Multi-attacks: multiple images + the same adversarial attack → multiple target labels
Multi-attacks: Many images $+$ the same adversarial attack $\to$ many target labels
Translation in progress — untranslated text is omitted.
The researcher Stanislav Fort proposes an adversarial attack method called multi-attacks, in which a single adversarial perturbation can simultaneously change up to hundreds of images from their original classes to their own individually specified target classes. The authors estimate that the number of high class-confidence regions for a given image in pixel space is about 10^O(100), which they say poses a significant challenge to exhaustive defense strategies. From this one can obtain adversarial attacks that change the resulting class with perturbation strength and scale-invariant adversarial examples; to demonstrate the redundancy and richness of class decision boundaries in pixel space, the authors also found two-dimensional cross-sections that can trace out images and spell words with specific classes. Experiments show that model ensembles can reduce susceptibility to multi-attacks, whereas classifiers trained with random labels are more vulnerable, and the code is open-sourced on GitHub.
- Adversarial examples typically attack only one image at a time. The authors ask: can the same perturbation simultaneously change many images to their own different target classes, and use this to estimate the number of class regions in pixel space.
- For n images and n target classes, a multi-attack is obtained by Adam gradient optimization of the cross-entropy loss of the same perturbation P; a toy geometric model is used to estimate the number of class regions around each image, N≈exp(nmax·log C), from the maximum number of simultaneous attacks nmax.
- On ImageNet-pretrained ResNet50, at 224×224, 483±5 out of 1024 images can be attacked simultaneously; with batch≤160 the success rate is 100%; the larger the ensemble, the harder to attack; models trained with random labels are more easily attacked; attacks that change class with strength and scale-independent attacks are also demonstrated.
- The authors state that more rigorous theory is needed to characterize the scale of redundancy, and they plan to study failure cases that resist attack and fast algorithms. The experiments mainly use ImageNet-pretrained ResNet50 and CIFAR-10 self-trained models, do not test defenses such as adversarial training, and the perturbation L∞ is greater than the conventional 8/255.
Related papers
- Adversarial PatchAttacksarXiv
- On the Adversarial Robustness of Vision TransformersAnalysis / interpretabilityarXiv