An Efficient and Margin-Approaching Zero-Confidence Adversarial Attack

1 INTRODUCTION . Adversarial attack refers to the task of finding small and imperceptible input transformations that cause a neural network classifier to misclassify . White-box attacks are a subset of attacks that have access to gradient information of the target network . In this paper , we will focus on the white-box attacks . An important class of input transformations is adding small perturbations to the input . There are two major paradigms of adversarial attacks that attempt to impose input perturbations . The first paradigm , called the fix-perturbation attack , tries to find perturbations that are most likely to cause misclassification , with the constraint that the norm of the perturbations can not exceed a given level . Since the perturbation level is fixed , fix-perturbation attacks may fail to find any adversarial samples for inputs that are far away from the decision boundary . The second paradigm , called the zero-confidence attack , tries to find the smallest perturbations that are guaranteed to cause misclassification , regardless of how large the perturbations are . Since they aim to minimize the perturbation norm , zero-confidence attacks usually find adversarial samples that ride right on the decision boundaries , and hence the name “ zero-confidence ” . The resulting perturbation norm is also known as the margin of an input feature to the decision boundary . Both of these paradigms are essentially constrained optimization problems . The former has a simple convex constraint ( perturbation norm ) , but a non-convex target ( classification loss or logit differences ) . In contrast , the latter has a non-convex constraint ( classification loss or logit differences ) , but a simple convex target ( perturbation norm ) . Despite their similarity as optimization problems , the two paradigms differ significantly in terms of difficulty . The fix-perturbation attack problem is easier . The state-of-the-art algorithms , including projected gradient descent ( PGD ) ( Madry et al. , 2017 ) and distributional adversarial attack ( Zheng et al. , 2018 ) , can achieve both high efficiency and high success rate , and often come with theoretical convergence guarantee . On the other hand , the zero-confidence attack problem is much more challenging . Existing methods are either not strong enough or too slow . For example , DeepFool ( Moosavi Dezfooli et al. , 2016 ) and fast gradient sign method ( FGSM ) ( Goodfellow et al. , 2014 ; Kurakin et al. , 2016a ; b ) linearizes the constraint , and solves the simplified optimization problem with a simple convex target and a linear constraint . However , due to the linearization approximation errors , the solution can be far from optimal . As another extreme , L-BFGS ( Szegedy et al. , 2013 ) and Carlini-Wagner ( CW ) ( Carlini & Wagner , 2017 ) convert the optimization problem into a Lagrangian , and the Lagrangian multiplier is determined through grid search or binary search . These attacks are generally much stronger and theoretically grounded , but can be very slow . The necessity of developing a better zero-confidence attack is evident . The zero-confidence attack paradigm is a more realistic attack setting . More importantly , it aims to measure the margin of each individual token , which lends more insight into the data distribution and adversarial robustness . Motivated by this , we propose MARGINATTACK , a zero-confidence attack framework that is able to compute the margin with improved accuracy and efficiency . Specifically , MARGINATTACK iterates between two moves . The first move , called restoration move , linearizes the constraint and solves the simplified optimization problem , just like DeepFool and FGSM ; the second move , called projection move , explores even smaller perturbations without changing the constraint values significantly . By construction , MARGINATTACK inherits the efficiency in DeepFool and FGSM , and improves over them in terms of accuracy with a convergence guarantee . Our experiments show that MARGINATTACK attack is able to compute a smaller margin than the state-of-the-art zero-confidence attacks , and matches the state-of-the-art fix-perturbation attacks . In addition , it runs significantly faster than CW , and in some cases comparable to DeepFool and FGSM . 