Abstract:Adversarial attacks can evaluate model robustness and have been of great concerns in recent years. Among various attacks, targeted attacks aim at misleading victim models to output adversary-desired predictions, which are more challenging and threatening than untargeted ones. Existing targeted attacks can be roughly divided into instancespecific and instance-agnostic attacks. Instance-specific attacks craft adversarial examples via iterative gradient updating on the specific instance. In contrast, instanceagnostic attacks learn a universal perturbation or a generative model on the global dataset to perform attacks. However they rely too much on the classification boundary of substitute models, ignoring the realistic distribution of target class, which may result in limited targeted attack performance. And there is no attempt to simultaneously combine the information of the specific instance and the global dataset. To deal with these limitations, we first conduct an analysis via a causal graph and propose to craft transferable targeted adversarial examples by injecting target patterns. Based on this analysis, we introduce a generative attack model composed of a cross-attention guided convolution module and a pattern injection module. Concretely, the former adopts a dynamic convolution kernel and a static convolution kernel for the specific instance and the global dataset, respectively, which can inherit the advantages of both instance-specific and instance-agnostic attacks. And the pattern injection module utilizes a pattern prototype to encode target patterns, which can guide the generation of targeted adversarial examples. Besides, we also provide rigorous theoretical analysis to guarantee the effectiveness of our method. Extensive experiments demonstrate that our method show superior performance than 10 existing adversarial attacks against 13 models.

Can Targeted Clean-Label Poisoning Attacks Generalize?

Clean-image Backdoor: Attacking Multi-label Models with Poisoned Labels Only

Class-Targeted Poisoning Attacks Against DNNs

Transferable Clean-Label Poisoning Attacks on Deep Neural Nets

Model-Targeted Poisoning Attacks with Provable Convergence

Bullseye Polytope: A Scalable Clean-Label Poisoning Attack with Improved Transferability

Exploring the Limits of Model-Targeted Indiscriminate Data Poisoning Attacks

From Adversarial Examples to Data Poisoning Instances: Utilizing an Adversarial Attack Method to Poison a Transfer Learning Model

Transferable Availability Poisoning Attacks

Manipulating Pre-Trained Encoder for Targeted Poisoning Attacks in Contrastive Learning

Clean-label Poisoning Attack with Perturbation Causing Dominant Features

Model Poisoning Attack on Neural Network Without Reference Data

Towards Transferable Targeted Attack.

Poisoning Attacks on Machine Learning Models in Cyber Systems and Mitigation Strategies

MetaPoison: Practical General-purpose Clean-label Data Poisoning

Generalization Bound and New Algorithm for Clean-Label Backdoor Attack

Partner in Crime: Boosting Targeted Poisoning Attacks against Federated Learning

Dynamic Generative Targeted Attacks with Pattern Injection

Witches' Brew: Industrial Scale Data Poisoning via Gradient Matching

A Flexible Poisoning Attack Against Machine Learning.

Broadly Applicable Targeted Data Sample Omission Attacks