S KIP C ONNECTIONS M ATTER : O N THE T RANSFERABILITY OF A DVERSARIAL E XAMPLES G ENERATED WITH R ES N ETS
A BSTRACT
Skip connections are an essential component of current state-of-the-art deep neural networks (DNNs) such as ResNet, WideResNet, DenseNet, and ResNeXt.
Despite their huge success in building deeper and more powerful DNNs, we identify a surprising security weakness of skip connections in this paper.
Use of skip connections allows easier generation of highly transferable adversarial examples .
Speciﬁcally, in ResNet-like (with skip connections) neural networks, gradients can backpropagate through either skip connections or residual modules.
We ﬁnd that using more gradients from the skip connections rather than the residual modules according to a decay factor, allows one to craft adversarial examples with high transferability.
Our method is termed Skip Gradient Method (SGM).
We conduct comprehensive transfer attacks against state-of-the-art DNNs including
ResNets, DenseNets, Inceptions, Inception-ResNet, Squeeze-and-Excitation Network (SENet) and robustly trained DNNs.
We show that employing SGM on the gradient ﬂow can greatly improve the transferability of crafted attacks in almost all cases.
Furthermore, SGM can be easily combined with existing black-box attack techniques, and obtain high improvements over state-of-the-art transferability methods.
Our ﬁndings not only motivate new research into the architectural vulnerability of DNNs, but also open up further challenges for the design of secure
DNN architectures.
I NTRODUCTION
In deep neural networks (DNNs), a skip connection builds a short-cut from a shallow layer to a deep layer by connecting the input of a convolutional block (also known as the residual module) directly to its output.
While different layers of a neural network learn different “levels” of features, skip connections can help preserve low-level features and avoid performance degradation when adding more layers.
This has been shown to be crucial for building very deep and powerful DNNs such as ResNet (He et al., 2016a;b), WideResNet (Zagoruyko & Komodakis, 2016), DenseNet (Huang et al., 2017) and ResNeXt (Xie et al., 2017).
In the meantime, despite their superior performance, DNNs have been found extremely vulnerable to adversarial examples (or attacks), which are input examples slightly perturbed with an intention to fool the network to make a wrong prediction (Szegedy et al., 2013; Goodfellow et al., 2014; Ma et al., 2018; Bai et al., 2019; Wang et al., 2019; 2020).
Adversarial examples often appear imperceptible to human observers, and are transferable across different models (Liu et al., 2017).
This has raised security concerns on the deployment of DNNs in security critical scenarios, such as face recognition (Sharif et al., 2016), autonomous driving (Evtimov et al., 2018), video analysis (Jiang et al., 2019) and medical diagnosis (Ma et al., 2019).
Adversarial examples can be crafted following either a white-box setting (the adversary has full access to the target model) or a black-box setting (the adversary has no information of the target model).
White-box methods such as Fast Gradient Sign Method (FGSM)
(Goodfellow et al., 2014),
Basic Iterative Method (BIM) (Kurakin et al., 2016), Projected Gradient Decent (PGD) (Madry et al., 2018) and Carlini and Wagner (CW) (Carlini & Wagner, 2017) often suffer from low transferability in a black-box setting, thus posing only limited threats to DNN models which are usually kept secret in practice (Dong et al., 2018;
Xie et al., 2019).
Several techniques have been proposed to improve the transferability of black-box attacks crafted on a surrogate model, such as momentum boosting (Dong et al., 2018), diverse input (Xie et al., 2019) and translation invariance (Dong et al., 2019).
Although these techniques are effective, they (as well as white-box methods) all treat the entire network (either the target model or the surrogate model) as a single component while ignore its inner architectural characteristics.
The question of whether or not the DNN architecture itself can expose more transferability of adversarial attacks is an unexplored problem.
In this paper, we identify one such weakness about the skip connections used by many state-of-theart DNNs.
We ﬁrst conduct a toy experiment with the BIM attack and ResNet-18 on the ImageNet validation dataset (Deng et al., 2009) to investigate how skip connections affect the adversarial strength of attacks crafted on the network.
