One for Many: an Instagram inspired black-box adversarial attack

1 INTRODUCTION . It is well known that deep learning models are susceptible to adversarial attacks and many recent researches in the field have been devoted to produce ever more reliable and effective attacks . Attack reliability is strictly connected to its applicability in real-world scenarios and to its ability to bypass potential defense mechanisms ; this is why the hard-label black-box setting ( also called decisionbased attack ) and the transferability property of white box attacks gained increasing attention . Several techniques have been proposed to increase the transferability of both black-box and white-box attacks ( Cheng et al . ( 2020 ) ; Wu et al . ( 2020 ) ; Brendel et al . ( 2018 ) , among the most popular ) . One of the most commonly adopted technique is to craft the attacks by using an ensemble of multiple models as proposed by Liu et al . ( 2017 ) . Besides the categorization in white-box and black-box methods , attacks can be classified as restricted or unrestricted , considering the amount of modifications they apply to the images in order to fool the systems . Restricted attacks : they generally use a Lp-norm distance to bound the modifications . The attacks are crafted with the aim of minimizing the differences between the original image and the adversarial one , even if it means having visible ( more or less ) artifacts . In Figures 1b and 1d , the attacks produced by Dong et al . ( 2019 ) and Wu et al . ( 2020 ) , two of the most recent state-of-the-art adversarial methods , are shown . In both the cases the generated artifacts are clearly visible . Unrestricted attacks : they employ large and visible perturbations while keeping the images realistic , natural looking and non-suspicious . The idea is to obtain images that can admit great differences from the original one but , beyond a direct comparison with the original one they can not be distinguished from any other real ( maybe filtered ) image . In Figures 1f and 1h , the attacks produced by ACE-Ins ( Zhao et al. , 2020 ) and Colorfool ( Shahin Shamsabadi et al. , 2020 ) are shown . The differences between the original image and the adversarial one are evident but , if the modifications are good enough , looking just at the adversarial one we might not be able to say that it is the attacking image . Another aspect that has to be taken into account for real-world attacks is the amount of queries to the victim model that are necessary to craft effective attacks . All the systems proposed in literature need a huge amount of queries and , also in the case of systems built to work with limited access to the victim model , several thousands of queries are needed to produce reliable attacks . In this paper we propose a system to craft reliable , effective and highly transferable attacks by composing image filters . In previous papers ( for ex . Destylization ) has been shown that Instagram inspired filters can have adversarial , but limited effects , when applied singularly . Hence , we decided to study the effects of filter composition with the aim to increase the adversarial effectiveness . Moreover , in the usual photo editing process people use more than one filter in order to obtain the desired effect . We just wanted to simulate a more realistic scenario . This kind of attack offers multiple benefits : ( i ) it is naturally robust to detecting methods able to find noise , injected patterns and irregularities in the high frequencies image ( Moosavi-Dezfooli et al. , 2018 ; Liao et al. , 2018 ) . ( ii ) it is naturally robust to masking-gradients ( and their numerical estimate ) defending methods . ( iii ) it produces natural looking artifacts-free images . ( iv ) it produces adversarial attacks that can not be distinguished from any other filtered images produced extensively every day , especially on social media platforms . The system works in the pure hard-label black box setting and implements a multi-network approach to increase the attack transferability . It can reach , with artifact-free images , a transferability rate higher than 70 % in the case of unsecured networks and , even more interestingly , higher than 60 % in the case of adversarially trained network . Moreover , the system requires a very low number of queries to find an attack , around 640 in the average case , and it can be limited by construction adjusting the algorithm parameters . In the experiments presented here the maximum number of allowed queries is 1610 . Our contribution can be summarized as follows : ( i ) We propose the AGV-multinetwork attack , a system able to craft powerful adversarial attacks capable of attacking even secured adversarially trained models by composing Instagram inspired image filters ; ( ii ) we empirically demonstrate the high transferability of these attacks and we compare our results with other state-of-the-art systems ; ( iii ) we empirically demonstrate the efficiency of our system in terms of queries to the victim model and we compare our results with other state-of-the-art systems . 2 BACKGROUND . 2.1 ADVERSARIAL MACHINE LEARNING . Given an input image x ∈ X ⊂ Rd and its corresponding label y , let F be a neural network classifier that ( correctly ) predicts the class label for the input image x : F ( x ) = y . An adversarial attack attempts to modify the input image x by adding a perturbation δ into an adversarial image x∗ = x+ δ such that the classifier is mislead into making a wrong prediction , i.e . F ( x∗ ) ̸= F ( x ) . If we consider the type of the applied perturbation δ , the attacks can be classified as restricted or unrestricted . In the restricted case , the modifications applied to the original image are usually small and bounded by a Lp-norm distance measure , forcing the adversarial image x∗ to be as close as possible to the original one . On the contrary , unrestricted attacks use large perturbations without Lp-bounded constraints that manipulate the image in order to create photo-realistic adversarial examples . In this case the objective is not to limit the modifications on pixels but limit the human perception that a modification has been applied ( Shahin Shamsabadi et al. , 2020 ; Zhao et al . ; Wang et al. , 2021 ) . 