A Frank-Wolfe Framework for Efficient and Effective Adversarial Attacks

√ T ) convergence rate . The empirical results of attacking Inception V3 model and ResNet V2 model on the ImageNet dataset also verify the efficiency and effectiveness of the proposed algorithms . More specific , our proposed algorithms attain the highest attack success rate in both white-box and black-box attacks among all baselines , and are more time and query efficient than the stateof-the-art . 1 INTRODUCTION . Deep Neural Networks ( DNNs ) have made many breakthroughs in different areas of artificial intelligence such as image classification ( Krizhevsky et al. , 2012 ; He et al. , 2016a ) , object detection ( Ren et al. , 2015 ; Girshick , 2015 ) , and speech recognition ( Mohamed et al. , 2012 ; Bahdanau et al. , 2016 ) . However , recent studies show that deep neural networks can be vulnerable to adversarial examples ( Szegedy et al. , 2013 ; Goodfellow et al. , 2015 ) – a tiny perturbation on an image that is almost invisible to human eyes could mislead a well-trained image classifier towards misclassification . Soon later this is proved to be not a coincidence : similar phenomena have been observed in other problems such as speech recognition ( Carlini et al. , 2016 ) , visual QA ( Xu et al. , 2017 ) , image captioning ( Chen et al. , 2017a ) , machine translation ( Cheng et al. , 2018 ) , reinforcement learning ( Pattanaik et al. , 2018 ) , and even on systems that operate in the physical world ( Kurakin et al. , 2016 ) . Depending on how much information an adversary can access to , adversarial attacks can be classified into two classes : white-box attack ( Szegedy et al. , 2013 ; Goodfellow et al. , 2015 ) and black-box attack ( Papernot et al. , 2016a ; Chen et al. , 2017c ) . In the white-box setting , the adversary has full access to the target model , while in the black-box setting , the adversary can only access the input and output of the target model but not its internal configurations . Among the approaches proposed for white-box and black-box attacks , optimization-based methods ( Carlini & Wagner , 2017 ; Chen et al. , 2017b ; c ; Ilyas et al. , 2018 ) are most effective : they usually achieve relatively low distortions and high attack success rates . However , these methods are far from efficient . In the white-box setting , they need to solve constrained optimization problems ( Carlini & Wagner , 2017 ) , and are usually significantly slower than Fast Gradient Sign Method ( FGSM ) ( Goodfellow et al. , 2015 ) or Iterative FGSM ( I-FGM ) ( Kurakin et al. , 2016 ) . Applying those methods with one or two examples are fine , yet in the case of attacking hundreds of thousands examples , e.g . in adversarial training ( Kurakin et al. , 2016 ; Madry et al. , 2018 ) , this is far from satisfactory . In the black-box setting , it becomes even more severe since they need to make gradient estimations ( Chen et al. , 2017c ) . Therefore , a large number of queries are needed for them to perform a successful attack , especially when the data dimension is large . For example , attacking a 299×299×3 Imagenet image may take them hundreds of thousands of queries . This significantly limits their prac- tical usefulness since they can be easily defeated by limiting the number of queries that an adversary can make to the target model . In this study , we aim to examine the following questions in this study : Can we improve the efficiency of the optimization-based attack algorithms ? In other words , can we use less time and queries to conduct adversarial attacks ? In this work , we provide an affirmative answer to this question by proposing an efficient FrankWolfe optimization framework for both white-box and black-box attacks . In summary , we make the following main contributions : • We propose a novel Frank-Wolfe based adversarial attack framework . The white-box attack algorithm is an iterative first-order method which admits the fast gradient sign method ( FGSM ) as the one-step special case . And the corresponding black-box attack algorithm adopts zeroth-order optimization with two sensing vector options ( either from the Euclidean unit sphere or from the standard Gaussian distribution ) provided . • We show that the proposed white-box and black-box attack algorithms enjoy an O ( 1/ √ T ) convergence rate . Also we show that the query complexity of the proposed black-box attack algorithm is linear in data dimension d. • Our empirical results on attacking Inception V3 model with the ImageNet dataset show that ( i ) the proposed white-box attack algorithm is more efficient than all the baseline whitebox algorithms evaluated here , and ( ii ) the proposed black-box attack algorithm is highly efficient and is also the only one algorithm that achieves a 100 % attack success rate . 