Transferable Adversarial Attack based on Integrated Gradients

1 INTRODUCTION . Adversarial example , which can mislead deep networks is one of the major obstacles for applying deep learning on security-sensitive applications ( Szegedy et al. , 2014 ) . Researchers found that some adversarial examples co-exist in models with different architectures and parameters ( Papernot et al. , 2016b ; 2017 ) . By exploiting this property , an adversary can derive adversarial examples through a surrogate model and attack other models ( Liu et al. , 2017 ) . Seeking these co-existing adversarial examples would benefit many aspects , including evaluating network robustness , developing defense schemes , and understanding deep learning ( Goodfellow et al. , 2015 ) . Adversarial examples are commonly studied under two threat models , white-box and black-box attacks ( Kurakin et al. , 2018 ) . In the white-box setting , adversaries have full knowledge of victim models , including model structures , weights of the parameters , and loss functions used to train the models . Accordingly , they can directly obtain the gradients of the victim models and seek adversarial examples ( Goodfellow et al. , 2015 ; Madry et al. , 2018 ; Carlini & Wagner , 2017 ) . Whitebox attacks are important for evaluating and developing robust models ( Goodfellow et al. , 2015 ) . In the black-box setting , adversaries have no knowledge of victim models . Two types of approaches , query-based approach and transfer-based approach , are commonly studied for black-box attacks . The query-based approach estimates the gradients of victim models through the outputs of query images ( Guo et al. , 2019 ; Ilyas et al. , 2018 ; 2019 ; Tu et al. , 2019 ) . Due to the huge number of queries , it can be easily defended . The transfer-based approach , using surrogate models to estimate the gradients , is a more practical way in black-box attacks . Some researchers have joined these two approaches together to reduce the number of queries ( Cheng et al. , 2019 ; Guo et al. , 2019 ; Huang & Zhang , 2020 ) . This paper focuses on the transfer-based approach because of its practicality and its use in the combined methods . There are three approaches , standard objective optimization , attention modification , and smoothing to craft adversarial examples . In general , combining methods based on different approaches together yields stronger black-box attacks . Along this line , we propose a new and simple algorithm named Transferable Attack based on Integrated Gradients ( TAIG ) to generate highly transferable adversarial examples in this paper . The fundamental difference from the previous methods is that TAIG uses one single term to carry out all the three approaches simultaneously . Two versions of TAIG , TAIG-S and TAIG-R are studied . TAIG-S uses the original integrated gradients ( Sundararajan et al. , 2017 ) computed on a straight-line path , while TAIG-R calculates the integrated gradients on a random piecewise linear path . TAIG can also be applied with other methods together to further increase its transferability . The rest of the paper is organized as follows . Section 2 summarizes the related works . Section 3 describes TAIG and discusses it from the three perspectives . Section 4 reports the experimental results and comparisons . Section 5 gives some conclusive remarks . 2 RELATED WORKS . Optimization approach mainly uses the gradients of a surrogate model to optimize a standard objective function , such as maximizing a training loss or minimizing the score or logit output of a benign image . Examples are Projected Gradient Descent ( PGD ) ( Madry et al. , 2018 ) , Fast Gradient Sign Method ( FGSM ) ( Goodfellow et al. , 2015 ) , Basic Iterative Method ( BIM ) ( Kurakin et al. , 2016 ) , Momentum Iterative FGSM ( MIFGSM ) ( Dong et al. , 2018 ) and Carlini-Wagner ’ s ( C & W ) ( Carlini & Wagner , 2017 ) attacks . They are commonly referred to as gradient-based attacks . These methods were originally designed for white-box attacks , but are commonly used as a back-end