Adversarial Attacks and Defences Competition

Kurakin, Alexey; Goodfellow, Ian; Bengio, Samy; Dong, Yinpeng; Liao, Fei-Yu; Liang, Ming; Pang, Tianyu; Zhu, Jun; Hu, Xiaolin; Xie, Cihang; Wang, Yunlong; Zhang, Zhishuai; Zhang, Ren; Yuille, Alan; Huang, Sangxia; Zhao, Yao; Zhao, Yongfeng; Han, Zhonglin; Long, Jessica B.; Berdibekov, Yerkebulan; Akiba, Takuya; Tokui, Seiya; Abe, Miki

doi:10.48550/arxiv.1804.00097

Cited by 31 publications

(52 citation statements)

References 0 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Among them, HGD [32] and R&P [61] are the rank-1 submission and rank-2 submission in the NeurIPS 2017 defense competition [30], respectively. FD [62] Implementation details.…”

Section: Methodsmentioning

confidence: 99%

“…Comprehensive experiments are conducted to verify the effectiveness of the proposed regionally homogeneous perturbation (RHP). Under the black-box setting, RHP successfully attacks 9 latest defenses [21,26,32,37,56,61,62] and improves the top-1 error rates by 21.6% in average, where three of them are the top submissions in the NeurIPS 2017 defense competition [30] and the Competition on Adversarial Attacks and Defenses 2018. Compared with the state-of-the-art attack methods, RHP not only outperforms universal adversarial perturbations (e.g., UAP [38] by 19.2% and GAP [42] by 15.6%), but also outperforms image-dependent perturbations (FGSM [18] by 12.9%, MIM [14] by 12.6% and DIM [14,63] by 9.58%).…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Regional Homogeneity: Towards Learning Transferable Universal Adversarial Perturbations Against Defenses

Bai

Xie

et al. 2019

Preprint

Self Cite

View full text Add to dashboard Cite

This paper focuses on learning transferable adversarial examples specifically against defense models (models to defense adversarial attacks). In particular, we show that a simple universal perturbation can fool a series of state-ofthe-art defenses.Adversarial examples generated by existing attacks are generally hard to transfer to defense models. We observe the property of regional homogeneity in adversarial perturbations and suggest that the defenses are less robust to regionally homogeneous perturbations. Therefore, we propose an effective transforming paradigm and a customized gradient transformer module to transform existing perturbations into regionally homogeneous ones. Without explicitly forcing the perturbations to be universal, we observe that a well-trained gradient transformer module tends to output input-independent gradients (hence universal) benefiting from the under-fitting phenomenon. Thorough experiments demonstrate that our work significantly outperforms the prior art attacking algorithms (either image-dependent or universal ones) by an average improvement of 14.0% when attacking 9 defenses in the black-box setting. In addition to the cross-model transferability, we also verify that regionally homogeneous perturbations can well transfer across different vision tasks (attacking with the semantic segmentation task and testing on the object detection task). The code is available here: https://github. com/LiYingwei/Regional-Homogeneity.

show abstract

“…Among them, HGD [32] and R&P [61] are the rank-1 submission and rank-2 submission in the NeurIPS 2017 defense competition [30], respectively. FD [62] Implementation details.…”

Section: Methodsmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Regional Homogeneity: Towards Learning Transferable Universal Adversarial Perturbations Against Defenses

Bai

Xie

et al. 2019

Preprint

Self Cite

View full text Add to dashboard Cite

show abstract

“…Black box attacks In the white box attack setting [22], the adversary has full knowledge of the model including model type, model architecture and values of all parameters and trainable weights. In the black box setting [23], [24], [25], [26], the adversary has limited or no knowledge about the model under attack [27]. In this paper, we focus on the white box attack for Siamese trackers.…”

Section: B Adversarial Attacksmentioning

confidence: 99%

A Simple and Strong Baseline for Universal Targeted Attacks on Siamese Visual Tracking

Shi

Gao

et al. 2022

IEEE Trans. Circuits Syst. Video Technol.

View full text Add to dashboard Cite

Siamese trackers are shown to be vulnerable to adversarial attacks recently. However, the existing attack methods craft the perturbations for each video independently, which comes at a non-negligible computational cost. In this paper, we show the existence of universal perturbations that can enable the targeted attack, e.g., forcing a tracker to follow the groundtruth trajectory with specified offsets, to be video-agnostic and free from inference in a network. Specifically, we attack a tracker by adding a universal imperceptible perturbation to the template image and adding a fake target, i.e., a small universal adversarial patch, into the search images adhering to the predefined trajectory, so that the tracker outputs the location and size of the fake target instead of the real target. Our approach allows perturbing a novel video to come at no additional cost except the mere addition operations -and not require gradient optimization or network inference. Experimental results on several datasets demonstrate that our approach can effectively fool the Siamese trackers in a targeted attack manner. We show that the proposed perturbations are not only universal across videos, but also generalize well across different trackers. Such perturbations are therefore doubly universal, both with respect to the data and the network architectures. We will make our code publicly available.

show abstract

“…z is obtained from the gradient w.r.t. r (or x) by smoothing, much like how r is obtained from z in the forward pass (17).…”

Section: Attack Targeting Optimalitymentioning

confidence: 99%

“…Adversarial examples where introduced by Szegedy et al [34] as imperceptible perturbations of a test image that can change a neural network's prediction. This has spawned active research on adversarial attacks and defenses with competitions among research teams [17]. Despite the theoretical and practical progress in understanding the sensitivity of neural networks to their input, assessing the imperceptibility of adversarial attacks remains elusive: user studies show that L p norms are largely unsuitable, whereas more sophisticated measures are limited too [30].…”

Section: Introductionmentioning

confidence: 99%

Smooth Adversarial Examples

Zhang,

Avrithis,

Furon

et al. 2019

Preprint

View full text Add to dashboard Cite

This paper investigates the visual quality of the adversarial examples. Recent papers propose to smooth the perturbations to get rid of high frequency artefacts. In this work, smoothing has a different meaning as it perceptually shapes the perturbation according to the visual content of the image to be attacked. The perturbation becomes locally smooth on the flat areas of the input image, but it may be noisy on its textured areas and sharp across its edges.This operation relies on Laplacian smoothing, wellknown in graph signal processing, which we integrate in the attack pipeline. We benchmark several attacks with and without smoothing under a white-box scenario and evaluate their transferability. Despite the additional constraint of smoothness, our attack has the same probability of success at lower distortion.

show abstract

Adversarial Attacks and Defences Competition

Cited by 31 publications

References 0 publications

Regional Homogeneity: Towards Learning Transferable Universal Adversarial Perturbations Against Defenses

Regional Homogeneity: Towards Learning Transferable Universal Adversarial Perturbations Against Defenses

A Simple and Strong Baseline for Universal Targeted Attacks on Siamese Visual Tracking

Smooth Adversarial Examples

Contact Info

Product

Resources

About