[Paper Review] AT-GAN: A Generative Attack Model for Adversarial Transferring on Generative Adversarial Nets.

Xiaosen Wang, Kun He+1 more|arXiv (Cornell University)|Apr 16, 2019

Adversarial Robustness in Machine Learning24 references24 citations

TL;DR

AT-GAN proposes a novel generative attack framework that learns to generate non-constrained, semantically meaningful adversarial examples from random noise using a GAN-based approach, bypassing input-dependent perturbations. By transferring a pre-trained GAN from benign data distribution to adversarial example distribution, AT-GAN achieves high attack success rates on white-box models and demonstrates moderate transferability in black-box settings, producing more realistic and diverse adversarial examples.

ABSTRACT

Despite the rapid development of adversarial machine learning, most adversarial attack and defense researches mainly focus on the perturbation-based adversarial examples, which is constrained by the input images. In comparison with existing works, we propose non-constrained adversarial examples, which are generated entirely from scratch without any constraint on the input. Unlike perturbation-based attacks, or the so-called unrestricted adversarial attack which is still constrained by the input noise, we aim to learn the distribution of adversarial examples to generate non-constrained but semantically meaningful adversarial examples. Following this spirit, we propose a novel attack framework called AT-GAN (Adversarial Transfer on Generative Adversarial Net). Specifically, we first develop a normal GAN model to learn the distribution of benign data, and then transfer the pre-trained GAN model to estimate the distribution of adversarial examples for the target model. In this way, AT-GAN can learn the distribution of adversarial examples that is very close to the distribution of real data. To our knowledge, this is the first work of building an adversarial generator model that could produce adversarial examples directly from any input noise. Extensive experiments and visualizations show that the proposed AT-GAN can very efficiently generate diverse adversarial examples that are more realistic to human perception. In addition, AT-GAN yields higher attack success rates against adversarially trained models under white-box attack setting and exhibits moderate transferability against black-box models.

Motivation & Objective

• To address the limitation of perturbation-based adversarial attacks that are constrained by input images and input noise.
• To develop a method for generating adversarial examples that are entirely synthesized from random noise, without relying on input data.
• To learn the distribution of adversarial examples as a way to generate semantically meaningful and realistic adversarial samples.
• To improve attack success rates, especially against adversarially trained models, by leveraging generative modeling of adversarial distributions.
• To explore transferability of generated adversarial examples across different models, including black-box scenarios.

Proposed method

• Train a standard GAN to model the distribution of benign training data, learning realistic data manifold representations.
• Transfer the pre-trained generator to learn the distribution of adversarial examples for a target model by fine-tuning on adversarial examples.
• Use the transferred generator to produce non-constrained adversarial examples directly from random noise vectors.
• Apply the generator to generate diverse adversarial examples that are semantically meaningful and perceptually realistic.
• Leverage the GAN’s latent space to explore and sample from the adversarial distribution, enabling efficient and scalable attack generation.
• Utilize the generator’s ability to model complex data distributions to produce adversarial examples that closely resemble real data in distribution.

Experimental results

Research questions

• RQ1 Can adversarial examples be generated from random noise without relying on input data or input-based perturbations?
• RQ2 Can a GAN-based model effectively learn and generate adversarial examples that are both semantically meaningful and realistic to human perception?
• RQ3 How does the attack success rate of AT-GAN compare to traditional perturbation-based attacks on white-box and black-box settings?
• RQ4 To what extent can adversarial examples generated by AT-GAN transfer across different models, especially when the target model is adversarially trained?
• RQ5 Can the distribution of adversarial examples be effectively modeled and transferred using a GAN framework to improve attack efficiency and diversity?

Key findings

• AT-GAN successfully generates non-constrained adversarial examples directly from random noise, without requiring any input image or input-based perturbation.
• The generated adversarial examples are more realistic and semantically meaningful, as confirmed by visualizations and human perception evaluation.
• AT-GAN achieves higher attack success rates than baseline methods on white-box settings, particularly against models that are adversarially trained.
• The framework demonstrates moderate transferability, enabling effective attacks on black-box models despite the lack of direct access to the target model.
• The transferred GAN generator learns a distribution of adversarial examples that closely matches the real data distribution, enabling diverse and high-quality sample generation.
• The approach represents the first generative model specifically designed to produce adversarial examples from noise, establishing a new paradigm in adversarial attack generation.