AI Chat Paper
Note: Please note that the following content is generated by AMiner AI. SciOpen does not take any responsibility related to this content.
{{lang === 'zh_CN' ? '文章概述' : 'Summary'}}
{{lang === 'en_US' ? '中' : 'Eng'}}
Chat more with AI
Powered by AMiner. Clicking this button will take you away from SciOpen.
Home Tsinghua Science and Technology Article
PDF (7.5 MB)
Cite
EndNote(RIS) BibTeX
Collect
Submit Manuscript AI Chat Paper
Show Outline
Outline
Show full outline
Hide outline
Outline
Show full outline
Hide outline
Open Access

DCVAE-adv: A Universal Adversarial Example Generation Method for White and Black Box Attacks

College of Mathematics and Information Science, Hebei University, Baoding 071002, China
Show Author Information

Abstract

Deep neural network (DNN) has strong representation learning ability, but it is vulnerable and easy to be fooled by adversarial examples. In order to handle the vulnerability of DNN, many methods have been proposed. The general idea of existing methods is to reduce the chance of DNN models being fooled by observing some designed adversarial examples, which are generated by adding perturbations to the original images. In this paper, we propose a novel adversarial example generation method, called DCVAE-adv. Different from the existing methods, DCVAE-adv constructs adversarial examples by mixing both explicit and implicit perturbations without using original images. Furthermore, the proposed method can be applied to both white box and black box attacks. In addition, in the inference stage, the adversarial examples can be generated without loading the original images into memory, which greatly reduces the memory overhead. We compared DCVAE-adv with three most advanced adversarial attack algorithms: FGSM, AdvGAN, and AdvGAN++. The experimental results demonstrate that DCVAE-adv is superior to these state-of-the-art methods in terms of attack success rate and transfer ability for targeted attack. Our code is available at https://github.com/xzforeverlove/DCVAE-adv.

Keywords

deep neural networkadversarial exampleswhite box attackblack box attackrobustness

