Perturbations are not Enough: Generating Adversarial Examples with Spatial Distortions

Deep neural network image classifiers are reported to be susceptible to adversarial evasion attacks , which use carefully crafted images created to mislead a classifier . Recently , various kinds of adversarial attack methods have been proposed , most of which focus on adding small perturbations to input images . Despite the success of existing approaches , the way to generate realistic adversarial images with small perturbations remains a challenging problem . In this paper , we aim to address this problem by proposing a novel adversarial method , which generates adversarial examples by imposing not only perturbations but also spatial distortions on input images , including scaling , rotation , shear , and translation . As humans are less susceptible to small spatial distortions , the proposed approach can produce visually more realistic attacks with smaller perturbations , able to deceive classifiers without affecting human predictions . We learn our method by amortized techniques with neural networks and generate adversarial examples efficiently by a forward pass of the networks . Extensive experiments on attacking different types of nonrobustified classifiers and robust classifiers with defence show that our method has state-of-the-art performance in comparison with advanced attack parallels . 1 INTRODUCTION . Recently , Deep Neural Networks ( DNNs ) have enjoyed great success in many areas such as computer vision and natural language processing . Nevertheless , DNNs are demonstrated to be vulnerable to adversarial attacks ( Goodfellow et al. , 2014b ; Nguyen et al. , 2015 ; Kurakin et al. , 2016 ) , which are data samples carefully crafted to be misclassified by DNN classifiers . For example , in image classification , an adversarial example may imperceptibly look like a legitimate data sample in a ground-truth class but misleads a DNN classifier to predict it into a maliciously-chosen target class or any class different from the ground truth . The former and latter are referred to as targeted attack and untargeted attack , respectively . In addition , adversarial attacks can be categorised into poisoning attacks ( attacks during the training phase of classifiers ) vs evasion attacks ( attacks during the testing/inference phase ) and whitebox attacks vs blackbox attacks . For whitebox attacks , the attacker has full access to the model architecture and parameters of a classifier , while those kinds of information are invisible to blackbox attackers . In this paper , we are particularly interested in untargeted , evasion , and whitebox attacks . However , many of the attacks discussed in this paper ( including the proposed ones ) can be easily adapted into targeted or blackbox settings . Shown in Goodfellow et al . ( 2014b ) , image classifiers based on DNNs ( e.g. , Convolutional Neural Networks ( CNNs ) ( LeCun et al. , 1998 ) ) are susceptible to small but carefully-chosen perturbations . Therefore , significant research efforts have been devoted into perturbation-based adversarial attacks , such as those in Goodfellow et al . ( 2014b ) ; Moosavi-Dezfooli et al . ( 2016 ) ; Carlini & Wagner ( 2017 ) ; Xiao et al . ( 2018a ) . Usually , a classifier is more easily fooled with larger perturbations , but this may result in adversarial examples that are less similar to original/real images . In practice , it is equally important that adversarial examples should mislead the classifier as well as “ look like ” real images . Therefore , the general task for perturbation-based methods can be formulated as misleading a classifier with a minimum amount of perturbation . It is reported that the intermediate feature maps ( convolutional layer activations ) in a CNN are not actually invariant to spatial transformations of the input data , due to its limited , pre-defined pooling mechanism for dealing with spatial variations ( Jaderberg et al. , 2015 ; Cohen & Welling , 2015 ; Lenc & Vedaldi , 2015 ) . Therefore , one can imagine generating adversarial examples by incorporating spatial distortions to original images . For example , Figure 1a shows that a CNN classifier successfully classifies the digits of MNIST ( LeCun & Cortes , 1998 ) . However , it is misled by the adversarial examples with properly-chosen spatial distortions . In contrast , humans are usually less influenced by such distortions . Motivated by this demonstration , by combining spatial distortions with perturbations , we may be able to generate more realistic adversarial examples with smaller perturbations , which can challenge classifiers without affecting human predictions . To further demonstrate this idea , given some samples of original MNIST images shown in Figure 1b , we apply a widely-used perturbation-based attack , Projected Gradient Descent ( PGD ) ( Madry et al. , 2018 ) , with the maximum perturbations of = 0.3 ( the standard setting of the attack ) , to attack the previously-mentioned classifier , the corresponding adversarial examples of which are shown in Figure 1c . It can be observed that those adversarial examples , though they fool the classifier , can be detected by humans , meaning that one can easily distinguish real and adversarial examples . On the other hand , shown in Figure 1d , the approach introduced in this paper , combines spatial distortions and perturbations to achieve similar attack performance as PGD , but with much smaller perturbation ( = 0.1 ) . Our adversarial examples are clearly less distinguishable from real images by humans . Motivated by the above idea , in this paper , we propose a new kind of adversarial attack on DNNbased image classifiers , which generalises the conventional perturbation-based attacks with additional spatial distortions . We name our framework SdpAdv ( Spatial distortion + perturbation Adversary ) . Specifically , to attack a pretrained classifier , our approach leverages a trainable joint process of two major steps , where it first generates a spatially distorted intermediate image by performing affine-transformations on a real image and then generates the final adversarial image by adding perturbations to the intermediate image . The proposed SdpAdv has the following appealing properties : • With the help of spatial distortions , our method is able to achieve state-of-the-art adversarial attack performance with much less perturbations than existing approaches purely based on perturbations , which generates less