Learning to Attack: Adversarial Transformation Networks

By Shumeet Baluja, Ian S. Fischer. 2018

191 citations recorded by the source corpus.

With the rapidly increasing popularity of deep neural networks for image recognition tasks, a parallel interest in generating adversarial examples to attack the trained models has arisen. To date, these approaches have involved either directly computing gradients with respect to the image pixels or directly solving an optimization on the image pixels. We generalize this pursuit in a novel direction: can a separate network be trained to efficiently attack another fully trained network? We demonstrate that it is possible, and that the generated attacks yield startling insights into the weaknesses of the target network. We call such a network an Adversarial Transformation Network (ATN). ATNs transform any input into an adversarial attack on the target network, while being minimally perturbing to the original inputs and the target network's outputs. Further, we show that ATNs are capable of not only causing the target network to make an error, but can be constructed to explicitly control the type of misclassification made. We demonstrate ATNs on both simple MNIST-digit classifiers and state-of-the-art ImageNet classifiers deployed by Google, Inc.: Inception ResNet-v2.

Subfields: Artificial Intelligence, Molecular Biology, Safety, Robustness & Interpretability

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Molecular Biology

In Safety, Robustness & Interpretability

Citations in the corpus

Adversarial Example Games (2020, background): “There is also a burgeoning literature of using parametric models to craft adversarial attacks such as the Adversarial Transformation Networks framework and its variants [4, 72].”
Learning Transferable Adversarial Examples via Ghost Networks (2018, background): “Some works [1, 24, 35] suggest re-training neural networks, e.”
Adversarial Reprogramming of Text Classification Neural Networks (2018, methodology): “For example, authors (Baluja and Fischer, 2018) trained an Adversarial Transformation Network that can be applied to all inputs to generate adversarial examples targeting a victim model or a set of victim models.”
Adversarial Generative Nets: Neural Network Attacks on State-of-the-Art Face Recognition (2018, methodology): “is the logit for class c. Minimizing Loss cw increases the probability of the target class, c t, and decreases the probability of others. Perhaps closest to our work is the work of Baluja and Fischer [8]. They propose to train an auto-encoding neural network that takes an image as input and outputs ”
Ask, Acquire, and Attack: Data-free UAP Generation using Class Impressions (2018, methodology): “Only similar work by Baluja et al. [2] presents a neural network that transforms a clean image into an adversarial sample by passing through a series of layers.”
Improving DNN Robustness to Adversarial Attacks using Jacobian Regularization (2018, methodology): “Such methods include DeepFool [4], Fast Gradient Sign Method (FGSM) [2], Jacobian-based Saliency Map Attack (JSMA) [5], Universal Perturbations [6], Adversarial Transformation Networks [7], and more [8].”
Attacks on Machine Learning: Lurking Danger for Accountability (2019, background): “Another group of attacks that tamper with data fed into the ML model, and thus are applicable on a wide range of different ML algorithms, are adversarial examples [5, 6, 17, 34, 51, 59], evasion attacks [23, 78], and feature deletion attacks.”
Black-Box Adversarial Attack with Transferable Model-based Embedding (2019, background): “We note that there have been a number of earlier works on using generators to produce adversarial perturbations in the white-box setting (Baluja & Fischer, 2018; Xiao et al., 2018; Wang & Yu, 2019).”
Learning Universal Adversarial Perturbations with Generative Models (2017, unknown): “This is similar to work by Baluja and Fischer [1], who studied the capacity for models to learn to craft adversarial examples.”
Regional Homogeneity: Towards Learning Transferable Universal Adversarial Perturbations Against Defenses (2019, background): “[4, 42, 60] also suggest to train generative models for creating adversarial examples.”