[Paper Review] Adversarial Transformation Networks: Learning to Generate Adversarial Examples

Shumeet Baluja, Ian Fischer|arXiv (Cornell University)|Mar 28, 2017

Adversarial Robustness in Machine Learning28 references221 citations

TL;DR

ATNs are trained as feed-forward networks to generate adversarial examples against target classifiers, enabling fast, diverse, targeted attacks with self-supervised training on MNIST and ImageNet (Inception ResNet v2).

ABSTRACT

Multiple different approaches of generating adversarial examples have been proposed to attack deep neural networks. These approaches involve either directly computing gradients with respect to the image pixels, or directly solving an optimization on the image pixels. In this work, we present a fundamentally new method for generating adversarial examples that is fast to execute and provides exceptional diversity of output. We efficiently train feed-forward neural networks in a self-supervised manner to generate adversarial examples against a target network or set of networks. We call such a network an Adversarial Transformation Network (ATN). ATNs are trained to generate adversarial examples that minimally modify the classifier's outputs given the original input, while constraining the new classification to match an adversarial target class. We present methods to train ATNs and analyze their effectiveness targeting a variety of MNIST classifiers as well as the latest state-of-the-art ImageNet classifier Inception ResNet v2.

Motivation & Objective

• Motivate and demonstrate weaknesses in deep classifiers by generating adversarial examples.
• Propose Adversarial Transformation Networks that produce adversarial inputs while preserving non-top output ordering.
• Showcase targeted, white-box ATN training against MNIST classifiers and a state-of-the-art ImageNet model.
• Analyze transferability, internal-state information, and parallel/serial use of ATNs.

Proposed method

• Define ATN as a neural network g_{f,θ}(x) that outputs an adversarial example x' for a target classifier f.
• Train ATN by minimizing a combined loss: β L_{X}(g_{f,θ}(x), x) + L_{Y}(f(g_{f,θ}(x)), f(x)).
• Use a targeted attack with L_{Y} constructed via a reranking function r(y, t) to ensure the target class t is top after transformation.
• Explore two ATN variants: Perturbation ATN (P-ATN) and Adversarial Autoencoding (AAE) ATN, with output constrained to valid input range (e.g., tanh activation).
• Train ATNs in self-supervised manner against fixed target classifiers, without requiring target labels.

Experimental results

Research questions

• RQ1 Can feed-forward networks be trained to generate effective targeted adversarial examples against a target classifier?
• RQ2 Do ATNs trained on one network transfer to other networks, and can they be trained to attack multiple networks simultaneously?
• RQ3 Does providing internal classifier signals (insider information) improve ATN effectiveness, particularly for maintaining secondary output order?
• RQ4 What is the behavior of ATNs when applied in parallel or in series, and how does this affect image quality and attack success?
• RQ5 Do ATNs trained on MNIST extend to large-scale ImageNet models, and how do different ATN architectures affect diversity and strength of adversaries.

Key findings

• ATNs can achieve high targeted fooling rates on MNIST classifiers, with success varying by β, and smaller β yields more faithful reconstructions but higher attack success.
• AAE ATNs generally outperform Perturbation ATNs in top-1 adversarial accuracy against ImageNet’s Inception ResNet v2, while perturbation approaches preserve more original pixels.
• ATN transformations tend to diversify adversarial outputs, producing a variety of plausible perturbations rather than a single perturbation pattern.
• Transferability tests show ATN attacks are not universal across different architectures; models trained to attack one network do not automatically fool others.
• Training ATNs with signals from multiple networks yields strong performance on trained targets and some transfer to unseen networks, with varying success.*
• Providing internal state information from the target classifier can improve secondary-output preservation, enhancing conditional success rates for the second-ranked class.*
• Serial application of ATNs degrades image quality, while parallel application can achieve broad success across multiple networks, with diminishing returns as more ATNs are chained.