Decoupling Direction and Norm for Efficient Gradient-Based L2 Adversarial Attacks and Defenses

Abstract

Research on adversarial examples in computer visiontasks has shown that small, often imperceptible changes to an image can induce misclassification, which has security implications for a wide range of image processing systems. Considering L 2 norm distortions, the Carlini and Wagner attack is presently the most effective white-box attack in the literature. However, this method is slow since it performs a line-search for one of the optimization terms, and often requires thousands of iterations. In this paper, an efficient approach is proposed to generate gradient-based attacks that induce misclassifications with low L 2 norm, by decoupling the direction and the norm of the adversarial perturbation that is added to the image. Experiments conducted on the MNIST, CIFAR-10 and ImageNet datasets indicate that our attack achieves comparable results to the state-of-the-art (in terms of L 2 norm) with considerably fewer iterations (as few as 100 iterations), which opens the possibility of using these attacks for adversarial training. Models trained with our attack achieve state-of-the-art robustness against whitebox gradient-based L 2 attacks on the MNIST and CIFAR-10 datasets, outperforming the Madry defense when the attacks are limited to a maximum norm. * Equal contribution.1 This also affects other machine learning classifiers, but we restrict our analysis to CNNs, that are most commonly used in computer vision tasks.

Simulating a Primary Visual Cortex at the Front of CNNs Improves Robustness to Image Perturbations

“…While adversarial formulations using Lagrangian relaxation like the C&W attack [7] and the EAD attack [8] are known to be more effective than PGD for finding minimal perturbations under L 2 and L 1 constraints, these formulations involve computationally expensive line searches, often requiring thousands of iterations to converge, making them computationally difficult to scale to 5000 ImageNet samples for a large number of models. Furthermore, because some of the models we tested operate with stochasticity during inference, we found that other state-of-the-art attacks formulated to efficiently find minimal perturbation distances [9,10] were generally difficult to tune, as their success becomes stochastic as they near the decision boundary. Thus we proceeded with the PGD formulation as we found it to be the most reliable, computationally tractable, and conceptually simple to follow.…”

“…However, scratching beneath the surface reveals a different picture. These CNNs are easily fooled by imperceptibly small perturbations explicitly crafted to induce mistakes, usually referred to as adversarial attacks [6,7,8,9,10]. Further, they exhibit a surprising failure to recognize objects in images corrupted with different noise patterns that humans have no trouble with [11,12,13].…”

Towards deep neural networks robust to adversarial examples

“…Decoupling direction and norm l 2 -attack (DDN) [72] DNNs, yet, safety verification of large DNNs remains challenging.…”

“…• Decoupled Direction and Norm l 2 -attack (DDN) [72] as in [140] with the following parameters: 1000 iterations, initial epsilon 1.0, and gamma 0.05.…”

“…The models on CIFAR-10 achieve the following clean test accuracy (first 1000 images of the test set): plain 88.38% (89.4%), l ∞ -AT 79.9% (80.4%), and l 2 -AT 80.44% (80.7%).Attacks:We tested the robustness of each model wrt to l ∞ -, l 2 -, l 1 -, and l 0norm adversaries. We compared the performance of our attacks to attacks representing state-of-the-art for each norm: Brendel & Bethge attack (B&B, l ∞ -,l 2 -, l 1 -, l 0 -norms)[139]; Carlini-Wagner l 2 -attack (C&W, l 2 -norm)[18]; Decoupled Direction and Norm l 2 -attack (DDN, l 2 -norm)[72]; DeepFool (DF, l ∞ -, and l 2norm)[53]; Distributionally Adversarial Attack (DAA, l ∞ -norm)[74]; Elastic-net attack (l 1 -norm)[75]; Fast Adaptive Boundary Attack (FAB, l ∞ -, l 2 -, l 1 -norms)[54];…”