and TI-DIM (Dong et al., 2019), which is state-of-the-art attack.”
Advances in adversarial attacks and defenses in computer vision: A survey (2021, background): “Other recent examples focusing directly or indirectly on improving transferablity of perturbations include [116], [117], [118], [119], [120].”
Trustworthy AI: From Principles to Practices (2021, background): “The corresponding defense [328] is later shown to be vulnerable against new attacks [99].”
Regional Homogeneity: Towards Learning Transferable Universal Adversarial Perturbations Against Defenses (2019, neutral): “menting ghost models [40] and smoothing gradient [17], respectively.”
Improving Black-box Adversarial Attacks with a Transfer-based Prior (2019, methodology): “Although various methods [7, 23, 8] have been introduced to improve the transferability, the attack success rate is still unsatisfactory.”
A Comprehensive Survey on Poisoning Attacks and Countermeasures in Machine Learning (2022, methodology): “[30] adopted class activation mapping to visualize the attention maps of three normally trained models.”
On Evaluating Adversarial Robustness of Large Vision-Language Models (2023, background): “Since we assume black-box access to the victim models, a common attacking strategy is transfer-based [22, 23, 47, 61, 94, 100], which relies on surrogate models (e.g., a publicly accessible CLIP model) to which the adversary has white-box access and crafts adversarial examples against them, then…”
A Self-supervised Approach for Adversarial Robustness (2020, background): “Puriﬁed adversaries by NRP. Adversaries produced by DIM [18] Puriﬁed adversaries by NRP Adversaries produces by DIM TI [4] Puriﬁed adversaries by NRP”
A Survey of Black-Box Adversarial Attacks on Computer Vision Models (2019, methodology): “[18] Translation-Invariant May 2019 Chen et al.”
Benchmarking Adversarial Robustness on Image Classification (2020, methodology): “The translation-invariant method (TI) [15] further improves the transferability for defense models.”
Enhancing the Transferability of Adversarial Attacks through Variance Tuning (2021, methodology): “In addition, we integrate the proposed method with various input transformations, i.e. DIM [35], TIM [7], SIM and CTM [18], denoted as VM(N)I-DI-FGSM, VM(N)I-TI-FGSM, VM(N)ISI-FGSM and VM(N)I-CT-FGSM respectively, to further validate the effectiveness of our method.”
Bag of Tricks for Adversarial Training (2020, background): “Pang et al. (2019) also ﬁnd that imposing label smoothing on the ensemble prediction can alleviate the adversarial transferability among individual members, and thus promote robustness of the ensemble model.”
Cross-Domain Transferability of Adversarial Perturbations (2019, methodology): “Finally, we compare our method with recently proposed instance-specific attack method [10] that exhibits high transferability to adversarially trained models.”