References

[1]
Y. LeCun, Y. Bengio, and G. Hinton, Deep learning, Nature, vol. 521, no. 7553, pp. 436–444, 2015.
Crossref Google Scholar
[2]
A. Krizhevsky, I. Sutskeve, and G. E. Hinton, ImageNet classification with deep convolutional neural networks, in Proc. 25th Int. Conf. Neural Inf. Process. Syst., Lake Tahoe, NV, USA, 2012, pp. 1097–1105.
Google Scholar
[3]
K. Simonyan and A. Zisserman, Very deep convolutional networks for large-scale image recognition, arXiv preprint arXiv: 1409.1556v2, 2015.
Google Scholar
[4]
K. He, X. Zhang, S. Ren, and J. Sun, Deep residual learning for image recognition, in Proc. 2016 IEEE Conf. Comput. Vis. Pattern Recognit. (CVPR), Las Vegas, NV, USA, 2016, pp. 770–778.
Crossref Google Scholar
[5]
M. D. Zeiler and R. Fergus, Visualizing and understanding convolutional networks, in Proc. 13th Eur. Conf. Comput. Vis., Zurich, Switzerland, 2014, pp. 818–833.
Crossref Google Scholar
[6]
J. Hu, L. Shen, S. Albanie, G. Sun, and E. Wu, Squeeze-and-excitation networks, IEEE Trans. Pattern Anal. Mach. Intell., vol. 42, no. 8, pp. 2011–2023, 2020.
Crossref Google Scholar
[7]
C. Szegedy, W. Liu, Y. Jia, P. Sermanet, S. Reed, D. Anguelov, D. Erhan, V. Vanhoucke, and A. Rabinovich, Going deeper with convolutions, in Proc. 2015 IEEE Conf. Comput. Vis. Pattern Recognit. (CVPR), Boston, MA, USA, 2015, pp. 1–9.
Crossref Google Scholar
[8]
F. Chollet, Xception: Deep learning with depthwise separable convolutions, in Proc. 2017 IEEE Conf. Comput. Vis. Pattern Recognit. (CVPR), Honolulu, HI, USA, 2017, pp. 1800–1807.
Crossref Google Scholar
[9]
M. Tan and Q. V. Le, EfficientNet: Rethinking model scaling for convolutional neural networks, in Proc. 36th Int. Conf. Mach. Learn. (ICML2019), Long Beach, CA, USA, 2019, pp. 6105–6114.
Google Scholar
[10]
C. Szegedy, W. Zaremba, I. Sutskever, J. Bruna, D. Erhan, and I. Goodfellow, Intriguing properties of neural networks, presented at 2014 2nd Int. Conf. Learn. Represent. (ICLR2014), Banff, Canada, 2014.
Google Scholar
[11]
X. Yuan, P. He, Q. Zhu, and X. Li, Adversarial examples: Attacks and defenses for deep learning, IEEE Trans. Neural Netw. Learn. Syst., vol. 30, no. 9, pp. 2805–2824, 2019.
Crossref Google Scholar
[12]
J. Zhang and C. Li, Adversarial examples: Opportunities and challenges, IEEE Trans. Neural Netw. Learn. Syst., vol. 31, no. 7, pp. 2578–2593, 2020.
Google Scholar
[13]
N. Akhtar, A. Mian, N. Kardan, and M. Shah, Advances in adversarial attacks and defenses in computer vision: A survey, IEEE Access, vol. 9, pp. 155161–155196, 2021.
Crossref Google Scholar
[14]
K. Ren, T. Zheng, Z. Qin, and X. Liu, Adversarial attacks and defenses in deep learning, Engineering, vol. 6, no. 3, pp. 346–360, 2020.
Crossref Google Scholar
[15]
A. Serban, E. Poll, and J. Visser, Adversarial examples on object recognition: A comprehensive survey, ACM Comput. Surv., vol. 53, no. 3, pp. 1–38, 2020.
Crossref Google Scholar
[16]
A. Kurakin, I. J. Goodfellow, and S. Bengio, Adversarial examples in the physical world, presented at 2017 Int. Conf. Learn. Represent. (ICLR2017), Toulon, France, 2017.
Google Scholar
[17]
N. Papernot, P. McDaniel, S. Jha, M. Fredrikson, Z. B. Celik, and A. Swami, The limitations of deep learning in adversarial settings, in Proc. 2016 IEEE Eur. Symp. Secur. Priv. (EuroS&P), Saarbruecken, Germany, 2016, pp. 372–387.
Crossref Google Scholar
[18]
S. M. Moosavi-Dezfooli, A. Fawzi, and P. Frossard, DeepFool: A simple and accurate method to fool deep neural networks, in Proc. 2016 IEEE Conf. Comput. Vis. Pattern Recognit. (CVPR), Las Vegas, NV, USA, 2016, pp. 2574–2582.
Crossref Google Scholar
[19]
L. Gao, Z. Huang, J. Song, Y. Yang, and H. T. Shen, Push & pull: Transferable adversarial examples with attentive attack, IEEE Trans. Multimed., .
Crossref Google Scholar
[20]
A. Chaturvedi and U. Garain, Mimic and fool: A task-agnostic adversarial attack, IEEE Trans. Neural Netw. Learn. Syst., vol. 32, no. 4, pp. 1801–1808, 2021.
Crossref Google Scholar
[21]
I. J. Goodfellow, J. Pouget-Abadie, M. Mirza, B. Xu, D. Warde-Farley, S. Ozair, A. Courville, and Y. Bengio, Generative adversarial nets, in Proc. 27th Int. Conf. Neural Infor. Process. Syst., Montreal, Canada, 2014, pp. 2672–2680.
