{"type":"ScholarlyArticle","title":"Improving Transferability of Adversarial Examples with Virtual Step and Auxiliary Gradients","authors":[{"name":"Ming Zhang","slug":"ming-zhang","given":"Ming","family":"Zhang","affiliation":"National Key Laboratory of Science and Technology on Information System Security , Beijing , China"},{"name":"Xiaohui Kuang","slug":"xiaohui-kuang","given":"Xiaohui","family":"Kuang","affiliation":"National Key Laboratory of Science and Technology on Information System Security , Beijing , China"},{"name":"Hu Li","slug":"hu-li","given":"Hu","family":"Li","affiliation":"National Key Laboratory of Science and Technology on Information System Security , Beijing , China"},{"name":"Zhendong Wu","slug":"zhendong-wu","given":"Zhendong","family":"Wu","affiliation":"National Key Laboratory of Science and Technology on Information System Security , Beijing , China"},{"name":"Yuanping Nie","slug":"yuanping-nie","given":"Yuanping","family":"Nie","affiliation":"National Key Laboratory of Science and Technology on Information System Security , Beijing , China"},{"name":"Gang Zhao","slug":"gang-zhao","given":"Gang","family":"Zhao","affiliation":"National Key Laboratory of Science and Technology on Information System Security , Beijing , China"}],"abstract":"Deep neural networks have been demonstrated to be vulnerable to adversarial examples, which fool networks by adding human-imperceptible perturbations to benign examples. At present, the practical transfer-based black-box attacks are attracting significant attention. However, most existing transfer-based attacks achieve only relatively limited success rates. We propose to improve the transferability of adversarial examples through the use of a virtual step and auxiliary gradients. Here, the “virtual step” refers to using an unusual step size and clipping adversarial perturbations only in the last iteration, while the “auxiliary gradients” refer to using not only gradients corresponding to the ground-truth label (for untargeted attacks), but also gradients corresponding to some other labels to generate adversarial perturbations. Our proposed virtual step and auxiliary gradients can be easily integrated into existing gradient-based attacks. Extensive experiments on ImageNet show that the adversarial examples crafted by our method can effectively transfer to different networks. For single-model attacks, our method outperforms the state-of-the-art baselines, improving the success rates by a large margin of 12%~28%. Our code is publicly available at https://github.com/mingcheung/Virtual-Step-and-Auxiliary-Gradients.","doi":"10.24963/ijcai.2022/227","url":"https://ijcai.org/proceedings/2022/227","pdf":"https://ijcai.org/proceedings/2022/0227.pdf","markdown":"https://ijcai.org/proceedings/2022/227.md","bibtex":"https://ijcai.org/proceedings/2022/bibtex/227","volume":{"slug":"2022","title":"Proceedings of the Thirty-First International Joint Conference on Artificial Intelligence","short_title":"IJCAI 2022","url":"https://ijcai.org/proceedings/2022/","year":2022,"location":"Vienna","dates":"23-29 July 2022","editors":"Luc De Raedt","isbn":"978-1-956792-00-3","publisher":"International Joint Conferences on Artificial Intelligence Organization","doi_prefix":"10.24963/ijcai.2022"},"section":"Computer Vision","track":"Main Track","number":227,"pages":{"first":1629,"last":1635},"keywords":["Machine