Thundernna: a white box adversarial attack
Linfeng Ye, Shayan Mohajer Hamidi
TL;DR
Thundernna addresses the need for a rapid, effective white-box adversarial attack by introducing a first-order method that exploits a second-order update principle applied to the integral of the network’s loss. By optimizing the integrated objective, using the negative log-likelihood loss with softmax to ensure convexity, the authors derive a perturbation form and demonstrate substantial attack efficacy on pretrained ResNet-18 models. The approach delivers higher success rates than FGSM while remaining faster than second-order and multi-step attacks, with practical acceleration via the TVM framework. This work has practical impact for robust evaluation and adversarial training, offering a scalable method to generate hard examples and reveal vulnerabilities in deep CNNs. The results suggest a meaningful trade-off between attack speed and multi-step strength, and point to future directions in iterative extensions and robustness enhancement.
Abstract
The existing work shows that the neural network trained by naive gradient-based optimization method is prone to adversarial attacks, adds small malicious on the ordinary input is enough to make the neural network wrong. At the same time, the attack against a neural network is the key to improving its robustness. The training against adversarial examples can make neural networks resist some kinds of adversarial attacks. At the same time, the adversarial attack against a neural network can also reveal some characteristics of the neural network, a complex high-dimensional non-linear function, as discussed in previous work. In This project, we develop a first-order method to attack the neural network. Compare with other first-order attacks, our method has a much higher success rate. Furthermore, it is much faster than second-order attacks and multi-steps first-order attacks.