Boosting Transferability of Targeted Adversarial Examples via Hierarchical Generative Networks
Abstract
Transfer-based adversarial attacks can effectively evaluate model robustness in the black-box setting.
Though several methods have demonstrated impressive transferability of untargeted adversarial examples, targeted adversarial transferability is still challenging.
In this paper, we develop a simple yet practical framework to efﬁciently craft targeted transfer-based adversarial examples.
Speciﬁcally, we propose a conditional generative attacking model, which can generate the adversarial examples targeted at different classes by simply altering the class embedding and share a single backbone.
Extensive experiments demonstrate that our method improves the success rates of targeted black-box attacks by a signiﬁcant margin over the existing methods — it reaches an average success rate of 29.6% against six diverse models based only on one substitute white-box model in the standard testing of NeurIPS 2017 competition, which outperforms the state-of-the-art gradientbased attack methods (with an average success rate of < 2%) by a large margin.
Moreover, the proposed method is also more efﬁcient beyond an order of magnitude than gradient-based methods.
1. Introduction
Recent progress in adversarial machine learning demonstrates that deep neural networks (DNNs) are highly vulnerable to adversarial examples (Szegedy et al., 2014; Goodfellow et al., 2015), which are maliciously generated to mislead a model to produce incorrect predictions.
It has been demonstrated that adversarial examples possess an intriguing property of transferability (Liu et al., 2017; Wu et al., 2020; Huang et al., 2019; Demontis et al., 2019; Yang
Accepted by the ICML
[Figure]
et al., 2020) — the adversarial examples crafted for a whitebox model can also mislead other unknown models, making black-box attacks feasible.
The current methods have achieved impressive performance of untargeted black-box attacks, intending to cause misclassiﬁcation of the blackbox models (Liu et al., 2017; Dong et al., 2018).
However, the targeted black-box attacks , aiming at misleading the black-box models by outputting the adversary-desired target class, perform unsatisfactorily (Dong et al., 2020) and have not been extensively explored (Zhang et al., 2020)
Existing efforts on targeted black-box attacks can be categorized as instance-speciﬁc and instance-agnostic attacks.
Speciﬁcally, the instance-speciﬁc attack methods (Goodfellow et al., 2016; Moosavi-Dezfooli et al., 2016; Kurakin et al., 2017; Dong et al., 2018) craft adversarial examples by performing gradient updates iteratively, which achieve unsatisfactory performance for targeted black-box attacks due to easy overﬁtting to a white-box model (Dong et al., 2018; Xie et al., 2019).
On the other hand, the instance-agnostic attack methods learn a universal adversarial perturbation (Zhang et al., 2020) or a universal function (Song et al., 2018;
Naseer et al., 2019) on the data distribution independent of speciﬁc instances.
They can promote more general and transferable adversarial examples since the universal pertur- bation or function can alleviate the data-speciﬁc overﬁtting problem by training on an unlabeled dataset.
Represent
CD-AP (Naseer et al., 2019) adopts a generative model as a universal function to obtain an acceptable performance when facing one speciﬁed target class.
However, CD-AP needs to learn a generative model for each target class while performing multi-target attack (Han et al., 2019).
Thus it is not scalable to the increasing number of targets such as hundreds of classes, limiting practical efﬁciency.
To address the aforementioned issues and develop an effective targeted black-box attack, in this paper we propose a conditional generative model as the universal adversarial function to craft adversarial perturbations.
Thus we can craft adversarial perturbations targeted at different classes, using a single model backbone with different class embeddings.
The proposed generative method is simple yet practical to obtain superior performance of targeted black-box attacks, meanwhile with two technical improvements including smooth projection mechanism that better helps the generator to probe targeted semantic knowledge from the classiﬁer and adaptive Gaussian Smoothing with the focus of making generated results obtain adaptive ability against adversarially trained models.
Thus ours only trains one model and reaches an average success rate of 51.1% against six naturally trained models and 36.4% against three adversarially trained models based only on one substitute whitebox model in NeurIPS ImageNet dataset, which outperforms
CD-AP by a large margin of 6.0% and 31.3%, respectively.
