Composite Adversarial Attacks

Abstract

Adversarial attack is a technique for deceiving Machine Learning (ML) models, which provides a way to evaluate the adversarial robustness. In practice, attack algorithms are artificially selected and tuned by human experts to break a ML system. However, manual selection of attackers tends to be sub-optimal, leading to a mistakenly assessment of model security. In this paper, a new procedure called Composite Adversarial Attack (CAA) is proposed for automatically searching the best combination of attack algorithms and their hyperparameters from a candidate pool of 32 base attackers. We design a search space where attack policy is represented as an attacking sequence, i.e., the output of the previous attacker is used as the initialization input for successors. Multiobjective NSGA-II genetic algorithm is adopted for finding the strongest attack policy with minimum complexity. The experimental result shows CAA beats 10 top attackers on 11 diverse defenses with less elapsed time (6 × faster than Au-toAttack), and achieves the new state-of-the-art on l∞, l2 and unrestricted adversarial attacks.

Towards Compositional Adversarial Robustness: Generalizing Adversarial Training to Composite Semantic Perturbations

“…Laidlaw and Feizi (Laidlaw & Feizi, 2019) propose the ReColorAdv attack, which admit multi-functional threats to be used for perturbing every input pixel and also combine with additional p -norm threat. Instead of changing input by adding perturbation functionally, (Mao et al, 2020) rather utilizes genetic algorithms for searching the best combination in multiple attacks that are stronger than single attack. However, they only consider searching the order of attack combination in particular norm space (i.e., 2 , ∞ and corruption semantic space), which is different from our multiple and sequential attack setting.…”