Boosting the Transferability of Adversarial Attacks with Reverse Adversarial Perturbation

Abstract

Deep neural networks (DNNs) have been shown to be vulnerable to adversarial examples, which can produce erroneous predictions by injecting imperceptible perturbations. In this work, we study the transferability of adversarial examples, which is significant due to its threat to real-world applications where model architecture or parameters are usually unknown. Many existing works reveal that the adversarial examples are likely to overfit the surrogate model that they are generated from, limiting its transfer attack performance against different target models. To mitigate the overfitting of the surrogate model, we propose a novel attack method, dubbed reverse adversarial perturbation (RAP). Specifically, instead of minimizing the loss of a single adversarial point, we advocate seeking adversarial example located at a region with unified low loss value, by injecting the worst-case perturbation (i.e., the reverse adversarial perturbation) for each step of the optimization procedure. The adversarial attack with RAP is formulated as a min-max bi-level optimization problem. By integrating RAP into the iterative process for attacks, our method can find more stable adversarial examples which are less sensitive to the changes of decision boundary, mitigating the overfitting of the surrogate model. Comprehensive experimental comparisons demonstrate that RAP can significantly boost adversarial transferability. Furthermore, RAP can be naturally combined with many existing black-box attack techniques, to further boost the transferability. When attacking a real-world image recognition system, i.e., Google Cloud Vision API, we obtain 22% performance improvement of targeted attacks over the compared method. Our codes are available at: https://github.com/SCLBD/Transfer_attack_RAP.

Improving Adversarial Transferability with Ghost Samples

“…To further illustrate the effectiveness and efficiency of GSA, we also compare GSA with state-of-the-art methods from other categories. We take a feature disruption method TAIG-R [14] and an advanced gradient-based method RAP [25] as additional baselines.…”

“…We also extend GSA to targeted attacks. Following the previous work [25], We set the l ∞ magnitude of perturbation = 16/255, the number of iterations T = 10, and the step size α = 2/255. Experimental results with different are shown in Appendix B.2.…”

“…11: end for 12: return x adv = x adv T loss landscape and attack transferability [3,25]. A flatter loss landscape means that the loss function has a relatively small gradient magnitude over a larger region of the input space.…”

“…This makes the loss function relatively insensitive to small changes in the input, allowing the attacker to generate effective adversarial examples across different models with similar loss landscapes. We follow the previous work [25] that visualizes the loss flatness around adversarial examples by plotting the loss change when moving the adversarial example along a random direction with different magnitudes. The loss flatness indicates whether x adv locates at a flat local region where the points in the vicinity of x adv have similar loss values as x adv .…”