Making Adversarial Examples More Transferable and Indistinguishable

Abstract

Fast gradient sign attack series are popular methods that are used to generate adversarial examples. However, most of the approaches based on fast gradient sign attack series cannot balance the indistinguishability and transferability due to the limitations of the basic sign structure. To address this problem, we propose a method, called Adam Iterative Fast Gradient Tanh Method (AI-FGTM), to generate indistinguishable adversarial examples with high transferability. Besides, smaller kernels and dynamic step size are also applied to generate adversarial examples for further increasing the attack success rates. Extensive experiments on an ImageNet-compatible dataset show that our method generates more indistinguishable adversarial examples and achieves higher attack success rates without extra running time and resource. Our best transfer-based attack NI-TI-DI-AITM can fool six classic defense models with an average success rate of 89.3% and three advanced defense models with an average success rate of 82.7%, which are higher than the state-of-the-art gradient-based attacks. Additionally, our method can also reduce nearly 20% mean perturbation. We expect that our method will serve as a new baseline for generating adversarial examples with better transferability and indistinguishability.

Adapting Step-size: A Unified Perspective to Analyze and Improve Gradient-based Methods for Adversarial Attacks

“…Lemma A.3. (Mukkamala & Hein, 2017) Suppose that 1 − 1 t ≤ β t ≤ 1 − γ t for some 0 < γ ≤ 1 and each t ≥ 1 in AdaMI-FGM (19). Then Theorem A.4.…”

“…This completes the proof of Theorem A.2. Note that our AdaMI-FGM (19) uses the same adaptive step-size strategy as the AdaGrad algorithm in Mukkamala & Hein (2017). In Mukkamala & Hein (2017), the regret analysis in an online setting is provided.…”

“…In Mukkamala & Hein (2017), the regret analysis in an online setting is provided. To analyze convergence of our AdaMI-FGM (19) with a constant learning rate, we first introduce an important lemma from Mukkamala & Hein (2017). In the following, for the diagonal matrix sequence {V t } T t=1 , we use v t,i to denote the i-th element in the diagonal of V t , g t,i to denote the i-th element of g t and g 1:T,i = [g 1,i , • • • , g T,i ] to denote the vector obtained by concatenating the i-th element of the gradient sequence {g t } T t=1 .…”

“…There have been several reports about the direct application of adaptive gradient-based methods in solving adversarial attack optimization problems. For example, a variant of Adam was proposed to generate indistinguishable adversarial examples with high transferability [19]. In [20], Adabelief optimizer [21] is introduced to improve the transferability of adversarial examples.…”

“…Then, we obtain a broad class of adaptive gradient-based adversarial learning algorithms by adapting the step-size with information of the accumulated gradients. In contrast to the investigations in [19] and [20], the adaptive methods here (Section 3.2) are established upon our analysis (Section 3.1). The contributions in this paper can be summarized as follows,…”