While handling plenty of classes ( e.g. , 1,000 classes in ImageNet), the effectiveness of generating targeted adversarial examples will be affected by a single generative model due to the difﬁculty of loss convergence in adversarial learning (Xu et al., 2019; Berthelot et al., 2017).
Thus we train a feasible number of models ( e.g. , 10 ∼ 20 models on ImageNet) to further promote the effectiveness beyond the single model backbone.
Speciﬁcally, each model is learned from a subset of classes speciﬁed by a designed hierarchical partition mechanism by considering the diversity property among subsets, for seeking a balance between effectiveness and scalability.
It reaches an average success rate of 29.6% against six different models, outperforming the state-of-theart methods with an average success rate of < 2% by a large margin, based only on one substitute white-box model in the
NeurIPS 2017 competition.
Moreover, the proposed method achieves substantial speedup over gradient-based methods.
Furthermore, these adversarial perturbations generated by the proposed Conditional Generative models can arise as a result of strong Semantic Pattern (C-GSP) as shown in
Fig.
We experimentally ﬁnd that the generated adversarial semantic pattern itself achieves well-generalizing performance among the different models and is robust to the inﬂuence of data, which is very instructive for the understanding of adversarial examples.
2. Method
In this section, we introduce a conditional generative model to learn a universal adversarial function, which can achieve effective multi-target black-box attacks.
While handing plenty of classes, we design a hierarchical partition mechanism to make the generative model capable of specifying any target class under a feasible number of models, regarding both the effectiveness and scalability.
2.1. Problem Formulation
We use x s to denote an input image belonging to an unlabeled training set X s ⊂ R d , and use c ∈ C to denote a speciﬁc target class.
Let F φ : X s → R K denote a classiﬁcation network that outputs a class probability vector with K classes.
To craft a targeted adversarial example x ∗ s from a real example x s , the targeted attack aims to fool the classiﬁer F φ by outputting a speciﬁc label c as arg max i ∈C F φ ( x ∗ s )
i =
c , meanwhile the (cid:96) ∞ norm of the adversarial perturbation is required to no more than value (cid:15) as (cid:107) x ∗ s − x s (cid:107) ∞ ≤ (cid:15) .
Although some generative methods (Poursaeed et al., 2018;
Naseer et al., 2019) can learn targeted adversarial perturbation, it does not take into account the effectiveness of multi-target generation, thus leading to inconvenience.
To make the generative model learn how to specify multiple targets, we propose a conditional generative network G θ that effectively crafts multi-target adversarial perturbations by modeling class-conditional distribution, as illustrated in
Fig.
The conditional generative model G θ : ( X s , C ) → P learns a perturbation δ
=
G θ ( x s , c ) ∈ P ⊂ R d on the training data.
The output δ of G θ is projected within the ﬁxed (cid:96) ∞ norm, thus generating the perturbed image x ∗ s =
x s + δ .
Given a pretrained network F φ , we propose to generate the targeted adversarial perturbations by solving
[Equation]
By solving problem (1), we can obtain a targeted conditional generator by minimizing the loss of speciﬁc target class in the unlabeled training dataset.
Note that we only optimize the parameter θ of the generator G θ using the training data
X s , then the targeted adversarial example x ∗ t can be crafted by x ∗ t = x t + G θ ( x t , c ) for any given image x t in the test data X t , which only requires an inference for this targeted image x t .
We experimentally ﬁnd that the objective (1) can enforce the transferability for the generated perturbation δ .
A reasonable explanation is that δ can arise as a result of strong and well-generalizing semantic pattern inherent to the target class, which is robust to the inﬂuence of any training data.
[Figure]
𝜃𝜃
[Figure]
ℱ 𝜙𝜙 f 𝑐𝑐
2.2. Network Architecture
We now present the details of the conditional generative model for targeted attack, as illustrated in Fig.
Specifically, we design a mapping network to generate a targetspeciﬁc vector in the implicit space of each target and train conditional generator G θ to reﬂect this vector by constantly misleading the classiﬁer F φ .
Mapping network.