At each of the last 3 skip connections and residual modules of ResNet-18, we illustrate the success rate of attacks crafted using gradients backpropagate through either the skip connection or the residual module in Figure 1.
As can be observed, the success rate drops more drastically whenever using gradients from a residual module instead of the skip connection.
This implies that gradients from the skip connections are more vulnerable (high success rate).
In addition, we surprisingly ﬁnd that skip connections expose more transferable information.
For example, the black-box success rate was even improved from 52.52% to 62.10% when the attack skips the last two residual modules (following the path in green color).
Motivated by the above observations, in this paper, we propose the Skip Gradient Method (SGM) to generate adversarial examples using gradients more from the skip connections rather than the residual modules.
In particular, SGM utilizes a decay factor to reduce gradients from the residual modules.
We ﬁnd that this simple adjustment on the gradient ﬂow can generate highly transferable adversarial examples, and the more skip connections in a network, the more transferable are the crafted attacks.
This is in sharp contrast to the design principles ( e.g. , “going deeper” with skip connections) underpinning many modern DNNs.
In particular, our main contributions are:
• We identify one surprising property of skip connections in ResNet-like neural networks,
i
e. , they allow an easy generation of highly transferable adversarial examples.
• We propose the Skip Gradient Method (SGM) to craft adversarial examples using gradients more from the skip connections.
Using a single decay factor on gradients, SGM is an appealingly simple and generic technique that can be used by any existing gradient-based attack methods.
• We provide comprehensive transfer attack experiments, from different source models againststate-of-the-art DNNs, showing that SGM can greatly improve the transferability of crafted adversarial examples.
When combined with existing transfer techniques, SGM improves the state-ofthe-art transferability benchmarks by a large margin
R ELATED W ORK
Existing adversarial attacks can be categorized into two groups: 1) white-box attacks and 2) blackbox attacks.
In the white-box setting, the adversary has full access to the parameters of the target model, while in the black-box setting, the target model is kept secret from the adversary.
2. W HITE - BOX A TTACKS
Given a clean example x with class label y and a target DNN model f , the goal of an adversary is to ﬁnd an adversarial example x adv that fools the network into making an incorrect prediction (eg. f
( x adv ) (cid:54) =
y ), while still remaining in the (cid:15) -ball centered at x (eg.
(cid:107) x adv − x (cid:107) ∞ ≤ (cid:15) ).
Fast Gradient Sign Method (FGSM) (Goodfellow et al., 2014).
FGSM perturbs clean example x for one step by the amount of (cid:15) along the gradient direction:
[Equation]
The Basic Iterative Method (BIM) (Kurakin et al., 2016) is an iterative version of FGSM that perturbs for T steps with step size (cid:15)/T .
Projected Gradient Descent (PGD) (Madry et al., 2018).
PGD perturbs normal example x for T steps with smaller step size.
After each step of perturbation, PGD projects the adversarial example back onto the (cid:15) -ball of x , if it goes beyond the (cid:15) -ball:
[Equation]
[Equation] [Equation]
where Π (cid:15) ( · ) is the projection operation.
Different to BIM, PGD allows step size α > (cid:15)/T .
There are also other types of white-box attacks including sparsity-based methods such as Jacobianbased Saliency Map Attack (JSMA)
(Papernot et al., 2016), sparse attack (Modas et al., 2019), onepixel attack (Su et al., 2019), and optimization-based methods such as Carlini and Wagner (CW) (Carlini & Wagner, 2017) and elastic-net (EAD) (Chen et al., 2018).
2. B LACK - BOX A TTACKS
Black-box attacks can be generated by either attacking a surrogate model or using gradient estimation methods in combination with queries to the target model.
Gradient estimation methods estimate the gradients of the target model using black-box optimization methods such as Finite Differences (FD) (Chen et al., 2017;
Bhagoji et al., 2018) or Natural Evolution Strategies (NES) (Ilyas et al., 2018; Jiang et al., 2019).
These methods all require a large number of queries to the target model, which not only reduces efﬁciency but also potentially exposes the attack.
