[Paper Review] Cross-Domain Transferability of Adversarial Perturbations

Muzammal Naseer, Salman Khan+3 more|arXiv (Cornell University)|May 28, 2019

Adversarial Robustness in Machine Learning30 references49 citations

TL;DR

The paper introduces a distribution- and domain-agnostic generative framework that learns universal adversarial perturbations capable of fooling classifiers across different domains (e.g., paintings, comics, medical images to ImageNet) with high transferability, using a relativistic discriminator.

ABSTRACT

Adversarial examples reveal the blind spots of deep neural networks (DNNs) and represent a major concern for security-critical applications. The transferability of adversarial examples makes real-world attacks possible in black-box settings, where the attacker is forbidden to access the internal parameters of the model. The underlying assumption in most adversary generation methods, whether learning an instance-specific or an instance-agnostic perturbation, is the direct or indirect reliance on the original domain-specific data distribution. In this work, for the first time, we demonstrate the existence of domain-invariant adversaries, thereby showing common adversarial space among different datasets and models. To this end, we propose a framework capable of launching highly transferable attacks that crafts adversarial patterns to mislead networks trained on wholly different domains. For instance, an adversarial function learned on Paintings, Cartoons or Medical images can successfully perturb ImageNet samples to fool the classifier, with success rates as high as $\sim$99\% ($\ell_{\infty} \le 10$). The core of our proposed adversarial function is a generative network that is trained using a relativistic supervisory signal that enables domain-invariant perturbations. Our approach sets the new state-of-the-art for fooling rates, both under the white-box and black-box scenarios. Furthermore, despite being an instance-agnostic perturbation function, our attack outperforms the conventionally much stronger instance-specific attack methods.

Motivation & Objective

• Demonstrate the existence of domain-invariant adversaries that transfer across diverse image domains and models.
• Develop a generative framework to craft highly transferable universal perturbations without using target domain data.
• Improve attack transferability by introducing a relativistic supervisory signal between perturbed and clean samples.

Proposed method

• Use a generator G_theta to produce perturbations applied to source-domain images within a bounded l_infinity norm.
• Employ a discriminator D_psi that outputs class probabilities for both clean and perturbed images, guiding perturbation generation.
• Introduce a relativistic cross-entropy loss (RCE) that compares perturbed versus clean predictions to maximize the fooling gap (Eq. 3).
• For targeted attacks, combine a targeted cross-entropy with the clean-image cross-entropy (Eq. 4).
• Train the generator only on the source domain without using target-domain labels or data during training.
• Project generated perturbations to satisfy the perturbation budget before forwarding to the discriminator.

Experimental results

Research questions

• RQ1 Can adversarial perturbations learned on one domain fool classifiers on completely different domains without access to target-domain data?
• RQ2 Does a relativistic loss improve cross-domain transferability compared to standard cross-entropy in adversarial generation?
• RQ3 How does the proposed universal perturbation function perform in white-box, black-box, and cross-domain black-box settings?
• RQ4 How do training dynamics and Gaussian smoothing affect transferability to naturally trained versus adversarially trained models?

Key findings

• Adversarial perturbations learned on Painting, Comics, or ChestX images can disrupt ImageNet classifiers with high fooling rates, reaching up to ~99% in some settings (l_infty ≤ 10).
• The relativistic adversarial perturbation (RAP) framework outperforms standard and prior methods in both white-box and black-box transfer scenarios.
• The universal perturbation function beats state-of-the-art instance-specific attacks in transfers across models and domains, with large average gains in fooling rates.
• Cross-domain black-box results show substantial fooling rates even when attacker lacks target-model access, architecture, or data distribution knowledge.
• Gaussian smoothing on the generator output can further boost transferability against adversarially trained models.
• Training dynamics indicate that increasing epochs improves transferability against naturally trained models but can reduce it against adversarially trained ones.