Abstract:Deep neural networks are extremely vulnerable to attacks and threats from adversarial examples. These adversarial examples deliberately crafted by attackers can easily fool classification models by adding imperceptibly tiny perturbations on clean images. This brings a great challenge to image security for deep learning. Therefore, studying and designing attack algorithms for generating adversarial examples is essential for building robust models. Moreover, adversarial examples are transferable in that they can mislead multiple different classifiers across models. This makes black-box attacks feasible for practical applications. However, most attack methods have low success rates and weak transferability against black-box models. This is because they often overfit the model during the production of adversarial examples. To address this issue, we propose a Nadam iterative fast gradient method (NAI-FGM), which combines an improved Nadam optimizer with gradient-based iterative attacks. Specifically, we introduce the look-ahead momentum vector and the adaptive learning rate component based on the Momentum Iterative Fast Gradient Sign Method (MI-FGSM). The look-ahead momentum vector is dedicated to making the loss function converge faster and get rid of the poor local maximum. Additionally, the adaptive learning rate component is used to help the adversarial example to converge to a better extreme point by obtaining adaptive update directions according to the current parameters. Furthermore, we also carry out different input transformations to further enhance the attack performance before using NAI-FGM for attack. Finally, we consider attacking the ensemble model. Extensive experiments show that the NAI-FGM has stronger transferability and black-box attack capability than advanced momentum-based iterative attacks. In particular, when using the adversarial examples produced by way of ensemble attack to test the adversarially trained models, the NAI-FGM improves the success rate by 8% to 11% over the other attack methods. Last but not least, the NAI-DI-TI-SI-FGM combined with the input transformation achieves a success rate of 91.3% on average.

Efficient Adversarial Training with Multi-Fidelity Optimization for Robust Neural Network

Feature Augmentation for Adversarial Robustness

Towards Well-trained Model Robustness in Federated Learning: an Adversarial- Example-Generation- Efficiency Perspective

ATRA: Efficient Adversarial Training with High-Robust Area

Towards Both Accurate and Robust Neural Networks Without Extra Data

Enhancing Robust Representation in Adversarial Training: Alignment and Exclusion Criteria

Multi-objective Search of Robust Neural Architectures Against Multiple Types of Adversarial Attacks

An Efficient Framework for Generating Robust Adversarial Examples.

Bi-fidelity Evolutionary Multiobjective Search for Adversarially Robust Deep Neural Architectures

Generating Adversarial Examples with an Optimized Quality

Model-Agnostic Meta-Attack: Towards Reliable Evaluation of Adversarial Robustness

Query-Efficient Generation of Adversarial Examples for Defensive DNNs via Multi-Objective Optimization

Adaptive Multi-scale Degradation-Based Attack for Boosting the Adversarial Transferability

Enhancing Adversarial Robustness Via Anomaly-aware Adversarial Training.

Hard Adversarial Example Mining for Improving Robust Fairness

An efficient adversarial example generation algorithm based on an accelerated gradient iterative fast gradient

Adaptive Feature Alignment for Adversarial Training

Boosting Adversarial Attacks with Nadam Optimizer

DAT: Improving Adversarial Robustness via Generative Amplitude Mix-up in Frequency Domain

Preventing Catastrophic Overfitting in Fast Adversarial Training: A Bi-level Optimization Perspective

Improving Generalization of Adversarial Training via Robust Critical Fine-Tuning