Alternatively, black-box adversarial examples can be crafted on a surrogate model then applied to attack the target model.
Although the white-box methods can be directly applied on the surrogate model, they are far less effective in the black-box setting (Dong et al., 2018;
Xie et al., 2019).
Several transfer techniques have been proposed to improve the transferability of black-box attacks.
Momentum Iterative boosting (MI) (Dong et al., 2018).
MI incorporates a momentum term into the gradient to boost the transferability:
[Equation]
where g t is the adversarial gradient at the t -th step, α = (cid:15)/T is the step size for a total of T steps, µ is a decay factor, and (cid:107) · (cid:107) 1 is the L 1 norm.
Diverse Input (DI) (Xie et al., 2019).
DI proposes to craft adversarial exampels using gradient with respect to the randomly-transformed input example:
[Equation]
where H ( x t adv ; p ) is a stochastic transformation function on x t adv for a given probability p .
Translation Invariant (TI) (Dong et al., 2019).
TI targets to evade robustly trained DNNs by generating adversarial examples that are less sensitive to the discriminative regions of the surrogate model.
More speciﬁcally, TI computes the gradients with respect to a set of translated versions of the original input:
[Equation]
where W is a predeﬁned kernel ( e.g. , uniform, linear, and Gaussian) matrix of size (2 k + 1)(2 k + 1) ( k being the maximal number of pixels to shift).
This kernel convolution is equivalent to the weighted sum of gradients over (2 k + 1) 2 number of shifted input examples.
Furthermore, there are other studies focusing on intermediate feature representations.
For example,
Activation Attack (Inkawhich et al., 2019) drives the activation of a speciﬁed layer on a given image towards the layer of a target image, to yield a highly transferable targeted example.
Intermediate
Level Attack (Huang et al., 2019) attempts to ﬁne-tune an existing adversarial example for greater black-box transferability by increasing its perturbation on a pre-speciﬁed layer of the source model.
Although the above transfer techniques are effective, they (including white-box attacks) either 1) treat the network (either the surrogate model or the target model) as a single component or 2) only use the intermediate layer output of the network.
In other words, they do not directly consider the effects of different DNN architectural characteristics.
Li et al. (2018) investigated the use of skip connections and dropout layers for sampling networks, which generates a huge set of ghost networks to perform an ensemble attack. Here, we focus on the architectural property of skip connections from the gradient view without modifying or generating any extra networks.
P ROPOSED S KIP G RADIENT A TTACK
In this section, we ﬁrst introduce the gradient decomposition of skip connection and residual module.
Following that, we propose our Skip Gradient Method (SGM), then demonstrate the adversarial transferability property of skip connection via a case study.
3. G RADIENT D ECOMPOSITION WITH S KIP C ONNECTIONS
In ResNet-like neural networks, a skip connection uses identity mapping to bypass residual layers, allowing data ﬂow from a shallow layer directly to subsequent deep layers.
Thus, we can decompose the network into a collection of paths of different lengths (Veit et al., 2016).
We denote a skip connection together with its associated residual module as a building block (residual block) of a network.
Considering three successive building blocks (eg.
z i +
=
z i
+ f i +
( z i ) ) in a residual network from input z 0 to output z 3 , the output z 3 can be expanded as:
[Equation]
According to the chain rule in calculus, the gradient of a loss function (cid:96) with respect to input z 0 can then be decomposed as,
[Equation]
Extending this toy example to a network with L residual blocks
[Equation]
the gradient can be decomposed from L -th to the ( l + 1) -th ( 0 ≤ l < L ) residual block as,
[Equation]
[Equation] The example illustrated in Figure 1 is a the above decomposition of a ResNet-18 at the last 3 building blocks ( l = L − 3 ).
3. S KIP G RADIENT M ETHOD (SGM)
In order to use more gradient from the skip connections, here, we introduce a decay parameter into the decomposed gradient to reduce the gradient from the residual modules.
Following the decomposition in Equation (8), the “skipped” gradient is,
[Equation]
where z 0 = x is the input of the network [Equation] and γ ∈ (0 , 1] is the decay parameter.
