Yet Another Intermediate-Level Attack

Li, Qizhang; Guo, Yiwen; Chen, Hao

doi:10.1007/978-3-030-58517-4_15

Cited by 28 publications

(38 citation statements)

References 23 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…To search for perturbations with better transferability, Intermediate Level Attack (ILA) [13] maximizes the scalar projection of the adversarial example onto a guided direction on a specific hidden layer. Motivated by ILA [13], [21] takes the advantage of auxiliary examples produced by a baseline attack and yields adversarial examples with better transferability.…”

Section: Related Workmentioning

confidence: 99%

“…Therefore, we will not devote our efforts in this stage also, in this paper. For the intermediate stage, some literatures [33,31,49,15,13,21,45,14,25] have explored to perturb the intermediate features to improve the transferability of adversarial examples. [13] develops a new paradigm to specifically optimize the transferability by utilizing the intermediate representation of a given adversarial example as directional guidance, which provides a reasonable proxy for generating the transferable perturbations.…”

Section: Introductionmentioning

confidence: 99%

“…[13] develops a new paradigm to specifically optimize the transferability by utilizing the intermediate representation of a given adversarial example as directional guidance, which provides a reasonable proxy for generating the transferable perturbations. [13] inspires [21] to further explore linear combinations of auxiliary results, which are produced in the baseline phase, as the directional guidance for the latter phase. However, since these directional guidances are fixed once the baseline phase is completed, the positive effects of these guidances tend to decline as the subsequent optimization steps carry out.…”

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

Exploring Transferable and Robust Adversarial Perturbation Generation from the Perspective of Network Hierarchy

Wang,

Guo,

Yang

et al. 2021

Preprint

View full text Add to dashboard Cite

The transferability and robustness of adversarial examples are two practical yet important properties for black-box adversarial attacks. In this paper, we explore effective mechanisms to boost both of them from the perspective of network hierarchy, where a typical network can be hierarchically divided into output stage, intermediate stage and input stage. Since over-specialization of source model, we can hardly improve the transferability and robustness of the adversarial perturbations in the output stage. Therefore, we focus on the intermediate and input stages in this paper and propose a transferable and robust adversarial perturbation generation (TRAP) method. Specifically, we propose the dynamically guided mechanism to continuously calculate accurate directional guidances for perturbation generation in the intermediate stage. In the input stage, instead of the single-form transformation augmentations adopted in the existing methods, we leverage multiform affine transformation augmentations to further enrich the input diversity and boost the robustness and transferability of the adversarial perturbations. Extensive experiments demonstrate that our TRAP achieves impressive transferability and high robustness against certain interferences.Preprint. Under review.

show abstract

Section: Related Workmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Exploring Transferable and Robust Adversarial Perturbation Generation from the Perspective of Network Hierarchy

Wang,

Guo,

Yang

et al. 2021

Preprint

View full text Add to dashboard Cite

show abstract

“…For instance, Xie et al [53] suggested to apply random and differentiable transformations to the inputs when performing attacks on pre-trained substitute models [53]. It was also widely explored to craft more transferable adversarial examples by optimizing on intermediate layers of the substitute models [61,22,19,27,14]. Unlike prior work that experimented on substitute models trained on the same set of data as that for training victim models, in this paper, we assume no access to the real victim training set and attempt to obtain models on a small number of auxiliary examples, e.g., 20 images from 2 classes.…”

Section: Related Workmentioning

confidence: 99%

Practical Adversarial Attacks Against Speaker Recognition Systems

Shi

Xie

et al. 2020

Proceedings of the 21st International Workshop on Mobile Computing Systems and Applications

View full text Add to dashboard Cite

The study of adversarial vulnerabilities of deep neural networks (DNNs) has progressed rapidly. Existing attacks require either internal access (to the architecture, parameters, or training set of the victim model) or external access (to query the model). However, both the access may be infeasible or expensive in many scenarios. We investigate no-box adversarial examples, where the attacker can neither access the model information or the training set nor query the model. Instead, the attacker can only gather a small number of examples from the same problem domain as that of the victim model. Such a stronger threat model greatly expands the applicability of adversarial attacks. We propose three mechanisms for training with a very small dataset (on the order of tens of examples) and find that prototypical reconstruction is the most effective. Our experiments show that adversarial examples crafted on prototypical auto-encoding models transfer well to a variety of image classification and face verification models. On a commercial celebrity recognition system held by clarifai.com, our approach significantly diminishes the average prediction accuracy of the system to only 15.40%, which is on par with the attack that transfers adversarial examples from a pre-trained Arcface model. Our code is publicly

show abstract

“…These techniques are effective but with limited improvement space for adversarial attacks due to the small number of optimization steps here. Huang et al (2019) and Li, Guo, and Chen (2020) only perturbed features from the intermediate layer of DNNs, but the layer should be picked manually and carefully. There are also some augmentation-based methods (Xie et al 2019;Lin et al 2020;Liu et al 2017;Zhong and Deng 2020).…”

Section: Introductionmentioning

confidence: 99%

Learning to Learn Transferable Attack

Shuman¹,

Li²,

Lin³

et al. 2021

Preprint

View full text Add to dashboard Cite

Transfer adversarial attack is a non-trivial black-box adversarial attack that aims to craft adversarial perturbations on the surrogate model and then apply such perturbations to the victim model. However, the transferability of perturbations from existing methods is still limited, since the adversarial perturbations are easily overfitting with a single surrogate model and specific data pattern. In this paper, we propose a Learning to Learn Transferable Attack (LLTA) method, which makes the adversarial perturbations more generalized via learning from both data and model augmentation. For data augmentation, we adopt simple random resizing and padding. For model augmentation, we randomly alter the back propagation instead of the forward propagation to eliminate the effect on the model prediction. By treating the attack of both specific data and a modified model as a task, we expect the adversarial perturbations to adopt enough tasks for generalization. To this end, the meta-learning algorithm is further introduced during the iteration of perturbation generation. Empirical results on the widely-used dataset demonstrate the effectiveness of our attack method with a 12.85% higher success rate of transfer attack compared with the state-of-the-art methods. We also evaluate our method on the real-world online system, i.e., Google Cloud Vision API, to further show the practical potentials of our method.

show abstract

Yet Another Intermediate-Level Attack

Cited by 28 publications

References 23 publications

Exploring Transferable and Robust Adversarial Perturbation Generation from the Perspective of Network Hierarchy

Exploring Transferable and Robust Adversarial Perturbation Generation from the Perspective of Network Hierarchy

Practical Adversarial Attacks Against Speaker Recognition Systems

Learning to Learn Transferable Attack

Contact Info

Product

Resources

About