2 RELATED WORKS . In addition to the aforementioned state-of-the-art attacks , there are a couple of other works that attempt to explore the margin . Jacobian-based saliency map attack ( Papernot et al. , 2016 ) is among the earliest works that apply gradient information to guide the crafting of adversarial examples . It chooses to perturb the input features whose gradient is consistent with the adversarial goal . Onepixel attack ( Su et al. , 2017 ) finds adversarial examples by perturbing only one pixel , which can be regarded as finding the ` 0 margin of the inputs . Ilyas et al . ( 2018 ) converts PGD into a zeroconfidence attack by searching different perturbation levels , but this again can be time-consuming because it needs to solve multiple optimization subproblems . Weng et al . proposed a metric called CLEVER ( Weng et al. , 2018 ) , which estimates an upper-bound of the margins . Unfortunately , recent work ( Goodfellow , 2018 ) has shown that CLEVER can overestimate the margins due to gradient masking ( Papernot et al. , 2017 ) . The above are a just a small subset of white-box attack algorithms that are relevant to our work . For an overview of the field , we refer readers to Akhtar & Mian ( 2018 ) . The MARGINATTACK framework is inspired by the Rosen ’ s algorithm ( Rosen , 1961 ) for constraint optimization problems . However , there are several important distinctions . First , the Rosen ’ s algorithm rests on some unrealistic assumptions for neural networks , e.g . continuously differentiable constraints , while MARGINATTACK has a convergence guarantee with a more realistic set of assumptions . Second , the Rosen ’ s algorithm requires a step size search for each iteration , which can be time-consuming , whereas MARGINATTACK will work with a simple diminishing step size scheme . Most importantly , as will be shown later , MARGINATTACK refers to a large class of attack algorithms depending on how the two parameters , a ( k ) and b ( k ) , are set , and the Rosen ’ s algorithm only fits into one of the settings , which only works well under the ` 2 norm . For other norms , there exist other parameter settings that are much more effective . As another highlight , the convergence guarantee of MARGINATTACK holds for all the settings that satisfy some moderate assumptions . 3 THE MARGINATTACK ALGORITHM . In this section , we will formally introduce the algorithm and discuss its convergence properties . In the paper , we will denote scalars with non-bolded letters , e.g . a or A ; column vectors with lowercased , bolded letters , e.g . a ; matrix with upper-cased , bolded letters , e.g . A ; sets with upper-cased double-stoke letters , e.g . A ; gradient of a function f ( x ) evaluated at x = x0 as ∇f ( x0 ) . 3.1 PROBLEM FORMULATION . Given a classifier whose output logits are denoted as l0 ( x ) , l1 ( x ) , · · · , lC−1 ( x ) , where C is the total number of classes , for any data token ( x0 , t ) , where x0 is an n-dimensional input feature vector , and t ∈ { 0 , · · · , C − 1 } is its label , MARGINATTACK computes x∗ = argmin x d ( x− x0 ) , s.t . c ( x ) ≤ 0 , ( 1 ) where d ( · ) is a norm . In this paper we only consider ` 2 and ` ∞ norms , but the proposed method is generalizable to other norms . For non-targeted adversarial attacks , the constraint is defined as c ( x ) = lt ( x ) −max i6=t li ( x ) − ε , ( 2 ) where ε is the offset parameter . As a common practice , ε is often set to a small negative number to ensure that the adversarial sample lies on the incorrect side of the decision boundary . In this paper , we will only consider non-targeted attack , but all the discussions are applicable to targeted attacks ( i.e . c ( x ) = maxi 6=a li ( x ) − la ( x ) − ε for a target class a ) . 3.2 THE MARGINATTACK PROCEDURE . MARGINATTACK alternately performs the restoration move and the projection move . Specifically , denote the solution after the k-th iteration as x ( k ) . Then the two steps are : Restoration Move : The restoration move tries to hop to the constraint boundary , i.e . c ( x ) = 0 with the shortest hop . Formally , it solves : z ( k ) = argmin x d ( x− x ( k ) ) , s.t.