Learning: Adversarial Machine Learning","Machine Learning: Convolutional Networks","Computer Vision: Adversarial learning, adversarial attack and defense methods"],"videos":[{"label":"Video #1","url":"https://slideslive.com/38986724","length_sec":86,"provider":"slideslive"},{"label":"Video #2","url":"https://slideslive.com/38984867","length_sec":340,"provider":"slideslive"}],"references":[{"position":1,"raw":"[Akhtar and Mian, 2018] Naveed Akhtar and Ajmal Mian. Threat of Adversarial Attacks on Deep Learning in Com- puter Vision: A Survey. IEEE Access, 2018.","title":"Threat of Adversarial Attacks on Deep Learning in Computer Vision: A Survey","authors":"Naveed Akhtar, Ajmal Mian","year":"2018","venue":"IEEE Access","doi":null,"url":null,"internal_url":null},{"position":2,"raw":"[Akhtar et al., 2021] Naveed Akhtar, Ajmal Mian, Navid Kardan, and Mubarak Shah. Advances in Adversarial At- tacks and Defenses in Computer Vision: A Survey. IEEE Access, 2021.","title":"Advances in Adversarial Attacks and Defenses in Computer Vision: A Survey","authors":"Naveed Akhtar, Ajmal Mian, Navid Kardan, Mubarak Shah","year":"2021","venue":null,"doi":null,"url":null,"internal_url":null},{"position":3,"raw":"[Biggio et al., 2013] Battista Biggio, Igino Corona, Davide Maiorca, Blaine Nelson, Nedim Srndic, Pavel Laskov, Giorgio Giacinto, and Fabio Roli. Evasion Attacks against Machine Learning at Test Time. In Proc. of ECML, 2013.","title":"Evasion Attacks against Machine Learning at Test Time","authors":"Battista Biggio, Igino Corona, Davide Maiorca, Blaine Nelson, Nedim Srndic, Pavel Laskov, Giorgio Giacinto, Fabio Roli","year":"2013","venue":"Proc. of ECML","doi":null,"url":null,"internal_url":null},{"position":4,"raw":"[Brendel et al., 2018] Wieland Brendel, Jonas Rauber, and Matthias Bethge. Decision-Based Adversarial Attacks: Reliable Attacks Against Black-Box Machine Learning Models. In Proc. of ICLR, 2018.","title":"Decision-Based Adversarial Attacks: Reliable Attacks Against Black-Box Machine Learning Models","authors":"Wieland Brendel, Jonas Rauber, Matthias Bethge","year":"2018","venue":"Proc. of ICLR","doi":null,"url":null,"internal_url":null},{"position":5,"raw":"[Chen et al., 2020] Jianbo Chen, Michael I. Jordan, and Martin J. Wainwright. HopSkipJumpAttack: A Query- Efficient Decision-Based Attack. In Proc. of SP, 2020.","title":"HopSkipJumpAttack: A Query-Efficient Decision-Based Attack","authors":"Jianbo Chen, Michael I Jordan, Martin J Wainwright","year":"2020","venue":"Proc. of SP","doi":null,"url":null,"internal_url":null},{"position":6,"raw":"[Chollet, 2017] Franc ¸ois Chollet. Xception: Deep Learn- ing with Depthwise Separable Convolutions. In Proc. of CVPR, 2017.","title":"Franc ¸ois Chollet. Xception: Deep Learning with Depthwise Separable Convolutions","authors":"Chollet","year":"2017","venue":"Proc. of CVPR","doi":null,"url":null,"internal_url":null},{"position":7,"raw":"[Dalvi et al., 2004] Nilesh Dalvi, Pedro Domingos, Mausam, Sumit Sanghai, and Deepak Verma. Ad- versarial classification. In Proc. of KDD, 2004.","title":"Adversarial classification","authors":"Nilesh Dalvi, Pedro Domingos, Sumit Mausam, Deepak Sanghai, Verma","year":"2004","venue":"Proc. of KDD","doi":null,"url":null,"internal_url":null},{"position":8,"raw":"[Dong et al., 2018] Yinpeng Dong, Fangzhou Liao, Tianyu Pang, Hang Su, Jun