[Paper Review] UPSET and ANGRI : Breaking High Performance Image Classifiers

Sayantan Sarkar, Ankan Bansal+2 more|arXiv (Cornell University)|Jul 4, 2017

Adversarial Robustness in Machine Learning15 references90 citations

TL;DR

This paper presents two black-box targeted attack methods, UPSET (universal perturbations) and ANGRI (image-specific perturbations), to fool high-performance image classifiers on MNIST and CIFAR-10.

ABSTRACT

In this paper, targeted fooling of high performance image classifiers is achieved by developing two novel attack methods. The first method generates universal perturbations for target classes and the second generates image specific perturbations. Extensive experiments are conducted on MNIST and CIFAR10 datasets to provide insights about the proposed algorithms and show their effectiveness.

Motivation & Objective

• Motivate and address targeted fooling of high-performance image classifiers.
• Introduce two attack algorithms, UPSET and ANGRI, that generate perturbed images to force a specific target class.
• Evaluate attack effectiveness and fidelity on MNIST and CIFAR-10 datasets.
• Analyze generalization across different victim classifiers and training schemes.

Proposed method

• UPSET learns a universal perturbation per target class using a residual generator R to produce r_t for each target t; adversarial image is x_hat = clip_U(x, t) where x_hat = max(min(s * R(t) + x, 1), -1).
• ANGRI generates image-specific perturbations by combining an input image x and a target t through a dedicated network A to produce x_hat = A(x, t).
• Both methods optimize a loss L = L_C(x_hat, t) + L_F(x, x_hat) where L_C is a cross-entropy misclassification loss across multiple pretrained classifiers and L_F is a fidelity loss (norm between x and x_hat).
• For UPSET, L_F is replaced by ||R(x, t)||_2^2, since the perturbation is intrinsic to the residual.
• Experiments measure Targeted Fooling Rate (TFR), Misclassification Rate (MR), Fidelity Score (FS), and Confidence (C) on MNIST and CIFAR-10; architectures are detailed for MNIST and CIFAR-10.

Experimental results

Research questions

• RQ1 Can black-box perturbation networks achieve targeted fooling across multiple target classes?
• RQ2 What is the comparative performance of universal perturbations (UPSET) versus image-specific perturbations (ANGRI) in terms of fooling rate and visual fidelity?
• RQ3 How well do UPSET and ANGRI generalize across similar or different victim classifier architectures?
• RQ4 Does simultaneous training on multiple classifiers improve cross-model generalization of the attacks?
• RQ5 How does the visual loss weight w affect targeted fooling and fidelity on MNIST/CIFAR-10?

Key findings

• UPSET and ANGRI achieve notable targeted fooling rates on MNIST and CIFAR-10 under black-box settings.
• ANGRI generally yields higher TFRs at similar fidelity levels than UPSET because it uses input-dependent perturbations.
• Simultaneous training on multiple classifiers improves cross-model generalization of the attacks, often at a small cost to self-attack performance.
• Cross-model fooling rates are higher for classifiers with similar structure; attacks trained on one structure generalize better to others of the same type (e.g., CNNs or ResNets).
• Attack confidence is high when the target class is achieved, indicating strong misclassification certainty under successful fools.