Given an one-hot class encodingc ∈ R K from target class c , the mapping network aims to generate the targeted latent vector w = W ( 1 c ) , where w ∈ R M and W ( · ) consists of a multi-layer perceptron (MLP) and a normalization layer, which can construct diverse targeted vectors w for a given target class c .
Thus W is capable of learning effective targeted latent vectors by randomly sampling different classes c ∈ C in training phase.
Generator.
Given an input image x s , the encoder ﬁrst calculates the feature map F ∈ R N × H × W , where N , H and W refer to the number of channels, height and width of the feature map, respectively.
The target latent vector w , derived from the mapping network W by introducing a speciﬁc target class c , is expanded along height and width directions to obtain the label feature map w s ∈ R M × H × W .
Then the above two feature maps are concatenated along the channels to obtain F (cid:48)
∈ R ( N + M ) × H × W .
The obtained mixed feature map is then fed to the subsequent network.
Thus our generator G θ translates an input image x s and latent target vector w into an output image G θ ( x s , w ) , which enables G θ to synthesize adversarial images of a series of targets.
For the output of feature map f ∈ R d in the decoder, we adopt a smooth projection P ( · ) to perform a change of variables over f rather than directly minimizing its (cid:96) 2 norm as (Han et al., 2019) or clipping values outside the ﬁxed norm (Naseer et al., 2019), which can be denoted as
[Equation]
where (cid:15) is the strength of perturbation.
Since − 1 ≤ tanh( f ) ≤ 1 , δ can automatically satisfy the (cid:96) ∞ -ball bound with perturbation budget (cid:15) .
This transformation can be regarded as a better smoothing of gradient than directly clipping values outside the ﬁxed norm, which is also instrumental for G θ to probe and learn the targeted semantic knowledge from F φ .
Training objectives.
The training objectives seek to minimize the classiﬁcation error on the perturbed image of the generator as
[Equation]
which adopts an end-to-end training paradigm with the goal of generating adversarial images to mislead the classiﬁer the target label, and CE is the cross entropy loss.
2.3. Hierarchical Partition for Classes
While handling plenty of classes, the effectiveness of a conditional generative model will decrease because the representative capacity is limited with a single generator.
Therefore, we propose to divide all classes into a feasible number of subsets to train models when the class number K is large, e.g. , 1,000 classes in ImageNet.
To obtain a good partition, we introduce a representative target class space, which is nearly equivalent to the original class space C .
Speciﬁcally, we utilize the weights φ cls ∈ R D
× C in the classiﬁer layer for the classiﬁcation network F φ .
Therefore, φ cls can be regarded as the alternative class space since the weight vector d c ∈ R D from φ cls can represent a class center of the feature embeddings of input images with same class c .
To capture more diverse examples in a given sampling space, we adopt K-determinantal point processes (DPP) (Kulesza & Taskar, 2012; 2011) to achieve a hierarchical partition, which can take advantage of the diversity property among subsets by assigning subset probabilities proportional to determinants of a kernel matrix.
First, we compute the
RBF kernel matrix L of φ cls and eigendecomposition of
L , and a random subset V of the eigenvectors is chosen by regarding the eigenvalues as sampling probability.
Second, we select a new class c i to add to the set and update V in a manner that de-emphaseizes items similar to the one selected.
Each successive point is selected and V is updated by Gram-Schmidt orthogonalization, and the distribution shifts to avoid points near those already chosen.
[Table]
3. Experiments
We consider the following datasets for training, including a widely used object detection dataset MS-COCO (Lin et al., 2014) and ImageNet training set (Deng et al., 2009).
We consider some public naturally trained networks, i.e. , Inceptionv
(Inc-v3) (Szegedy et al., 2016), Inception-v4 (Inc-v4) (Szegedy et al., 2017), Resnet-v2-152 (Res-152)
(He et al., 2016) and Inception-Resnet-v2 (IncRes-v2) (Szegedy et al., 2017), which are widely used for evaluating transferability.
Besides, we supplement DenseNet-201 (Dense-201) (Huang et al., 2017), GoogleNet (Szegedy et al., 2015) and VGG- (Simonyan & Zisserman, 2014) and adversarially trained networks (Tram ` er et al., 2018), e.g. , ens3-adv-Inceptionv
(Inc-v3 ens3 ), ens4-adv-Inception-v3 (Inc-v3 ens4 ) and ensadv-Inception-ResNet-v2 (IncRes-v2 ens ).
