Transferable Adversarial Attack based on Integrated Gradients

1 INTRODUCTION . Adversarial example , which can mislead deep networks is one of the major obstacles for applying deep learning on security-sensitive applications ( Szegedy et al. , 2014 ) . Researchers found that some adversarial examples co-exist in models with different architectures and parameters ( Papernot et al. , 2016b ; 2017 ) . By exploiting this property , an adversary can derive adversarial examples through a surrogate model and attack other models ( Liu et al. , 2017 ) . Seeking these co-existing adversarial examples would benefit many aspects , including evaluating network robustness , developing defense schemes , and understanding deep learning ( Goodfellow et al. , 2015 ) . Adversarial examples are commonly studied under two threat models , white-box and black-box attacks ( Kurakin et al. , 2018 ) . In the white-box setting , adversaries have full knowledge of victim models , including model structures , weights of the parameters , and loss functions used to train the models . Accordingly , they can directly obtain the gradients of the victim models and seek adversarial examples ( Goodfellow et al. , 2015 ; Madry et al. , 2018 ; Carlini & Wagner , 2017 ) . Whitebox attacks are important for evaluating and developing robust models ( Goodfellow et al. , 2015 ) . In the black-box setting , adversaries have no knowledge of victim models . Two types of approaches , query-based approach and transfer-based approach , are commonly studied for black-box attacks . The query-based approach estimates the gradients of victim models through the outputs of query images ( Guo et al. , 2019 ; Ilyas et al. , 2018 ; 2019 ; Tu et al. , 2019 ) . Due to the huge number of queries , it can be easily defended . The transfer-based approach , using surrogate models to estimate the gradients , is a more practical way in black-box attacks . Some researchers have joined these two approaches together to reduce the number of queries ( Cheng et al. , 2019 ; Guo et al. , 2019 ; Huang & Zhang , 2020 ) . This paper focuses on the transfer-based approach because of its practicality and its use in the combined methods . There are three approaches , standard objective optimization , attention modification , and smoothing to craft adversarial examples . In general , combining methods based on different approaches together yields stronger black-box attacks . Along this line , we propose a new and simple algorithm named Transferable Attack based on Integrated Gradients ( TAIG ) to generate highly transferable adversarial examples in this paper . The fundamental difference from the previous methods is that TAIG uses one single term to carry out all the three approaches simultaneously . Two versions of TAIG , TAIG-S and TAIG-R are studied . TAIG-S uses the original integrated gradients ( Sundararajan et al. , 2017 ) computed on a straight-line path , while TAIG-R calculates the integrated gradients on a random piecewise linear path . TAIG can also be applied with other methods together to further increase its transferability . The rest of the paper is organized as follows . Section 2 summarizes the related works . Section 3 describes TAIG and discusses it from the three perspectives . Section 4 reports the experimental results and comparisons . Section 5 gives some conclusive remarks . 2 RELATED WORKS . Optimization approach mainly uses the gradients of a surrogate model to optimize a standard objective function , such as maximizing a training loss or minimizing the score or logit output of a benign image . Examples are Projected Gradient Descent ( PGD ) ( Madry et al. , 2018 ) , Fast Gradient Sign Method ( FGSM ) ( Goodfellow et al. , 2015 ) , Basic Iterative Method ( BIM ) ( Kurakin et al. , 2016 ) , Momentum Iterative FGSM ( MIFGSM ) ( Dong et al. , 2018 ) and Carlini-Wagner ’ s ( C & W ) ( Carlini & Wagner , 2017 ) attacks . They are commonly referred to as gradient-based attacks . These methods were originally designed for white-box attacks , but are commonly used as a back-end component in other methods for black-box attacks . Attention modification approach assumes that different deep networks classify the same image based on similar features . Therefore , adversarial examples generated by modifying the features in benign images are expected to be more transferable . Examples are Jacobian based Saliency Map Attack ( JSMA ) ( Papernot et al. , 2016a ) , Attack on Attention ( AoA ) ( Chen et al. , 2020 ) and Attentionguided Transfer Attack ( ATA ) ( Wu et al. , 2020b ) , which use attention maps to identify potential common features for attacks . JSMA uses the Jacobian matrix to compute its attention map , but its objective function is unclear . AoA utilizes SGLRP ( Iwana et al. , 2019 ) to compute the attention map , while ATA uses the gradients of an objective function with respect to neuron outputs to derive an attention map . Both AoA and ATA seek adversarial example that maximizes the difference between its attention map and the attention map of the corresponding benign sample . In addition to the attention terms , AoA and ATA also include the typical attack losses , e.g. , logit output in their objective functions , and use a hyperparameter to balance the two terms . Adversarial Perturbations ( TAP ) ( Zhou et al. , 2018 ) , Activation attack ( AA ) ( Inkawhich et al. , 2019 ) and Intermediate Level Attack ( ILA ) ( Huang et al. , 2019 ) , which all directly maximize the distance between feature maps of benign images and adversarial examples , also belong to this category . TAP and AA generate adversarial examples by employing multi-layer and single-layer feature maps respectively . ILA fine-tunes existing adversarial examples by increasing the perturbation on a specific hidden layer for higher black-box transferability . Smoothing approach aims at avoiding over-fitting the decision surface of surrogate model . The methods based on the smoothing approach can be divided into two branches . One branch uses smoothed gradients derived from multiple points of the decision surface . Examples