[Paper Review] Efficient Project Gradient Descent for Ensemble Adversarial Attack

Fanyou Wu, Rado Gazo+2 more|arXiv (Cornell University)|Jun 7, 2019

Adversarial Robustness in Machine Learning18 references4 citations

TL;DR

This paper proposes Efficient Project Gradient Descent (EPGD), an enhanced PGD method for targeted adversarial attacks on ensemble models that dynamically adjusts step size and ensemble weights per iteration per input. By optimizing search direction and perturbation magnitude adaptively, EPGD generates smaller perturbation adversarial examples than standard PGD while maintaining high efficiency, achieving first place in the IJCAI19 Targeted Adversarial Attack competition.

ABSTRACT

Recent advances show that deep neural networks are not robust to deliberately crafted adversarial examples which many are generated by adding human imperceptible perturbation to clear input. Consider $l_2$ norms attacks, Project Gradient Descent (PGD) and the Carlini and Wagner (C\&W) attacks are the two main methods, where PGD control max perturbation for adversarial examples while C\&W approach treats perturbation as a regularization term optimized it with loss function together. If we carefully set parameters for any individual input, both methods become similar. In general, PGD attacks perform faster but obtains larger perturbation to find adversarial examples than the C\&W when fixing the parameters for all inputs. In this report, we propose an efficient modified PGD method for attacking ensemble models by automatically changing ensemble weights and step size per iteration per input. This method generates smaller perturbation adversarial examples than PGD method while remains efficient as compared to C\&W method. Our method won the first place in IJCAI19 Targeted Adversarial Attack competition.

Motivation & Objective

• To develop a more efficient and effective adversarial attack method for ensemble deep neural networks.
• To reduce the magnitude of perturbations in adversarial examples while preserving attack success rate.
• To improve upon standard Projected Gradient Descent (PGD) by dynamically adjusting step size and ensemble weights per input and iteration.
• To achieve superior performance in the IJCAI19 Targeted Adversarial Attack competition, particularly in minimizing perturbation size under time constraints.
• To provide a robust, implementation-ready framework for generating low-noise adversarial examples across diverse models and image transformations.

Proposed method

• EPGD modifies standard PGD by introducing adaptive step size and dynamic ensemble weighting per input and iteration, improving search direction and convergence.
• The method uses a step-like strategy that starts with small perturbation parameters and gradually increases the maximum allowed perturbation to balance efficiency and noise reduction.
• Ensemble weights are automatically adjusted per input based on model confidence and gradient information to enhance attack effectiveness.
• A novel image mapping function is employed to convert floating-point adversarial images to integer pixel values, minimizing distortion and preserving adversarial properties.
• The framework uses bilinear interpolation via PIL.Image.BILINEAR for consistent resizing to 299×299, ensuring compatibility with evaluation models and avoiding discrepancies from TensorFlow’s default resize behavior.
• The method is implemented in TensorFlow 1.14 to ensure compatibility with official evaluation models, which are hosted in TensorFlow, and avoids performance issues found in later versions.

Experimental results

Research questions

• RQ1 Can adaptive step size and dynamic ensemble weighting improve the efficiency and robustness of PGD-based adversarial attacks on ensemble models?
• RQ2 How can adversarial examples be generated with smaller perturbation magnitudes while maintaining high attack success rates?
• RQ3 What impact do image preprocessing and resizing methods have on adversarial example performance and consistency across different deep learning frameworks?
• RQ4 How does the choice of image mapping function (e.g., round vs. floor) affect the final perturbation size and attack success in competitive settings?
• RQ5 Can a hybrid approach combining adaptive parameters and careful implementation choices outperform fixed-parameter PGD and C&W-style attacks in terms of both perturbation size and computational efficiency?

Key findings

• EPGD achieved first place in the IJCAI19 Targeted Adversarial Attack competition by generating adversarial examples with significantly smaller perturbations than standard PGD.
• The method reduced the average perturbation size compared to baseline PGD while maintaining high attack success rates, demonstrating improved efficiency in the targeted attack setting.
• Adaptive step size and dynamic ensemble weighting were critical in minimizing perturbation magnitude without sacrificing attack speed or success.
• The use of PIL.Image.BILINEAR for resizing ensured consistent image transformation, avoiding performance degradation caused by TensorFlow’s inconsistent resize behavior in versions prior to 1.14.
• The final implementation in TensorFlow 1.14 achieved the best balance between compatibility with official models and computational performance, outperforming both PyTorch and later TensorFlow versions in this context.
• The proposed image mapping function, which rounds to the nearest integer while preserving proximity to the original image, outperformed floor and standard round operations in adversarial example quality.