component in other methods for black-box attacks . Attention modification approach assumes that different deep networks classify the same image based on similar features . Therefore , adversarial examples generated by modifying the features in benign images are expected to be more transferable . Examples are Jacobian based Saliency Map Attack ( JSMA ) ( Papernot et al. , 2016a ) , Attack on Attention ( AoA ) ( Chen et al. , 2020 ) and Attentionguided Transfer Attack ( ATA ) ( Wu et al. , 2020b ) , which use attention maps to identify potential common features for attacks . JSMA uses the Jacobian matrix to compute its attention map , but its objective function is unclear . AoA utilizes SGLRP ( Iwana et al. , 2019 ) to compute the attention map , while ATA uses the gradients of an objective function with respect to neuron outputs to derive an attention map . Both AoA and ATA seek adversarial example that maximizes the difference between its attention map and the attention map of the corresponding benign sample . In addition to the attention terms , AoA and ATA also include the typical attack losses , e.g. , logit output in their objective functions , and use a hyperparameter to balance the two terms . Adversarial Perturbations ( TAP ) ( Zhou et al. , 2018 ) , Activation attack ( AA ) ( Inkawhich et al. , 2019 ) and Intermediate Level Attack ( ILA ) ( Huang et al. , 2019 ) , which all directly maximize the distance between feature maps of benign images and adversarial examples , also belong to this category . TAP and AA generate adversarial examples by employing multi-layer and single-layer feature maps respectively . ILA fine-tunes existing adversarial examples by increasing the perturbation on a specific hidden layer for higher black-box transferability . Smoothing approach aims at avoiding over-fitting the decision surface of surrogate model . The methods based on the smoothing approach can be divided into two branches . One branch uses smoothed gradients derived from multiple points of the decision surface . Examples are Diverse Inputs Iterative method ( DI ) ( Xie et al. , 2019 ) , Scale Invariance Attack ( SI ) ( Lin et al. , 2020 ) , Translation-invariant Attack ( TI ) ( Dong et al. , 2019 ) , Smoothed Gradient Attack ( SG ) ( Wu & Zhu , 2020 ) , Admix Attack ( Admix ) ( Wang et al. , 2021 ) and Variance Tuning ( VT ) ( Wang & He , 2021 ) . Most of these methods smooth the gradients by calculating the average gradients of augmented images . The other branch modifies the gradient calculations in order to estimate the gradients of a smoother surface . Examples are Skip Gradient Method ( SGM ) ( Wu et al. , 2020a ) and Linear backpropagation Attack ( LinBP ) ( Guo et al. , 2020 ) . SGM is specifically designed for models with skip connections , such as ResNet . It forces backpropagating using skip connections more than the routes with non-linear functions . LinBP takes a similar approach , which computes forward loss as normal and skips some non-linear activations in backpropagating . By diminishing non-linear paths in a surrogate model , gradients are computed from a smoother surface . 3 PRELIMINARIES AND TAIG . 3.1 NOTATIONS AND INTEGRATED GRADIENTS . For the sake of clear presentation , a set of notations is given first . Let F : RN → RK be a classification network that maps input x to a vector whose k-th element represents the value of the k-th output node in the logit layer , and fk : RN → R be the network mapping x to the output value of the k-th class , i.e. , F ( x ) = [ f1 ( x ) · · · fk ( x ) · · · fK ( x ) ] T , where T is a transpose operator . To simplify the notations , the subscript k is omitted i.e. , f = fk , when k represents arbitrary class in K or the class label is clear . x and x̃ represent a benign image and an adversarial example respectively , and xi and x̃i represent their i-th pixels . The class label of x is denoted as y . The bold symbols e.g. , x , are used to indicate images , matrices and vectors , and non-bold symbols e.g. , xi , are used to indicate scalars . Integrated gradients ( Sundararajan