One for Many: an Instagram inspired black-box adversarial attack

1 INTRODUCTION . It is well known that deep learning models are susceptible to adversarial attacks and many recent researches in the field have been devoted to produce ever more reliable and effective attacks . Attack reliability is strictly connected to its applicability in real-world scenarios and to its ability to bypass potential defense mechanisms ; this is why the hard-label black-box setting ( also called decisionbased attack ) and the transferability property of white box attacks gained increasing attention . Several techniques have been proposed to increase the transferability of both black-box and white-box attacks ( Cheng et al . ( 2020 ) ; Wu et al . ( 2020 ) ; Brendel et al . ( 2018 ) , among the most popular ) . One of the most commonly adopted technique is to craft the attacks by using an ensemble of multiple models as proposed by Liu et al . ( 2017 ) . Besides the categorization in white-box and black-box methods , attacks can be classified as restricted or unrestricted , considering the amount of modifications they apply to the images in order to fool the systems . Restricted attacks : they generally use a Lp-norm distance to bound the modifications . The attacks are crafted with the aim of minimizing the differences between the original image and the adversarial one , even if it means having visible ( more or less ) artifacts . In Figures 1b and 1d , the attacks produced by Dong et al . ( 2019 ) and Wu et al . ( 2020 ) , two of the most recent state-of-the-art adversarial methods , are shown . In both the cases the generated artifacts are clearly visible . Unrestricted attacks : they employ large and visible perturbations while keeping the images realistic , natural looking and non-suspicious . The idea is to obtain images that can admit great differences from the original one but , beyond a direct comparison with the original one they can not be distinguished from any other real ( maybe filtered ) image . In Figures 1f and 1h , the attacks produced by ACE-Ins ( Zhao et al. , 2020 ) and Colorfool ( Shahin Shamsabadi et al. , 2020 ) are shown . The differences between the original image and the adversarial one are evident but , if the modifications are good enough , looking just at the adversarial one we might not be able to say that it is the attacking image . Another aspect that has to be taken into account for real-world attacks is the amount of queries to the victim model that are necessary to craft effective attacks . All the systems proposed in literature need a huge amount of queries and , also in the case of systems built to work with limited access to the victim model , several thousands of queries are needed to produce reliable attacks . In this paper we propose a system to craft reliable , effective and highly transferable attacks by composing image filters . In previous papers ( for ex . Destylization ) has been shown that Instagram inspired filters can have adversarial , but limited effects , when applied singularly . Hence , we decided to study the effects of filter composition with the aim to increase the adversarial effectiveness . Moreover , in the usual photo editing process people use more than one filter in order to obtain the desired effect . We just wanted to simulate a more realistic scenario . This kind of attack offers multiple benefits : ( i ) it is naturally robust to detecting methods able to find noise , injected patterns and irregularities in the high frequencies image ( Moosavi-Dezfooli et al. , 2018 ; Liao et al. , 2018 ) . ( ii ) it is naturally robust to masking-gradients ( and their numerical estimate ) defending methods . ( iii ) it produces natural looking artifacts-free images . ( iv ) it produces adversarial attacks that can not be distinguished from any other filtered images produced extensively every day , especially on social media platforms . The system works in the pure hard-label black box setting and implements a multi-network approach to increase the attack transferability . It can reach , with artifact-free images , a transferability rate higher than 70 % in the case of unsecured networks and , even more interestingly , higher than 60 % in the case of adversarially trained network . Moreover , the system requires a very low number of queries to find an attack , around 640 in the average case , and it can be limited by construction adjusting the algorithm parameters . In the experiments presented here the maximum number of allowed queries is 1610 . Our contribution can be summarized as follows : ( i ) We propose the AGV-multinetwork attack , a system able to craft powerful adversarial attacks capable of attacking even secured adversarially trained models by composing Instagram inspired image filters ; ( ii ) we empirically demonstrate the high transferability of these attacks and we compare our results with other state-of-the-art systems ; ( iii ) we empirically demonstrate the efficiency of our system in terms of queries to the victim model and we compare our results with other state-of-the-art systems . 2 BACKGROUND . 2.1 ADVERSARIAL MACHINE LEARNING . Given an input image x ∈ X ⊂ Rd and its corresponding label y , let F be a neural network classifier that ( correctly ) predicts the class label for the input image x : F ( x ) = y . An adversarial attack attempts to modify the input image x by adding a perturbation δ into an adversarial image x∗ = x+ δ such that the classifier is mislead into making a wrong prediction , i.e . F ( x∗ ) ̸= F ( x ) . If we consider the type of the applied perturbation δ , the attacks can be classified as restricted or unrestricted . In the restricted case , the modifications applied to the original image are usually small and bounded by a Lp-norm distance measure , forcing the adversarial image x∗ to be as close as possible to the original one . On the contrary , unrestricted attacks use large perturbations without Lp-bounded constraints that manipulate the image in order to create photo-realistic adversarial examples . In this case the objective is not to limit the modifications on pixels but limit the human perception that a modification has been applied ( Shahin Shamsabadi et al. , 2020 ; Zhao et al . ; Wang et al. , 2021 ) . 