Distributionally Adversarial Attack

By Tianhang Zheng, Changyou Chen, Kui Ren. 2018

137 citations recorded by the source corpus.

Recent work on adversarial attack has shown that Projected Gradient Descent (PGD) Adversary is a universal first-order adversary, and the classifier adversarially trained by PGD is robust against a wide range of first-order attacks. It is worth noting that the original objective of an attack/defense model relies on a data distribution p(x), typically in the form of risk maximization/minimization, e.g., max/min Ep(x) L(x) with p(x) some unknown data distribution and L(·) a loss function. However, since PGD generates attack samples independently for each data sample based on L(·), the procedure does not necessarily lead to good generalization in terms of risk optimization. In this paper, we achieve the goal by proposing distributionally adversarial attack (DAA), a framework to solve an optimal adversarial-data distribution, a perturbed distribution that satisfies the L∞ constraint but deviates from the original data distribution to increase the generalization risk maximally. Algorithmically, DAA performs optimization on the space of potential data distributions, which introduces direct dependency between all data points when generating adversarial samples. DAA is evaluated by attacking state-of-the-art defense models, including the adversarially-trained models provided by MIT MadryLab. Notably, DAA ranks the first place on MadryLab’s white-box leaderboards, reducing the accuracy of their secret MNIST model to 88.56% (with l∞ perturbations of ε = 0.3) and the accuracy of their secret CIFAR model to 44.71% (with l∞ perturbations of ε = 8.0). Code for the experiments is released on https://github.com/tianzheng4/Distributionally-Adversarial-Attack.

Subfields: Artificial Intelligence

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

Citations in the corpus

Towards the first adversarially robust neural network model on MNIST (2018, neutral): “3 (Zheng et al., 2018).”
Minimally distorted Adversarial Examples with a Fast Adaptive Boundary Attack (2019, background): “For PGD and DAA this is the time for evaluating the robust accuracy at 5 thresholds, while for the other methods a single run is sufficient to compute the robust accuracy for all five thresholds.”
Towards Stable and Efficient Training of Verifiably Robust Neural Networks (2019, methodology): “Networks trained by this procedure achieve state-of-the-art test accuracy under strong attacks (Athalye et al., 2018; Wang et al., 2018a; Zheng et al., 2018).”
On the Geometry of Adversarial Examples (2018, unknown): “79% (Zheng et al. (2018)).”
Square Attack: a query-efficient black-box adversarial attack via random search (2019, background): “Many defenses against adversarial examples have been proposed [21, 53, 40, 5, 31, 1, 7] but with limited success, as new more powerful attacks could break many of them [11, 4, 35, 13, 54].”
Adversarial Attacks and Defenses in Deep Learning (2020, methodology): “Zheng et al. [7] propose a new adversarial attack that performs on the space of probability measures, called the distributionally adversarial attack (DAA).”