et al. , 2017 ) is a method attributing the prediction of a deep network to its input features . The attributes computed by it indicate the importance of each pixel to the network output and can be regarded as attention and saliency values . Integrated gradients is developed based on two axioms — Sensitivity and Implementation Invariance , and satisfies another two axioms — Linearity and Completeness . To discuss the proposed TAIG , the completeness axiom is needed . Thus , we briefly introduce integrated gradients and the completeness axiom below . Integrated gradients is a line integral of the gradients from a reference image r to an input image x . An integrated gradient of the i-th pixel of the input x is defined as IGi ( f , x , r ) = ( xi − ri ) × ∫ 1 η=0 ∂f ( r + η × ( x− r ) ) ∂xi dη , ( 1 ) where ri is the i-th pixel of r. In this work , a black image is selected as the reference r. The completeness axiom states that the difference between f ( x ) and f ( r ) is equal to the sum of IGi ( f , x , r ) , i.e. , f ( x ) − f ( r ) = N∑ i=1 IGi ( f , x , r ) . ( 2 ) To simplify the notations , both IGi ( x ) and IGi ( f , x ) are used to represent IGi ( f , x , r ) , and IG ( x ) and IG ( f , x ) are used to represent [ IG1 ( f , x , r ) · · · IGN ( f , x , r ) ] T , when f and r are clear . The details of the other axioms and the properties of integrated gradients can be found in Sundararajan et al . ( 2017 ) . 3.2 THE TWO VERSIONS — TAIG-S AND TAIG-R. We propose two versions of TAIG for untargeted attack . The first one based on the original integrated gradients performs the integration on a straight-line path . This version is named Transferable Attack based on Integrated Gradients on Straight-line Path ( TAIG-S ) and its attack equation is defined as x̃ = x− α× sign ( IG ( fy , x ) ) , ( 3 ) where the integrated gradients are computed from the label of x , i.e. , y , and α > 0 controls the step size . The second version is named Transferable Attack based on Integrated Gradients on Random Piecewise Linear Path ( TAIG-R ) . Let P be a random piecewise linear path and x0 , · · · , xE be its E + 1 turning points , including the starting point x0 and the endpoint xE . The line segment from xe to xe+1 is defined as xe + η × ( xe+1 − xe ) , where 0 ≤ η ≤ 1 . When computing integrated gradients of the line segment , xe is used as a reference and the corresponding integrated gradients can be computed by equation 1 . The integrated gradients of the entire path are defined , RIGi ( f , xE , x0 ) = E−1∑ e=0 IGi ( f , xe+1 , xe ) . ( 4 ) The integrated gradients computed from the random piecewise linear path is called random path integrated gradients ( RIG ) . Note that RIG still fulfills the completeness axiom : N∑ i=1 E−1∑ e=0 IGi ( f , xe+1 , xe ) = E−1∑ e=0 ( f ( xe+1 ) − f ( xe ) ) = f ( xE ) − f ( x0 ) . ( 5 ) It should be highlighted that the integrated gradients computed from other paths also fulfill the completeness axiom ( Sundararajan et al. , 2017 ) . In this paper , the turning points , xe in the random path are generated by xe = x0 + e E ( xE − x0 ) + v , ( 6 ) where e ∈ ( 0 , 1 , · · · , E ) and v is a random vector following a uniform distribution with support from ( −τ , τ ) . The attack equation of TAIG-R is x̃ = x− α× sign ( RIG ( fy , x ) ) , ( 7 ) which is the same as TAIG-S , except that IG ( fy , x ) in TAIG-S is replaced by RIG ( fy , x ) . As with PGD and BIM , TAIG can be applied iteratively . The sign function is used in TAIG because the distance between x̃ and x is measured by l∞ norm in this study .

Summary: Two methods are proposed in this paper. They are Transferable Attack using Integrated Gradients on Straight-line Path (TAIG-S) and Transferable Attack using Integrated Gradients on Random Piecewise Linear Path (TAIG-R). Compared with typical gradient-based attack methods, the TAIG-S uses integrated gradients to update adversarial examples, and TAIG-R uses random path integrated gradients to update adversarial examples. Experiments on ImageNet can prove the effectiveness of these methods.