[Paper Review] Enhancing Generalization of Universal Adversarial Perturbation through Gradient Aggregation

Xuannan Liu, Yaoyao Zhong+3 more|arXiv (Cornell University)|Aug 11, 2023

Adversarial Robustness in Machine Learning4 citations

TL;DR

This paper proposes Stochastic Gradient Aggregation (SGA), a novel method to enhance the generalization of universal adversarial perturbations (UAPs) by mitigating gradient vanishing and escaping poor local optima. SGA performs inner pre-search with small-batch gradients, aggregates them into a stable one-step update, and significantly improves UAP transferability, achieving a 95.95% average fooling ratio on ImageNet, surpassing state-of-the-art methods.

ABSTRACT

Deep neural networks are vulnerable to universal adversarial perturbation (UAP), an instance-agnostic perturbation capable of fooling the target model for most samples. Compared to instance-specific adversarial examples, UAP is more challenging as it needs to generalize across various samples and models. In this paper, we examine the serious dilemma of UAP generation methods from a generalization perspective -- the gradient vanishing problem using small-batch stochastic gradient optimization and the local optima problem using large-batch optimization. To address these problems, we propose a simple and effective method called Stochastic Gradient Aggregation (SGA), which alleviates the gradient vanishing and escapes from poor local optima at the same time. Specifically, SGA employs the small-batch training to perform multiple iterations of inner pre-search. Then, all the inner gradients are aggregated as a one-step gradient estimation to enhance the gradient stability and reduce quantization errors. Extensive experiments on the standard ImageNet dataset demonstrate that our method significantly enhances the generalization ability of UAP and outperforms other state-of-the-art methods. The code is available at https://github.com/liuxuannan/Stochastic-Gradient-Aggregation.

Motivation & Objective

• To investigate the root causes of poor generalization in existing universal adversarial perturbation (UAP) methods.
• To address the dual challenges of gradient instability and quantization error in small-batch UAP training.
• To overcome the trade-off between small-batch optimization (gradient vanishing) and large-batch optimization (poor local optima) in UAP generation.
• To improve the transferability and robustness of UAPs across diverse models and samples.
• To develop a simple, effective, and integrable method that enhances UAP generalization without requiring architectural changes.

Proposed method

• SGA employs an outer-outer iteration framework where each outer step performs multiple inner pre-searches using small-batch samples.
• During inner iterations, gradients are computed and accumulated without quantization to preserve gradient stability.
• All inner gradients are aggregated into a single, low-variance gradient estimate before quantization and outer update.
• The aggregated gradient is used to update the universal perturbation, reducing quantization error and improving convergence directionality.
• The method leverages small-batch stochastic optimization for generalization while using gradient aggregation to stabilize updates and escape sharp local minima.
• SGA is compatible with existing gradient-based UAP methods and can be easily integrated with transferability-enhancing techniques like momentum and model ensembling.

Experimental results

Research questions

• RQ1 What are the primary causes of poor generalization in current universal adversarial perturbation generation methods?
• RQ2 How does gradient instability and quantization error contribute to gradient vanishing in small-batch UAP training?
• RQ3 Can gradient aggregation effectively stabilize optimization and reduce quantization error in UAP generation?
• RQ4 Does SGA improve transferability of UAPs across diverse models and datasets?
• RQ5 How do hyperparameters such as inner batch size and inner iteration count affect the performance of SGA?

Key findings

• SGA achieves a 95.95% average fooling ratio on five standard ImageNet models, outperforming state-of-the-art methods.
• The method improves attack success rates by up to 77.11% in ensemble model settings, demonstrating strong transferability.
• Gradient aggregation significantly outperforms perturbation aggregation, proving that gradient-level aggregation is key to reducing gradient deviation.
• An inner batch size of 10 yields optimal performance, indicating a balance between stability and diversity in gradient estimation.
• An inner iteration count of K=4 (where K is the average number of traversals per image) maximizes attack success, showing optimal exploration of gradient space.
• SGA enhances generalization without increasing computational cost per gradient calculation, maintaining efficiency while improving robustness.