Universal Adversarial Training

Abstract

Standard adversarial attacks change the predicted class label of an image by adding specially tailored small perturbations to its pixels. In contrast, a universal perturbation is an update that can be added to any image in a broad class of images, while still changing the predicted class label. We study the efficient generation of universal adversarial perturbations, and also efficient methods for hardening networks to these attacks. We propose a simple optimization-based universal attack that reduces the top-1 accuracy of various network architectures on Ima-geNet to less than 20%, while learning the universal perturbation 13× faster than the standard method. To defend against these perturbations, we propose universal adversarial training, which models the problem of robust classifier generation as a two-player min-max game. This method is much faster and more scalable than conventional adversarial training with a strong adversary (PGD), and yet yields models that are extremely resistant to universal attacks, and comparably resistant to standard (per-instance) black box attacks. We also discover a rather fascinating side-effect of universal adversarial training: attacks built for universally robust models transfer better to other (black box) models than those built with conventional adversarial training.

Real-time Detection of Practical Universal Adversarial Perturbations

“…Existing defenses for adversarial mask UAPs denoise the input or retrain the model to correct its output on perturbed inputs [2,5,30,35]. These approaches are good for correcting model predictions on tested universal attacks without having to intervene during model inference.…”

“…Adversarial masks are usually generated by directly optimizing over the model's training loss function. These direct attacks are effective, but require white-box access to the model [10,27,35]. Effective UAP attacks can be achieved with Stochastic Gradient Descent (SGD), which uses the Projected Gradient Descent (PGD) [26] algorithm, but optimizes over batches rather than single inputs [30,35,41].…”

“…These direct attacks are effective, but require white-box access to the model [10,27,35]. Effective UAP attacks can be achieved with Stochastic Gradient Descent (SGD), which uses the Projected Gradient Descent (PGD) [26] algorithm, but optimizes over batches rather than single inputs [30,35,41]. The algorithm optimizes i L(x i + δ), where L is the model's training loss, X batch = {x i } are batches of inputs, and δ ∈ P are the valid perturbations.…”

“…UAPs can also be generated "indirectly" by either optimizing a proxy objective [23,28,29] or by exploiting a specific property of the input domain such as in procedural noise [9] or Fourier basis functions [42]. These demonstrate that UAPs can be generated under more restrictive threat assumptions, even if they are less effective than direct attacks [10,35]. For proxy objectives, existing work find perturbations that maximally activate hidden layer values [28,29].…”

Jacobian Regularization for Mitigating Universal Adversarial Perturbations

“…An untargeted UAP is an adversarial perturbation δ ∈ R n that satisfies F (x + δ) = τ (x) for sufficiently many x ∈ X and with δ p < ε [18]. The most effective UAP attacks for generating δ under ℓ p -norm constraints can be achieved by maximizing the loss i L(x i + δ) with an iterative stochastic gradient descent algorithm [5,23,19,27]. Here, L is the model's training loss, {x i } are batches of inputs, and δ are small perturbations that satisfy δ p < ε.…”