Abstract:Transfer-based adversarial example is one of the most important classes of black-box attacks. However, there is a trade-off between transferability and imperceptibility of the adversarial perturbation. Prior work in this direction often requires a fixed but large $\ell_p$-norm perturbation budget to reach a good transfer success rate, leading to perceptible adversarial perturbations. On the other hand, most of the current unrestricted adversarial attacks that aim to generate semantic-preserving perturbations suffer from weaker transferability to the target model. In this work, we propose a geometry-aware framework to generate transferable adversarial examples with minimum changes. Analogous to model selection in statistical machine learning, we leverage a validation model to select the best perturbation budget for each image under both the $\ell_{\infty}$-norm and unrestricted threat models. We propose a principled method for the partition of training and validation models by encouraging intra-group diversity while penalizing extra-group similarity. Extensive experiments verify the effectiveness of our framework on balancing imperceptibility and transferability of the crafted adversarial examples. The methodology is the foundation of our entry to the CVPR'21 Security AI Challenger: Unrestricted Adversarial Attacks on ImageNet, in which we ranked 1st place out of 1,559 teams and surpassed the runner-up submissions by 4.59% and 23.91% in terms of final score and average image quality level, respectively. Code is available at <a class="link-external link-https" href="https://github.com/Equationliu/GA-Attack" rel="external noopener nofollow">this https URL</a>.

Geometric Universality of Adversarial Examples in Deep Learning

Intriguing Properties of Adversarial Examples

Generalized Adversarial Training in Riemannian Space

How Can We Deal with Adversarial Examples?

A Simple Explanation for the Existence of Adversarial Examples with Small Hamming Distance

Adversarial Examples in Deep Learning: Characterization and Divergence

The relationship between high-dimensional geometry and adversarial examples

Interpreting Universal Adversarial Example Attacks on Image Classification Models.

Adversarial Examples Generated from Sample Subspace

Adversarial Margin Maximization Networks

Adversarial spheres

Game Theoretical Adversarial Deep Learning with Variational Adversaries

Adversarial examples: attacks and defenses in the physical world

With Friends Like These, Who Needs Adversaries?

Adversarial Examples Exist in Two-Layer ReLU Networks for Low Dimensional Linear Subspaces

Generalizing universal adversarial perturbations for deep neural networks

Towards Transferable Unrestricted Adversarial Examples with Minimum Changes

Why do universal adversarial attacks work on large language models?: Geometry might be the answer

Detecting Adversarial Examples on Deep Neural Networks with Mutual Information Neural Estimation

Adversarial examples within the training distribution: A widespread challenge

Adversarial Image Generation and Training for Deep Convolutional Neural Networks.