Training Meta-Surrogate Model for Transferable Adversarial Attack

1 INTRODUCTION . The developments of Convolutional Neural Network ( CNN ) ( LeCun et al. , 1995 ; Krizhevsky et al. , 2012 ) have greatly promoted the advancements in Computer Vision ( Ren et al. , 2016 ) . However , previous works ( Goodfellow et al. , 2014 ; Carlini & Wagner , 2017 ; Croce & Hein , 2020a ; Ganeshan et al. , 2019 ) have shown a critical robustness issue that CNN models are vulnerable to humanimperceptible perturbations of input images , also known as adversarial examples ( AEs ) . The design of AEs is useful for revealing the security threats on machine learning systems ( Croce & Hein , 2020b ) and for understanding the representations learned by CNN models ( Ilyas et al. , 2019 ) . In this paper , we consider the problem of black-box attack , where the target victim model is entirely hidden from the attacker . In this setting , standard white-box attacks ( Moosavi-Dezfooli et al. , 2016 ; Carlini & Wagner , 2017 ) or even query-based black-box attacks ( Ilyas et al. , 2018 ; Cheng et al. , 2018 ; 2020 ; 2019 ) can not be used , and the prevailing way to attack the victim is through transfer attack ( Papernot et al. , 2017 ; Wu et al. , 2018 ) . In transfer attack ( Demontis et al. , 2019 ; Dong et al. , 2018 ) , the attackers commonly generate AEs by attacking one or an ensemble of surrogate models and hope the obtained AEs can also successfully fool the victim black-box model . Although great efforts have been made to improve the transferability of adversarial attacks ( Tramèr et al. , 2017 ; Xie et al. , 2019 ; Wu et al. , 2020a ) , the transfer attack-based methods still encounter poor success rates , especially when attacking adversarially trained target models . This is caused by a fundamental limitation of current approaches—they all leverage the surrogate models trained by standard learning tasks ( e.g. , classification , object detection ) , while it is not always the case that attacks fooling such models can be easily transferred . We thus pose the following important question on transfer attack that has not been well studied in the literature : Instead of using standard ( naturally trained ) models as surrogate , can we artificially construct another Meta-Surrogate Model ( MSM ) such that attacks to this model can be easier transferred to other models ? We answer this question in the affirmative by developing a novel black-box attack pipeline called Meta-Transfer Attack ( MTA ) . Assume a set of source models ( standard surrogate models ) are given , instead of directly attacking these source models , our algorithm aims to obtain a “ meta-surrogate model ( MSM ) ” , which is designed in the way that attacks to this model can be easier transferred to fool other models , and conduct attacks on the MSM to obtain transferable AEs . We show that this goal can be mathematically formulated as a well-posed ( bi-level-like ) training objective by unrolling the attacks on the MSM and defining a loss to measure the transferability of the resulting AEs . To avoid discrete operations in the white-box attack , we propose a Customized PGD attacker that enables back-propagation through the whole procedure . With this bi-level-like optimization ( Finn et al. , 2017 ; Qin et al. , 2020 ) , the source models supervise the MSM to improve the transferability of the AEs created on it . Through extensive experiments on various models and datasets , we show that the proposed MTA method leads to significantly improved transfer attacks , demonstrating the effectiveness of the MSM . We summarize the main contributions of our work as follows . 1 ) We propose a novel MTA framework to train an MSM to improve the transferability of AEs . To the best of our knowledge , our work is the first attempt to explore a better surrogate model for producing stronger transferable AEs . 2 ) We compare MTA with state-of-the-art transfer attack methods ( e.g. , MI ( Dong et al. , 2018 ) , DI ( Xie et al. , 2019 ) , TI ( Dong et al. , 2019 ) , SGM ( Wu et al. , 2020a ) , AEG ( Bose et al. , 2020 ) , IR ( Wang et al. , 2021a ) , SI-NI ( Lin et al. , 2020 ) ) on Cifar-10 ( Krizhevsky et al. , 2009 ) and Imagenet ( Deng et al. , 2009 ) . The comparisons demonstrate the effectiveness of the proposed MTA—the AEs generated by attacking MSM significantly outperform previous methods , in attacking both naturally trained and adversarially trained black-box target models . 2 BACKGROUND . Adversarial attacks . Szegedy et al . ( 2014 ) reveals the interesting phenomenon that CNN models are vunerable to adversarial attacks . After that , many attacks have been developed ( Gao et al. , 2020 ; Zhou et al. , 2018 ; Wu et al. , 2020b ; Li et al. , 2020b ; Kaidi et al. , 2019 ; Sriramanan et al. , 2020 ) . Adversarial attacks can be mainly classified into white-box and black-box attacks ( Maksym et al. , 2020 ) according to how much information about the target model is exposed to the attacker . Whitebox attacks ( Kurakin et al. , 2016 ) are often more effective than than black-box attacks ( Brendel et al. , 2017 ; Cheng et al. , 2018 ; 2020 ) as they can leverage full knowledge of the target model including the model weights and architecture . For example , Fast Gradient Sign Method ( FGSM ) ( Goodfellow et al. , 2014 ) uses 1-step gradient ascent to produce adversarial examples that enlarge the model ’ s loss . Projected gradient descent ( PGD ) attack can be viewed as a multi-step FGSM attack ( Madry et al. , 2018 ) . Many other white-box attacks have also been developed by leveraging full information of the target model ( Moosavi-Dezfooli et al. , 2016 ; Croce & Hein , 2020a ) . In the black-box setting , query-based