distinguishable adversarial examples . • With a differentiable framework , the learning of SdpAdv can be done efficiently in an amortized way , where two neural networks are learned to generate the specific parameters of the spatial distortions and perturbations for an input image . After SdpAdv is trained , it only takes one-step forward propagation in the two neural networks to generate adversarial examples , which enjoys better efficiency in the testing phase . • As most of existing robust classifier with defences , like those in Samangouei et al . ( 2018 ) ; Matyasko & Chau ( 2018 ) , are designed to defend against perturbation-based attacks , they can be less effective to our attacks based on spatial distortions ( Xiao et al. , 2018b ) . • Unlike many other whitebox attack methods , which usually require full access to the model structures and parameters of the classifier , SdpAdv only needs to be trained with access to the predicted probabilities of the classifier and directly generates adversarial examples from input images in the testing phase . That is to say , SdpAdv fits the settings of the semi-whitebox attack ( Xiao et al. , 2018a ) , which can be more applicable in practice . To demonstrate the superiority of our proposed method , we conduct extensive comparisons with state-of-the-art adversarial attacks . The experimental results show that SdpAdv is able to achieve better attack performance against both unprotected and robust classifiers . More interestingly , using less perturbation , our adversarial examples are much less distinguishable from real images . 2 BACKGROUND AND RELATED WORK . We now introduce the background and related work on adversarial attacks . Suppose that an image x in the ground-truth label y is the input of a neural network classifier f . The predicted label of f given x is denoted as f ( x ) . We assume f ( x ) = y for a well-trained classifier and will use them interchangeably hereafter . The general goal of adversarial attacks is to generate an adversarial example xA , which should “ look like ” x but change the prediction of f , i.e. , f ( x ) 6= f ( xA ) . Conversely , the goal of a defender is to train a robust classifier to defend against adversarial attacks . 2.1 PERTURBATION-BASED ADVERSARIAL ATTACKS . As the name implies , perturbation-based attacks generate xA by adding small perturbations η to x : xA = x + η . In general , η can be constructed by either : η : = argmaxη′ : ‖η′‖≤ ` f ( xA , y ) or η : = argminη′ : f ( x ) 6=f ( xA ) ‖η ′‖ , where ` f ( · ) denotes the cross-entropy loss of f and ‖ · ‖ can be the L∞ in accordance with Madry et al . ( 2018 ) ; Athalye et al . ( 2018 ) or other norms . As finding the closed-form solution for the above problem can be hard , Fast Gradient Sign Method ( FGSM ) ( Goodfellow et al. , 2014b ) is a one-step attack that applies a first-order approximation : η = · sign ( ∇x ` f ( x , y ) ) . Several extensions and variants to FGSM have been proposed , such as Randomized FGSM ( Tramèr et al. , 2018 ) , Basic Iterative Method ( BIM ) ( Kurakin et al. , 2016 ) , and Projected Gradient Descent ( PGD ) ( Madry et al. , 2018 ) . In addition to FGSM , there are numerous perturbation-based attacks that use different approximations to the above problem . For example , DeepFool ( Moosavi-Dezfooli et al. , 2016 ) generates adversarial perturbations by taking a step in the direction of the closest decision boundary in an iterative manner and CW ( Carlini & Wagner , 2017 ) is an attack based on the optimisation of a modified loss function with implicit box-constraints . Despite their success , the optimisation process of the above methods may have to be done for every test image , which could be inefficient in practice . To alleviate this problem , several attack methods have been proposed to directly generate perturbations by feeding real images into a generator : η = g ( x ) , which is usually implemented by neural networks . For example , Adversarial Transformation Networks ( ATNs ) ( Baluja & Fischer , 2018 ) trains g by minimising the combination of the re-ranking loss and an L2 norm loss , so as to constrain xA to be close to x in terms of L2 . Instead of using an L2 norm , the AdvGAN ( Xiao et al. , 2018a ) attack adopts a Generative Adversarial Network ( GAN ) ( Goodfellow et al. , 2014a ) framework with a discriminator to encourage the perceptual quality of the generated attacks . Moreover , the Rob-GAN ( Liu & Hsieh , 2019 ) attack also uses a GAN framework , where the discriminator is trained to distinguish between the attacks generated by PGD and those by the generator . 2.2 NON-PERTURBATION-BASED ADVERSARIAL ATTACKS . Here we consider non-perturbation-based methods as attacks that do not purely rely on manipulating the pixel values of original images . Compared with perturbation-based attacks , to our knowledge , research on non-perturbation-based methods is relatively rare . Recently , by adding perturbations to the latent space learned by Auxiliary Classifier GAN ( AC-GAN ) ( Odena et al. , 2017 ) , the attack in Song et al . ( 2018 ) generates adversarial examples for a specific label from scratch without taking a real image as input . Alternatively , there are attacks that apply spatial transformations to original images . Spatial Transformation Method ( STM ) 1 used in the CleverHans library ( Papernot et al. , 2018 ) constructs adversarial candidates by rotation and translation then selects the one that chal- 1https : //cleverhans.readthedocs.io/en/latest/source/attacks.html lenges the classifier most . As the selection process is non-differentiable , STM relies on the SPSA adversary ( Uesato et al. , 2018 ) , which is a gradient-free optimization method . Given a real image , stAdv ( Xiao et al. , 2018b ) is differentiable method that finds a flow field , each cell of which captures the transformation direction of one pixel of an input image .

Summary: This paper builds upon the work of AdvGAN and proposes to add spatial transformations on top of it. The resulting attacking framework is demonstrated to outperform AdvGAN on attacking several defense approaches, such as Defense-GAN, AdvCritic and adversarial training. Compared to previous approaches on generating spatially transformed adversarial examples, this approaches amortizes the attacking procedure and can produce spatially transformed adversarial examples much faster. This approach also simultaneously combine spatial transformations and perturbations to make the attack stronger.