Perturbations are not Enough: Generating Adversarial Examples with Spatial Distortions

Deep neural network image classifiers are reported to be susceptible to adversarial evasion attacks , which use carefully crafted images created to mislead a classifier . Recently , various kinds of adversarial attack methods have been proposed , most of which focus on adding small perturbations to input images . Despite the success of existing approaches , the way to generate realistic adversarial images with small perturbations remains a challenging problem . In this paper , we aim to address this problem by proposing a novel adversarial method , which generates adversarial examples by imposing not only perturbations but also spatial distortions on input images , including scaling , rotation , shear , and translation . As humans are less susceptible to small spatial distortions , the proposed approach can produce visually more realistic attacks with smaller perturbations , able to deceive classifiers without affecting human predictions . We learn our method by amortized techniques with neural networks and generate adversarial examples efficiently by a forward pass of the networks . Extensive experiments on attacking different types of nonrobustified classifiers and robust classifiers with defence show that our method has state-of-the-art performance in comparison with advanced attack parallels . 1 INTRODUCTION . Recently , Deep Neural Networks ( DNNs ) have enjoyed great success in many areas such as computer vision and natural language processing . Nevertheless , DNNs are demonstrated to be vulnerable to adversarial attacks ( Goodfellow et al. , 2014b ; Nguyen et al. , 2015 ; Kurakin et al. , 2016 ) , which are data samples carefully crafted to be misclassified by DNN classifiers . For example , in image classification , an adversarial example may imperceptibly look like a legitimate data sample in a ground-truth class but misleads a DNN classifier to predict it into a maliciously-chosen target class or any class different from the ground truth . The former and latter are referred to as targeted attack and untargeted attack , respectively . In addition , adversarial attacks can be categorised into poisoning attacks ( attacks during the training phase of classifiers ) vs evasion attacks ( attacks during the testing/inference phase ) and whitebox attacks vs blackbox attacks . For whitebox attacks , the attacker has full access to the model architecture and parameters of a classifier , while those kinds of information are invisible to blackbox attackers . In this paper , we are particularly interested in untargeted , evasion , and whitebox attacks . However , many of the attacks discussed in this paper ( including the proposed ones ) can be easily adapted into targeted or blackbox settings . Shown in Goodfellow et al . ( 2014b ) , image classifiers based on DNNs ( e.g. , Convolutional Neural Networks ( CNNs ) ( LeCun et al. , 1998 ) ) are susceptible to small but carefully-chosen perturbations . Therefore , significant research efforts have been devoted into perturbation-based adversarial attacks , such as those in Goodfellow et al . ( 2014b ) ; Moosavi-Dezfooli et al . ( 2016 ) ; Carlini & Wagner ( 2017 ) ; Xiao et al . ( 2018a ) . Usually , a classifier is more easily fooled with larger perturbations , but this may result in adversarial examples that are less similar to original/real images . In practice , it is equally important that adversarial examples should mislead the classifier as well as “ look like ” real images . Therefore , the general task for perturbation-based methods can be formulated as misleading a classifier with a minimum amount of perturbation . It is reported that the intermediate feature maps ( convolutional layer activations ) in a CNN are not actually invariant to spatial transformations of the input data , due to its limited , pre-defined pooling mechanism for dealing with spatial variations ( Jaderberg et al. , 2015 ; Cohen & Welling , 2015 ; Lenc & Vedaldi , 2015 ) . Therefore , one can imagine generating adversarial examples by incorporating spatial distortions to original images . For example , Figure 1a shows that a CNN classifier successfully classifies the digits of MNIST ( LeCun & Cortes , 1998 ) . However , it is misled by the adversarial examples with properly-chosen spatial distortions . In contrast , humans are usually less influenced by such distortions . Motivated by this demonstration , by combining spatial distortions with perturbations , we may be able to generate more realistic adversarial examples with smaller perturbations , which can challenge classifiers without affecting human predictions . To further demonstrate this idea , given some samples of original MNIST images shown in Figure 1b , we apply a widely-used perturbation-based attack , Projected Gradient Descent ( PGD ) ( Madry et al. , 2018 ) , with the maximum perturbations of = 0.3 ( the standard setting of the attack ) , to attack the previously-mentioned classifier , the corresponding adversarial examples of which are shown in Figure 1c . It can be observed that those adversarial examples , though they fool the classifier , can be detected by humans , meaning that one can easily distinguish real and adversarial examples . On the other hand , shown in Figure 1d , the approach introduced in this paper , combines spatial distortions and perturbations to achieve similar attack performance as PGD , but with much smaller perturbation ( = 0.1 ) . Our adversarial examples are clearly less distinguishable from real images by humans . Motivated by the above idea , in this paper , we propose a new kind of adversarial attack on DNNbased image classifiers , which generalises the conventional perturbation-based attacks with additional spatial distortions . We name our framework SdpAdv ( Spatial distortion + perturbation Adversary ) . Specifically , to attack a pretrained classifier , our approach leverages a trainable joint process of two major steps , where it first generates a spatially distorted intermediate image by performing affine-transformations on a real image and then generates the final adversarial image by adding perturbations to the intermediate image . The proposed SdpAdv has the following appealing properties : • With the help of spatial distortions , our method is able to achieve state-of-the-art adversarial attack performance with much less perturbations than existing approaches