Accordingly, given a clean example x and a DNN model f , an adversarial example can be crafted iteratively by,
[Equation]
[Table]
SGM is a generic technique that can be easily implemented on any neural network that has skip connections.
During the backpropagation process, SGM simply multiplies the decay parameter to the gradient whenever it passes a residual module.
Therefore, SGM does not require any computation overhead, and works efﬁciently even on densely connected networks such as DenseNets.
The reduction of residual gradients is accumulated along the backpropagation path, that is, the residual gradients at lower layers will be reduced more times than those at higher layers.
This is because, compared to high-level features, low-level features have already been well preserved by skip connections (see feature decompositions in Equation (6)).
3. A DVERSARIAL T RANSFERABILITY WITH S KIP C ONNECTIONS : A C ASE S TUDY
To demonstrate the adversarial transferability of skip connections
[Table]
we conduct a case study on 10step PGD, and their corresponding SGM versions, to investigate the success rates of black-box attacks crafted with or without manipulating the skip connections.
The black-box attacks are generated on 8 different source (surrogate) models ResNet(RN)-18/34/50/101/152 and DenseNet(DN)- 121/169/201, then applied to attack a Inception V3 target model.
All models were trained on ImageNet training set.
We randomly select 5000 ImageNet validation images that are correctly classiﬁed by all source models, and craft untargeted attacks under maximum L ∞ perturbation (cid:15) = 16 , which is a typical black-box setting (Dong et al., 2018; Xie et al., 2019; Dong et al., 2019).
The step size of PGD was set to α = 2 , and the decay parameter of SGM was set to γ = 0 .
We run the attack for 5 times with different random seeds, and report the success rates (transferability) of different methods in Table 1.
As can be seen, when the skip connections are manipulated with our SGM, the transferability of PGD is greatly improved across all source models.
On all source models except RN18, the improvements are more than 13% .
Without SGM, the best transferability against the Inception-V3 target model is 35.48% which is achieved by PGD on DN201, however, this is improved further by our proposed SGM to 65.38% ( > 29% gain).
This not only highlights the surprising property of skip connections in terms of the generation of highly transferable attacks, but also indicates the signiﬁcance of this property, as such a huge boost in transferability only takes a single decay factor.
The 8 source models can be interpreted as from 3 ResNet families: 1) RN18/34 are ResNets with normal residual blocks, 2) RN50/101/152 are ResNets with “bottleneck” residual blocks, and 3)
DN121/169/201 are densely connected ResNets.
Another important observation is that when there are more skip connections in a network within the same ResNet family ( e.g. , RN34 > RN18,
RN152 > RN101 > RN50, and DN201 > DN169 > DN121), or from ResNets to DenseNets ( e.g.
DN121/169/201 > RN18/34 and DN121/169/201 > RN50/101/152), the crafted adversarial examples become more transferable, especially when the skip connections are manipulated by our SGM.
This raises questions about the design principle behind many state-of-the-art DNNs: “going deeper” with techniques like skip connection and 1 × 1 convolution.
C OMPARISON TO E XISTING T RANSFER A TTACKS
In this section, we compare the transferability of adversarial examples crafted by our proposed SGM and existing methods on ImageNet against both unsecured and secured target models.
Baselines.
We compare SGM with FGSM, PGD, and 3 state-of-the-art transfer attacks: (1) Momentum Iterative (MI)
(Dong et al., 2018), (2) Diverse Input (DI) (Xie et al., 2019), and (3) Transition
Invariant (TI) (Dong et al., 2019).
Note that the TI attack was originally proposed to attack secured models, although here we include TI to attack both unsecured models and secured models.
For TI and our SGM, we test both the one-step and the iterative version, however, the other methods DI and
MI only have an iterative version.
The iteration step is set to 10 and 20 for unsecured and secured target models respectively.
For all iterative methods PGD, TI and our SGM, the step size is set to α = 2 .
For our proposed SGM, the decay parameter is set to γ = 0 .
2 (0 . 5) and γ = 0 .
