Decoupling Direction and Norm for Efficient Gradient-Based L2 Adversarial Attacks and Defenses

By Jérôme Rony, Luiz Gustavo Hafemann, Luiz Oliveira, Ismail Ben Ayed, Robert Sabourin, Eric Granger. Computer Vision and Pattern Recognition, 2018

327 citations recorded by the source corpus.

Research on adversarial examples in computer vision tasks has shown that small, often imperceptible changes to an image can induce misclassification, which has security implications for a wide range of image processing systems. Considering L2 norm distortions, the Carlini and Wagner attack is presently the most effective white-box attack in the literature. However, this method is slow since it performs a line-search for one of the optimization terms, and often requires thousands of iterations. In this paper, an efficient approach is proposed to generate gradient-based attacks that induce misclassifications with low L2 norm, by decoupling the direction and the norm of the adversarial perturbation that is added to the image. Experiments conducted on the MNIST, CIFAR-10 and ImageNet datasets indicate that our attack achieves comparable results to the state-of-the-art (in terms of L2 norm) with considerably fewer iterations (as few as 100 iterations), which opens the possibility of using these attacks for adversarial training. Models trained with our attack achieve state-of-the-art robustness against white-box gradient-based L2 attacks on the MNIST and CIFAR-10 datasets, outperforming the Madry defense when the attacks are limited to a maximum norm.

Subfields: Artificial Intelligence, Molecular Biology

View Paper: https://www.semanticscholar.org/paper/5ca131d97019ff1e40a92fa1c9c4c5179632744a

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Molecular Biology

Citations in the corpus

Provably Robust Deep Learning via Adversarially Trained Smoothed Classifiers (2019, methodology): “We focus on two such methods: the well-studied projected gradient descent (PGD) method [20, 25], and the recently proposed decoupled direction and norm (DDN) method [29] which achieves `2 robust accuracy competitive with PGD on CIFAR-10.”
A Simple Way to Make Neural Networks Robust Against Diverse Image Corruptions (2020, methodology): “We tested this using the white-box attacks PGD [20] and DDN [33].”
Advances in adversarial attacks and defenses in computer vision: A survey (2021, background): “In [69], decoupling of the direction and norm of `2-norm bounded gradient-based perturbations was proposed to make the attack more lethal.”
Queried Unlabeled Data Improves and Robustifies Class-Incremental Learning (2022, unknown): “, 2014), and numerous defense methods have been invented (Madry et al., 2018; Sinha et al., 2018; Rony et al., 2019; Zhang et al., 2019a; Ding et al., 2020).”
Increasing the robustness of DNNs against image corruptions by playing the Game of Noise (2020, methodology): “5 like for ImageNet. et al., 2018], [Madry et al., 2017], DDN [Rony et al., 2019]) and our noise trained models (GNT and ANT).”
Machine Learning in Python: Main developments and technology trends in data science, machine learning, and artificial intelligence (2020, unknown): “[178] yes no no no no ZOO [179] no no yes no no Virtual adversarial method [180] yes yes yes no no Adversarial patch [181] no no yes no no Spatial transformation attack [182] no yes yes no no Decision tree attack [183] no no yes no no FGSM [184] yes yes yes yes yes R+FGSM [185] no no no yes no R+LLC”
Adversarial Defense Via Local Flatness Regularization (2019, unknown): “We evaluate the adversarial robustness of different methods under fast gradient sign method (FGSM) [7], project gradient descent (PGD) [8], momentum iterative fast gradient sign method (MI-FGSM) [21] and decoupled direction and norm attack (DDNA) [22].”
MMA Training: Direct Input Space Margin Maximization through Adversarial Training (2018, methodology): “There also are differences in training hyperparameters, which we refer the reader to Rony et al. (2018) for details.”
Certifiably Robust Interpretation in Deep Learning (2019, methodology): “The adversarially training for classification uses the implementation provided in Rony et al. (2019), with default arguments.”
A Panda? No, It's a Sloth: Slowdown Attacks on Adaptive Multi-Exit Neural Network Inference (2020, methodology): “For crafting (cid:96) ∞ , (cid:96) 2 and (cid:96) 1 -bounded perturbations, we adapt the PGD (Madry et al., 2017), the DDN (Rony et al., 2019) and the SLIDE algorithms (Tramèr & Boneh, 2019), respectively.”