black-box attacks ( Huang & Zhang , 2020 ; Du et al. , 2020 ) assume model information is hidden but attackers can query the model and observe the corresponding hard-label or soft-label predictions . Among them , ( Chen et al. , 2017 ; Ilyas et al. , 2018 ) considered soft-label probability predictions and ( Chen et al. , 2020 ; Huang & Zhang , 2020 ; Cheng et al. , 2018 ) considered hard-label decision-based predictions . Considering that using a large number of queries to attack an image is impractical , several works try to further reduce the query counts ( Li et al. , 2020a ; Wang et al. , 2020 ) . Transferability of adversarial examples . In this paper , we consider the black-box attack scenario when the attacker can not make any query to the target model ( Lin et al. , 2020 ; Huang et al. , 2019 ; Wang et al. , 2021b ) . In this case , the common attack method is based on transfer attack—the attacker generates AEs by attacking one or few surrogate models and hopes the AEs can also fool the target model ( Papernot et al. , 2016 ; Liu et al. , 2017 ; Yuan et al. , 2021 ; Zhou et al. , 2018 ) . Compared with query-based attacks , crafting AEs from the surrogate model consumes less computational resources and is more realistic in practice . Along this direction , subsequent works have made attempts to improve the transferability of AEs ( Guo et al. , 2020 ; Wu et al. , 2020c ; Naseer et al. , 2019 ; Li et al. , 2020c ; Wang & He , 2021 ) . For instance , Dong et al . ( 2018 ) boosted the transferability by integrating the momentum term into the iterative process . Other techniques like data augmentations ( Xie et al. , 2019 ) , exploiting gradients of skip-connection ( Wu et al. , 2020a ) , and negative interaction between pixels ( Wang et al. , 2021a ) also contribute to stronger transferable attacks . In addition to using the original surrogate models , AEG ( Bose et al. , 2020 ) adversarially trains a robust classifier together with an encoder-decoder-based transferable perturbation generator . After the training , AEG uses the generator to generate transferable AEs to attack a set of classifiers . Compared to all the existing works , our method is the first that meta-trains a new meta-surrogate model ( MSM ) such that attacks on MSM can be easier transferred to other models . This not only differs from all the previous methods that attack standard surrogate models but also differs from the encoder-decoder based method such as AEG ( Bose et al. , 2020 ) . 3 METHODOLOGY . We consider the black-box attack setting where the target model is hidden to the attacker and queries are not allowed . This setting is also known as the transfer attack setting ( Dong et al. , 2018 ; 2019 ; Xie et al. , 2019 ; Wang et al. , 2021a ) and the attacker 1 ) can not access the weight , the architecture , and the gradient of the target model ; and 2 ) can not querying the target model . The attacker can access 1 ) the dataset used by the target model ; and 2 ) a single or a set of surrogate models ( also known as source models ) that may share the dataset with the target model . For example , it is common to assume that the attacker can access one or multiple well-performed ( pretrained ) image classification models . Existing transferable adversarial attack methods conduct various attacks to these models and hope to get transferable AEs that can fool an unknown target model . Instead of proposing another attack method on surrogate models , we propose a novel framework MTA to train a Meta-Surrogate Model ( MSM ) with the goal that attacking the MSM can generate stronger transferable AEs than directly attacking the original surrogate models . When evaluating , the transferable AEs are generated by attacking the MSM with standard white-box attack methods ( e.g. , PGD attack ) . In the following , we will first review exiting attacks and then show how to form a bi-level optimization objective to train the MSM model . 3.1 REVIEWS OF FGSM AND PGD . We follow the settings of existing works ( Dong et al. , 2018 ; Xie et al. , 2019 ; Wu et al. , 2020a ; Wang et al. , 2021a ) to focus on untargeted attack , where the attack is considered successful as long as the perturbed image is wrongly predicted . FGSM ( Goodfellow et al. , 2014 ) conducts one-step gradient ascent to generate AEs to enlarge the prediction loss . The formulation can be written as xadv = Clip ( x+ · sign ( ∇xL ( f ( x ) , y ) ) ) , ( 1 ) where x is a clean image and y is the corresponding label ; is the attack step size that determines the maximum L∞ perturbation of each pixel ; f is the victim model that is transparent to the FGSM attacker ; Clip is the function that clipping the values of xadv to the legal range ( e.g. , clipping the RGB AEs to the range of [ 0 , 255 ] ) ; L is usually the cross-entropy loss . PGD ( Kurakin et al. , 2016 ) , also known as I-FGSM attack , is a multi-step extension of FGSM . The formulation of PGD is xkadv=Clip ( xk−1adv + T · sign ( ∇xk−1adv L ( f ( x k−1 adv ) , y ) ) ) . ( 2 ) xkadv is the AEs generated in the k-th gradient ascent step . Note that x 0 adv is the clean image equals to x. Eq 2 will be run for T iterations to obtain xTadv with perturbation size .

Summary: A complete black box adversarial attack thus far has not performed well as research shows. By complete black box, it means there is no information available about the target model, not even query based probing. Most SOTA uses a surrogate model to generate adversarial examples, where the surrogate model may, every likely, not in any way resemble the target model in practice. This paper claims that by adopting a meta training scheme, more effective black box attacks are achievable when compared to the SOTA.