Strong Transferable Adversarial Attacks via Ensembled Asymptotically Normal Distribution Learning

TL;DR

Addresses the need for robust evaluation of DNN robustness against transferable adversarial attacks. Proposes ANDA and MultiANDA, which learn a posterior over perturbations by exploiting the asymptotic normality of SGD and employing deep ensembles to form a Gaussian mixture. The framework formalizes the attack as $\max_{\Pi_{\delta}} \mathbb{E}_{\delta \sim \Pi_{\delta}} \sum_{i=1}^n \mathcal{L}(\texttt{AUG}_i(x+\delta),y)$, enabling unlimited, diverse adversaries that improve transferability. Empirical results on ImageNet-1k show that MultiANDA outperforms ten state-of-the-art black-box attacks across seven normally trained and seven defense models, highlighting its value for defense benchmarking and robustness evaluation.

Abstract

Strong adversarial examples are crucial for evaluating and enhancing the robustness of deep neural networks. However, the performance of popular attacks is usually sensitive, for instance, to minor image transformations, stemming from limited information -- typically only one input example, a handful of white-box source models, and undefined defense strategies. Hence, the crafted adversarial examples are prone to overfit the source model, which hampers their transferability to unknown architectures. In this paper, we propose an approach named Multiple Asymptotically Normal Distribution Attacks (MultiANDA) which explicitly characterize adversarial perturbations from a learned distribution. Specifically, we approximate the posterior distribution over the perturbations by taking advantage of the asymptotic normality property of stochastic gradient ascent (SGA), then employ the deep ensemble strategy as an effective proxy for Bayesian marginalization in this process, aiming to estimate a mixture of Gaussians that facilitates a more thorough exploration of the potential optimization space. The approximated posterior essentially describes the stationary distribution of SGA iterations, which captures the geometric information around the local optimum. Thus, MultiANDA allows drawing an unlimited number of adversarial perturbations for each input and reliably maintains the transferability. Our proposed method outperforms ten state-of-the-art black-box attacks on deep learning models with or without defenses through extensive experiments on seven normally trained and seven defense models.

Figures (13)

• Figure 1: Perturbation visualization of the adversarial examples generated by ANDA/MultiANDA that fool all selected normally trained (first row) and defense (second row) models.
• Figure 2: Asymptotically normal distribution examples with iterative trajectories of adversarial perturbations generated by stochastic BIM (a) and the proposed approach (b).
• Figure 3: Most examples crafted by our proposed methods successfully deceived all 6 black-box models.
• Figure 4: Attack success rates of sampled adversaries with single $\{\bar{\delta}\}$, multiple $\{\delta_{m}\}_{m=1}^{20}$ and the succeeded $Suc. \{\delta_{m}\}_{m=1}^{20}$ generated by ANDA and MultiANDA. $\{\delta_{m}\}_{m=1}^{20}$ means the 20 adversarial examples sampled from the learned perturbation distribution for each input image; whereas $Suc. \{\delta_{m}\}_{m=1}^{20}$ are the 20 sampled adversarial examples for the input image whose corresponding single adversarial example has succeeded in the attack.
• Figure 5: Most examples crafted by our proposed methods successfully deceived more than 5 defense models.