[Paper Review] Pre-trained Adversarial Perturbations

Yuanhao Ban, Yinpeng Dong|arXiv (Cornell University)|Oct 7, 2022

Adversarial Robustness in Machine Learning4 citations

TL;DR

This paper introduces Pre-trained Adversarial Perturbations (PAPs), a novel universal adversarial attack method targeting pre-trained vision models before fine-tuning. By leveraging a Low-Level Layer Lifting Attack (L4A) that manipulates early-layer activations and enhancing transferability with uniform Gaussian noise augmentation, PAPs achieve significantly higher attack success rates—up to 95.3%—against fine-tuned models across ten downstream tasks, outperforming state-of-the-art methods under a quasi-black-box setting.

ABSTRACT

Self-supervised pre-training has drawn increasing attention in recent years due to its superior performance on numerous downstream tasks after fine-tuning. However, it is well-known that deep learning models lack the robustness to adversarial examples, which can also invoke security issues to pre-trained models, despite being less explored. In this paper, we delve into the robustness of pre-trained models by introducing Pre-trained Adversarial Perturbations (PAPs), which are universal perturbations crafted for the pre-trained models to maintain the effectiveness when attacking fine-tuned ones without any knowledge of the downstream tasks. To this end, we propose a Low-Level Layer Lifting Attack (L4A) method to generate effective PAPs by lifting the neuron activations of low-level layers of the pre-trained models. Equipped with an enhanced noise augmentation strategy, L4A is effective at generating more transferable PAPs against fine-tuned models. Extensive experiments on typical pre-trained vision models and ten downstream tasks demonstrate that our method improves the attack success rate by a large margin compared with state-of-the-art methods.

Motivation & Objective

• To investigate the vulnerability of pre-trained models to adversarial attacks that remain effective after fine-tuning.
• To address the gap in adversarial robustness evaluation for pre-training to fine-tuning pipelines.
• To develop a universal adversarial attack method effective in a quasi-black-box setting where downstream task details are unknown.
• To improve cross-fine-tuning transferability of adversarial perturbations by focusing on low-level feature representations.

Proposed method

• Proposes a Low-Level Layer Lifting Attack (L4A) that targets and manipulates neuron activations in the early layers of pre-trained models.
• Leverages the observation that low-level layers are less modified during fine-tuning, preserving attack effectiveness.
• Introduces a noise augmentation strategy using uniform Gaussian sampling to improve the transferability of PAPs.
• Generates PAPs by optimizing perturbations that maximize misclassification while minimizing changes to low-level features.
• Employs a loss function that emphasizes low-level layer activations to guide perturbation generation.
• Uses a single hyperparameter configuration (μl=0.4, μh=0.6, σl=0.05, σh=0.1) across models to maintain consistency and generalization.

Experimental results

Research questions

• RQ1 Can adversarial perturbations crafted for pre-trained models maintain high transferability to downstream models after fine-tuning?
• RQ2 Why do low-level layers of pre-trained models offer better targets for universal adversarial attacks in the pre-training to fine-tuning pipeline?
• RQ3 How does noise augmentation improve the cross-finetuning transferability of universal adversarial perturbations?
• RQ4 To what extent does the inclusion of high-level layer losses degrade the performance of universal adversarial attack methods in this context?
• RQ5 How does the proposed L4A method compare to existing universal attack baselines in terms of attack success rate across diverse downstream tasks?

Key findings

• The L4A method achieves an average attack success rate of 71.90% on ResNet101, 72.64% on ResNet50, and 94.42% on ViT-Base-16 when using the base L4A configuration.
• With noise augmentation (L4A ugs), the attack success rate increases to 72.20% on ResNet101, 77.80% on ResNet50, and 95.30% on ViT-Base-16, demonstrating significant improvement.
• The method outperforms all baselines, including EPGD, UAP, and ASV, across all three pre-trained models and ten downstream tasks.
• Pixel-level perturbations with ε=0.05 achieve only 12.52% average attack success rate, indicating that standard perturbations are ineffective in this context.
• High-level layer losses significantly degrade performance, causing over 10% drop in attack success rate, confirming that focusing on low-level features is critical.
• The hyperparameter configuration (μl=0.4, μh=0.6, σl=0.05, σh=0.1) generalizes well across models without re-tuning, ensuring consistent performance.