{"type":"ScholarlyArticle","title":"Learning to Generate Image Source-Agnostic Universal Adversarial Perturbations","authors":[{"name":"Pu Zhao","slug":"pu-zhao","given":"Pu","family":"Zhao","affiliation":"Northeastern University"},{"name":"Parikshit Ram","slug":"parikshit-ram","given":"Parikshit","family":"Ram","affiliation":"IBM Research"},{"name":"Songtao Lu","slug":"songtao-lu","given":"Songtao","family":"Lu","affiliation":"IBM Research"},{"name":"Yuguang Yao","slug":"yuguang-yao","given":"Yuguang","family":"Yao","affiliation":"Michigan State University"},{"name":"Djallel Bouneffouf","slug":"djallel-bouneffouf","given":"Djallel","family":"Bouneffouf","affiliation":"IBM Research"},{"name":"Xue Lin","slug":"xue-lin","given":"Xue","family":"Lin","affiliation":"Northeastern University"},{"name":"Sijia Liu","slug":"sijia-liu","given":"Sijia","family":"Liu","affiliation":"IBM Research; Michigan State University"}],"abstract":"Adversarial perturbations are critical for certifying the robustness of deep learning models. A ``universal adversarial perturbation'' (UAP) can simultaneously attack multiple images, and thus offers a more unified threat model, obviating an image-wise attack algorithm. However, the existing UAP generator is underdeveloped when images are drawn from different image sources (e.g., with different image resolutions). Towards an authentic universality across image sources, we take a novel view of UAP generation as a customized instance of ``few-shot learning'', which leverages bilevel optimization and learning-to-optimize (L2O) techniques for UAP generation with improved attack success rate (ASR). We begin by considering the popular model agnostic meta-learning (MAML) framework to meta-learn a UAP generator. However, we see that the MAML framework does not directly offer the universal attack across image sources, requiring us to integrate it with another meta-learning framework of L2O. The resulting scheme for meta-learning a UAP generator (i) has better performance (50% higher ASR) than baselines such as Projected Gradient Descent, (ii) has better performance (37% faster) than the vanilla L2O and MAML frameworks (when applicable), and (iii) is able to simultaneously handle UAP generation for different victim models and data sources.","doi":"10.24963/ijcai.2022/239","url":"https://ijcai.org/proceedings/2022/239","pdf":"https://ijcai.org/proceedings/2022/0239.pdf","markdown":"https://ijcai.org/proceedings/2022/239.md","bibtex":"https://ijcai.org/proceedings/2022/bibtex/239","volume":{"slug":"2022","title":"Proceedings of the Thirty-First International Joint Conference on Artificial Intelligence","short_title":"IJCAI 2022","url":"https://ijcai.org/proceedings/2022/","year":2022,"location":"Vienna","dates":"23-29 July 2022","editors":"Luc De Raedt","isbn":"978-1-956792-00-3","publisher":"International Joint Conferences on Artificial Intelligence Organization","doi_prefix":"10.24963/ijcai.2022"},"section":"Computer Vision","track":"Main Track","number":239,"pages":{"first":1714,"last":1720},"keywords":["Computer Vision: Adversarial learning, adversarial attack and defense methods","Machine Learning: Meta-Learning"],"videos":[{"label":"Video #1","url":"https://slideslive.com/38986580","length_sec":84,"provider":"slideslive"},{"label":"Video #2","url":"https://slideslive.com/38984723","length_sec":358,"provider":"slideslive"}],"references":[{"position":1,"raw":"[Andrychowicz et al., 2016] Marcin Andrychowicz, Misha Denil, et al. Learning to learn by gradient descent by gradient descent. In NeurIPS, 2016.","title":"Learning to learn by gradient descent by gradient descent","authors":"Marcin Andrychowicz, Misha Denil","year":"2016","venue":"NeurIPS","doi":null,"url":null,"internal_url":null},{"position":2,"raw":"[Balcan et al., 2019] Maria-Florina Balcan, Mikhail Khodak, and Ameet Talwalkar. Provable guarantees for gradient-based meta- learning. In ICML, 2019.","title":"Provable guarantees for gradient-based metalearning","authors":"Maria-Florina Balcan, Mikhail Khodak, Ameet Talwalkar","year":"2019","venue":"ICML","doi":null,"url":null,"internal_url":null},{"position":3,"raw":"[Cao et al., 2019] Yue Cao, Tianlong Chen, et al. Learning to opti- mize in swarms. In NeurIPS, 2019.","title":"Learning to optimize in swarms","authors":"Yue Cao, Tianlong