Cycle-Consistent Adversarial GAN: The Integration of Adversarial Attack and Defense

Abstract

In image classification of deep learning, adversarial examples where inputs intended to add small magnitude perturbations may mislead deep neural networks (DNNs) to incorrect results, which means DNNs are vulnerable to them. Different attack and defense strategies have been proposed to better research the mechanism of deep learning. However, those research in these networks are only for one aspect, either an attack or a defense, not considering that attacks and defenses should be interdependent and mutually reinforcing, just like the relationship between spears and shields. In this paper, we propose Cycle-Consistent Adversarial GAN (CycleAdvGAN) to generate adversarial examples, which can learn and approximate the distribution of original instances and adversarial examples. For CycleAdvGAN, once the Generator A and D are trained, A G can generate adversarial perturbations efficiently for any instance, so as to make DNNs predict wrong, and D G recovery adversarial examples to clean instances, so as to make DNNs predict correct. We apply CycleAdvGAN under semi-white box and black-box settings on two public datasets MNIST and CIFAR10. Using the extensive experiments, we show that our method has achieved the state-of-the-art adversarial attack method and also efficiently improve the defense ability, which make the integration of adversarial attack and defense come true. In additional, it has improved attack effect only trained on the adversarial dataset generated by any kind of adversarial attack. INTRODUCTIONWith the Deep Neural Networks (DNNs) rapid development, they have achieved great successes in various tasks handling the image recognition[1], text processing[2] and speech recognition[3]. Despite the great success, DNNs have been proved to be vulnerable and susceptible to adversarial example[4], the carefully crafted samples looking similar to natural images but designed to mislead a pretrained model. On the one hand, adversarial example leads to potential security threats by attacking or misleading the practical deep learning applications, for example mistaking a stop sign for a yield sign[5] when auto driving, and a thief for a staff when face recognition[6]. On the other hand, adversarial examples are also valuable and beneficial to not only the deep learning models but also the machine learning model, as they can enhance the robust of models and provide insights into their strengths, weaknesses, and blind-spots[7]. CycleAdvGAN: integration of adversarial attack and defence 2 The strategy to generate adversarial examples is to intentionally add imperceptible perturbations to clean instances, for fooling DNNs to make wrong predictions. In the past years, various attack algorithms have been developed to produce adversarial examples in the white-box manner with the knowledge of the structure and parameters of a given model, including gradient based algorithms such as fast gradient sign method[8] and iterative variants of gradient-based methods[9], optimization-based methods such as box-constrained LBFGS[4] and ...

Generation and Countermeasures of Adversarial Examples on Vision: A Survey

“…Instead of using the original image directly as a mirror, as shown in Figure 9 (b), Adv-GAN++ added a feature extractor to take the features in the clean example as prior. Jiang et al [102] argued that the purpose of only training for attack or defense limited the capabilities of deep neural networks, so they proposed CycleGAN with two generators and discriminators. Moreover, they introduced cycle consistency to train for attack and defense simultaneously.…”

A Two-Stage Generative Adversarial Networks With Semantic Content Constraints for Adversarial Example Generation

“…Guoping Zhao et al [20] proposed an unsupervised adversarial attack GAN (UAA-GAN) to solve the content-based image retrieval (CBIR), face search and person re-identification (ReID) problem, which method focused on the deep visual features of disturbed examples. Lingyun Jiang et al [21] proposed a cycle-uniform adversarial GAN (CycleAdvGAN), which trained two generators to adversarial examples generation and adversarial examples recovery, that could help the model training. Zilong Lin et al [22] proposed IDSGAN for IDS detection system, which used black-box IDs as the target model to generate adversarial examples of flow data.…”

Explore Gap between 3D DNN and Human Vision Utilizing Fooling Point Cloud Generated by MEHHO

“…Exploring such diferences is helpful to accelerate the development of 3D DNN robustness. However, most adversarial defenses [29][30][31][32][33][34][35][36] for 3D DNN are mainly aimed at defense specifc attack and do not explain this diference clearly.…”