[Paper Review] Generating Adversarial Examples with Adversarial Networks

Chaowei Xiao, Bo Li+4 more|arXiv (Cornell University)|Jan 8, 2018

Adversarial Robustness in Machine Learning34 references238 citations

TL;DR

AdvGAN trains a GAN-based generator to produce perceptually realistic adversarial perturbations, enabling fast semi-whitebox and black-box attacks with high success rates even against defenses.

ABSTRACT

Deep neural networks (DNNs) have been found to be vulnerable to adversarial examples resulting from adding small-magnitude perturbations to inputs. Such adversarial examples can mislead DNNs to produce adversary-selected results. Different attack strategies have been proposed to generate adversarial examples, but how to produce them with high perceptual quality and more efficiently requires more research efforts. In this paper, we propose AdvGAN to generate adversarial examples with generative adversarial networks (GANs), which can learn and approximate the distribution of original instances. For AdvGAN, once the generator is trained, it can generate adversarial perturbations efficiently for any instance, so as to potentially accelerate adversarial training as defenses. We apply AdvGAN in both semi-whitebox and black-box attack settings. In semi-whitebox attacks, there is no need to access the original target model after the generator is trained, in contrast to traditional white-box attacks. In black-box attacks, we dynamically train a distilled model for the black-box model and optimize the generator accordingly. Adversarial examples generated by AdvGAN on different target models have high attack success rate under state-of-the-art defenses compared to other attacks. Our attack has placed the first with 92.76% accuracy on a public MNIST black-box attack challenge.

Motivation & Objective

• Motivate the need for high-quality, efficiently generated adversarial examples.
• Propose AdvGAN to learn perturbations that look real while fooling target models.
• Demonstrate effectiveness of AdvGAN in semi-whitebox and black-box settings.
• Show robustness of AdvGAN against state-of-the-art defenses and on large-scale challenges.

Proposed method

• Introduce a generator G and discriminator D forming a GAN conditioned on the input x.
• Use an adversarial loss L_adv^f to steer perturbations toward a target class or away from the true class.
• Incorporate a GAN loss L_GAN to keep generated perturbations visually similar to original data.
• Add a hinge loss L_hinge to bound perturbation magnitude and stabilize GAN training.
• Combine losses into L = L_adv^f + α L_GAN + β L_hinge and train the min-max game min_G max_D L.
• For black-box attacks, employ static and dynamic distillation to approximate the target model and adapt G accordingly.

Experimental results

Research questions

• RQ1 Can AdvGAN generate perceptually realistic adversarial examples that effectively fool models under white-box and black-box settings?
• RQ2 How does AdvGAN perform against state-of-the-art defenses compared to other attacks?
• RQ3 Can black-box attacks be effectively conducted without relying on transferability?
• RQ4 What is the impact of dynamic distillation versus static distillation on black-box attack performance?
• RQ5 Do high-resolution adversarial examples maintain perceptual realism while achieving high attack success?

Key findings

• AdvGAN achieves high attack success across MNIST and CIFAR-10 in semi-whitebox settings (MNIST: A 97.9%, B 97.1%, C 98.3%; CIFAR-10: ResNet 94.7%, Wide ResNet 99.3%).
• Black-box attacks with dynamic distillation reach high success (MNIST b-D 93.4%, CIFAR-10 b-D 78.5% for ResNet and 81.8% for Wide ResNet).
• AdvGAN attains strong performance under defenses; in semi-whitebox defenses, attack rates exceed FGSM and some Opt methods (examples: MNIST A 8.0%, A: AdvGAN 11.5% under one defense; CIFAR-10 ResNet 16.03% under AdvGAN vs 11.9% for FGSM).
• On the MNIST challenge with the MadryLab model, AdvGAN achieves 88.93% accuracy in white-box and 92.76% in black-box settings (top performance in the challenge).
• High-resolution adversarial examples against Inception_v3 yield 100% attack success at 299×299 with L_infinity bound 0.01, and human perceptual studies show AdvGAN examples are nearly as realistic as benign images (AMT: 49.4% chose AdvGAN as more realistic).