Ask, Acquire, and Attack: Data-free UAP Generation using Class Impressions

By Konda Reddy Mopuri, Phani Krishna Uppala, R. Venkatesh Babu. 2018

94 citations recorded by the source corpus.

Deep learning models are susceptible to input specific noise, called adversarial perturbations. Moreover, there exist input-agnostic noise, called Universal Adversarial Perturbations (UAP) that can affect inference of the models over most input samples. Given a model, there exist broadly two approaches to craft UAPs: (i) data-driven: that require data, and (ii) data-free: that do not require data samples. Data-driven approaches require actual samples from the underlying data distribution and craft UAPs with high success (fooling) rate. However, data-free approaches craft UAPs without utilizing any data samples and therefore result in lesser success rates. In this paper, for data-free scenarios, we propose a novel approach that emulates the effect of data samples with class impressions in order to craft UAPs using data-driven objectives. Class impression for a given pair of category and model is a generic representation (in the input space) of the samples belonging to that category. Further, we present a neural network based generative model that utilizes the acquired class impressions to learn crafting UAPs. Experimental evaluation demonstrates that the learned generative model, (i) readily crafts UAPs via simple feed-forwarding through neural network layers, and (ii) achieves state-of-the-art success rates for data-free scenario and closer to that for data-driven setting without actually utilizing any data samples.

Subfields: Artificial Intelligence, Signal Processing

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Signal Processing

Citations in the corpus

Zero-Shot Knowledge Distillation in Deep Networks (2019, methodology): “It has been shown by (Mopuri et al., 2018) that the pretrained models have memory in terms of learned parameters and can be used to extract class representative samples.”
Universal Adversarial Training (2018, background): “As a variant of universal perturbation, unconditional generators are trained to create perturbations from random noises for attack (Reddy Mopuri, Krishna Uppala, and Venkatesh Babu, 2018; Reddy Mopuri et al., 2018).”
Cross-Domain Transferability of Adversarial Perturbations (2019, methodology): “To reduce dependency on the input data samples, [13] maximizes layer activations of the source network while [14] extracts deluding perturbations using class impressions relying on the source label space.”
Robust Feature-Level Adversaries are Interpretability Tools (2021, background): “This has been done to synthesize imperceptible attacks that are transferable, universal, or efficient to produce [20, 41, 42, 51, 73, 19, 72].”