purely based on perturbations , which generates less distinguishable adversarial examples . • With a differentiable framework , the learning of SdpAdv can be done efficiently in an amortized way , where two neural networks are learned to generate the specific parameters of the spatial distortions and perturbations for an input image . After SdpAdv is trained , it only takes one-step forward propagation in the two neural networks to generate adversarial examples , which enjoys better efficiency in the testing phase . • As most of existing robust classifier with defences , like those in Samangouei et al . ( 2018 ) ; Matyasko & Chau ( 2018 ) , are designed to defend against perturbation-based attacks , they can be less effective to our attacks based on spatial distortions ( Xiao et al. , 2018b ) . • Unlike many other whitebox attack methods , which usually require full access to the model structures and parameters of the classifier , SdpAdv only needs to be trained with access to the predicted probabilities of the classifier and directly generates adversarial examples from input images in the testing phase . That is to say , SdpAdv fits the settings of the semi-whitebox attack ( Xiao et al. , 2018a ) , which can be more applicable in practice . To demonstrate the superiority of our proposed method , we conduct extensive comparisons with state-of-the-art adversarial attacks . The experimental results show that SdpAdv is able to achieve better attack performance against both unprotected and robust classifiers . More interestingly , using less perturbation , our adversarial examples are much less distinguishable from real images . 2 BACKGROUND AND RELATED WORK . We now introduce the background and related work on adversarial attacks . Suppose that an image x in the ground-truth label y is the input of a neural network classifier f . The predicted label of f given x is denoted as f ( x ) . We assume f ( x ) = y for a well-trained classifier and will use them interchangeably hereafter . The general goal of adversarial attacks is to generate an adversarial example xA , which should “ look like ” x but change the prediction of f , i.e. , f ( x ) 6= f ( xA ) . Conversely , the goal of a defender is to train a robust classifier to defend against adversarial attacks . 2.1 PERTURBATION-BASED ADVERSARIAL ATTACKS . As the name implies , perturbation-based attacks generate xA by adding small perturbations η to x : xA = x + η . In general , η can be constructed by either : η : = argmaxη′ : ‖η′‖≤ ` f ( xA , y ) or η : = argminη′ : f ( x ) 6=f ( xA ) ‖η ′‖ , where ` f ( · ) denotes the cross-entropy loss of f and ‖ · ‖ can be the L∞ in accordance with Madry et al . ( 2018 ) ; Athalye et al . ( 2018 ) or other norms . As finding the closed-form solution for the above problem can be hard , Fast Gradient Sign Method ( FGSM ) ( Goodfellow et al. , 2014b ) is a one-step attack that applies a first-order approximation : η = · sign ( ∇x ` f ( x , y ) ) . Several extensions and variants to FGSM have been proposed , such as Randomized FGSM ( Tramèr et al. , 2018 ) , Basic Iterative Method ( BIM ) ( Kurakin et al. , 2016 ) , and Projected Gradient Descent ( PGD ) ( Madry et al. , 2018 ) . In addition to FGSM , there are numerous perturbation-based attacks that use different approximations to the above problem . For example , DeepFool ( Moosavi-Dezfooli et al. , 2016 ) generates adversarial perturbations by taking a step in the direction of the closest decision boundary in an iterative manner and CW ( Carlini & Wagner , 2017 ) is an attack based on the optimisation of a modified loss function with implicit box-constraints . Despite their success , the optimisation process of the above methods may have to be done for every test image , which could be inefficient in practice . To alleviate this problem , several attack methods have been proposed to directly generate perturbations by feeding real images into a generator : η = g ( x ) , which is usually implemented by neural networks . For example , Adversarial Transformation Networks ( ATNs ) ( Baluja & Fischer , 2018 ) trains g by minimising the combination of the re-ranking loss and an L2 norm loss , so as to constrain xA to be close to x in terms of L2 . Instead of using an L2 norm , the AdvGAN ( Xiao et al. , 2018a ) attack adopts a Generative Adversarial Network ( GAN ) ( Goodfellow et al. , 2014a ) framework with a discriminator to encourage the perceptual quality of the generated attacks . Moreover , the Rob-GAN ( Liu & Hsieh , 2019 ) attack also uses a GAN framework , where the discriminator is trained to distinguish between the attacks generated by PGD and those by the generator . 2.2 NON-PERTURBATION-BASED ADVERSARIAL ATTACKS . Here we consider non-perturbation-based methods as attacks that do not purely rely on manipulating the pixel values of original images . Compared with perturbation-based attacks , to our knowledge , research on non-perturbation-based methods is relatively rare . Recently , by adding perturbations to the latent space learned by Auxiliary Classifier GAN ( AC-GAN ) ( Odena et al. , 2017 ) , the attack in Song et al . ( 2018 ) generates adversarial examples for a specific label from scratch without taking a real image as input . Alternatively , there are attacks that apply spatial transformations to original images . Spatial Transformation Method ( STM ) 1 used in the CleverHans library ( Papernot et al. , 2018 ) constructs adversarial candidates by rotation and translation then selects the one that chal- 1https : //cleverhans.readthedocs.io/en/latest/source/attacks.html lenges the classifier most . As the selection process is non-differentiable , STM relies on the SPSA adversary ( Uesato et al. , 2018 ) , which is a gradient-free optimization method . Given a real image , stAdv ( Xiao et al. , 2018b ) is differentiable method that finds a flow field , each cell of which captures the transformation direction of one pixel of an input image .

Summary: This paper proposes a new adversarial attack method by combining spatial transformations with perturbation-based noises. The proposed method uses two networks to generate the parameters of spatial transformation and the perturbation noise. The whole architecture is trained by a variant of GAN-loss to make the adversarial examples realistic to humans. Experiments on MNIST prove that the proposed attack method can improve the success rate of white-box attacks against several models.