Chen","year":"2019","venue":"NeurIPS","doi":null,"url":null,"internal_url":null},{"position":4,"raw":"[Carlini and Wagner, 2017] Nicholas Carlini and David Wagner. Towards evaluating the robustness of neural networks. In SP, 2017.","title":"Towards evaluating the robustness of neural networks","authors":"Nicholas Carlini, David Wagner","year":"2017","venue":null,"doi":null,"url":null,"internal_url":null},{"position":5,"raw":"[Chen et al., 2017] Pin-Yu Chen, Huan Zhang, et al. Zoo: Zeroth order optimization based black-box attacks to deep neural net- works without training substitute models. In ACM Workshop on Artificial Intelligence and Security, 2017.","title":"Zeroth order optimization based black-box attacks to deep neural networks without training substitute models","authors":"Chen","year":"2017","venue":"ACM Workshop on Artificial Intelligence and Security","doi":null,"url":null,"internal_url":null},{"position":6,"raw":"[Chen et al., 2020] Tianlong Chen, Weiyi Zhang, et al. Training stronger baselines for learning to optimize. NeurIPS, 2020.","title":"Training stronger baselines for learning to optimize","authors":"Tianlong Chen, Weiyi Zhang","year":"2020","venue":"NeurIPS","doi":null,"url":null,"internal_url":null},{"position":7,"raw":"[Croce and Hein, 2020] Francesco Croce and Matthias Hein. Re- liable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks. In ICML, 2020.","title":"Francesco Croce and Matthias Hein. Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks","authors":"Hein Croce","year":"2020","venue":"ICML","doi":null,"url":null,"internal_url":null},{"position":8,"raw":"[Fallah et al., 2019] Alireza Fallah, Aryan Mokhtari, and Asuman Ozdaglar. On the convergence theory of gradient-based model- agnostic meta-learning algorithms. arXiv preprint, 2019.","title":"On the convergence theory of gradient-based modelagnostic meta-learning algorithms","authors":"Alireza Fallah, Aryan Mokhtari, Asuman Ozdaglar","year":"2019","venue":null,"doi":null,"url":null,"internal_url":null},{"position":9,"raw":"[Finn et al., 2017] Chelsea Finn, Pieter Abbeel, and Sergey Levine. Model-agnostic meta-learning for fast adaptation of deep net- works. arXiv preprint arXiv:1703.03400, 2017.","title":"Model-agnostic meta-learning for fast adaptation of deep networks","authors":"Finn","year":"2017","venue":null,"doi":null,"url":null,"internal_url":null},{"position":10,"raw":"[Finn et al., 2018] Chelsea Finn, Kelvin Xu, and Sergey Levine. Probabilistic model-agnostic meta-learning. In NeurIPS, 2018.","title":"Probabilistic model-agnostic meta-learning","authors":"Chelsea Finn, Kelvin Xu, Sergey Levine","year":"2018","venue":"NeurIPS","doi":null,"url":null,"internal_url":null},{"position":11,"raw":"[Finn et al., 2019] Chelsea Finn, Aravind Rajeswaran, et al. Online meta-learning. In ICML, 2019.","title":"Online meta-learning","authors":"Finn","year":"2019","venue":null,"doi":null,"url":null,"internal_url":null},{"position":12,"raw":"[Goodfellow et al., 2015] Ian Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial exam- ples. 2015 ICLR, 2015.","title":"Explaining and harnessing adversarial examples","authors":"Ian Goodfellow, Jonathon Shlens, Christian Szegedy","year":"2015","venue":"ICLR","doi":null,"url":null,"internal_url":null},{"position":13,"raw":"[Hashemi et al., 2020] Atiye Sadat Hashemi, Andreas Bär, et al. Transferable universal adversarial perturbations using generative models. arXiv preprint, 2020.","title":"Transferable universal adversarial perturbations using generative models","authors":"Atiye Sadat Hashemi, Andreas Bär","year":"2020","venue":null,"doi":null,"url":null,"internal_url":null},{"position":14,"raw":"[Jiang et al., 2018] Haoming Jiang, Zhehui Chen, et al. Learning to defense by learning to attack. arXiv preprint, 2018.","title":"Learning to defense by learning to attack","authors":"Haoming Jiang, Zhehui Chen","year":"2018","venue":null,"doi":null,"url":null,"internal_url":null},{"position":15,"raw":"[Khodak et al., 2019] M Khodak, M Balcan, et al. Adaptive gradient-based meta-learning methods. In NeurIPS, 2019.","title":"Adaptive gradient-based meta-learning methods","authors":"Khodak, Balcan","year":"2019","venue":"NeurIPS","doi":null,"url":null,"internal_url":null},{"position":16,"raw":"[Khrulkov and Oseledets, 2018] Valentin Khrulkov and Ivan Os- eledets. Art