Distributionally Adversarial Attack

Abstract

Recent work on adversarial attack has shown that Projected Gradient Descent (PGD) Adversary is a universal first-order adversary, and the classifier adversarially trained by PGD is robust against a wide range of first-order attacks. It is worth noting that the original objective of an attack/defense model relies on a data distribution p(x), typically in the form of risk maximization/minimization, e.g., max/min E p(x) L(x) with p(x) some unknown data distribution and L(·) a loss function. However, since PGD generates attack samples independently for each data sample based on L(·), the procedure does not necessarily lead to good generalization in terms of risk optimization. In this paper, we achieve the goal by proposing distributionally adversarial attack (DAA), a framework to solve an optimal adversarial-data distribution, a perturbed distribution that satisfies the L∞ constraint but deviates from the original data distribution to increase the generalization risk maximally. Algorithmically, DAA performs optimization on the space of potential data distributions, which introduces direct dependency between all data points when generating adversarial samples. DAA is evaluated by attacking state-of-the-art defense models, including the adversarially-trained models provided by MIT MadryLab. Notably, DAA ranks the first place on MadryLab's white-box leaderboards, reducing the accuracy of their secret MNIST model to 88.79% (with l∞ perturbations of = 0.3) and the accuracy of their secret CIFAR model to 44.71% (with l∞ perturbations of = 8.0). Code for the experiments is released on https://github.com/tianzheng4/ Distributionally-Adversarial-Attack.

Artificial Intelligence Security Threat, Crime, and Forensics: Taxonomy and Open Issues

“…With regard to DFR introduced in Section II-B1, it is important to prevent or detect the adversarial attack proactively. Many researchers proposed defence methods that attempt to classify AEs correctly, but the methods have been being defeated by newly developed attacks [126]- [128].…”

Towards deep neural networks robust to adversarial examples

“…This greatly increases the computational cost of the attack and makes it infeasible for evaluating the robustness of large models. Other methods, such as FGM [5], PGD [8,17] and DAA [74] attacks, reformulate the original norm minimization problem with non-convex misclassification constraint as non-convex surrogate loss minimization with convex l p -norm perturbation constraint as in Equation (2.15). For this "simpler" problem, projected gradient descent attack (PGD) is an optimal first-order adversary [17].…”

“…• We reimplemented Distributionally Adversarial Attack (DAA) [74]. We used Lagrangian Blob Attack algorithm.…”

“…The models on CIFAR-10 achieve the following clean test accuracy (first 1000 images of the test set): plain 88.38% (89.4%), l ∞ -AT 79.9% (80.4%), and l 2 -AT 80.44% (80.7%).Attacks:We tested the robustness of each model wrt to l ∞ -, l 2 -, l 1 -, and l 0norm adversaries. We compared the performance of our attacks to attacks representing state-of-the-art for each norm: Brendel & Bethge attack (B&B, l ∞ -,l 2 -, l 1 -, l 0 -norms)[139]; Carlini-Wagner l 2 -attack (C&W, l 2 -norm)[18]; Decoupled Direction and Norm l 2 -attack (DDN, l 2 -norm)[72]; DeepFool (DF, l ∞ -, and l 2norm)[53]; Distributionally Adversarial Attack (DAA, l ∞ -norm)[74]; Elastic-net attack (l 1 -norm)[75]; Fast Adaptive Boundary Attack (FAB, l ∞ -, l 2 -, l 1 -norms)[54];…”

Towards robust inference against distribution shifts in computer vision

“…Adversarial examples [40,47] are specifically manipulated inputs that are able to drastically change the model predictions with insignificant perturbations, which can barely be observed by humans. It's a thorn in the side of the modern machine learning community that undermines the reliability of DNN models in various domains [112][113][114][115][116][117][118][119] and settings [120][121][122][123][124][125], causing serious security issues in computer vision systems, like face recognition [126] and autonomous vehicle [127]. Therefore, a line of related research [47,48,51,77,85,[128][129][130][131] has attracted significant attention in the machine learning community.…”