[Paper Review] Customizing an Adversarial Example Generator with Class-Conditional GANs

Shih-Hong Tsai|arXiv (Cornell University)|Jun 27, 2018

Adversarial Robustness in Machine Learning21 references4 citations

TL;DR

This paper proposes Adaptive GAN, a non-perturbation-based method that uses class-conditional GANs to generate native adversarial examples from scratch, bypassing reliance on existing clean data. It achieves competitive attack success rates—64.20% on MNIST and 61.90% on CIFAR10—demonstrating that GAN-based generation expands adversarial example diversity beyond perturbation-based methods.

ABSTRACT

Adversarial examples are intentionally crafted data with the purpose of deceiving neural networks into misclassification. When we talk about strategies to create such examples, we usually refer to perturbation-based methods that fabricate adversarial examples by applying invisible perturbations onto normal data. The resulting data reserve their visual appearance to human observers, yet can be totally unrecognizable to DNN models, which in turn leads to completely misleading predictions. In this paper, however, we consider crafting adversarial examples from existing data as a limitation to example diversity. We propose a non-perturbation-based framework that generates native adversarial examples from class-conditional generative adversarial networks.As such, the generated data will not resemble any existing data and thus expand example diversity, raising the difficulty in adversarial defense. We then extend this framework to pre-trained conditional GANs, in which we turn an existing generator into an "adversarial-example generator". We conduct experiments on our approach for MNIST and CIFAR10 datasets and have satisfactory results, showing that this approach can be a potential alternative to previous attack strategies.

Motivation & Objective

• Address the limited diversity of adversarial examples generated by perturbation-based methods, which rely on modifying existing clean data.
• Overcome the constraint that adversarial examples must visually resemble real data by generating entirely new, native adversarial examples.
• Develop a framework to adapt pre-trained conditional GANs into adversarial-example generators without retraining from scratch.
• Demonstrate that GAN-based generation can produce effective adversarial examples that surpass or match the performance of traditional perturbation-based attacks.

Proposed method

• Train a class-conditional GAN to generate images conditioned on specific target classes, directly producing adversarial examples without perturbing real images.
• Modify the GAN's generator loss to encourage misclassification by the target classifier, effectively turning the generator into an adversarial-example generator.
• Use adaptive retraining on pre-trained conditional GANs (e.g., ACGAN and DCGAN) to fine-tune the generator for adversarial generation with minimal training overhead.
• Integrate techniques such as batch normalization, leaky ReLU, label smoothing, and minibatch discrimination to improve GAN training stability and image quality.
• Apply the trained generator to produce adversarial examples for targeted attacks, where the model is optimized to misclassify the generated image as the target class.
• Evaluate the attack success rate using standard benchmarks like PGD and FGSM on MNIST and CIFAR10, comparing performance against perturbation-based baselines.

Experimental results

Research questions

• RQ1 Can a generative model like a conditional GAN be effectively repurposed to generate native adversarial examples without perturbing existing data?
• RQ2 Does the proposed Adaptive GAN framework expand the adversarial example subspace beyond the limitations of perturbation-based methods?
• RQ3 How effective is the Adaptive GAN in achieving high attack success rates on standard datasets like MNIST and CIFAR10 compared to state-of-the-art perturbation-based attacks?
• RQ4 To what extent can pre-trained conditional GANs be adapted into adversarial-example generators with minimal retraining?
• RQ5 What are the trade-offs in image quality and perceptual realism between GAN-generated adversarial examples and those from perturbation-based methods?

Key findings

• Adaptive GAN achieved an attack success rate of 64.20% on the MNIST dataset, outperforming all tested perturbation-based methods including FGSM and PGD.
• On the CIFAR10 robustness challenge, Adaptive GAN achieved a 61.90% attack success rate, surpassing all baseline perturbation-based methods such as 20-step PGD and FGSM.
• The method successfully transformed a pre-trained conditional GAN into an adversarial-example generator through only 2 epochs of adaptive retraining, significantly reducing training time.
• Despite lower perceptual quality compared to perturbation-based methods, the generated adversarial examples were still effective, indicating the method's practical viability.
• The attack success rate of Adaptive GAN was not limited by perturbation size, as it generates entirely new images, which may explain its higher performance on robust classifiers.
• The framework demonstrates that GAN-based generation can produce adversarial examples that are structurally distinct from real data, thereby expanding the adversarial example subspace.