A New Ensemble Adversarial Attack Powered by Long-Term Gradient Memories - Archive ouverte HAL Accéder directement au contenu
Article Dans Une Revue Proceedings of the AAAI Conference on Artificial Intelligence Année : 2020

A New Ensemble Adversarial Attack Powered by Long-Term Gradient Memories

Zhaohui Che
Ali Borji
Guangtao Zhai
Suiyi Ling
Jing Li
  • Fonction : Auteur

Résumé

Deep neural networks are vulnerable to adversarial attacks. More importantly, some adversarial examples crafted against an ensemble of pre-trained source models can transfer to other new target models, thus pose a security threat to black-box applications (when the attackers have no access to the target models). Despite adopting diverse architectures and parameters, source and target models often share similar decision boundaries. Therefore, if an adversary is capable of fooling several source models concurrently, it can potentially capture intrinsic transferable adversarial information that may allow it to fool a broad class of other black-box target models. Current ensemble attacks, however, only consider a limited number of source models to craft an adversary, and obtain poor transferability. In this paper, we propose a novel black-box attack, dubbed Serial-Mini-Batch-Ensemble-Attack (SMBEA). SMBEA divides a large number of pre-trained source models into several mini-batches. For each single batch, we design 3 new ensemble strategies to improve the intra-batch transferability. Besides, we propose a new algorithm that recursively accumulates the “long-term” gradient memories of the previous batch to the following batch. This way, the learned adversarial information can be preserved and the inter-batch transferability can be improved. Experiments indicate that our method outperforms state-of-the-art ensemble attacks over multiple pixel-to-pixel vision tasks including image translation and salient region prediction. Our method successfully fools two online black-box saliency prediction systems including DeepGaze-II (Kummerer 2017) and SALICON (Huang et al. 2017). Finally, we also contribute a new repository to promote the research on adversarial attack and defense over pixel-to-pixel tasks: https://github.com/CZHQuality/AAA-Pix2pix.

Dates et versions

hal-03652644 , version 1 (26-04-2022)

Identifiants

Citer

Zhaohui Che, Ali Borji, Guangtao Zhai, Suiyi Ling, Jing Li, et al.. A New Ensemble Adversarial Attack Powered by Long-Term Gradient Memories. Proceedings of the AAAI Conference on Artificial Intelligence, 2020, 34 (04), pp.3405-3413. ⟨10.1609/aaai.v34i04.5743⟩. ⟨hal-03652644⟩
17 Consultations
0 Téléchargements

Altmetric

Partager

Gmail Facebook X LinkedIn More