Training Meta-Surrogate Model for Transferable Adversarial Attack

1 INTRODUCTION . The developments of Convolutional Neural Network ( CNN ) ( LeCun et al. , 1995 ; Krizhevsky et al. , 2012 ) have greatly promoted the advancements in Computer Vision ( Ren et al. , 2016 ) . However , previous works ( Goodfellow et al. , 2014 ; Carlini & Wagner , 2017 ; Croce & Hein , 2020a ; Ganeshan et al. , 2019 ) have shown a critical robustness issue that CNN models are vulnerable to humanimperceptible perturbations of input images , also known as adversarial examples ( AEs ) . The design of AEs is useful for revealing the security threats on machine learning systems ( Croce & Hein , 2020b ) and for understanding the representations learned by CNN models ( Ilyas et al. , 2019 ) . In this paper , we consider the problem of black-box attack , where the target victim model is entirely hidden from the attacker . In this setting , standard white-box attacks ( Moosavi-Dezfooli et al. , 2016 ; Carlini & Wagner , 2017 ) or even query-based black-box attacks ( Ilyas et al. , 2018 ; Cheng et al. , 2018 ; 2020 ; 2019 ) can not be used , and the prevailing way to attack the victim is through transfer attack ( Papernot et al. , 2017 ; Wu et al. , 2018 ) . In transfer attack ( Demontis et al. , 2019 ; Dong et al. , 2018 ) , the attackers commonly generate AEs by attacking one or an ensemble of surrogate models and hope the obtained AEs can also successfully fool the victim black-box model . Although great efforts have been made to improve the transferability of adversarial attacks ( Tramèr et al. , 2017 ; Xie et al. , 2019 ; Wu et al. , 2020a ) , the transfer attack-based methods still encounter poor success rates , especially when attacking adversarially trained target models . This is caused by a fundamental limitation of current approaches—they all leverage the surrogate models trained by standard learning tasks ( e.g. , classification , object detection ) , while it is not always the case that attacks fooling such models can be easily transferred . We thus pose the following important question on transfer attack that has not been well studied in the literature : Instead of using standard ( naturally trained ) models as surrogate , can we artificially construct another Meta-Surrogate Model ( MSM ) such that attacks to this model can be easier transferred to other models ? We answer this question in the affirmative by developing a novel black-box attack pipeline called Meta-Transfer Attack ( MTA ) . Assume a set of source models ( standard surrogate models ) are given , instead of directly attacking these source models , our algorithm aims to obtain a “ meta-surrogate model ( MSM ) ” , which is designed in the way that attacks to this model can be easier transferred to fool other models , and conduct attacks on the MSM to obtain transferable AEs . We show that this goal can be mathematically formulated as a well-posed ( bi-level-like ) training objective by unrolling the attacks on the MSM and defining a loss to measure the transferability of the resulting AEs . To avoid discrete operations in the white-box attack , we propose a Customized PGD attacker that enables back-propagation through the whole procedure . With this bi-level-like optimization ( Finn et al. , 2017 ; Qin et al. , 2020 ) , the source models supervise the MSM to improve the transferability of the AEs created on it . Through extensive experiments on various models and datasets , we show that the proposed MTA method leads to significantly improved transfer attacks , demonstrating the effectiveness of the MSM . We summarize the main contributions of our work as follows . 1 ) We propose a novel MTA framework to train an MSM to improve the transferability of AEs . To the best of our knowledge , our work is the first attempt to explore a better surrogate model for producing stronger transferable AEs . 2 ) We compare MTA with state-of-the-art transfer attack methods ( e.g. , MI ( Dong et al. , 2018 ) , DI ( Xie et al. , 2019 ) , TI ( Dong et al. , 2019 ) , SGM ( Wu et al. , 2020a ) , AEG ( Bose et al. , 2020 ) , IR ( Wang et al. , 2021a ) , SI-NI ( Lin et al. , 2020 ) ) on Cifar-10 ( Krizhevsky et al. , 2009 ) and Imagenet ( Deng et al. , 2009 ) . The comparisons demonstrate the effectiveness of the proposed MTA—the AEs generated by attacking MSM significantly outperform previous methods , in attacking both naturally trained and adversarially trained black-box target models . 2 BACKGROUND . Adversarial attacks . Szegedy et al . ( 2014 ) reveals the interesting phenomenon that CNN models are vunerable to adversarial attacks . After that , many attacks have been developed ( Gao et al. , 2020 ; Zhou et al. , 2018 ; Wu et al. , 2020b ; Li et al. , 2020b ; Kaidi et al. , 2019 ; Sriramanan et al. , 2020 ) . Adversarial attacks can be mainly classified into white-box and black-box attacks ( Maksym et al. , 2020 ) according to how much information about the target model is exposed to the attacker . Whitebox attacks ( Kurakin et al. , 2016 ) are often more effective than than black-box attacks ( Brendel et al. , 2017 ; Cheng et al. , 2018 ; 2020 ) as they can leverage full knowledge of the target model including the model weights and architecture . For example , Fast Gradient Sign Method ( FGSM ) ( Goodfellow et al. , 2014 ) uses 1-step gradient ascent to produce adversarial examples that enlarge the model ’ s loss . Projected gradient descent ( PGD ) attack can be viewed as a multi-step FGSM attack ( Madry et al. , 2018 ) . Many other white-box attacks have also been developed by leveraging full information of the target model ( Moosavi-Dezfooli et al. , 2016 ; Croce & Hein , 2020a ) . In the black-box setting , query-based black-box attacks ( Huang & Zhang , 2020 ; Du et al. , 2020 ) assume model information is hidden but attackers can query the model and observe the corresponding hard-label or soft-label predictions . Among them , ( Chen et al. , 2017 ; Ilyas et al. , 2018 ) considered soft-label probability predictions and ( Chen et al. , 2020 ; Huang & Zhang , 2020 ; Cheng et al. , 2018 ) considered hard-label decision-based predictions . Considering that using a large number of queries to attack an image is impractical , several works try to further reduce the query counts ( Li et al. , 2020a ; Wang et al. , 2020 ) . Transferability of adversarial examples . In this paper , we consider the black-box attack scenario when the attacker can not make any query to the target model ( Lin et al. , 2020 ; Huang et al. , 2019 ; Wang et al. , 2021b ) . In this case , the common attack method is based on transfer attack—the attacker generates AEs by attacking one or few surrogate models and hopes the AEs can also fool the target model ( Papernot et al. , 2016 ; Liu et al. , 2017 ; Yuan et al. , 2021 ; Zhou et al. , 2018 ) . Compared with query-based attacks , crafting AEs from the surrogate model consumes less computational resources and is more realistic in practice . Along this direction , subsequent works have made attempts to improve the transferability of AEs ( Guo et al. , 2020 ; Wu et al. , 2020c ; Naseer et al. , 2019 ; Li et al. , 2020c ; Wang & He , 2021 ) . For instance , Dong et al . ( 2018 ) boosted the transferability by integrating the momentum term into the iterative process . Other techniques like data augmentations ( Xie et al. , 2019 ) , exploiting gradients of skip-connection ( Wu et al. , 2020a ) , and negative interaction between pixels ( Wang et al. , 2021a ) also contribute to stronger transferable attacks . In addition to using the original surrogate models , AEG ( Bose et al. , 2020 ) adversarially trains a robust classifier together with an encoder-decoder-based transferable perturbation generator . After the training , AEG uses the generator to generate transferable AEs to attack a set of classifiers . Compared to all the existing works , our method is the first that meta-trains a new meta-surrogate model ( MSM ) such that attacks on MSM can be easier transferred to other models . This not only differs from all the previous methods that attack standard surrogate models but also differs from the encoder-decoder based method such as AEG ( Bose et al. , 2020 ) . 3 METHODOLOGY . We consider the black-box attack setting where the target model is hidden to the attacker and queries are not allowed . This setting is also known as the transfer attack setting ( Dong et al. , 2018 ; 2019 ; Xie et al. , 2019 ; Wang et al. , 2021a ) and the attacker 1 ) can not access the weight , the architecture , and the gradient of the target model ; and 2 ) can not querying the target model . The attacker can access 1 ) the dataset used by the target model ; and 2 ) a single or a set of surrogate models ( also known as source models ) that may share the dataset with the target model . For example , it is common to assume that the attacker can access one or multiple well-performed ( pretrained ) image classification models . Existing transferable adversarial attack methods conduct various attacks to these models and hope to get transferable AEs that can fool an unknown target model . Instead of proposing another attack method on surrogate models , we propose a novel framework MTA to train a Meta-Surrogate Model ( MSM ) with the goal that attacking the MSM can generate stronger transferable AEs than directly attacking the original surrogate models . When evaluating , the transferable AEs are generated by attacking the MSM with standard white-box attack methods ( e.g. , PGD attack ) . In the following , we will first review exiting attacks and then show how to form a bi-level optimization objective to train the MSM model . 3.1 REVIEWS OF FGSM AND PGD . We follow the settings of existing works ( Dong et al. , 2018 ; Xie et al. , 2019 ; Wu et al. , 2020a ; Wang et al. , 2021a ) to focus on untargeted attack , where the attack is considered successful as long as the perturbed image is wrongly predicted . FGSM ( Goodfellow et al. , 2014 ) conducts one-step gradient ascent to generate AEs to enlarge the prediction loss . The formulation can be written as xadv = Clip ( x+ · sign ( ∇xL ( f ( x ) , y ) ) ) , ( 1 ) where x is a clean image and y is the corresponding label ; is the attack step size that determines the maximum L∞ perturbation of each pixel ; f is the victim model that is transparent to the FGSM attacker ; Clip is the function that clipping the values of xadv to the legal range ( e.g. , clipping the RGB AEs to the range of [ 0 , 255 ] ) ; L is usually the cross-entropy loss . PGD ( Kurakin et al. , 2016 ) , also known as I-FGSM attack , is a multi-step extension of FGSM . The formulation of PGD is xkadv=Clip ( xk−1adv + T · sign ( ∇xk−1adv L ( f ( x k−1 adv ) , y ) ) ) . ( 2 ) xkadv is the AEs generated in the k-th gradient ascent step . Note that x 0 adv is the clean image equals to x. Eq 2 will be run for T iterations to obtain xTadv with perturbation size .

Summary: In this paper, the authors proposed a novel method of Meta-Surrogate Model (MSM) which can generate more transferable adversarial examples in the black-box adversarial attacks. The problem is formulated as a bi-level-like optimization problem which achieved via a differentiable attacker. Extensive experiments demonstrate its effectiveness in generating the transferable adversarial examples.