LAFEAT: Piercing Through Adversarial Defenses with Latent Features

Yu, Yunrui; Gao, Xitong; Xu, Cheng‐Zhong

doi:10.1109/cvpr46437.2021.00568

Cited by 36 publications

(20 citation statements)

References 20 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…We used the new surrogate loss function introduced in our earlier work [51], which can improve attack success rate and convergence rate with this function when compared to the original loss function used to train the model. For this competition, we divided the model into robust models and nonrobust ones, and designed different strategies for each type.…”

Section: Methodsmentioning

confidence: 99%

Adversarial Attacks on ML Defense Models Competition

Dong,

Fu,

Yang

et al. 2021

Preprint

Self Cite

View full text Add to dashboard Cite

Due to the vulnerability of deep neural networks (DNNs) to adversarial examples, a large number of defense techniques have been proposed to alleviate this problem in recent years. However, the progress of building more robust models is usually hampered by the incomplete or incorrect robustness evaluation. To accelerate the research on reliable evaluation of adversarial robustness of the current defense models in image classification, the TSAIL group at Tsinghua University and the Alibaba Security group organized this competition along with a CVPR 2021 workshop on adversarial machine learning (https://aisecureworkshop.github.io/amlcvpr2021/). The purpose of this competition is to motivate novel attack algorithms to evaluate adversarial robustness more effectively and reliably. The participants were encouraged to develop stronger white-box attack algorithms to find the worst-case robustness of different defenses. This competition was conducted on an adversarial robustness evaluation platform -ARES (https://github.com/thu-ml/ares), and is held on the TianChi platform (https://tianchi. aliyun.com/competition/entrance/531847/ introduction) as one of the series of AI Security Challengers Program. After the competition, we summarized the results and established a new adversarial robustness benchmark at https://ml.cs.tsinghua.edu.cn/ ares-bench/, which allows users to upload adversarial attack algorithms and defense models for evaluation.

show abstract

Section: Methodsmentioning

confidence: 99%

Adversarial Attacks on ML Defense Models Competition

Dong,

Fu,

Yang

et al. 2021

Preprint

Self Cite

View full text Add to dashboard Cite

show abstract

“…21 And Jacobian-Based Saliency Map Attack (JSMA) 41 prioritizes the modification of the most important pixels according to the gradient information, thereby improving the visual quality of adversarial examples. Besides, in the latest study, Latent Features Attack (LAFEAT) 22 enhances white-box attacks on the robust model by introducing auxiliary classification loss on intermediate layers.…”

Section: White-box Attacksmentioning

confidence: 99%

“…20 In white-box settings, attackers have full access to model details, such as architectures, model parameters, and training strategies. 18,19,21,22 While in black-box settings, the target model keeps inaccessible during attacking. In most realistic cases, since the details of business models are generally unavailable, supervision models on Internet platforms are basically faced with black-box attacks.…”

Section: Introductionmentioning

confidence: 99%

“…According to the knowledge of attackers, adversarial attacks can be roughly divided into white‐box attacks and black‐box attacks 20 . In white‐box settings, attackers have full access to model details, such as architectures, model parameters, and training strategies 18,19,21,22 . While in black‐box settings, the target model keeps inaccessible during attacking.…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Attention‐guided transformation‐invariant attack for black‐box adversarial examples

Zhu

Dai

et al. 2022

Int J of Intelligent Sys

View full text Add to dashboard Cite

With the development of media convergence, information acquisition is no longer limited to traditional media, such as newspapers and televisions, but more from digital media on the Internet, where media contents should be under supervision by platforms. At present, the media content analysis technology of Internet platforms relies on deep neural networks (DNNs). However, DNNs show vulnerability to adversarial examples, which results in security risks. Therefore, it is necessary to adequately study the internal mechanism of adversarial examples to build more effective supervision models. When coming to practical applications, supervision models are mostly faced with black‐box attacks, where cross‐model transferability of adversarial examples has attracted increasing attention. In this paper, to improve the transferability of adversarial examples, we propose an attention‐guided transformation‐invariant adversarial attack method, which incorporates an attention mechanism to disrupt the most distinctive features and simultaneously ensures adversarial attack invariance under different transformations. Specifically, we dynamically weight the latent features according to an attention mechanism and disrupt them accordingly. Meanwhile, considering the lack of semantics in low‐level features, high‐level semantics are introduced as spatial guidance to make low‐level feature perturbations concentrate on the most discriminative regions. Moreover, since the attention heatmaps may vary significantly across different models, a transformation‐invariant aggregated attack strategy is proposed to alleviate overfitting to the proxy model attention. Comprehensive experimental results show that the proposed method can significantly improve the transferability of adversarial examples.

show abstract

“…Adversarial attacks and defenses. There is a bunch of studies on adversarial attacks(Szegedy et al, 2014;Goodfellow et al, 2015;Moosavi-Dezfooli et al, 2016;Papernot et al, 2016;Carlini and Wagner, 2017;Chen et al, 2018;Ilyas et al, 2018;Xiao et al, 2018;Wong et al, 2019;Mopuri et al, 2018;Alaifari et al, 2019;Sriramanan et al, 2020;Chen et al, 2020;Rahmati et al, 2020;Yan et al, 2020;Croce and Hein, 2020;Wu et al, 2020a;b;Andriushchenko et al, 2020;Yu et al, 2021;Hendrycks et al, 2021;Kanth Nakka and Salzmann, 2021) and defensesCai et al, 2018;Song et al, 2019;Tramèr et al, 2018;Wong and Kolter, 2018;Shafahi et al, 2019;Pang et al, 2019;Carmon et al, 2019;Ding et al, 2020;Wu et al, 2020a;Dong et al, 2020;Wong et al, 2020;Zhang et al, 2019a;Qin et al, 2019;Zhang et al, 2019b;Sriramanan et al, 2020; Robey et al, 2021;Zou et al, 2021; Kim et al, 2021;Wang et al, 2021;Sarkar et al, 2021; Pang et al, 20...…”

mentioning

confidence: 99%

Adversarial Attack and Defense for Non-Parametric Two-Sample Tests

Xu¹,

Zhang²,

Liu³

et al. 2022

Preprint

View full text Add to dashboard Cite

Non-parametric two-sample tests (TSTs) that judge whether two sets of samples are drawn from the same distribution, have been widely used in the analysis of critical data. People tend to employ TSTs as trusted basic tools and rarely have any doubt about their reliability. This paper systematically uncovers the failure mode of non-parametric TSTs through adversarial attacks and then proposes corresponding defense strategies. First, we theoretically show that an adversary can upper-bound the distributional shift which guarantees the attack's invisibility. Furthermore, we theoretically find that the adversary can also degrade the lower bound of a TST's test power, which enables us to iteratively minimize the test criterion in order to search for adversarial pairs. To enable TST-agnostic attacks, we propose an ensemble attack (EA) framework that jointly minimizes the different types of test criteria. Second, to robustify TSTs, we propose a max-min optimization that iteratively generates adversarial pairs to train the deep kernels. Extensive experiments on both simulated and real-world datasets validate the adversarial vulnerabilities of non-parametric TSTs and the effectiveness of our proposed defense.

show abstract

LAFEAT: Piercing Through Adversarial Defenses with Latent Features

Cited by 36 publications

References 20 publications

Adversarial Attacks on ML Defense Models Competition

Adversarial Attacks on ML Defense Models Competition

Attention‐guided transformation‐invariant attack for black‐box adversarial examples

Adversarial Attack and Defense for Non-Parametric Two-Sample Tests

Contact Info

Product

Resources

About