are Diverse Inputs Iterative method ( DI ) ( Xie et al. , 2019 ) , Scale Invariance Attack ( SI ) ( Lin et al. , 2020 ) , Translation-invariant Attack ( TI ) ( Dong et al. , 2019 ) , Smoothed Gradient Attack ( SG ) ( Wu & Zhu , 2020 ) , Admix Attack ( Admix ) ( Wang et al. , 2021 ) and Variance Tuning ( VT ) ( Wang & He , 2021 ) . Most of these methods smooth the gradients by calculating the average gradients of augmented images . The other branch modifies the gradient calculations in order to estimate the gradients of a smoother surface . Examples are Skip Gradient Method ( SGM ) ( Wu et al. , 2020a ) and Linear backpropagation Attack ( LinBP ) ( Guo et al. , 2020 ) . SGM is specifically designed for models with skip connections , such as ResNet . It forces backpropagating using skip connections more than the routes with non-linear functions . LinBP takes a similar approach , which computes forward loss as normal and skips some non-linear activations in backpropagating . By diminishing non-linear paths in a surrogate model , gradients are computed from a smoother surface . 3 PRELIMINARIES AND TAIG . 3.1 NOTATIONS AND INTEGRATED GRADIENTS . For the sake of clear presentation , a set of notations is given first . Let F : RN → RK be a classification network that maps input x to a vector whose k-th element represents the value of the k-th output node in the logit layer , and fk : RN → R be the network mapping x to the output value of the k-th class , i.e. , F ( x ) = [ f1 ( x ) · · · fk ( x ) · · · fK ( x ) ] T , where T is a transpose operator . To simplify the notations , the subscript k is omitted i.e. , f = fk , when k represents arbitrary class in K or the class label is clear . x and x̃ represent a benign image and an adversarial example respectively , and xi and x̃i represent their i-th pixels . The class label of x is denoted as y . The bold symbols e.g. , x , are used to indicate images , matrices and vectors , and non-bold symbols e.g. , xi , are used to indicate scalars . Integrated gradients ( Sundararajan et al. , 2017 ) is a method attributing the prediction of a deep network to its input features . The attributes computed by it indicate the importance of each pixel to the network output and can be regarded as attention and saliency values . Integrated gradients is developed based on two axioms — Sensitivity and Implementation Invariance , and satisfies another two axioms — Linearity and Completeness . To discuss the proposed TAIG , the completeness axiom is needed . Thus , we briefly introduce integrated gradients and the completeness axiom below . Integrated gradients is a line integral of the gradients from a reference image r to an input image x . An integrated gradient of the i-th pixel of the input x is defined as IGi ( f , x , r ) = ( xi − ri ) × ∫ 1 η=0 ∂f ( r + η × ( x− r ) ) ∂xi dη , ( 1 ) where ri is the i-th pixel of r. In this work , a black image is selected as the reference r. The completeness axiom states that the difference between f ( x ) and f ( r ) is equal to the sum of IGi ( f , x , r ) , i.e. , f ( x ) − f ( r ) = N∑ i=1 IGi ( f , x , r ) . ( 2 ) To simplify the notations , both IGi ( x ) and IGi ( f , x ) are used to represent IGi ( f , x , r ) , and IG ( x ) and IG ( f , x ) are used to represent [ IG1 ( f , x , r ) · · · IGN ( f , x , r ) ] T , when f and r are clear . The details of the other axioms and the properties of integrated gradients can be found in Sundararajan et al . ( 2017 ) . 3.2 THE TWO VERSIONS — TAIG-S AND TAIG-R. We propose two versions of TAIG for untargeted attack . The first one based on the original integrated gradients performs the integration on a straight-line path . This version is named Transferable Attack based on Integrated Gradients on Straight-line Path ( TAIG-S ) and its attack equation is defined as x̃ = x− α× sign ( IG ( fy , x ) ) , ( 3 ) where the integrated gradients are computed from the label of x , i.e. , y , and α > 0 controls the step size . The second version is named Transferable Attack based on Integrated Gradients on Random Piecewise Linear Path ( TAIG-R ) . Let P be a random piecewise linear path and x0 , · · · , xE be its E + 1 turning points , including the starting point x0 and the endpoint xE . The line segment from xe to xe+1 is defined as xe + η × ( xe+1 − xe ) , where 0 ≤ η ≤ 1 . When computing integrated gradients of the line segment , xe is used as a reference and the corresponding integrated gradients can be computed by equation 1 . The integrated gradients of the entire path are defined , RIGi ( f , xE , x0 ) = E−1∑ e=0 IGi ( f , xe+1 , xe ) . ( 4 ) The integrated gradients computed from the random piecewise linear path is called random path integrated gradients ( RIG ) . Note that RIG still fulfills the completeness axiom : N∑ i=1 E−1∑ e=0 IGi ( f , xe+1 , xe ) = E−1∑ e=0 ( f ( xe+1 ) − f ( xe ) ) = f ( xE ) − f ( x0 ) . ( 5 ) It should be highlighted that the integrated gradients computed from other paths also fulfill the completeness axiom ( Sundararajan et al. , 2017 ) . In this paper , the turning points , xe in the random path are generated by xe = x0 + e E ( xE − x0 ) + v , ( 6 ) where e ∈ ( 0 , 1 , · · · , E ) and v is a random vector following a uniform distribution with support from ( −τ , τ ) . The attack equation of TAIG-R is x̃ = x− α× sign ( RIG ( fy , x ) ) , ( 7 ) which is the same as TAIG-S , except that IG ( fy , x ) in TAIG-S is replaced by RIG ( fy , x ) . As with PGD and BIM , TAIG can be applied iteratively . The sign function is used in TAIG because the distance between x̃ and x is measured by l∞ norm in this study .

Summary: In practice, adversarial examples are generated in three ways, i) solving a standard optimisation problem, ii) leveraging the salient regions of an image, or iii) smoothing the decision surfaces. The authors propose a simple technique named Transferable Attack based on Integrated Gradients (TAIG) that combines all these three approaches. Unlike the existing systems, which leverages other methods by adding additional terms to the objective function, TAIG integrates them into a single objective.