Implementation details.
We choose the same ResNet autoencoder architecture in (Johnson et al., 2016; Naseer et al., 2019) as the basic generator networks, which consists of downsampling, residual and upsampling layers.
Smoothing mechanism is proposed to improve the transferability against adversarially trained models (Dong et al., 2019).
Instead of adopting smoothing for generated perturbation while the training is completed as CD-AP (Naseer et al., 2019), we introduce adaptive Gaussian smoothing kernel to compute δ from Eq.
(2) in the training phase, named adaptive Gaussian smoothing , with the focus of making generated results obtain adaptive ability.
More implementation details are illustrated in Appendix.
3.1. Transferability Evaluation
Efﬁciency and effectivenessof multi-target black-box attack.
Among comparable methods, instance-speciﬁc methods, i [Table] e. , MIM, TI-DIM, DIM and TI-DIM, require iterative mechanism with M steps by computing gradients to obtain adversarial examples.
Instance-agnostic methods only require the inference cost from the trained generator, thus possessing the priority for those attack scenarios within limited time.
However, instance-speciﬁc methods require to trainmodels to obtain all predictions from 8 different classes.
As a comparison, our conditional generative method only trains one model to inference the results and outperforms in the
[Table]
aspect of efﬁciency .
Tab. 1 shows the transferability comparison of different methods on both naturally and adversarially trained models.
The success rate of instance-speciﬁc attacks are lower than 3%.
The instance-agnostic attack CD-AP obtains acceptable performance, yet inferior to proposed method w.r.t black-box transferability.
The primary reason for such a trend lies in some distinctions as 1) direct clip projection in CD-AP and our smooth projection in Eq.
(2) and 2) their Gaussian Smoothing and our adaptive Gaussian
Smoothing.
Thus proposed conditional generative method can be a reliable baseline w.r.t targeted black-box attacks.
Effectiveness on NeurIPS 2017 Competition
We here follow the ofﬁcial setting from NeurIPS 2017 adversarial competition (Kurakin et al., 2018) for testing targeted black-box transferability.
Considering limited resource, we only focus on the instance-speciﬁc attack.
Our hierarchical partition mechanism considers 20 models, with each specifyingdiverse classes from k-DPP hierarchical partition in this setting, to implement targeted attack by only once inference for each target image.
Our method outperforms all other baseline methods in Tab. 2.
The results demonstrate that this method can be reliable in practical targeted attacks, regarding both effectiveness and efﬁciency .
4. Discussion and Conclusion
Transferability of targeted black-box attack is affected by data and model.
Instance-speciﬁc methods obtain weak transferability due to easily overﬁting the data point and white-box model.
Proposed generative method reduces the dependency for data points by learning from the unlabeled training data, thus enabling to learn semantic pattern and signiﬁcantly improve the transferability of targeted attacks.
A. Sampling Algorithm
We summarize the overall sampling procedure based on k-DPP (Kulesza & Taskar, 2011) as follows.
• Compute the RBF kernel matrix L of φ cls and eigendecomposition of L .
A random subset V of the eigenvectors is chosen by regarding the eigenvalues as sampling probability.
• Select a new class
c
i to add to the set and update V in a manner that de-emphaseizes items similar to the one selected.
• Update V by Gram-Schmidt orthogonalization, and the distribution shifts to avoid points near those already chosen.
By performing the Algorithm 1, we can obtain a subset with k size.
Thus while handling the conditional classes with K, we can hierarchically adopt this algorithm to get the ﬁnal
K/k subsets, which are regarded as conditional variables of generative models to craft adversarial examples.
B. Some Implementation Details
The study of smoothing mechanism.
Smoothing mechanism has been proved to improve the transferability against adversarially trained models.
CD-AP (Naseer et al., 2019) uses direct clip projection to have a ﬁxed norm (cid:15) , and adopts smoothing for generated perturbation while the generator G is trained, i.e. ,
[Equation]
where W indicates Gaussian smoothing of kernel size of 3, ∗ indicates the convolution operation, and Clip (cid:15) means clipping values outside the ﬁxed norm (cid:15) .
