Nesterov Accelerated Gradient and Scale Invariance for Adversarial Attacks

1 INTRODUCTION . Deep learning models have been shown to be vulnerable to adversarial examples ( Goodfellow et al. , 2014 ; Szegedy et al. , 2014 ) , which are generated by applying human-imperceptible perturbations on benign input to result in the misclassification . In addition , adversarial examples have an intriguing property of transferability , where adversarial examples crafted by the current model can also fool other unknown models . As adversarial examples can help identify the robustness of models ( Arnab et al. , 2018 ) , as well as improve the robustness of models by adversarial training ( Goodfellow et al. , 2014 ) , learning how to generate adversarial examples with high transferability is important and has gained increasing attentions in the literature ( Liu et al. , 2016 ; Dong et al. , 2018 ; Xie et al. , 2019 ; Dong et al. , 2019 ; Wang et al. , 2019 ) . Several gradient-based attacks have been proposed to generate adversarial examples , such as onestep attacks ( Goodfellow et al. , 2014 ) and iterative attacks ( Kurakin et al. , 2016 ; Dong et al. , 2018 ) . Under the white-box setting , with the knowledge of the current model , existing attacks can achieve high success rates . However , they often exhibit low success rates under the black-box setting , especially for models with defense mechanism , such as adversarial training ( Madry et al. , 2018 ; Song ∗Corresponding author . et al. , 2019 ) and input modification ( Liao et al. , 2018 ; Xie et al. , 2018 ) . Under the black-box setting , most existing attacks fail to generate robust adversarial examples against defense models . In this work , by regarding the adversarial example generation process as an optimization process , we propose two new methods to improve the transferability of adversarial examples : Nesterov Iterative Fast Gradient Sign Method ( NI-FGSM ) and Scale-Invariant attack Method ( SIM ) . • Inspired by the fact that Nesterov accelerated gradient ( Nesterov , 1983 ) is superior to momentum for conventionally optimization ( Sutskever et al. , 2013 ) , we adapt Nesterov accelerated gradient into the iterative gradient-based attack , so as to effectively look ahead and improve the transferability of adversarial examples . We expect that NI-FGSM could replace the momentum iterative gradient-based method ( Dong et al. , 2018 ) in the gradient accumulating portion and yield higher performance . • Besides , we discover that deep learning models have the scale-invariant property , and propose a Scale-Invariant attack Method ( SIM ) to improve the transferability of adversarial examples by optimizing the adversarial perturbations over the scale copies of the input images . SIM can avoid “ overfitting ” on the white-box model being attacked and generate more transferable adversarial examples against other black-box models . • We found that combining our NI-FGSM and SIM with existing gradient-based attack methods ( e.g. , diverse input method ( Xie et al. , 2019 ) ) can further boost the attack success rates of adversarial examples . Extensive experiments on the ImageNet dataset ( Russakovsky et al. , 2015 ) show that our methods attack both normally trained models and adversarially trained models with higher attack success rates than existing baseline attacks . Our best attack method , SI-NI-TI-DIM ( Scale-Invariant Nesterov Iterative FGSM integrated with translation-invariant diverse input method ) , reaches an average success rate of 93.5 % against adversarially trained models under the black-box setting . For further demonstration , we evaluate our methods by attacking the latest robust defense methods ( Liao et al. , 2018 ; Xie et al. , 2018 ; Liu et al. , 2019 ; Jia et al. , 2019 ; Cohen et al. , 2019 ) . The results show that our attack methods can generate adversarial examples with higher transferability than state-of-theart gradient-based attacks . 2 PRELIMINARY . 2.1 NOTATION . Let x and ytrue be a benign image and the corresponding true label , respectively . Let J ( x , ytrue ) be the loss function of the classifier ( e.g . the cross-entropy loss ) . Let xadv be the adversarial example of the benign image x . The goal of the non-targeted adversaries is to search an adversarial example xadv to maximize the loss J ( xadv , ytrue ) in the ` p norm bounded perturbations . To align with previous works , we focus on p = ∞ in this work to measure the distortion between xadv and x . That is ∥∥xadv − x∥∥∞ ≤ , where is the magnitude of adversarial perturbations . 2.2 ATTACK METHODS . Several attack methods have been proposed to generate adversarial examples . Here we provide a brief introduction . Fast Gradient Sign Method ( FGSM ) . FGSM ( Goodfellow et al. , 2014 ) generates an adversarial example xadv by maximizing the loss function J ( xadv , ytrue ) with one-step update as : xadv = x+ · sign ( ∇xJ ( x , ytrue ) ) , ( 1 ) where sign ( · ) function restricts the perturbation in the L∞ norm bound . Iterative Fast Gradient Sign Method ( I-FGSM ) . Kurakin et al . ( 2016 ) extend FGSM to an iterative version by applying FGSM with a small step size α : x0 = x , x adv t+1 = Clip x { xadvt + α · sign ( ∇xJ ( xadvt , ytrue ) ) } , ( 2 ) where Clip x ( · ) function restricts generated adversarial examples to be within the -ball of x . Projected Gradient Descent ( PGD ) . PGD attack ( Madry et al. , 2018 ) is a strong iterative variant of FGSM . It consists of a random start within the allowed norm ball and then follows by running several iterations of I-FGSM to generate adversarial examples . Momentum Iterative Fast Gradient Sign Method ( MI-FGSM ) . Dong et al . ( 2018 ) integrate momentum into the iterative attack and lead to a higher transferability for adversarial examples . Their update procedure is formalized as follows : gt+1 = µ · gt + ∇xJ ( xadvt , ytrue ) ∥∥∇xJ ( xadvt , ytrue ) ∥∥1 , xadvt+1 = Clip x { xadvt + α · sign ( gt+1 ) } , ( 3 ) where gt is the accumulated gradient at iteration t , and µ is the decay factor of gt . Diverse Input Method ( DIM ) . Xie et al . ( 2019 ) optimize the adversarial perturbations over the diverse transformation of the input image at each iteration . The transformations include the random resizing and the random padding . DIM can be naturally integrated into other gradient-based attacks to further improve the transferability of adversarial examples . Translation-Invariant Method ( TIM ) . Instead of optimizing the adversarial perturbations on a single image , Dong et al . ( 2019 ) use a set of translated images to optimize the adversarial perturbations . They further develop an efficient algorithm to calculate the gradients by convolving the gradient at untranslated images with a kernel matrix . TIM can also be naturally integrated with other gradientbased attack methods . The combination of TIM and DIM , namely TI-DIM , is the current strongest black-box attack method . Carlini & Wagner attack ( C & W ) . C & W attack ( Carlini & Wagner , 2017 ) is an optimization-based method which directly optimizes the distance between the benign examples and the adversarial examples by solving : argmin xadv ∥∥xadv − x∥∥ p − c · J ( xadv , ytrue ) . ( 4 ) It is a powerful method to find adversarial examples while minimizing perturbations for white-box attacks , but it lacks the transferability for black-box attacks . 2.3 DEFENSE METHODS . Various defense methods have been proposed to against adversarial examples , which can fall into the following two categories . Adversarial Training . One popular and promising defense method is adversarial training ( Goodfellow et al. , 2014 ; Szegedy et al. , 2014 ; Zhai et al. , 2019 ; Song et al. , 2020 ) , which augments the training data by the adversarial examples in the training process . Madry et al . ( 2018 ) develop a successful adversarial training method , which leverages the projected gradient descent ( PGD ) attack to generate adversarial examples . However , this method is difficult to scale to large-scale datasets ( Kurakin et al. , 2017 ) . Tramr et al . ( 2018 ) propose ensemble adversarial training by augmenting the training data with perturbations transferred from various models , so as to further improve the robustness against the black-box attacks . Currently , adversarial training is still one of the best techniques to defend against adversarial attacks . Input Modification . The second category of defense methods aims to mitigate the effects of adversarial perturbations by modifying the input data . Guo et al . ( 2018 ) discover that there exists a range of image transformations , which have the potential to remove adversarial perturbations while preserving the visual information of the images . Xie et al . ( 2018 ) mitigate the adversarial effects through random transformations . Liao et al . ( 2018 ) propose high-level representation guided denoiser to purify the adversarial examples . Liu et al . ( 2019 ) propose a JPEG-based defensive compression framework to rectify adversarial examples without impacting classification accuracy on benign data . Jia et al . ( 2019 ) leverage an end-to-end image compression model to defend adversarial examples . Although these defense methods perform well in practice , they can not tell whether the model is truly robust to adversarial perturbations . Cohen et al . ( 2019 ) use randomized smoothing to obtain an ImageNet classifier with certified adversarial robustness . 3 METHODOLOGY . 3.1 MOTIVATION . Similar with the process of training neural networks , the process of generating adversarial examples can also be viewed as an optimization problem . In the optimizing phase , the white-box model being attacked to optimize the adversarial examples can be viewed as the training data on the training process . And the adversarial examples can be viewed as the training parameters of the model . Then in the testing phase , the black-box models to evaluate the adversarial examples can be viewed as the testing data of the model . From the perspective of the optimization , the transferability of the adversarial examples is similar with the generalization ability of the trained models ( Dong et al. , 2018 ) . Thus , we can migrate the methods used to improve the generalization of models to the generation of adversarial examples , so as to improving the transferability of adversarial examples . Many methods have been proposed to improve the generalization ability of the deep learning models , which can be split to two aspects : ( 1 ) better optimization algorithm , such as Adam optimizer ( Kingma & Ba , 2014 ) ; ( 2 ) data augmentation ( Simonyan & Zisserman , 2014 ) . Correspondingly , the methods to improve the transferability of adversarial examples can also be split to two aspects : ( 1 ) better optimization algorithm , such as MI-FGSM , which applies the idea of momentum ; ( 2 ) model augmentation ( i.e. , ensemble attack on multiple models ) , such as the work of Dong et al . ( 2018 ) , which considers to attack multiple models simultaneously . Based on above analysis , we aim to improve the transferability of adversarial examples by applying the idea of Nesterov accelerated gradient for optimization and using a set of scaled images to achieve model augmentation .

Summary: This paper studies how to generate transferable adversarial examples for black-box attacks. Two methods have been proposed,  namely Nesterov Iterative Fast Gradient Sign Method (NI-FGSM) and Scale-Invariant attack Method (SIM). The first method adopts Nesterov optimizer instead of momentum optimizer to generate adversarial examples. And the second is a model-augmentation method to avoid "overfitting" of the adversarial examples. Experiments on ImageNet can prove the effectiveness of the proposed methods.