Improving Transferability of Adversarial Examples With Input Diversity

By Cihang Xie, Zhishuai Zhang, Yuyin Zhou, Zhou Ren, Alan L. Yuille. 2018

1,463 citations recorded by the source corpus.

Though CNNs have achieved the state-of-the-art performance on various vision tasks, they are vulnerable to adversarial examples --- crafted by adding human-imperceptible perturbations to clean images. However, most of the existing adversarial attacks only achieve relatively low success rates under the challenging black-box setting, where the attackers have no knowledge of the model structure and parameters. To this end, we propose to improve the transferability of adversarial examples by creating diverse input patterns. Instead of only using the original images to generate adversarial examples, our method applies random transformations to the input images at each iteration. Extensive experiments on ImageNet show that the proposed attack method can generate adversarial examples that transfer much better to different networks than existing baselines. By evaluating our method against top defense solutions and official baselines from NIPS 2017 adversarial competition, the enhanced attack reaches an average success rate of 73.0%, which outperforms the top-1 attack submission in the NIPS competition by a large margin of 6.6%. We hope that our proposed attack strategy can serve as a strong benchmark baseline for evaluating the robustness of networks to adversaries and the effectiveness of different defense methods in the future. Code is available at https://github.com/cihangxie/DI-2-FGSM.

Subfields: Artificial Intelligence, Computer Vision and Pattern Recognition, Safety, Robustness & Interpretability

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Vision and Pattern Recognition

In Safety, Robustness & Interpretability

Citations in the corpus

Adversarial Example Games (2020, methodology): “Indeed, this setting—as well as the general notion of transferring attacks between classiﬁers—has generated an increasing amount of empirical interest [22, 49, 70, 68], though the ﬁeld currently lacks the necessary theoretical foundations to understand the feasibility of such attacks.”
Ensemble Adversarial Training: Attacks and Defenses (2017, background): “By incorporating additional optimization techniques (e.g., momentum (Dong et al., 2018), data-augmentation (Xie et al., 2019b; Dong et al., 2019) or gradients from a residual network’s “skip connections” (Wu et al., 2020)), these attacks substantially improve the transferability of adversarial…”
Disentangling Adversarial Robustness and Generalization (2018, background): “Due to their transferability [57, 108, 70], these attacks can also be used in a black-box setting (e.”
On Improving Adversarial Transferability of Vision Transformers (2021, methodology): “Baseline Attacks: We show consistent improvements for single step fast gradient sign method (FGSM) [16] as well as iterative attacks including PGD [17], MIM [29] and input diversity (transformation to the inputs) (DIM) [32] attacks.”
Curls & Whey: Boosting Black-Box Adversarial Attacks (2019, background): “works [28, 29, 4] compare the misclassification rate with a fixed l∞ norm, but we concentrate on the quality of adversarial noises generated by different attacks on one image.”
On Evaluating Adversarial Robustness of Large Vision-Language Models (2023, background): “Since we assume black-box access to the victim models, a common attacking strategy is transfer-based [22, 23, 47, 61, 94, 100], which relies on surrogate models (e.g., a publicly accessible CLIP model) to which the adversary has white-box access and crafts adversarial examples against them, then…”
Reproducibility Report: Rethinking Softmax Cross-Entropy Loss for Adversarial Robustness (2021, background): “This unexpected behavior of DNNs raises some of the security concerns in DNN based systems [4, 5] thus limits the usage of DNN’s in self-driving cars, robotics, and other related ﬁelds.”
Regional Homogeneity: Towards Learning Transferable Universal Adversarial Perturbations Against Defenses (2019, methodology): “For example, when attacking HGD [32] with = 16, RHP outperforms FGSM [18] by 24.0%, MIM [14] by 19.5%, DIM [14, 63] by 14.9%, UAP [38] by 24.9%, and GAP [42] by 25.5%, respectively.”
Skip Connections Matter: On the Transferability of Adversarial Examples Generated with ResNets (2020, methodology): “Although the white-box methods can be directly applied on the surrogate model, they are far less effective in the black-box setting (Dong et al., 2018; Xie et al., 2019).”
Cross-Domain Transferability of Adversarial Perturbations (2019, methodology): “Recently, a few methods [18, 10] propose input or gradient transformation modules to improve the transferability of adversarial examples.”
A Survey of Black-Box Adversarial Attacks on Computer Vision Models (2019, methodology): “The proposed method can be integrated with any of the gradient-based attacks which include Fast Gradient Sign Method (FGSM) [37], Basic Iterative Method (BIM) [38], Momentum Iterative Fast Gradient Sign Method (MI-FGSM) [39], Diverse Inputs Method [40] and Carlini & Wagner’s Method (C&W) [32].”
Enhancing Adversarial Example Transferability With an Intermediate Level Attack (2019, neutral): “[31].”
Nesterov Accelerated Gradient and Scale Invariance for Adversarial Attacks (2019, methodology): “Speciﬁcally, we attack an ensemble of normally trained models (including Inc-v3, Inc-v4, IncRes-v2 and Res-101) with equal ensemble weights using TIM, SI-NI-TIM, DIM, SI-NI-DIM, TI-DIM and SI-NI-TI-DIM, respectively.”
A Self-supervised Approach for Adversarial Robustness (2020, background): “Puriﬁed adversaries by NRP. Adversaries produced by DIM [18] Puriﬁed adversaries by NRP Adversaries produces by DIM TI [4] Puriﬁed adversaries by NRP”
Evading Defenses to Transferable Adversarial Examples by Translation-Invariant Attacks (2019, methodology): “…[10] (TI-FGSM) has the following update rule Also, the integration of the translation-invariant method into the basic iterative method [15] yields the TI-BIM algorithm The translation-invariant method can be similarly integrated into MI-FGSM [7] and DIM [38] as TI-MI-FGSM and TI-DIM, respectively.”
Advances in adversarial attacks and defenses in computer vision: A survey (2021, methodology): “Their technique is known as Momentum Iterative (MI-)FGSM. Diverse Input I-FGSM, i.e. DI2-FGSM [51] is another example of the attacks that directly builds on FGSM.”