∇T c ( x ( k ) ) ( x− x ( k ) ) = −α ( k ) c ( x ( k ) ) . ( 3 ) where α ( k ) is the step size within [ 0 , 1 ] . Notice that the left hand side of the constraint in Eq . ( 3 ) is the first-order Taylor approximation of c ( z ( k ) ) − c ( x ( k ) ) , so this constraint tries to move point closer to c ( x ) = 0 by α ( k ) . It can be shown , from the dual-norm theory,1 that the solution to ( 3 ) is z ( k ) = x ( k ) − α ( k ) c ( x ( k ) ) s ( x ( k ) ) ∇T c ( x ( k ) ) s ( x ( k ) ) ( 4 ) s ( x ) is defined such that∇T c ( x ) s ( x ) = d∗ ( ∇T c ( x ) ) , where d∗ ( · ) is the dual norm of d ( · ) . Specifically , noticing that the dual norm of the ` p norm is the ` ( 1−p−1 ) −1 norm , we have s ( x ) = { ∇c ( x ) /‖∇c ( x ) ‖2 if d ( · ) is the ` 2 norm sign ( ∇c ( x ) ) if d ( · ) is the ` ∞ norm . ( 5 ) As mentioned , Eq . ( 4 ) is similar to DeepFool under ` 2 norm , and to FGSM under ` ∞ norm . Therefore , we can expect that the restoration move should effectively hop towards the decision boundary , but the hop direction may not be optimal . That is why we need the next move . Projection Move : The projection move tries to move closer to x0 while ensuring that c ( x ) will not change drastically . Formally , x ( k+1 ) = z ( k ) − β ( k ) a ( k ) ∇d ( z ( k ) − x0 ) − β ( k ) b ( k ) s ( z ( k ) ) ( 6 ) where β ( k ) is the step size within [ 0 , 1 ] ; a ( k ) and b ( k ) are two scalars , which will be specified later . As an intuitive explanation on Eq . ( 3 ) , notice that the second term , which we will call the distance reduction term , reduces the distance to x0 , whereas the third term , which we will call the constraint reduction term , reduces the the constraint ( because s ( z ( k ) ) and ∇c ( z ( k ) ) has a positive inner product ) . Therefore , the projection move essentially strikes a balance between reduction in distance and reduction in constraint . a ( k ) and b ( k ) can have two designs . The first design is to ensure the constraint values are roughly the same after the move , i.e . c ( z ( k ) ) − c ( x ( k+1 ) ) ≈ 0 . By Taylor approximation , we have ∇T c ( z ( k ) ) ( x ( k+1 ) − z ( k ) ) = 0 , ( 7 ) whose solution is b ( k ) = a ( k ) ∇T c ( z ( k ) ) ∇d ( z ( k ) − x0 ) ∇T c ( z ( k ) ) s ( z ( k ) ) . ( 8 ) Another design is to ensure the perturbation norm reduces roughly by β ( k ) , i.e . d ( x ( k+1 ) − x0 ) ≈ ( 1− β ( k ) ) d ( z ( k ) − x0 ) . By Taylor approximation , we have ∇T d ( z ( k ) − x0 ) ( x ( k+1 ) − z ( k ) ) = β ( k ) d ( z ( k ) − x0 ) , ( 9 ) whose solution is a ( k ) = 1− b ( k ) ∇T d ( z ( k ) − x0 ) s ( z ( k ) ) ∇T d ( z ( k ) − x0 ) ∇d ( z ( k ) − x0 ) ( 10 ) It should be noted that Eqs . ( 8 ) and ( 10 ) are just two specific choices for a ( k ) and b ( k ) . It turns out that MARGINATTACK will work with a convergence guarantee for a wide range of bounded a ( k ) s and b ( k ) s that satisfy some conditions , as will be shown in section 3.4 . Therefore , MARGINATTACK provides a general and flexible framework for zero-confidence adversarial attack designs . In practice , we find that Eq . ( 8 ) works better for ` 2 norm , and Eq . ( 8 ) works better for ` ∞ norm . 1See Thm . 2 in the appendix for a detailed proof .

Summary: The authors propose a new method for constructing adversarial examples called MarginAttack. The method is inspired by Rosen's algorithm, a classical algorithm in constrained optimization. At its core, Rosen's algorithm (instantiated for adversarial examples) alternates between moving towards the set of misclassified points and moving towards the original data point (while ensuring that we do not move too far away from the set of misclassified points). The authors provide theoretical guarantees (local convergence) and a broad set of experiments. The experiments show that MarginAttack finds adversarial examples with small distortion (as good as the baselines or slightly better), and that the algorithm runs faster than the Carlini-Wagner (CW) baseline (but slower than other methods).