2 RELATED WORK . There is a large body of work on adversarial attacks . In this section , we review the most relevant work in both white-box and black-box attack settings , as well as the non-convex Frank-Wolfe optimization . White-box Attacks : Szegedy et al . ( 2013 ) proposed to use box-constrained L-BFGS algorithm for conducting white-box attacks . Goodfellow et al . ( 2015 ) proposed the Fast Gradient Sign Method ( FGSM ) based on linearization of the network as a simple alternative to L-BFGS . Kurakin et al . ( 2016 ) proposed to iteratively perform one-step FGSM ( Goodfellow et al. , 2015 ) algorithm and clips the adversarial point back to the distortion limit after every iteration . It is called Basic Iterative Method ( BIM ) or I-FGM in the literature . Madry et al . ( 2018 ) showed that for the L∞ norm case , BIM/I-FGM is equivalent to Projected Gradient Descent ( PGD ) , which is a standard tool for constrained optimization . Papernot et al . ( 2016b ) proposed JSMA to greedily attack the most significant pixel based on the Jacobian-based saliency map . Moosavi-Dezfooli et al . ( 2016 ) proposed attack methods by projecting the data to the closest separating hyperplane . Carlini & Wagner ( 2017 ) introduced the so-called CW attack by proposing multiple new loss functions for generating adversarial examples . Chen et al . ( 2017b ) followed CW ’ s framework and use an Elastic Net term as the distortion penalty . Black-box Attacks : One popular family of black-box attacks ( Hu & Tan , 2017 ; Papernot et al. , 2016a ; 2017 ) is based on the transferability of adversarial examples ( Liu et al. , 2018 ; Bhagoji et al. , 2017 ) , where an adversarial example generated for one DNN may be reused to attack other neural networks . This allows the adversary to construct a substitute model that mimics the targeted DNN , and then attack the constructed substitute model using white-box attack methods . However , this type of attack algorithms usually suffer from large distortions and relatively low success rates ( Chen et al. , 2017c ) . To address this issue , Chen et al . ( 2017c ) proposed the Zeroth-Order Optimization ( ZOO ) algorithm that extends the CW attack to the black-box setting and uses a zeroth-order optimization approach to conduct the attack . Although ZOO achieves much higher attack success rates than the substitute model-based black-box attacks , it suffers from a poor query complexity since its naive implementation requires to estimate the gradients of all the coordinates ( pixels ) of the image . To improve its query complexity , several approaches have been proposed . For example , Tu et al . ( 2018 ) introduces an adaptive random gradient estimation algorithm and a well-trained Autoencoder to speed up the attack process . Ilyas et al . ( 2018 ) and Liu et al . ( 2018 ) improved ZOO ’ s query complexity by using Natural Evolutionary Strategies ( NES ) ( Wierstra et al. , 2014 ; Salimans et al. , 2017 ) and active learning , respectively . Non-convex Frank-Wolfe Algorithms : The Frank-Wolfe algorithm ( Frank & Wolfe , 1956 ) , also known as the conditional gradient method , is an iterative optimization method for constrained optimization problem . Jaggi ( 2013 ) revisited Frank-Wolfe algorithm in 2013 and provided a stronger and more general convergence analysis in the convex setting . Yu et al . ( 2017 ) proved the first convergence rate for Frank-Wolfe type algorithm in the non-convex setting . Lacoste-Julien ( 2016 ) provided the convergence guarantee for Frank-Wolfe algorithm in the non-convex setting with adaptive step sizes . Reddi et al . ( 2016 ) further studied the convergence rate of non-convex stochastic Frank-Wolfe algorithm in the finite-sun optimization setting . Very recently , Staib & Jegelka ( 2017 ) proposed to use Frank-Wolfe for distributionally robust training ( Sinha et al. , 2018 ) . Balasubramanian & Ghadimi ( 2018 ) proved the convergence rate for zeroth-order nonconvex Frank-Wolfe algorithm using one-side finite difference gradient estimator with standard Gaussian sensing vectors . 3 METHODOLOGY . 3.1 NOTATIONS . Throughout the paper , scalars are denoted by lower case letters , vectors by lower case bold face letters and sets by calligraphy upper cae letters . For a vector x ∈ Rd , we denote the Lp norm of x by ‖x‖p = ( ∑d i=1 x p i ) 1/p . Specially , for p = ∞ , the L∞ norm of x by ‖x‖∞ = maxdi=1 |θi| . We denote PX ( x ) as the projection operation of projecting vector x into the set X . 