Adversarial Transformation Networks: Learning to Generate Adversarial Examples

By Shumeet Baluja, Ian S. Fischer. 2017

305 citations recorded by the source corpus.

Multiple different approaches of generating adversarial examples have been proposed to attack deep neural networks. These approaches involve either directly computing gradients with respect to the image pixels, or directly solving an optimization on the image pixels. In this work, we present a fundamentally new method for generating adversarial examples that is fast to execute and provides exceptional diversity of output. We efficiently train feed-forward neural networks in a self-supervised manner to generate adversarial examples against a target network or set of networks. We call such a network an Adversarial Transformation Network (ATN). ATNs are trained to generate adversarial examples that minimally modify the classifier's outputs given the original input, while constraining the new classification to match an adversarial target class. We present methods to train ATNs and analyze their effectiveness targeting a variety of MNIST classifiers as well as the latest state-of-the-art ImageNet classifier Inception ResNet v2.

Subfields: Artificial Intelligence, Computer Vision and Pattern Recognition, Safety, Robustness & Interpretability

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Vision and Pattern Recognition

In Safety, Robustness & Interpretability

Citations in the corpus

GAN Inversion: A Survey (2021, methodology): “Adversarial attack methods [148], [149], [150], [151] aim at fooling a CNN classifier by adding a certain perturbation ∆x to a target image x.”
Adversarial Example Games (2020, background): “There is also a burgeoning literature of using parametric models to craft adversarial attacks such as the Adversarial Transformation Networks framework and its variants [4, 69].”
Adversarial Training for Free! (2019, methodology): “network [Baluja and Fischer, 2018, Poursaeed et al., 2018, Xiao et al., 2018]. This approach is slower than standard training, and problematic on complex datasets, such as ImageNet, for which it is hard to produce highly expressive GANs that cover the entire image space. Another popular defense stra”
Ensemble Adversarial Training: Attacks and Defenses (2017, background): “Iterative attacks and ATNs produce samples that transfer less [8, 1], so it is also unclear whether achieving robustness to these attacks would increase robustness to black-box attacks.”
Generating Adversarial Examples with Adversarial Networks (2018, methodology): “Independently from our work, feed-forward networks have been applied to generate adversarial perturbation (Baluja & Fischer, 2017).”
Adversarial Examples for Semantic Segmentation and Object Detection (2017, background): “[1] trained a network to generate adversarial examples for a particular target model (without using gradients).”
Threat of Adversarial Attacks on Deep Learning in Computer Vision: A Survey (2018, background): “Baluja and Fischer [42] trained feed-forward neural networks to generate adversarial examples against other targeted net-”
Constructing Unrestricted Adversarial Examples with Generative Models (2018, neutral): “Examples include AdvGAN [23], DeepDGA [47], ATN [48], GAT [49] and Defense-GAN [14].”
Defense Against Adversarial Attacks Using High-Level Representation Guided Denoiser (2017, methodology): “transformation networks [1], probably improves the performance of HGD.”
Achieving Robustness in the Wild via Adversarial Mixing With Disentangled Representations (2019, background): “Early works (e.g., Baluja and Fischer [33]) also demonstrated that it is possible to go beyond analytically deﬁned variations by us-ing generative models to create perturbations.”
Review of Artificial Intelligence Adversarial Attack and Defense Technologies (2019, methodology): “[66] ANTs The Adversarial Transformation Networks (ATNs) used a feed-forward neural network to generate adversarial samples.”
Generalizable Adversarial Attacks Using Generative Models (2019, methodology): “Similar to our approach, there is relevant previous work on generating adversarial images using parametric models, such as the Adversarial Transformation Networks (ATN) framework and its variants [3, 36].”
Exploiting Deep Generative Prior for Versatile Image Restoration and Manipulation (2020, methodology): “We adopt the adversarial transformation networks attacker [57] to produce the adversarial samples.”
Distortion Agnostic Deep Watermarking (2020, methodology): “Many attempts have since been made to reduce the cost of adversarial training, e.g. , using approximations to the optimization step [27], or using generative models in place of iterative optimization [4, 18].”
Learning Data Manipulation for Augmentation and Weighting (2019, background): “GAN-based approaches have achieved impressive results for synthesizing conditional image data [3, 34].”
Machine Learning as an Adversarial Service: Learning Black-Box Adversarial Examples (2017, background): “• In concurrent work, Baluja & Fischer [1] develop a machine learning approach to crafting white-box adversarial examples.”
Adversarial Generative Nets: Neural Network Attacks on State-of-the-Art Face Recognition (2018, background): “Except for a few attacks [5], [14], [51], [56], [67], in traditional evasion attacks against DNNs the attacker directly alters benign inputs to maximize or minimize a pre-defined function related to the desired misclassification (see Sec.”