Google Scholar
[22]
D. P. Kingma and M. Welling, Auto-encoding variational bayes, presented at 2014 Int. Conf. Learn. Represent., Banff, Canada, 2014.
Google Scholar
[23]
X. Liu and C. J. Hsieh, Rob-GAN: Generator, discriminator, and adversarial attacker, in Proc. 2019 IEEE/CVF Conf. Comput. Vis. Pattern Recognit. (CVPR), Long Beach, CA, USA, 2019, pp. 11226–11235.
Crossref Google Scholar
[24]
J. Chen, H. Zheng, H. Xiong, S. Shen, and M. Su, MAG-GAN: Massive attack generator via GAN, Inf. Sci., vol. 536, pp. 67–90, 2020.
Crossref Google Scholar
[25]
P. Yu, K. Song, and J. Lu, Generating adversarial examples with conditional generative adversarial net, in Proc. 2018 24th Int. Conf. Pattern Recognit. (ICPR), Beijing, China, 2018, pp. 676–681.
Crossref Google Scholar
[26]
C. Xiao, B. Li, J. Y. Zhu, W. He, M. Liu, and D. Song, Generating adversarial examples with adversarial networks, in Proc. 27th Int. Joint Conf. Artif. Intell. (IJCAI-18), Stockholm, Sweden, 2018, pp. 3905–3911.
Crossref Google Scholar
[27]
S. Jandial, P. Mangla, S. Varshney, and V. Balasubramanian, AdvGAN++: Harnessing latent layers for adversary generation, in Proc. 2019 IEEE/CVF Int. Conf. Comput. Vis. Workshop (ICCVW), Seoul, Republic of Korea, 2019, pp. 2045–2048.
Crossref Google Scholar
[28]
T. Yu, S. Wang, C. Zhang, Z. Wang, Y. Li, and X. Yu, Targeted adversarial examples generating method based on cVAE in black box settings, Chin. J. Electron., vol. 30, no. 5, pp. 866–875, 2021.
Crossref Google Scholar
[29]
U. Upadhyay and P. Mukherjee, Generating out of distribution adversarial attack using latent space poisoning, IEEE Signal Process. Lett., vol. 28, pp. 523–527, 2021.
Crossref Google Scholar
[30]
I. J. Goodfellow, J. Shlens, and C. Szegedy, Explaining and harnessing adversarial examples, presented at 3rd Int. Conf. Learn. Represent. (ICLR2015), San Diego, CA, USA, 2015.
Google Scholar
[31]
A. Athalye, L. Engstrom, A. Ilyas, and K. Kwok, Synthesizing robust adversarial examples, in Proc. 35th Int. Conf. Mach. Learn., Stockholm, Sweden, 2018, pp. 284–293.
Google Scholar
[32]
T. Deng and Z. Zeng, Generate adversarial examples by spatially perturbing on the meaningful area, Pattern Recognit. Lett., vol. 125, pp. 632–638, 2019.
Crossref Google Scholar
[33]
Y. Xu, B. Du, and L. Zhang, Self-attention context network: Addressing the threat of adversarial attacks for hyperspectral image classification, IEEE Trans. Image Process., vol. 30, pp. 8671–8685, 2021.
Crossref Google Scholar
[34]
P. Vidnerová and R. Neruda, Vulnerability of classifiers to evolutionary generated adversarial examples, Neural Netw., vol. 127, pp. 168–181, 2020.
Crossref Google Scholar
[35]
T. Karras, S. Laine, and T. Aila, A style-based generator architecture for generative adversarial networks, in Proc. 2019 IEEE/CVF Conf. Comput. Vis. Pattern Recognit. (CVPR), Long Beach, CA, USA, 2019, pp. 4396–4405.
Crossref Google Scholar
[36]
M. Y. Zhai, L. Chen, F. Tung, J. He, M. Nawhal, and G. Mori, Lifelong GAN: Continual learning for conditional image generation, in Proc. 2019 IEEE/CVF Int. Conf. Comput. Vis. (ICCV), Seoul, Republic of Korea, 2019, pp. 2759–2768, 2019.
Crossref Google Scholar
[37]
M. Y. Zhai, L. Chen, J. He, M. Nawhal, F. Tung, and G. Mori, Piggyback GAN: Efficient lifelong learning for image conditioned generation, in Proc. 16th Eur. Conf. Comput. Vis., Glasgow, UK, 2020, pp. 397–413.
Crossref Google Scholar
[38]
M. Y. Zhai, L. Chen, and G. Mori, Hyper-LifelongGAN: Scalable lifelong learning for image conditioned generation, in Proc. 2021 IEEE/CVF Conf. Comput. Vis. Pattern Recognit. (CVPR2021), Nashville, TN, USA, 2021, pp. 2246–2255.
Crossref Google Scholar
[39]
K. Sohn, X. Yan, and H. Lee, Learning structured output representation using deep conditional generative models, in Proc. 28th Int. Conf. Neural Infor. Process. Syst. (NIPS), Montreal, Canada, 2015, pp.3483–3491.
Google Scholar
[40]
I. Higgins, L. Matthey, A. Pal, C. Burgess, X. Glorot, M. Botvinick, S. Mohamed, and A. Lerchner, Beta-VAE: Learning basic visual concepts with a constrained variational framework, presented at 5th Int. Conf. Learn. Represent., Toulon, France, 2017.
Google Scholar
[41]
