Generating Adversarial Examples with Adversarial Networks

By Chaowei Xiao, Bo Li, Jun-Yan Zhu, Warren He, M. Liu, Dawn Song. 2018

1,047 citations recorded by the source corpus.

Deep neural networks (DNNs) have been found to be vulnerable to adversarial examples resulting from adding small-magnitude perturbations to inputs. Such adversarial examples can mislead DNNs to produce adversary-selected results. Different attack strategies have been proposed to generate adversarial examples, but how to produce them with high perceptual quality and more efficiently requires more research efforts. In this paper, we propose AdvGAN to generate adversarial exam- ples with generative adversarial networks (GANs), which can learn and approximate the distribution of original instances. For AdvGAN, once the generator is trained, it can generate perturbations efficiently for any instance, so as to potentially accelerate adversarial training as defenses. We apply Adv- GAN in both semi-whitebox and black-box attack settings. In semi-whitebox attacks, there is no need to access the original target model after the generator is trained, in contrast to traditional white-box attacks. In black-box attacks, we dynamically train a distilled model for the black-box model and optimize the generator accordingly. Adversarial examples generated by AdvGAN on different target models have high attack success rate under state-of-the-art defenses compared to other attacks. Our attack has placed the first with 92.76% accuracy on a public MNIST black-box attack challenge.

Subfields: Artificial Intelligence, Safety, Robustness & Interpretability

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Safety, Robustness & Interpretability

Citations in the corpus

Adversarial Example Games (2020, background): “There is also a burgeoning literature of using parametric models to craft adversarial attacks such as the Adversarial Transformation Networks framework and its variants [4, 72].”
Certified Robustness to Adversarial Examples with Differential Privacy (2018, background): “norm bounding exist [61], [52], [60], but this paper deals exclusively with norm-bounded attacks.”
Adversarial Training for Free! (2019, background): “Some recent works replace the perturbation generation in adversarial training with a parameterized generator network [Baluja and Fischer, 2018, Poursaeed et al., 2018, Xiao et al., 2018].”
Ensemble Adversarial Training: Attacks and Defenses (2017, background): “Yet, a recent work by Xiao et al. (2018) found Ensemble Adversarial Training to be resilient to such attacks on MNIST and CIFAR10, and often attaining higher robustness than models that were adversarially trained on iterative attacks.”
Towards Robust Neural Networks via Random Self-ensemble (2017, background): “easy to integrate into any neural network. 1 Introduction Deep neural networks have demonstrated their success in many machine learning and computer vision applications, including image classication [14,7,35,9,34], object recognition [30] and image captioning [38]. Despite having near-perfect predic”
Pros and Cons of GAN Evaluation Measures (2018, neutral): “Similar approaches have been followed in [36, 99, 94, 96, 100, 82, 18, 52, 56].”
Towards Stable and Efficient Training of Verifiably Robust Neural Networks (2019, background): “Many defense methods have been proposed recently (Guo et al., 2018; Song et al., 2017; Buckman et al., 2018; Ma et al., 2018; Samangouei et al., 2018; Xiao et al., 2018a; 2019a), but their robustness improvement cannot be certified – no provable guarantees can be given to verify their robustness.”
Intermediate Layer Optimization for Inverse Problems using Deep Generative Models (2021, methodology): “This optimization problem is one of the simplest methods to create adversarial examples (Xiao et al., 2018) and hence the generated images will not be visually interesting.”
Robust Feature-Level Adversaries are Interpretability Tools (2021, background): “This has been done to synthesize imperceptible attacks that are transferable, universal, or efficient to produce [20, 41, 42, 51, 73, 19, 72].”
Action Robust Reinforcement Learning and Applications in Continuous Control (2019, methodology): “Similar to our approach, when using GANs for robustness, an adversary learns to create small perturbations in the input data in an attempt to cause a misclassification (Xiao et al., 2018; Samangouei et al., 2018; Kurakin et al., 2018).”
Cross-Domain Transferability of Adversarial Perturbations (2019, background): “[20] apply generative adversarial networks to craft visually realistic perturbations and build distilled network to perform black-box attack.”
Adversarially Robust Neural Architectures (2020, neutral): “trated that neural networks are vulnerable to adversarial attacks [13]. Vast techniques have been introduced to generate adversarial samples in both white-box case where the model is fully accessible [31, 8, 32, 33] and black-box case where adversaries can only query the outputs of the models [34, 3”
Generating 3D Adversarial Point Clouds (2018, background): “Such vulnerability of machine learning models has raised great concerns in the community and many works have been proposed to improve the attack performance [9, 17, 15, 3, 16, 29, 28] and search for possible defense [2, 14, 31, 21, 22, 32].”
Universal Adversarial Training (2018, background): “The cost of the inner PGD loop is high, although this can sometimes be replaced with neural models for attack generation [3, 26, 36].”
DeepMutation: Mutation Testing of Deep Learning Systems (2018, methodology): “We follow the training instructions of the papers [23], [38], [39] to train the original DL models.”
Big but Imperceptible Adversarial Perturbations via Semantic Manipulation (2019, methodology): “To date, many methods have been proposed to generate adversarial examples [14, 4, 22, 29, 30].”
Achieving Robustness in the Wild via Adversarial Mixing With Disentangled Representations (2019, methodology): “[35] used a pre-trained AC-GAN [36] to generate perturbations; and they demonstrated that it is possible to generate semantically relevant perturbations for tasks such as MNIST, SVHN and CELEBA.”
Adversarial Generative Nets: Neural Network Attacks on State-of-the-Art Face Recognition (2018, background): “criminator to be real and are misclassified by the digit-recognition DNN. Unlike prior attacks, which typically attempted to minimally perturb specific benign inputs to cause misclassification (e.g., [13, 19, 27, 57, 61, 77]), the attack we propose does not assume that a benign input is provided, no”