As a comparison, we introduce adaptive Gaussian smoothing kernel to compute adversarial images x ∗ s i from in the training phase, named adaptive Gaussian smoothing as
[Equation]
which can make generated results obtain adaptive ability in the training phase.
We perform training in ImageNet dataset to report all results including comparable baselines.
Network architecture of generator.
We adopt the same autoencoder architecture in (Naseer et al., 2019) as the basic generator networks.
Besides, we also explore BigGAN (Brock et al., 2018) as conditional generator network.
An very weak testing performance is obtained even in the
Algorithm
Input: Weight Vector θ cls ; Subset size k .
Output: A subset C .
Compute RBF kernel matrix L of θ cls
Compute eigenvector/value { v n , λ n } Nn =1 pairs of L // Phase I:
J ← φ , e k ( λ 1 , . . .
, λ N ) = (cid:80) | J | = k (cid:81) n ∈ J λ n for n = N, ..., 1 do if u ∼ U [0 , 1] <
λ n e n − 1 k − 1 e nk and k > 0 then
J ← J ∪ { n } ; k ← k −end if end for // Phase II:
V ← { v n } n ∈ J , Y ← φ while | V | > 0 do
Select c i from C with P ( c i ) =
| V | (cid:80) v ∈ V (cid:0) v (cid:62) e i (cid:1)
C ← C ∪ { c i }
V ← V ⊥ , an orthonormal basis for the subspace of V orthogonal to e i end while white-box attack scenario, possibly explained by the weak diversity of latent variable with the Gaussian distribution from BigGAN in the training phase, whereas autoencoder can take full advantage of large-scale training dataset, e.g. ,
ImageNet.
Furthermore, we also train the autoencoder with
Gaussian noise as the training dataset and obtain similar inferior performance in the white-box attack scenario, indicating that a large-scale training dataset is very signiﬁcant for generating transferable targeted adversarial examples.
Some details.
In our experiments of testing time, we apply
NVIDIA 1080Ti GPUs.
Instance-speciﬁc methods, i.e. ,
MIM, TI-DIM, DIM and TI-DIM, adopt iterative steps M = 20 and follow their reported hyperparameters.
C. More Analyses
Targeted adversarial samples from proposed generative method can produce semantic pattern inherent to the target class in Fig.
Why does generative semantic pattern work?
First, generative methods can produce strong targeted semantic pattern that is robust to the inﬂuence of data , which is obtained by minimizing the loss of speciﬁc target class in the training phase.
To corroborate our claim, we directly feed scaled crafted perturbations by instance-speciﬁc attack
MIM and our generative method into the classiﬁer.
Indeed, we ﬁnd that our generative perturbation is considered as target class with a high degree of conﬁdence whereas the perturbation from MIM performs like the noise.
Second, the generated adversarial semantic pattern
[Figure]
S ea li on
M aca qu e
L e m on achieves well-generalizing performance among the different models .
We feed 1k images from ImageNet test set into the generator trained by Inc-v3 model to obtain 1k semantic patterns, which are scaled to image pixel space and then fed into different classiﬁers.
We compute the mean conﬁdence of 0 .
46 for Dense-201, 0 .
44 for Inc-v4, and 0 .
35 for Res-152, whereas the perturbation from MIM is lower than 0 .
The results show that our scaled semantic pattern can directly achieve well-generalizing performance among models, possibly explained by utilizing similar feature knowledge from the same class on different classiﬁers trained on same training data distribution.
Thus similar pattern can be instrumental for transferability among models.
Therefore, transferability of targeted black-box attack is simultaneously affected by data and model.
Instance-speciﬁc methods easily overﬁt the data point and white-box model, resulting in weak transferability.
As a comparison, proposed generative method with powerful learning capacity reduces the dependency for data point by adopting the unlabeled training data, thus enabling the model to learn semantic pattern and improve the transferability of targeted black-box attack.
We hope that crafting C-GSP can be regarded as a new reliable baseline method in terms of targeted black-box attacks, which raises new security issues to develop more robust DNNs.