of singular vectors and universal adversarial per- turbations. In CVPR, 2018.","title":"Art of singular vectors and universal adversarial perturbations","authors":"Valentin Khrulkov, Ivan Oseledets","year":"2018","venue":"CVPR","doi":null,"url":null,"internal_url":null},{"position":17,"raw":"[Kingma and Ba, 2015] Diederik P. Kingma and Jimmy Ba. Adam: A method for stochastic optimization. ICLR, 2015.","title":"Adam: A method for stochastic optimization","authors":"P Diederik, Jimmy Kingma, Ba","year":"2015","venue":"ICLR","doi":null,"url":null,"internal_url":null},{"position":18,"raw":"[Lecun et al., 1998] Y. Lecun, L. Bottou, Y. Bengio, and P. Haffner. Gradient-based learning applied to document recognition. Pro- ceedings of the IEEE, 86(11):2278-2324, Nov 1998.","title":"Gradient-based learning applied to document recognition","authors":"Y Lecun, L Bottou, Y Bengio, P Haffner","year":"1998","venue":"Proceedings of the IEEE","doi":null,"url":null,"internal_url":null},{"position":19,"raw":"[Li and Malik, 2017] Ke Li and Jitendra Malik. Learning to opti- mize. ICLR, 2017.","title":"Learning to optimize","authors":"Malik ; Li, Ke Li, Jitendra Malik","year":"2017","venue":null,"doi":null,"url":null,"internal_url":null},{"position":20,"raw":"[Li et al., 2020] Yingwei Li, Song Bai, et al. Regional homogene- ity: Towards learning transferable universal adversarial perturba- tions against defenses. In ECCV, 2020.","title":"Regional homogeneity: Towards learning transferable universal adversarial perturbations against defenses","authors":"Li","year":"2020","venue":"ECCV","doi":null,"url":null,"internal_url":null},{"position":21,"raw":"[Liu et al., 2018] S. Liu, J. Chen, et al. Zeroth-order online admm: Convergence analysis and applications. In AISTATS, 2018.","title":"Zeroth-order online admm: Convergence analysis and applications","authors":"S Liu, J Chen","year":"2018","venue":"AISTATS","doi":null,"url":null,"internal_url":null},{"position":22,"raw":"[Liu et al., 2019a] Hao Liu, Richard Socher, and Caiming Xiong. Taming maml: Efficient unbiased meta-reinforcement learning. In ICML, 2019.","title":"Taming maml: Efficient unbiased meta-reinforcement learning","authors":"Liu","year":"2019","venue":"ICML","doi":null,"url":null,"internal_url":null},{"position":23,"raw":"[Liu et al., 2019b] Hong Liu, Rongrong Ji, et al. Universal adver- sarial perturbation via prior driven uncertainty approximation. In ICCV, 2019.","title":"Universal adversarial perturbation via prior driven uncertainty approximation","authors":"Liu","year":"2019","venue":"ICCV","doi":null,"url":null,"internal_url":null},{"position":24,"raw":"[Liu et al., 2020] Sijia Liu, Pin-Yu Chen, et al. A primer on zeroth- order optimization in signal processing and machine learning. IEEE Signal Processing Magazine, 2020.","title":"A primer on zerothorder optimization in signal processing and machine learning","authors":"Sijia Liu, Pin-Yu Chen","year":"2020","venue":"IEEE Signal Processing Magazine","doi":null,"url":null,"internal_url":null},{"position":25,"raw":"[Lv and others, 2017] Kaifeng Lv et al. Learning gradient descent: Better generalization and longer horizons. In ICML, 2017.","title":"Learning gradient descent: Better generalization and longer horizons","authors":"Kaifeng Lv, Lv","year":"2017","venue":"ICML","doi":null,"url":null,"internal_url":null},{"position":26,"raw":"[Madry et al., 2017] Aleksander Madry, Aleksandar Makelov, et al. Towards deep learning models resistant to adversarial attacks. arXiv preprint, 2017.","title":"Towards deep learning models resistant to adversarial attacks","authors":"Aleksander Madry, Aleksandar Makelov","year":"2017","venue":null,"doi":null,"url":null,"internal_url":null},{"position":27,"raw":"[Matachana et al., 2020] Alberto G Matachana, Kenneth T Co, et al. Robustness and transferability of universal attacks on com- pressed models. arXiv preprint, 2020.","title":"Robustness and transferability of universal attacks on compressed models","authors":"Alberto G Matachana, Kenneth T Co","year":"2020","venue":null,"doi":null,"url":null,"internal_url":null},{"position":28,"raw":"[Moosavi-Dezfooli et al., 2017] Seyed-Mohsen Moosavi-Dezfooli, Alhussein Fawzi, et al. Universal adversarial perturbations. In CVPR, 2017.","title":"Universal adversarial perturbations","authors":"Seyed-Mohsen