Question: In the page 9, what is PGA?
Evidence: Algorithm 1 GFCS: Gradient First, Coimage Second Sample w ∼ U (−1, 1) C 13:
q ← d ODS (x adv , s, w) ▷ See Eqn. 1 for definition.
14:
for α ∈ {ϵ, −ϵ} do
x adv ← Π xin,ν (x adv + α • q) 17:
S rem ← S ▷ Reset candidate surrogate set to input set; resume using loss gradients.
18:
break
The entirety of the proposed method is given in pseudocode as Algorithm 1. As indicated in Sec. 2.1, the method takes a victim classifier v, an input image x in , and a norm bound ν. The projection operator Π xin,ν confines its input to the ν-ball centred on x in : its inclusion in the algorithm represents a standard projected gradient ascent (PGA) implementation. Additionally, the method requires a loss function L, a set S of one or more surrogate models, and a step length ϵ representing the fixed length of the perturbations to be attempted at each iterate 1 along its candidate direction. The loss L can be any function of the iterate that serves as a suitable proxy for the adversarial objective, as in Sec. 2.1:
the only requirement here is that it be once differentiable. In our implementation, we make the popular and effective choice of the margin loss L f (x) = f ct (x) − f cs (x) where c s = argmax c v c (x) and c t = argmax c̸ =cs v c (x), i.e. the difference between the highest and second-highest (or, in the targeted case, the target) class scores. Note that the class IDs c t and c s are defined by the ranking according to v, but are evaluated on the net f parametrising the loss, which is either s or v depending on the line of the algorithm (9 and 15, respectively). The natural assumption of a surrogate method is that the surrogate will provide useful information about the victim, but there is no "hard" requirement on the surrogates s ∈ S other than being once-differentiable functions mapping X → Y. The definition of ODS direction d ODS for network f and input x is, as in,
where w is sampled from the uniform distribution over [−1, 1] C . By definition, it is the normalised gradient of a randomly weighted sum of all of the class scores. Equivalently, by linearity, it is a randomly weighted sum of all of the class-score gradients (i.e. rows of the Jacobian matrix), which are themselves a basis of the coimage of the linear approximation of f : the subspace which f exhibits any nonzero response to.
As indicated in Sec. 1, the logic of the method is simple. At any given iterate, the method tries to proceed in a SimBA-like manner by testing the change in adversarial loss at fixed-length steps along candidate directions, projected back into the feasible set where necessary. It does so exclusively using normalised loss gradients from the surrogates in the input set (drawn in random order, without replacement), unless and until it has exhausted them at that iterate without success. As we will demonstrate in Sec. 3.2, this intermediate failure state is seldom reached. If this state is reached, however, the method instead randomly samples a surrogate (with replacement) and an ODS direction from that surrogate, attempting a SimBA update each time, until an improvement in the loss is realised. Once such a successful update occurs, the method resets the candidate surrogate set to the input set and resumes using normalised loss gradients only. The method terminates on finding an adversarial example or on exceeding an upper bound on the query count if one has been specified.). The latter is omitted for LeBA , which does not admit non-singleton surrogate sets. All networks used are pretrained models available via PyTorch/torchvision. Parameter values of competitors are as they specify except where we note otherwise for reasons that will be discussed below. LeBA is run in "train" mode on a held-out set of 1000 images and then evaluated in "test" mode on the same set of 2000 used for all other methods. P-RGF always uses the adaptive coefficient mode. P-RGF and ODS-RGF are based on our own PyTorch port of the reference P-RGF code, which will be released along with this paper: no public implementation of ODS-RGF currently exists otherwise. We include the surrogate-free for comparison.
To delve deeper into the results of Sec. 3.1, we plot each attacked example as a 2D point whose x-coordinate is the number of queries expended by the surrogate loss gradient block of the algorithm, and whose y-coordinate is the analogous count for the coimage block. This gives the scatter plot of Fig., which is supplemented by marginal histograms corresponding to the axes opposite them. The figure shows results obtained using Inception-v3 as the victim: see Appendix A.3 for analogous figures for VGG-16 and ResNet-50. Note that the axes of the main scatter plots are log-log, while those of the marginal histograms are linear-log. Some phenomena are readily evident. For one, there is a large fraction of examples (represented by the dense horizontal rows of dots at the bottom of the plots) that succeed within a very low number of queries (on the order of 1-10), which are entirely or almost entirely due to the surrogate gradient transfer, with ODS used seldom or not at all. As these low-query clusters are extremely dense, the corresponding marginals should be consulted (best under zoom) in order to quantify them. For another, the number of examples outside of this regime falls considerably when the four-surrogate set is used instead of ResNet-152 on its own, as can be seen by comparing the left and right sides of the figure. It is clear that the examples that rely on the interplay between the gradient-and coimage-based direction generators are reduced to a nontrivial (i.e. sufficient to affect the failure rate if not handled) but nonetheless relatively small group. Overall, there is an order-of-magnitude difference between surrogate loss gradient queries and ODS queries in the points extending away from the dense low-query cluster at the bottom, i.e. the examples that rely on both submethods. That is, when the ODS block is required, it typically requires far more queries to progress the optimiser than in the much more common cases in which the gradient suffices.
its inclusion in the algorithm represents a standard projected gradient ascent (PGA) implementation.
Answer: Projected Gradient Ascent. The abbreviation is defined on page 4. We have used ascent sign conventions throughout the paper, i.e. the attacker seeks to increase the loss. Thus, we refer to PGA rather than PGD.