[论文解读] Boosting Adversarial Attacks with Momentum

Yinpeng Dong, Fangzhou Liao+5 more|arXiv (Cornell University)|Oct 17, 2017

Adversarial Robustness in Machine Learning参考文献 29被引用 50

一句话总结

本文提出基于动量的迭代梯度方法（MI-FGSM及变体）以增强对抗攻击，提升白盒强度和黑盒转移性，并展示对集成模型的攻击以突破鲁棒防御。

ABSTRACT

Deep neural networks are vulnerable to adversarial examples, which poses security concerns on these algorithms due to the potentially severe consequences. Adversarial attacks serve as an important surrogate to evaluate the robustness of deep learning models before they are deployed. However, most of existing adversarial attacks can only fool a black-box model with a low success rate. To address this issue, we propose a broad class of momentum-based iterative algorithms to boost adversarial attacks. By integrating the momentum term into the iterative process for attacks, our methods can stabilize update directions and escape from poor local maxima during the iterations, resulting in more transferable adversarial examples. To further improve the success rates for black-box attacks, we apply momentum iterative algorithms to an ensemble of models, and show that the adversarially trained models with a strong defense ability are also vulnerable to our black-box attacks. We hope that the proposed methods will serve as a benchmark for evaluating the robustness of various deep models and defense methods. With this method, we won the first places in NIPS 2017 Non-targeted Adversarial Attack and Targeted Adversarial Attack competitions.

研究动机与目标

• 对深度模型在对抗威胁下进行鲁棒性评估的动机。
• 开发基于动量的迭代攻击方法，以稳定更新并提升转移性。
• 演示对模型集成的攻击以增强黑盒成功率。
• 展示通过对抗性训练的模型在强攻击下的脆弱性。

提出的方法

• 将动量引入迭代梯度攻击（MI-FGSM），通过累积梯度 g_{t+1} = μ g_t + grad(J(x_t*, y))/||grad(J)||_1 以及 x_{t+1}* = x_t* + α sign(g_{t+1}) 来稳定更新方向。
• 将动量扩展到 L2 范数和定向攻击；给出相应的更新规则。
• 提出通过融合 logits 的方式攻击集成模型：l(x) = sum_k w_k l_k(x)；使用集成 logits 来优化 J(x, y)。
• 比较集成方案（logits、预测、损失）并显示集成 logits 产生最强攻击。
• 在 ImageNet 上对七个模型进行实验；显示 MI-FGSM 在黑盒转移和白盒强度方面优于 FGSM 和 I-FGSM。

实验结果

研究问题

• RQ1 如何将动量整合到基于迭代梯度的攻击中以增强对抗样本的转移性？
• RQ2 攻击一个模型集合是否能提高黑盒攻击成功率，尤其对抗有防御的模型？
• RQ3 基于集成 logits 的攻击是否比基于集成预测或集成损失的方法更有效？
• RQ4 基于动量的攻击是否会威胁以集成对抗训练方式训练的模型？

主要发现

攻击	Inc-v3	Inc-v4	IncRes-v2	Res-152	Inc-v3 ens3	Inc-v3 ens4	IncRes-v2 ens
FGSM	72.3*	28.2	26.2	25.3	11.3	10.9	4.8
I-FGSM	100.0*	22.8	19.9	16.2	7.5	6.4	4.1
MI-FGSM	100.0*	48.8	48.0	35.6	15.1	15.2	7.8

• MI-FGSM 在白盒模型上几乎达到 100% 的成功率，并显著提高相对 I-FGSM 和 FGSM 的黑盒成功率。
• 动量（μ 约为 1.0）稳定更新方向并提高在多种黑盒模型上的转移性。
• 基于集成 logits 的攻击在多模型中优于基于集成预测或集成损失的方法。
• 对抗性训练的集成对 MI-FGSM 的黑盒攻击仍然脆弱，在某些防御上有显著成功率（例如最高约 40%）。
• 攻击在 NIPS 2017 非目标性和目标性对抗攻击竞赛中获得第一名。