Cross-Domain Transferability of Adversarial Perturbations

By Muzammal Naseer, Salman Hameed Khan, Muhammad Haris Khan, Fahad Shahbaz Khan, Fatih Murat Porikli. 2019

183 citations recorded by the source corpus.

Adversarial examples reveal the blind spots of deep neural networks (DNNs) and represent a major concern for security-critical applications. The transferability of adversarial examples makes real-world attacks possible in black-box settings, where the attacker is forbidden to access the internal parameters of the model. The underlying assumption in most adversary generation methods, whether learning an instance-specific or an instance-agnostic perturbation, is the direct or indirect reliance on the original domain-specific data distribution. In this work, for the first time, we demonstrate the existence of domain-invariant adversaries, thereby showing common adversarial space among different datasets and models. To this end, we propose a framework capable of launching highly transferable attacks that crafts adversarial patterns to mislead networks trained on wholly different domains. For instance, an adversarial function learned on Paintings, Cartoons or Medical images can successfully perturb ImageNet samples to fool the classifier, with success rates as high as $\sim$99\% ($\ell_{\infty} \le 10$). The core of our proposed adversarial function is a generative network that is trained using a relativistic supervisory signal that enables domain-invariant perturbations. Our approach sets the new state-of-the-art for fooling rates, both under the white-box and black-box scenarios. Furthermore, despite being an instance-agnostic perturbation function, our attack outperforms the conventionally much stronger instance-specific attack methods.

Subfields: Artificial Intelligence, Hardware and Architecture, Signal Processing

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Hardware and Architecture

In Signal Processing

Citations in the corpus

Transformers in Vision: A Survey (2021, background): “They further show robustness against adversarial perturbations [146, 187] and generalization to unseen transformations.”
Regional Homogeneity: Towards Learning Transferable Universal Adversarial Perturbations Against Defenses (2019, background): “Recent works [4, 49, 52, 54, 55, 73] also suggest to train generative models for creating adversarial examples.”
Membership Leakage in Label-Only Exposures (2020, background): “Almost all related works [15, 33, 37, 39] focus on the transferability of adversarial examples, i.”
A Survey On Universal Adversarial Attack (2021, background): “Naseer et al. takes transferability a step further and shows the existence of domain-invariant adversaries [Naseer et al., 2019].”
On Improving Adversarial Transferability of Vision Transformers (2021, methodology): “However, combining the intermediate feature response with final classification loss is non-trivial as it might require optimization to find the best performing layers [34, 35], and d) Generative Approach: Orthogonal to iterative attacks, generative methods [37, 38, 39] train an autoencoder against t”
Intriguing Properties of Vision Transformers (2021, background): “d) settings but remain highly sensitive to distributional shifts; adversarial noise [11, 12], common image corruptions [13], and domain shifts (e.”