H. Shao, Z. Xiao, S. Yao, D. Sun, A. Zhang, S. Liu, T. Wang, J. Li, and T. Abdelzaher, ControlVAE: Tuning, analytical properties, and performance analysis, IEEE Trans. Pattern Anal. Mach. Intell., .
Crossref Google Scholar
[42]
Z. Zhao, D. Dua, and S. Singh, Generating natural adversarial examples, presented at 6th Int. Conf. Learn. Represent., Vancouver, Canada, 2018.
Google Scholar
[43]
Y. Song. R. Shu, N. Kushman, and S. Ermon, Constructing unrestricted adversarial examples with generative models, in Proc. 32nd Int. Conf. Neural Infor. Process. Syst. (NeurIPS 2018), Montréal, Canada, 2018, pp. 8322–8333.
Google Scholar
[44]
M. Sharif, S. Bhagavatula, L. Bauer, and M. K. Reiter, A general framework for adversarial examples with objectives, ACM Trans. Priv. Secur., vol. 22, no. 3, pp. 1–30, 2019.
Crossref Google Scholar
[45]
J. Liu, Y. Tian, R. Zhang, Y. Sun, and C. Wang, A two-stage generative adversarial networks with semantic content constraints for adversarial example generation, IEEE Access, vol. 8, pp. 205766–205777, 2020.
Crossref Google Scholar
[46]
P. Tang, W. Wang, J. Lou, and L. Xiong, Generating adversarial examples with distance constrained adversarial imitation networks, IEEE Trans. Dependable Secur. Comput., .
Crossref Google Scholar
[47]
C. Hu, X. Wu, and Z. Li, Generating adversarial examples with elastic-net regularized boundary equilibrium generative adversarial network, Pattern Recognit. Lett., vol. 140, pp. 281–287, 2020.
Crossref Google Scholar
[48]
W. Zhang, Generating adversarial examples in one shot with image-to-image translation GAN, IEEE Access, vol. 7, pp. 151103–151119, 2019.
Crossref Google Scholar
[49]
W. Jiang, Z. He, J. Zhan, W. Pan, and D. Adhikari, Research progress and challenges on application-driven adversarial examples: A survey, ACM Trans. Cyber Phys. Syst., vol. 5, no. 4, p. 39, 2021.
Crossref Google Scholar
[50]
A. Odena, C. Olah, and J. Shlens, Conditional image synthesis with auxiliary classifier GANs, in Proc. 34th Int. Conf. Mach. Learn., Sydney, Australia, 2017, pp. 2642–2651.
Google Scholar
[51]
L. Deng, The MNIST database of handwritten digit images for machine learning research, IEEE Signal Process. Mag., vol. 29, no. 6, pp. 141–142, 2012.
Crossref Google Scholar
[52]
H. Xiao, K. Rasul, and R. Vollgraf, Fashion-MNIST: A novel image dataset for benchmarking machine learning algorithms, arXiv preprint arXiv: 1708.07747, 2017.
Google Scholar
[53]
A. Torralba, R. Fergus, and W. T. Freeman, 80 million tiny images: A large data set for nonparametric object and scene recognition, IEEE Trans. Pattern Anal. Mach. Intell., vol. 30, no. 11, pp. 1958–1970, 2008.
Crossref Google Scholar
[54]
Y. Lecun, L. Bottou, Y. Bengio, and P. Haffner, Gradient-based learning applied to document recognition, Proc. IEEE, vol. 86, no. 11, pp. 2278–2324, 1998.
Crossref Google Scholar
[55]
S. Zagoruyko and N. Komodakis, Wide residual networks, in Proc. British Mach. Vis. Conf. (BMVC 2016), York, UK, 2016, pp. 1–12.
Crossref Google Scholar
[56]
C. Z. Wang, X. Lv, W. P. Ding, and X. D. Fan, No-reference image quality assessment with multi-scale weighted residuals and channel attention mechanism, Soft Comput., vol. 26, pp. 13449–13465, 2022.
Crossref Google Scholar
[57]
X. Lv, C. Wang, X. Fan, Q. Leng, and X. Jiang, A novel image super-resolution algorithm based on multi-scale dense recursive fusion network, Neurocomputing, vol. 489, pp. 98–111, 2022.
Crossref Google Scholar
Tsinghua Science and Technology
Volume 29 Issue 2,
April 2024
Pages 430-446
DOI: 10.26599/TST.2023.9010004
Cite this article:
Xu L, Zhai J. DCVAE-adv: A Universal Adversarial Example Generation Method for White and Black Box Attacks. Tsinghua Science and Technology, 2024, 29(2): 430-446. https://doi.org/10.26599/TST.2023.9010004

1268

Views

232

Downloads

4

Crossref

3

Web of Science

3

Scopus

0

CSCD

Altmetrics
Received: 27 September 2022
Revised: 26 December 2022
Accepted: 29 January 2023
Published: 22 September 2023
© The author(s) 2024.

The articles published in this open access journal are distributed under the terms of the Creative Commons Attribution 4.0 International License (http://creativecommons.org/licenses/by/4.0/).
Return