5 (0 . 7) on ResNet and DenseNet source models in PGD (FGSM) respectively.
For simplicity, we utilize
SGM to indicate FGSM+SGM in one-step attacks, and PGD+SGM in multi-step attacks.
Other parameters of existing methods are conﬁgured as in their original papers.
Threat Model.
We adopt a black-box threat model in which adversarial examples are generated by attacking a source model and then applied to attack the target model.
The target model is of a different architecture (indicated by the model name) to the source model, expect when the source and target models are of the same architecture, where we directly use the source model as the target model (equivalent to a white-box setting).
The attacks are crafted on 5000 randomly selected
ImageNet validation images that are classiﬁed correctly by all source models, and are repeated for 5 times with different random seeds.
For all attack methods, we follow the standard setting (Dong et al., 2018; Xie et al., 2019) to craft untargeted attacks under maximum L ∞ perturbation (cid:15) =with respect to pixel values in [0 , 255] .
Target Models.
We consider two types of target models: 1) unsecured models that are trained on
ImageNet training set using traditional training; and 2) secured models trained using adversarial training.
For unsecured target model, we choose 7 state-of-the-art DNNs:
VGG19 (with batch normalization) (Simonyan & Zisserman, 2015), ResNet-152 (RN152)
(He et al., 2016a), DenseNet201 (DN152), 154 layer Squeeze-and-Excitation network (SE154) (Hu et al., 2018), Inception V (IncV3) (Szegedy et al., 2016), Inception V4 (IncV3) (Szegedy et al., 2017) and Inception-ResNet
V2 (IncResV2) (Szegedy et al., 2017).
For secured target models, we consider 3 robustly trained
DNNs using ensemble adversarial training (Tram ` er et al., 2018): IncV3 ens 3 (ensemble of 3 IncV networks), IncV3 ens 4 (ensemble of 4 IncV3 networks) and IncResV2 ens 3 (ensemble of 3 IncResV networks).
Source Models.
We choose 8 different source models from the ResNet family: ResNet(RN)- 18/34/50/101/152 and DenseNet(DN)-121/169/201.
Whenever the input size of the source model does not match the target model, we resize the crafted adversarial images to the input size of the target model.
For VGG19, ResNet and DenseNet models, images are cropped and resized to 224 × 224 , while for Inception/Inception-ResNet models, images are cropped and resized to 299 × 299 .
4. T RANSFERABILITY AGAINST U NSECURED M ODELS
We ﬁrst investigate the transferability of all attack methods against 7 unsecured models, which is to ﬁnd the best method that can generate the most transferable attacks on one source model against all target models.
One-step Transferability.
The one-step transferability is measured by the success rate of one-step attacks, as reported in Table 2.
Here, we only show the results on two source models: 1) RN which is the best ResNet source model with the highest success rate on average against all target models, and 2) DN201 which is the best DenseNet source model.
Also note that, when the source and target models are the same, the result represents the white-box success rate.
Overall, adversarial examples crafted on DN201 have signiﬁcantly better transferability than those crafted on RN152, especially for our SGM method.
This is because there are ∼ 30 × more skip connections that can be manipulated by our SGM in DN201 compared to RN152.
In comparison to to both FGSM and TI, transferability is improved considerably by SGM in almost all test scenarios, except when transferring from RN152 to VGG19/IncV3/IncV4 where SGM is outperformed by TI.
This implies that, when transfereing across different architectures (eg.
ResNet → VGG/Inception), translation adaptation may help increase the transferability of one-step perturbations.
However, this advantage of TI disappears when there are more skip connections, as is the case for the DN201 source model.
[Table]
[Figure]
[Table]
Multi-step Transferability.
First we provide a detailed study about the transferability of all attack methods from the 8 source models to the 3 representative unsecured target models.
We then compare different attack methods on two best source models against all unsecured target models: the best ResNet source model and the best DenseNet source model.
The multi-step ( e.g. , 10 step) transferability from all source models to three representative target models (VGG19, SE and IncV3) is illustrated in Figure 2.