Zhu, Xiaolin Hu, and Jianguo Li. Boosting Adversarial Attacks with Momentum. In Proc. of CVPR, 2018.","title":"Boosting Adversarial Attacks with Momentum","authors":"Dong","year":"2018","venue":"Proc. of CVPR","doi":null,"url":null,"internal_url":null},{"position":9,"raw":"[Dong et al., 2019] Yinpeng Dong, Tianyu Pang, Hang Su, and Jun Zhu. Evading Defenses to Transferable Adversar- ial Examples by Translation-Invariant Attacks. In Proc. of CVPR, 2019.","title":"Evading Defenses to Transferable Adversarial Examples by Translation-Invariant Attacks","authors":"Dong","year":"2019","venue":"Proc. of CVPR","doi":null,"url":null,"internal_url":null},{"position":10,"raw":"[Goodfellow et al., 2015] Ian J. Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and Harness- ing Adversarial Examples. In Proc. of ICLR, 2015.","title":"Explaining and Harnessing Adversarial Examples","authors":"Ian J Goodfellow, Jonathon Shlens, Christian Szegedy","year":"2015","venue":"Proc. of ICLR","doi":null,"url":null,"internal_url":null},{"position":11,"raw":"[Guo et al., 2018] Chuan Guo, Mayank Rana, Moustapha Cisse, and Laurens van der Maaten. Countering Adversar- ial Images using Input Transformations. In Proc. of ICLR, 2018.","title":"Countering Adversarial Images using Input Transformations","authors":"Chuan Guo, Mayank Rana, Moustapha Cisse, Laurens Van Der Maaten","year":"2018","venue":"Proc. of ICLR","doi":null,"url":null,"internal_url":null},{"position":12,"raw":"[He et al., 2016] Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Identity Mappings in Deep Residual Networks. In Proc. of ECCV, 2016.","title":"Identity Mappings in Deep Residual Networks","authors":"Kaiming He, Xiangyu Zhang, Shaoqing Ren, Jian Sun","year":"2016","venue":"Proc. of ECCV","doi":null,"url":null,"internal_url":null},{"position":13,"raw":"[Kurakin et al., 2017] Alexey Kurakin, Ian Goodfellow, and Samy Bengio. Adversarial examples in the physical world. In Proc. of ICLR, 2017.","title":"Adversarial examples in the physical world","authors":"Alexey Kurakin, Ian Goodfellow, Samy Bengio","year":"2017","venue":"Proc. of ICLR","doi":null,"url":null,"internal_url":null},{"position":14,"raw":"[Li et al., 2020] Yingwei Li, Song Bai, Yuyin Zhou, Cihang Xie, Zhishuai Zhang, and Alan Yuille. Learning Transfer- able Adversarial Examples via Ghost Networks. In Proc. of AAAI, 2020.","title":"Learning Transferable Adversarial Examples via Ghost Networks","authors":"Yingwei Li, Song Bai, Yuyin Zhou, Cihang Xie, Zhishuai Zhang, Alan Yuille","year":"2020","venue":"Proc. of AAAI","doi":null,"url":null,"internal_url":null},{"position":15,"raw":"[Liao et al., 2018] Fangzhou Liao, Ming Liang, Yinpeng Dong, Tianyu Pang, Xiaolin Hu, and Jun Zhu. Defense Against Adversarial Attacks Using High-Level Represen- tation Guided Denoiser. In Proc. of CVPR, 2018.","title":"Defense Against Adversarial Attacks Using High-Level Representation Guided Denoiser","authors":"Fangzhou Liao, Ming Liang, Yinpeng Dong, Tianyu Pang, Xiaolin Hu, Jun Zhu","year":"2018","venue":"Proc. of CVPR","doi":null,"url":null,"internal_url":null},{"position":16,"raw":"[Liu et al., 2019] Yujia Liu, Seyed-Mohsen Moosavi- Dezfooli, and Pascal Frossard. A geometry-inspired decision-based attack. In Proc. of ICCV, 2019.","title":"A geometry-inspired decision-based attack","authors":"Liu","year":"2019","venue":"Proc. of