Moosavi-Dezfooli, Alhussein Fawzi","year":"2017","venue":"CVPR","doi":null,"url":null,"internal_url":null},{"position":29,"raw":"[Nichol et al., 2018] Alex Nichol, Joshua Achiam, and John Schul- man. On first-order meta-learning algorithms. arXiv preprint arXiv:1803.02999, 2018.","title":"On first-order meta-learning algorithms","authors":"Alex Nichol, Joshua Achiam, John Schulman","year":"2018","venue":null,"doi":null,"url":null,"internal_url":null},{"position":30,"raw":"[Papernot et al., 2016] Nicolas Papernot, Ian Goodfellow, et al. cleverhans v1.0.0: an adversarial machine learning library. arXiv preprint, 2016.","title":"cleverhans v1.0.0: an adversarial machine learning library","authors":"Papernot","year":"2016","venue":null,"doi":null,"url":null,"internal_url":null},{"position":31,"raw":"[Rajeswaran et al., 2019] Aravind Rajeswaran, Chelsea Finn, et al. Meta-learning with implicit gradients. In NeurIPS, 2019.","title":"Meta-learning with implicit gradients","authors":"Aravind Rajeswaran, Chelsea Finn","year":"2019","venue":"NeurIPS","doi":null,"url":null,"internal_url":null},{"position":32,"raw":"[Ruan et al., 2020] Yangjun Ruan, Yuanhao Xiong, et al. Learning to learn by zeroth-order oracle. In ICLR, 2020.","title":"Learning to learn by zeroth-order oracle","authors":"Ruan","year":"2020","venue":"ICLR","doi":null,"url":null,"internal_url":null},{"position":33,"raw":"[Simonyan and Zisserman, 2014] Karen Simonyan and Andrew Zisserman. Very deep convolutional networks for large-scale im- age recognition. arXiv preprint, 2014.","title":"Very deep convolutional networks for large-scale image recognition","authors":"Karen Simonyan, Andrew Zisserman","year":"2014","venue":null,"doi":null,"url":null,"internal_url":null},{"position":34,"raw":"[Song et al., 2020] Xingyou Song, Wenbo Gao, et al. Es-maml: Simple hessian-free meta learning. ICLR, 2020.","title":"Es-maml: Simple hessian-free meta learning","authors":"Song","year":"2020","venue":null,"doi":null,"url":null,"internal_url":null},{"position":35,"raw":"[Thrun and Pratt, 1998] Sebastian Thrun and Lorien Pratt. Learn- ing to learn: Introduction and overview. In Learning to Learn, pages 3-17, Boston, MA, 1998. Springer US.","title":"Sebastian Thrun and Lorien Pratt. Learning to learn: Introduction and overview","authors":"Pratt Thrun","year":"1998","venue":null,"doi":null,"url":null,"internal_url":null},{"position":36,"raw":"[Wichrowska et al., 2017] Olga Wichrowska, Niru Mah- eswaranathan, et al. Learned optimizers that scale and generalize. In ICML, 2017.","title":"Learned optimizers that scale and generalize","authors":"Olga Wichrowska, Niru Maheswaranathan","year":"2017","venue":"ICML","doi":null,"url":null,"internal_url":null},{"position":37,"raw":"[Xiong and Hsieh, 2020] Yuanhao Xiong and Cho-Jui Hsieh. Im- proved adversarial training via learned optimizer. In European Conference on Computer Vision, pages 85-100. Springer, 2020.","title":"Improved adversarial training via learned optimizer","authors":"Hsieh Xiong, Yuanhao Xiong, Cho-Jui Hsieh","year":"2020","venue":"European Conference on Computer Vision","doi":null,"url":null,"internal_url":null},{"position":38,"raw":"[Xu et al., 2019] Kaidi Xu, Sijia Liu, et al. Structured adversarial attack: Towards general implementation and better interpretabil- ity. In ICLR, 2019.","title":"Structured adversarial attack: Towards general implementation and better interpretability","authors":"Kaidi Xu, Sijia Liu","year":"2019","venue":"ICLR","doi":null,"url":null,"internal_url":null},{"position":39,"raw":"[Yin et al., 2020] Mingzhang Yin, George Tucker, et al. Meta- learning without memorization. In ICLR, 2020.","title":"Metalearning without memorization","authors":"Yin","year":"2020","venue":"ICLR","doi":null,"url":null,"internal_url":null},{"position":40,"raw":"[Zhao et al., 2019] Pu Zhao, Sijia Liu, et al. On the design of black- box adversarial examples by leveraging gradient-free optimiza- tion and operator splitting method. In ICCV, 2019.","title":"On the design of blackbox adversarial examples by leveraging gradient-free optimization and operator splitting method","authors":"Pu Zhao, Sijia Liu","year":"2019","venue":"ICCV","doi":null,"url":null,"internal_url":null}],"license_note":"Copyright International Joint Conferences on Artificial Intelligence."}