Evading Defenses to Transferable Adversarial Examples by Translation-Invariant Attacks

Abstract

Deep neural networks are vulnerable to adversarial examples, which can mislead classifiers by adding imperceptible perturbations. An intriguing property of adversarial examples is their good transferability, making black-box attacks feasible in real-world applications. Due to the threat of adversarial attacks, many methods have been proposed to improve the robustness. Several state-of-the-art defenses are shown to be robust against transferable adversarial examples. In this paper, we propose a translation-invariant attack method to generate more transferable adversarial examples against the defense models. By optimizing a perturbation over an ensemble of translated images, the generated adversarial example is less sensitive to the white-box model being attacked and has better transferability. To improve the efficiency of attacks, we further show that our method can be implemented by convolving the gradient at the untranslated image with a pre-defined kernel. Our method is generally applicable to any gradient-based attack method. Extensive experiments on the ImageNet dataset validate the effectiveness of the proposed method. Our best attack fools eight state-of-the-art defenses at an 82% success rate on average based only on the transferability, demonstrating the insecurity of the current defense techniques.

An Effective Adversarial Attack on Person Re-Identification in Video Surveillance via Dispersion Reduction

“…As mentioned above, we have used three state-of-the-art ReID methods as victim models, attacked them with the proposed DR attack, and evaluated the performance drop on four different datasets. Moreover, we attacked the same victim models with two other state-of-the-art attack approaches, namely TI-FGSM and TI-DIM [56], [71]. We compared the effectiveness of our DR attack with these other attack methods as well.…”

“…In one of the earlier works, Goodfellow et al [53] proposed fast gradient sign method (FGSM), which generates AEs in one step. Several works extended this by iteratively updating the AEs with multistep attacks including the basic iterative method (BIM) [10], deep fool [54], momentum iterative method [11], Diverse Inputs Method (DIM) [55] and Translation-Invariant (TI) attacks [56]. Compared with FGSM, the iterative methods generate a smaller perturbation, which makes the adversarial examples even more imperceptible to human eye.…”

“…Translation-Invariant (TI) attack methods have been proposed by Dong et al [56] to further improve the transferability on white-box models. The authors notice the difference between the discriminative regions used by defenses to identify object categories and the normal trained models.…”

“…We follow the data preparation process described in [68], [69]. After pre-processing, we apply the TI-FGSM and TI-DIM attacks as described in [56], and detailed in the source code on Github page [71].…”

“…Content may change prior to final publication. [51] 88.9 77.2 81.2 -TI-FGSM-DG [1], [53], [75] 51.2 31.9 48.3 32.1 TI-FGSM-AR [3], [53], [75] 58.7 29.4 49.5 30.8 TI-FGSM-OS [51], [53], [75] 55.9 32.1 51.2 -TI-DIM-DG [1], [55], [75] 45. 4 14.2 32.7 25.4 TI-DIM-AR [3], [55], [75] 44.9 16.5 29.4 22.6 TI-DIM-OS [51], [55], [75] 47…”