ICCV","doi":null,"url":null,"internal_url":null},{"position":17,"raw":"[Madry et al., 2018] Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards Deep Learning Models Resistant to Adversarial Attacks. In Proc. of ICLR, 2018.","title":"Towards Deep Learning Models Resistant to Adversarial Attacks","authors":"Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, Adrian Vladu","year":"2018","venue":"Proc. of ICLR","doi":null,"url":null,"internal_url":null},{"position":18,"raw":"[Szegedy et al., 2014] Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. Intriguing properties of neural networks. In Proc. of ICLR, 2014.","title":"Intriguing properties of neural networks","authors":"Szegedy","year":"2014","venue":"Proc. of ICLR","doi":null,"url":null,"internal_url":null},{"position":19,"raw":"[Szegedy et al., 2016] Christian Szegedy, Vincent Van- houcke, Sergey Ioffe, Jonathon Shlens, and Zbigniew Wojna. Rethinking the Inception Architecture for Computer Vision. In Proc. of CVPR, 2016.","title":"Rethinking the Inception Architecture for Computer Vision","authors":"Szegedy","year":"2016","venue":"Proc. of CVPR","doi":null,"url":null,"internal_url":null},{"position":20,"raw":"[Szegedy et al., 2017] Christian Szegedy, Sergey Ioffe, Vin- cent Vanhoucke, and Alex Alemi. Inception-v4, Inception- ResNet and the Impact of Residual Connections on Learn- ing. In Proc. of AAAI, 2017.","title":"Christian Szegedy, Sergey Ioffe, Vincent Vanhoucke, and Alex Alemi. Inception-v4, Inception-ResNet and the Impact of Residual Connections on Learning","authors":"Szegedy","year":"2017","venue":"Proc. of AAAI","doi":null,"url":null,"internal_url":null},{"position":21,"raw":"[Tramer et al., 2018] Florian Tramer, Alexey Kurakin, Nico- las Papernot, Ian Goodfellow, Dan Boneh, and Patrick Mc- Daniel. Ensemble Adversarial Training: Attacks and De- fenses. In Proc. of ICLR, 2018.","title":"Ensemble Adversarial Training: Attacks and Defenses","authors":"Florian Tramer, Alexey Kurakin, Nicolas Papernot, Ian Goodfellow, Dan Boneh, Patrick Mc-Daniel","year":"2018","venue":"Proc. of ICLR","doi":null,"url":null,"internal_url":null},{"position":22,"raw":"[Xie et al., 2018] Cihang Xie, Jianyu Wang, Zhishuai Zhang, Zhou Ren, and Alan Yuille. Mitigating Adversarial Effects Through Randomization. In Proc. of ICLR, 2018.","title":"Mitigating Adversarial Effects Through Randomization","authors":"Cihang Xie, Jianyu Wang, Zhishuai Zhang, Alan Zhou Ren, Yuille","year":"2018","venue":"Proc. of ICLR","doi":null,"url":null,"internal_url":null},{"position":23,"raw":"[Xie et al., 2019a] Cihang Xie, Yuxin Wu, Laurens van der Maaten, Alan Yuille, and Kaiming He. Feature Denoising for Improving Adversarial Robustness. In Proc. of CVPR, 2019.","title":"Feature Denoising for Improving Adversarial Robustness","authors":"Xie","year":"2019","venue":"Proc. of CVPR","doi":null,"url":null,"internal_url":null},{"position":24,"raw":"[Xie et al., 2019b] Cihang Xie, Zhishuai Zhang, Yuyin Zhou, Song Bai, Jianyu Wang, Zhou Ren, and Alan L. Yuille. Improving Transferability of Adversarial Exam- ples With Input Diversity. In Proc. of CVPR, 2019.","title":"Improving Transferability of Adversarial Examples With Input Diversity","authors":"Xie","year":"2019","venue":"Proc. of CVPR","doi":null,"url":null,"internal_url":null}],"license_note":"Copyright International Joint Conferences on Artificial Intelligence."}