In all transfer scenarios, our proposed SGM outperforms existing methods consistently on almost all source models except RN18.
Adversarial attacks crafted by SGM become more transferable when there are more skip connections in the source model ( e.g. , from RN18 to
DN201).
An interesting observation is that, when the target model is shallow such as VGG19 (left ﬁgure in Figure 2), shallow source models transfer better, however, when the target model is deep such as SE154 and IncV3 (middle and right ﬁgures in Figure 2), deeper source models tend to have better transferability.
We suspect this is due to the architectural similarities shared by the target and source models.
Note that against the VGG19 target model, the success rate of baseline methods all drop signiﬁcantly when the ResNet source models become more complex (from RN18 to RN152).
The small variations at RN50 and DN121 source models may be caused by the architectural difference between RN18/34 which consist of normal residual blocks, RN50/101/152 which consist of “bottleneck” residual blocks and DN121/169/201 which has dense skip connections.
Results for the best source models RN152 and DN201 against unsecured target models are reported in Table 3.
The proposed SGM attack outperforms existing methods by a large margin consistently against different target models.
Particularly, for transfer DN201 → SE154 (a recent state-of-the-art
DNN with only 2.251% top-5 error on ImageNet), SGM achieves a success rate of 72 .
03% , which is > 7% and > 10% higher than MI and DI respectively.
Combining with Existing Methods.
We further demonstrate that the adversarial transferability of skip connections can be exploited in combination with existing techniques.
The experiments are conducted on DN201 (the best source model in the above multi-step experiments), and TI attack is excluded as it was originally proposed against secured models and demonstrates limited improvement over PGD against unsecured models.
The results are reported in Table 4 * .
The transferability of MI and DI is improved remarkably of 11.98% ∼ 21.98% by SGM.
When combined with both MI
[Table] [Table]
and DI, SGM improves the state-of-the-art (MI+DI) transferability by a huge margin consistently against all target models.
In particular, SGM pushes the new state-of-the-art to at least 80.52% which previously was only 71%.
This illustrates that skip connections can be easily manipulated to craft highly transferable attacks against many state-of-the-art DNN models.
4. T RANSFERABILITY AGAINST R OBUSTLY T RAINED M ODELS
The success rates of our SGM and other baseline methods against the 3 secured target models are reported in Table 5.
Overall, with translation adaptation speciﬁcally designed for evading adversarially trained models, TI achieves the best standalone transferability, while SGM is the second best with higher success rates than either PGD, MI or DI.
When combined with TI, SGM also improves the TI attack by a considerable margin across all transfer scenarios.
This indicates that, although manipulating the skip connections alone may not sufﬁcient to attack secured models, it still can make existing attacks more powerful.
One interesting observation is that attacks crafted here on
RN152 are more transferable than those crafted on DN201, which is quite the opposite to attacking unsecured models.
4. A C LOSER L OOK AT SGM
In this part, we conduct more experiments to investigate the gradient decay factor of our proposed
SGM, and explore the potential use of SGM for ensemble-based attacks and white-box attacks.
Effect of Residual Gradient Decay γ .
We test the transferability of our proposed SGM with varying decay parameter γ ∈ [0 . 1 , 1 . 0] , where γ = 1 . 0 means no decay on the residual gradients.
The attacks are crafted by 10-step SGM on 5000 random ImageNet validation images.
The results against 3 target models (VGG19, SE154 and IncV3) are illustrated in Figure 3.
As can be observed, the trends are very consistent against different target models.
On DenseNet source models, decreasing decay parameter (increasing decay strength) tends to improve transferability until it exceeds a certain threshold, e.g. , γ = 0 .
This is because the decay encourages the attack to focus on more transferable low-level information, however, it becomes less sufﬁcient if all high-level class-relevant information is ignored.
On ResNet source models, decreasing decay parameter can constantly improve transferability for γ ≥ 0 .
Compared to DenseNet source models, ResNets require more
[Figure] [Figure]
DN
[Figure]
IncV
IncRes
[Figure]
+
RN +
DN
PGD
[Table]
[Table] [Table]
[Table]
decay on the residual gradients.