3.2 PROBLEM FORMULATION . According to the attack purposes , attacks can be divided into two categories : untargeted attack and targeted attack . In particular , untargeted attack aims to turn the prediction into any incorrect label , while the targeted attack , which is considerably harder , requires to mislead the classifier to a specific target class . In this work , we follow the literature ( Carlini & Wagner , 2017 ; Ilyas et al. , 2018 ) and focus on the strictly harder targeted attack setting . It is worth noting that our proposed algorithm can be extended to untargeted attack straightforwardly . Let us define f ( · ) as the classification loss function of the targeted DNN . For targeted attacks , we aim to learn an adversarial example x that is close enough to the original input xori and can be misclassified to the target class ytar . The corresponding optimization problem 1 is defined as : minx f ( x , ytar ) subject to ‖x− xori‖p ≤ . ( 3.1 ) Evidently , the constraint set X : = { x | ‖x − xori‖p ≤ } is a bounded convex set when p ≥ 1 . Normally , p = 2 and p =∞ are used to measure the distortions ‖x− xori‖p , resulting in L2 attack model and L∞ attack model respectively . In this work , we study both attack models . In the sequel , since we mainly focus on the targeted attack case , we use f ( x ) to denote f ( x , ytar ) for simplicity . 3.3 FRANK-WOLFE WHITE-BOX ATTACKS . Frank-Wolfe algorithm ( Frank & Wolfe , 1956 ) , also known as the conditional gradient descent , is a popular optimization tool for constrained optimization . Different from PGD that first performs gradient descent followed by a projection step at each iteration , Frank-Wolfe algorithm calls a Linear Minimization Oracle ( LMO ) over the the constraint set X at each iteration , i.e. , LMO ∈ argmin v∈X 〈v , ∇f ( xt ) 〉 . The LMO can be seen as the minimization of the first-order Taylor expansion of f ( · ) at point xt : min v∈X f ( xt ) + 〈v − xt , ∇f ( xt ) 〉 . By calling LMO , Frank Wolfe solves the linear problem in X and then perform weighted average with previous iterate to obtain the final update formula . We present our proposed Frank-Wolfe white-box attack algorithm in Algorithm 1 , which is built upon the original Frank-Wolfe algorithm . The key difference between Algorithm 1 and the standard Frank-Wolfe algorithm is in Line 4 , where the LMO is called over a slightly relaxed constraint set 1Note that there is usually an additional constraint on the input variable x , e.g. , x ∈ [ 0 , 1 ] n for normalized image inputs . Xλ : = { x | ‖x−xori‖p ≤ λ } with λ ≥ 1 , instead of the original constraint set X . When λ = 1 , set Xλ reduces to X , and Algorithm 1 reduces to standard Frank Wolfe . We argue that this modification makes our algorithm more general , and gives rise to better attack results . Algorithm 1 Frank-Wolfe White-box Attack Algorithm 1 : input : number of iterations T , step sizes { γt } , λ > 0 , original image xori ; 2 : x0 = xori 3 : for t = 0 , . . . , T − 1 do 4 : vt = argminv∈Xλ〈v , ∇f ( xt ) 〉 // LMO 5 : dt = vt − xt 6 : xt+1 = xt + γtdt 7 : if λ > 1 then 8 : xt+1 = PX ( xt+1 ) 9 : end if 10 : end for 11 : output : xT The LMO solution itself can be expensive to obtain in general . Fortunately , applying Frank-Wolfe to solve ( 3.1 ) actually gives us a closed-form LMO solution . We provide the solutions of LMO ( Line 4 in Algorithm 1 ) for L2 norm and L∞ norm cases respectively : vt = − λ · ∇f ( xt ) ‖∇f ( xt ) ‖2 + xori , ( L2 norm ) vt = −λ · sign ( ∇f ( xt ) ) + xori . ( L∞ norm ) The derivation can be found in the supplemental materials . Note that when T = 1 , λ = 1 , substituting the above LMO solutions into Algorithm 1 yields the final update of x1 = x0 − γt · ∇f ( xt ) , which reduces to FGSM 2 when γt = 1 . Similar derivation also applies to L2 norm case . Therefore , just like PGD , our proposed Frank-Wolfe white-box attack also includes FGSM ( FGM ) as a one-step special instance .

Summary: The paper investigates the Frank-Wolfe (FW) algorithm for constructing adversarial examples both in a white-box and black-box setting. The authors provide both a theoretical analysis (convergence to a stationary point) and experiments for an InceptionV3 network on ImageNet. The main claim is that the proposed algorithm can construct adversarial examples faster than various baselines (PGD, I-FGSM, CW, etc.), and from fewer queries in a black-box setting.