[Paper Review] Understanding Adversarial Examples from the Mutual Influence of Images and Perturbations

Chaoning Zhang, Philipp Benz+2 more|arXiv (Cornell University)|Jul 13, 2020

Adversarial Robustness in Machine Learning50 references4 citations

TL;DR

This paper proposes a novel framework that treats DNN logits as feature vectors to analyze the mutual influence between clean images and adversarial perturbations using Pearson correlation coefficient (PCC). It reveals that universal adversarial perturbations (UAPs) contain dominant features while images act like noise to them, enabling the first data-free targeted UAP generation using only a proxy dataset—achieving performance comparable to state-of-the-art methods that require original training data.

ABSTRACT

A wide variety of works have explored the reason for the existence of adversarial examples, but there is no consensus on the explanation. We propose to treat the DNN logits as a vector for feature representation, and exploit them to analyze the mutual influence of two independent inputs based on the Pearson correlation coefficient (PCC). We utilize this vector representation to understand adversarial examples by disentangling the clean images and adversarial perturbations, and analyze their influence on each other. Our results suggest a new perspective towards the relationship between images and universal perturbations: Universal perturbations contain dominant features, and images behave like noise to them. This feature perspective leads to a new method for generating targeted universal adversarial perturbations using random source images. We are the first to achieve the challenging task of a targeted universal attack without utilizing original training data. Our approach using a proxy dataset achieves comparable performance to the state-of-the-art baselines which utilize the original training dataset.

Motivation & Objective

• To understand the intrinsic relationship between clean images and adversarial perturbations in universal adversarial attacks.
• To challenge the conventional view that perturbations are noise by analyzing their feature dominance using DNN logits.
• To develop a method for generating targeted universal adversarial perturbations without access to original training data.
• To validate the effectiveness of proxy datasets—such as COCO—for targeted UAP generation in data-scarce settings.

Proposed method

• Treat DNN logit outputs as a vector representation for feature analysis, rather than focusing only on the top-activated class.
• Use the Pearson correlation coefficient (PCC) to quantify the linear influence of two independent inputs (e.g., image and perturbation) on the combined logit vector.
• Disentangle the contributions of clean images and perturbations by computing PCC between the logit vectors of individual inputs and their sum.
• Leverage the insight that UAPs dominate over images to design a targeted UAP generation method using random source images as a proxy dataset.
• Formulate a non-targeted loss function in Equation 4 to train UAPs without gradient blocking, enabling automatic class dominance search.
• Evaluate performance using fooling ratios and transferability metrics across different network architectures.

Experimental results

Research questions

• RQ1 How do clean images and adversarial perturbations mutually influence the DNN’s logit representation in universal adversarial examples?
• RQ2 Do universal adversarial perturbations contain dominant features compared to the features of the images they are applied to?
• RQ3 Can images be considered as noise relative to the features of universal adversarial perturbations in the context of DNN feature space?
• RQ4 Is it feasible to generate targeted universal adversarial perturbations without access to the original training dataset?
• RQ5 How does the performance of data-free targeted UAP generation compare to state-of-the-art methods that use original training data?

Key findings

• The Pearson correlation coefficient (PCC) analysis reveals that adversarial examples (AEs) are strongly correlated with universal adversarial perturbations (UAPs), but weakly correlated with the original clean images.
• UAPs exhibit dominant features in the DNN feature space, while the input images behave like noise to them, challenging the traditional perception of perturbations as additive noise.
• The proposed method generates targeted UAPs using only a proxy dataset (e.g., COCO), achieving a targeted fooling ratio of 53.4% on Inception-V3—surpassing the prior state-of-the-art of 52% that used original ImageNet data.
• Even without access to original training data, the method achieves performance comparable to state-of-the-art data-free UAP generation methods, demonstrating its practicality.
• Non-targeted transferability of UAPs is reasonably strong, especially between similar architectures like VGG16 and VGG19, with PCC values indicating higher feature similarity.
• Targeted transferability is low, especially across different network families, consistent with findings in image-dependent attacks, and PCC provides additional insight into network transferability.