Recalling that skip connections reveal more transferable information of the source model, ResNets require more penalty on the residual gradients to increase the importance of skip gradients that reveal more transferable information of the source model.
As for the selection of γ under a scenario without knowing the target model, from Figure 3 and
Appendix C, we can see that the inﬂuence of γ is more related to the source model rather than the target model, that is, given a source model, the best γ against different target models are generally the same.
This makes the selection of γ quite straightforward: choosing the best γ on the source model(s).
For instance, in Figure 3, suppose the unknown target model is SE154 (middle ﬁgure), the adversary could tune γ on source model DN201 to attack VGG19 (left ﬁgure) and ﬁnd the best γ = 0 .
The attacks crafted on DN201 with γ = 0 .
5 indeed achieved the best success rate against the SE154 target model (and other target models).
Ensemble-based Attacks.
It has been shown that attacking multiple source models simultaneously can improve the transferability of the crafted adversarial examples, and is commonly adopted in practice.
We follow the ensemble-based strategy (Liu et al., 2017) and craft attacks on an ensemble of RN34, RN152 and DN201.
According to the discussion above, we select the best γ individually for each source model: choose γ for source RN34 and RN152 against target DN201, and γ for source DN201 against target RN152.
The success rates (transferability) against 7 unsecured models and 3 secured models are reported in Table 6 and Table 7 respectively.
Similar to the results of single source model attacks, against unsecured target models, SGM has a similar standalone performance with DI, better than the others (except the two “white-box” scenarios against RN152 and DN201).
When combined with other methods, e.g. DI, it improves the success rates again by a large margin.
[Figure] [Figure]
Against secured models, SGM achieves the second best standalone transferability, with TI is still the best.
When combined with TI, SGM improves the success rate by ∼ 10% consistently against all secured target models.
In particular, against IncV3 ens 3 , TI+SGM achieves higher success rate (87.65%) than reported in (Dong et al., 2019)
(84.8%), even if only 3 source models are used here and the source models ( e.g. RN34, RN152 and DN201) are all of different architecture to IncV target model ((Dong et al., 2019) uses 6 source models including even the IncV3 model).
From all aspects analyzed above, the existence of skip connections makes transferable attacks much easier to craft in practice.
Improving Weak White-box Attacks.
In addition to the black-box transferability, we next show that SGM can also improve the weak (one-step) white-box attack FGSM.
Note that the one-step version of SGM is equivalent to FGSM plus residual gradient decay.
Our experiments are conducted on the 8 source models, and the white-box success rates under maximum L ∞ perturbation (cid:15) =(a typical white-box setting) are shown in Figure 4a.
As can be observed, using SGM can help improve the adversarial strength ( i.e. , higher success rate).
We then vary the maximum perturbation (cid:15) ∈ [1 , 64] , and show the results on ResNet and DenseNet models separately in Figure 4b and
Figure 4c.
Compared to FGSM, SGM can always give better adversarial strength, except when (cid:15) is extremely small ( (cid:15) ≤ 2 ).
When the perturbation space becomes inﬁnitely small, the loss landscape within the space becomes ﬂat and the gradient points to the optimal perturbation direction.
However, when the perturbation space expands, one-step gradient becomes less accurate due to changes in the loss landscape (success rate decreases as (cid:15) increases from 4 to 16), and in this case, the skip gradient which contains more low-level information is more reliable than the residual gradient (the improvement is more signiﬁcant for (cid:15) ∈ [4 , 16] ).
Another interesting observation is that adversarial strength decreases when the model becomes more complex from RN18 to RN152, or DN121 to
DN201.
This is likely because the loss landscape of complex models is steeper than shallow models, making one-step gradient less reliable.
C ONCLUSION
In this paper, we have identiﬁed a surprising property of the skip connections used by many state-ofthe-art ResNet-like neural networks, that is, they can be easily used to generate highly transferable adversarial examples.
To demonstrate this architectural “weakness”, we proposed the Skip Gradient
Method (SGM) to craft adversarial examples using more gradients from the skip connections rather than the residual ones, via a decay factor on gradients.