2.2 IMAGE FILTERS . We implemented ten of the most popular Instagram filters using Python3 and the Pillow , OpenCV and Numpy libraries : Clarendon , Juno , Reyes , Gingham , Lark , Hudson , Slumber , Stinson , Rise , and Perpetua . Each filter has distinct characteristics and effects given by different level of contrast , saturation , brightness , shadows , etc . For instance , Clarendon brightens and highlights a photo , Juno adds saturation and warmth making the colors more intense , Rise gives a warm glow by mixing a radial gradient with a light sepia tone , while Hudson bumps up the blues giving a more colder feel . Examples of single filter applications are shown in Figure 6 in Appendix A. . Each filter is parameterized by two parameters that have to be optimized by the algorithm : intensity α and strength s. The role of the parameter α is to alter the intensity of each basic component inside each filter implementation such as brightness , contrast , saturation , edge enhancement , gamma correction and many more . The parameter s is used to control the strength of the filter application and it is defined as the convex interpolation between the original image x and the transformed image x∗ : strength ( x , x∗ , s ) = ( 1.0− s ) · x+ s · x∗ ( 1 ) thus , if s = 0 the output image of the filter is the original image , while with s = 1 the filter returns the modified image x∗ . 3 APPROACH AND ALGORITHM . 3.1 PROBLEM DEFINITION . Given a set S = { f1 , f2 , . . . , fm } of Instagram inspired image filters as described in Section 2.2 , and a clean image x , we want to find a sequence of n parametrized filters { fk1 ( α1 , s1 ) , . . . , fkn ( αn , sn ) } able to produce an adversarial attack against a classifier model F starting from the image x , that is { F ( x ) ̸= F ( x∗ ) x∗ = fkn ( αn , sn ) ( . . . fk2 ( α2 , s2 ) ( fk1 ( α1 , s1 ) ( x ) ) ) ( 2 ) 3.2 APPROACH . The algorithm used to optimize the sequence of filters and their parameters is inspired by Baia et al . ( 2021 ) . In our proposal the universal approach proposed by Baia et al . has been transformed into a multi-network per-image approach , where the attack is crafted and optimized for just one image with respect to more target models . Since the algorithm uses an evolutionary approach , the fitness function used to guide the search can have any ( also non differentiable ) form , and we decide to use it to implement a sort of generalization ability induced by attacking more models simultaneously . This is inspired by Liu et al . ( 2017 ) where the authors suggested that attacking an ensemble of multiple networks simultaneously can generate much stronger adversarial examples . Instead of attacking an ensemble network we decided to exploit the optimization ability of the evolutionary approach and try to simultaneously attack all the ( or at least k ) reference networks . Therefore , our goal is to find one adversarial perturbation per-image that can fool many deep learning models . This objective is much harder to achieve than attacking a single model but it guarantees complete ( 100 % ) transferability of the attack towards the reference networks . The proposed multi-network approach has the objective to obtain adversarial images with better transferability avoiding the natural overfitting trap we can fall into when the attacks are crafted by using a unique reference model . 3.3 ALGORITHM . The optimization method consists of two evolutionary nested algorithms : the outer algorithm , using a GA approach , in charge of finding the sequence of filters to use , and the inner algorithm , based on ES , used to choose the filter parameter values . The general structure of the multi-network algorithm is shown in Algorithm 1 . Given a set S = { f1 , f2 , fm } of image filters , the outer algorithm genotype ( with length n ) is encoded as a list of n integers k1 , . . . , kn ∈ { 1 , . . . , m } representing the corresponding filters in S , while the inner algorithm genotype is represented by a list containing the pairs of parameters used for each selected filter ( ( α1 , s1 ) , . . . , ( αn , sn ) ) . The associated phenotype is sequence of parametrized filters able to generate the adversarial examples by applying the selected sequence of filters , with their corresponding optimized parameters , as described in Eq.2 . 3.3.1 OUTER ALGORITHM . The outer optimization step is performed by a genetic algorithm : a population of N candidate perturbations is iteratively evolved towards better solutions . In order to breed a new generation , population members are randomly selected and the crossover and mutation operations are performed . The quality of the candidates is evaluated based on their fitness values and , at the end of each iteration , the N best individuals are chosen for the next generation . Initial population : it is generated by randomly selecting l filters from the set S of available filters and their parameters are initialized with default values equal to 1 . Crossover : a standard one-point crossover is used to generate new off-springs from randomly selected members . Each child is guaranteed to inherit some genetic information from both parents , including the optimized parameters . For example , given two parent elements P1 = ( f ′1 ( α ′ 1 , s ′ 1 ) , . . . , f ′ n ( α ′ n , s ′ n ) ) and P2 = ( f ′′ 1 ( α ′′ 1 , s ′′ 1 ) , . . . , f ′′ n ( α ′′ n , s ′′ n ) ) and crossover index i = 2 , we obtain the child element ( f ′1 ( α ′ 1 , s ′ 1 ) , f ′ 2 ( α ′ 2 , s ′ 2 ) , f ′′ 3 ( α ′′ 3 , s ′′ 3 ) , . . . , f ′′ n ( α ′′ n , s ′′ n ) ) . Mutation : it is applied by substituting a filter with another one based on a mutation probability . The substituent filter is initialized with random parameter values . For example considering the element P = ( f1 ( α1 , s1 ) , f2 ( α2 , s2 ) , f3 ( α3 , s3 ) . . . , fn ( αn , sn ) ) and supposing that filters f1 and f3 has been chosen to mutate with g1 and g2 , the new generated element is P ∗ = ( g1 ( α ∗ 1 , s ∗ 1 ) , f2 ( α2 , s2 ) , g2 ( α ∗ 2 , s ∗ 2 ) . . . , fn ( αn , sn ) ) , where α ∗ i , s ∗ i are randomly extracted from the parameter domains . Selection : at the end of each iteration , we choose the N best individuals from the set of 2N candidates ( parents and offsprings ) according to their fitness values . This process is repeated until the algorithm exhausts the allowed number of generations .

Summary: The paper proposes a black-box attack method that uses an evolutionary algorithm to find the best image filter parameters that can achieve untargeted attacks. Model ensembling is also used in the AE generation to improve attack transferability. The proposed method is compared to other similar image filtering-based AE generation methods. Results show that the proposed method is able to outperform most of the related works in terms of transferability.