2.2 IMAGE FILTERS . We implemented ten of the most popular Instagram filters using Python3 and the Pillow , OpenCV and Numpy libraries : Clarendon , Juno , Reyes , Gingham , Lark , Hudson , Slumber , Stinson , Rise , and Perpetua . Each filter has distinct characteristics and effects given by different level of contrast , saturation , brightness , shadows , etc . For instance , Clarendon brightens and highlights a photo , Juno adds saturation and warmth making the colors more intense , Rise gives a warm glow by mixing a radial gradient with a light sepia tone , while Hudson bumps up the blues giving a more colder feel . Examples of single filter applications are shown in Figure 6 in Appendix A. . Each filter is parameterized by two parameters that have to be optimized by the algorithm : intensity α and strength s. The role of the parameter α is to alter the intensity of each basic component inside each filter implementation such as brightness , contrast , saturation , edge enhancement , gamma correction and many more . The parameter s is used to control the strength of the filter application and it is defined as the convex interpolation between the original image x and the transformed image x∗ : strength ( x , x∗ , s ) = ( 1.0− s ) · x+ s · x∗ ( 1 ) thus , if s = 0 the output image of the filter is the original image , while with s = 1 the filter returns the modified image x∗ . 3 APPROACH AND ALGORITHM . 3.1 PROBLEM DEFINITION . Given a set S = { f1 , f2 , . . . , fm } of Instagram inspired image filters as described in Section 2.2 , and a clean image x , we want to find a sequence of n parametrized filters { fk1 ( α1 , s1 ) , . . . , fkn ( αn , sn ) } able to produce an adversarial attack against a classifier model F starting from the image x , that is { F ( x ) ̸= F ( x∗ ) x∗ = fkn ( αn , sn ) ( . . . fk2 ( α2 , s2 ) ( fk1 ( α1 , s1 ) ( x ) ) ) ( 2 ) 3.2 APPROACH . The algorithm used to optimize the sequence of filters and their parameters is inspired by Baia et al . ( 2021 ) . In our proposal the universal approach proposed by Baia et al . has been transformed into a multi-network per-image approach , where the attack is crafted and optimized for just one image with respect to more target models . Since the algorithm uses an evolutionary approach , the fitness function used to guide the search can have any ( also non differentiable ) form , and we decide to use it to implement a sort of generalization ability induced by attacking more models simultaneously . This is inspired by Liu et al . ( 2017 ) where the authors suggested that attacking an ensemble of multiple networks simultaneously can generate much stronger adversarial examples . Instead of attacking an ensemble network we decided to exploit the optimization ability of the evolutionary approach and try to simultaneously attack all the ( or at least k ) reference networks . Therefore , our goal is to find one adversarial perturbation per-image that can fool many deep learning models . This objective is much harder to achieve than attacking a single model but it guarantees complete ( 100 % ) transferability of the attack towards the reference networks . The proposed multi-network approach has the objective to obtain adversarial images with better transferability avoiding the natural overfitting trap we can fall into when the attacks are crafted by using a unique reference model . 3.3 ALGORITHM . The optimization method consists of two evolutionary nested algorithms : the outer algorithm , using a GA approach , in charge of finding the sequence of filters to use , and the inner algorithm , based on ES , used to choose the filter parameter values . The general structure of the multi-network algorithm is shown in Algorithm 1 . Given a set S = { f1 , f2 , fm } of image filters , the outer algorithm genotype ( with length n ) is encoded as a list of n integers k1 , . . . , kn ∈ { 1 , . . . , m } representing the corresponding filters in S , while the inner algorithm genotype is represented by a list containing the pairs of parameters used for each selected filter ( ( α1 , s1 ) , . . . , ( αn , sn ) ) . The associated phenotype is sequence of parametrized filters able to generate the adversarial examples by applying the selected sequence of filters , with their corresponding optimized parameters , as described in Eq.2 . 3.3.1 OUTER ALGORITHM . The outer optimization step is performed by a genetic algorithm : a population of N candidate perturbations is iteratively evolved towards better solutions . In order to breed a new generation , population members are randomly selected and the crossover and mutation operations are performed . The quality of the candidates is evaluated based on their fitness values and , at the end of each iteration , the N best individuals are chosen for the next generation . Initial population : it is generated by randomly selecting l filters from the set S of available filters and their parameters are initialized with default values equal to 1 . Crossover : a standard one-point crossover is used to generate new off-springs from randomly selected members . Each child is guaranteed to inherit some genetic information from both parents , including the optimized parameters . For example , given two parent elements P1 = ( f ′1 ( α ′ 1 , s ′ 1 ) , . . . , f ′ n ( α ′ n , s ′ n ) ) and P2 = ( f ′′ 1 ( α ′′ 1 , s ′′ 1 ) , . . . , f ′′ n ( α ′′ n , s ′′ n ) ) and crossover index i = 2 , we obtain the child element ( f ′1 ( α ′ 1 , s ′ 1 ) , f ′ 2 ( α ′ 2 , s ′ 2 ) , f ′′ 3 ( α ′′ 3 , s ′′ 3 ) , . . . , f ′′ n ( α ′′ n , s ′′ n ) ) . Mutation : it is applied by substituting a filter with another one based on a mutation probability . The substituent filter is initialized with random parameter values . For example considering the element P = ( f1 ( α1 , s1 ) , f2 ( α2 , s2 ) , f3 ( α3 , s3 ) . . . , fn ( αn , sn ) ) and supposing that filters f1 and f3 has been chosen to mutate with g1 and g2 , the new generated element is P ∗ = ( g1 ( α ∗ 1 , s ∗ 1 ) , f2 ( α2 , s2 ) , g2 ( α ∗ 2 , s ∗ 2 ) . . . , fn ( αn , sn ) ) , where α ∗ i , s ∗ i are randomly extracted from the parameter domains . Selection : at the end of each iteration , we choose the N best individuals from the set of 2N candidates ( parents and offsprings ) according to their fitness values . This process is repeated until the algorithm exhausts the allowed number of generations .

Summary: This paper proposed a nested evolutionary algorithm to generate adversarial perturbations under the black-box settings. Such perturbations are composed of various image filters inspired by Instagram and can simultaneously attack multiple neural networks. They claimed that the attacks were semantically robust and had a low cost of queries.