We conducted a series of transfer attack experiments with 8 source models and 10 target models including 7 unsecured and 3 secured models, and showed that attacks crafted by SGM have signiﬁcantly better transferability than those crafted by existing methods.
When combined with existing techniques, SGM can also boost state-of-the-art transferability by a huge margin.
We believe the high adversarial transferability of skip connections is due to the fact that they expose extra low-level information which is more transferable across different DNNs.
Our ﬁndings in this paper not only remind researchers in adversarial research to pay attention to the architectural vulnerability of DNNs, but also raise new challenges for secure
DNN architecture design.
A CKNOWLEDGEMENT
Shu-Tao Xia is supported in part by National Key Research and Development Program of China under Grant 2018YFB1800204, National Natural Science Foundation of China under Grant 61771273,
R&D Program of Shenzhen under Grant JCYJ20180508152204044, and research fund of PCL Future Regional Network Facilities for Large-scale Experiments and Applications (PCL2018KP001).
A V ISUALIZATION OF A DVERSARIAL E XAMPLES C RAFTED BY SGM
In this section, we visualize 6 clean images and their corresponding adversarial examples crafted using our SGM on either a ResNet-152 or a DenseNet201 in Figure 5.
These visualization results show that the generated adversarial perturbations are human imperceptible.
B C OMPARISON WITH P REVIOUSLY P UBLISHED R ESULTS
In this section, we compare the experimental settings in previous and our works, and discuss some small discrepancies of the baseline performance reported in ours and previous works.
Table 8 and 9 summarizes these differences for single-source and ensemble-based attack respectively.
Out of all these works (Dong et al., 2018; 2019; Xie et al., 2019), results reported in (Xie et al., 2019) are more complete.
Our reported success rate of baseline attacks ( e.g. MI and DI) matches that reported in (Xie et al., 2019), sometimes even higher.
The slight discrepancy is caused by the difference in experimental settings.
Table 10 summarizes the different source models used by baseline attacks, and Table 11 summarizes the difference in dataset, number of test images, input image size, maximum L ∞ perturbation (cid:15) , number of attack steps N and attack step size α .
Compared to 299 × 299 image size, here we use a more standard image size 224 × 224 on ImageNet.
The use of smaller input size may reduce the effectiveness of existing attacks (Simon-Gabriel et al., 2019).
In another work by Liu et al.
(2017), 81% success rate was reported for optimization-based attack crafted on ResNet-152 against target VGG16, which is higher than our 65.52% from ResNet-152 to
VGG19.
This is because they did not restrict the maximum perturbation (cid:15) .
The root mean square deviation (RMSD) of their attacks is 22.83,which indicates that many pixels are perturbed more than 16 pixel values.
In our experiments, the RMSD is 6.29 for PGD, 7.71 for SGM, and 12.55 for
MI.
This appears to be another reason for the performance discrepancy.
Note that the advantage of bounded small perturbation is increasing imperceptibility to human observers (see Figure 5).
[Table] [Table]
“Hold-out” refers to the hold-out target model from the group, with all remaining models are used as source models.
Group 1 consists of ResNet-v2-152, IncV3, IncV4 and IncRes, while groupconsists of ResNet-v2-152, IncV3, IncV4, IncRes, IncV3 ens
[Table]
IncV
[Table]
For proper implementation, we use open-source codes and pretrained models for our experiments, e.g. , AdverTorch (Ding et al., 2019) for FGSM, PGD and MI, and source/target models from two
GitHub repositories †‡§ for all models
[Table]
We reproduced DI and TI in PyTorch.
[Table]
C T RANSFERABILITY OF DECAY PARAMETER γ
In this section, we study the “transferability” of decay parameter γ across different target models.
RN152 and DN201 are used as the source model, and the target model are varying to observe trends.
As indicated in Figure 6, all black-box target models share the same best selection of γ , which makes γ selection quite simple.
Even if the true target model is unknown, the adversary can tune the gamma for a resnet-like neural network through another model and obtain the best selection as well.
[Figure]