Evading Defenses to Transferable Adversarial Examples by Translation-Invariant Attacks
Yinpeng Dong, Tianyu Pang, Hang Su, Jun Zhu
Department of Computer Science and Technology, Institute for AI, Tsinghua University

Observation & Motivation

Introduction

Inception
ResNet v2

Inception v3

q Adversarial examples are crafted by adding small, human-imperceptible
noises to normal examples, but make a model output wrong predictions.

ResNet 152

Experiments

Tramer et al. (2018) Liao et al. (2018) Xie et al. (2018) Guo et al. (2018)

lllll

q Constrained Optimization Problem:+,+,45+6max𝐽𝑥,𝑦𝑠.
𝑡.
𝑥−𝑥≤𝜖7%&'$

1. Fast Gradient Sign Method (FGSM)[Goodfellow et al., 2015]:
𝑥 +,- = 𝑥 45+6 + 𝜖 ⋅ sign(𝛻$ 𝐽(𝑥 45+6 , 𝑦))n The defenses make predictions based on different discriminative regions
compared with normal models (and also different gradient [Tsipras et al., 2019]);+,𝑥DEF= 𝑥D+,- + α ⋅ sign 𝛻$ 𝐽 𝑥D+,- , 𝑦

Raw Image

FGSM

TI-FGSM3. Momentum Iterative Fast Gradient Sign Method (MI-FGSM) [Dong et al., 2018]
𝛻$ 𝐽 𝑥D+,- , 𝑦𝛻$ 𝐽 𝑥D+,- , 𝑦n Therefore, we propose to craft an adversarial example against an ensembleof translated images.

+,, 𝑥DEF= 𝑥D+,- + 𝛼 ⋅ sign 𝑔DEF
FMethodology
q Translation-invariant objective function

q Defenses
Image Denoising+,max𝑤
𝐽𝑇(𝑥), 𝑦K
MN
MN%&'

Robust Training

Denoiserclassifier$𝑠. 𝑡. 𝑥 +,- − 𝑥 45+6 7 ≤ 𝜖M,Nl 𝑇MN is the translation operation, i.e., 𝑇MN 𝑥 +,Q = 𝑥+RM,QRN .

q Assumption – translation-invariant property of CNNs
Classifier

The defenses can be circumvented in the white-box manner since they cause
obfuscated gradients [Athalye et al., 2018]; but some of them claim to berobust in the black-box manner.
We want to answer that: Are these defenses really robust against blackbox attacks based on the transferability?

$T$X

𝛻$ K 𝑤MN 𝐽 𝑇MN 𝑥 , 𝑦M,N0.4

0.2

010S

$T$X

50≈ 𝑊 ∗ 𝛻$ 𝐽 𝑥, 𝑦 S-5-10

M1−]EFl_M,N =A linear kernel 𝑊l_M,N =A Gaussian kernel 𝑊

0-5-5-10x-10(b) Inc-v4

0.4

0.3
0.2

0.3
0.20.1105500-5-5-10-10(c) Inc-Res-v2

N1−]EF_ V,Wa, 𝑊M,N = ∑ _aV,WM ^EN ^\d^, 𝑊M,N = ∑ _−100y0.5yFexp\cd^x01010550y0-5-5-10-10x(d) Res-v2-152_ V,WaaV,Wq Our method can be integrated into any gradient-based attack method
Classifier1

Classifier2

Wrong
Predictionl TI-FGSM: 𝑥 +,- = 𝑥 45+6 + 𝜖 ⋅ sign 𝑊 ∗ 𝛻$ 𝐽 𝑥 45+6 , 𝑦+,l TI-BIM: 𝑥DEF= 𝑥D+,- + α ⋅ sign 𝑊 ∗ 𝛻$ 𝐽 𝑥D+,- , 𝑦

Kernel Length=1555x-100.1

A uniform kernel 𝑊M,N =0100-50.4F;\]EF ^Kernel Length=9 Kernel Length=11 Kernel Length=130.2

0.5010Kernel Length=70.3(a) Inc-v3$T$X

Kernel Length=50.1

105yq Kernel matrix
l0.40.3

Kernel Length=3

q Attacking an ensemble of models
0.50.1

q Loss gradientKernel Length=10.5

Loss

Loss orRegularization$TUVW ($X)≈ 𝛻$ 𝐽 𝑥, 𝑦 S

Loss

𝛻$ 𝐽 𝑥, 𝑦 SLossClassifierLoss

Adversarial Training

www.PosterPresentations.com

q Results of kernel lengthn The adversarial example is highly correlated with the discriminative region
or gradient of the white-box model at the given input point, making it hard totransfer to defenses which are based on different regions for predictions;

4. Carlini & Wagner’s method (C&W) [Carlini and Wagner, 2017] optimizes theLagrangian-relaxed form of the problem.

RESEARCH POSTER PRESENTATION DESIGN © 2015

Inc-v3ens3, Inc-v3ens4, IncRes-v2ens [Tramer et al., 2018];
High-level representation guided denoiser (HGD) [Liao et al., 2018];
Random resizing and padding (R&P) [Xie et al., 2018];
JPEG compression and total variance minimization (TVM) [Guo et al., 2018];
NIPS-r3 (rank-3 submission in the NIPS 2017 defense competition).

White-box models: Inc-v3, Inc-v4, IncRes-v2, Res-v2-152

2. Basic Iterative Method (BIM) [Kurakinet al., 2016]:

𝑔DEF = 𝜇 ⋅ 𝑔D +q Experimental settings

Conclusion
q We propose a translation-invariant attack method to craft adversarial
examples with improved transferability against the defense models.
q Our method can be integrated into any gradient-based attack method.
q Our best attack TI-DIM fools eight state-of-the-art
defenses at an 82% success rate on average.
q Our method can serve as a benchmark to evaluate
robustness of future developed defenses.