Enhancing Output Diversity Improves Conjugate Gradient-based Adversarial Attacks

TL;DR

This work addresses the vulnerability of deep neural networks to adversarial examples by leveraging output diversity to strengthen attacks. It introduces Rescaling-ACG (ReACG), which enhances the Auto Conjugate Gradient attack by (i) rescaling the conjugate-gradient coefficient to diversify search directions and (ii) optimizing step-size checkpoints via Optuna to widen the distance between consecutive search points. Across 30 robust models on CIFAR-10/100 and ImageNet, ReACG outperforms state-of-the-art attacks (APGD and ACG), especially on ImageNet, with roughly 0.4–0.9% improvements under CW losses and 0.1–0.4% under DLR losses, while also enabling success on examples where other methods fail. The findings highlight a substantial link between search-point distance, CTC (consecutive top-class) diversity, and attack effectiveness, suggesting a path to more potent nonlinear-optimization-based adversarial attacks.

Abstract

Deep neural networks are vulnerable to adversarial examples, and adversarial attacks that generate adversarial examples have been studied in this context. Existing studies imply that increasing the diversity of model outputs contributes to improving the attack performance. This study focuses on the Auto Conjugate Gradient (ACG) attack, which is inspired by the conjugate gradient method and has a high diversification performance. We hypothesized that increasing the distance between two consecutive search points would enhance the output diversity. To test our hypothesis, we propose Rescaling-ACG (ReACG), which automatically modifies the two components that significantly affect the distance between two consecutive search points, including the search direction and step size. ReACG showed higher attack performance than that of ACG, and is particularly effective for ImageNet models with several classification classes. Experimental results show that the distance between two consecutive search points enhances the output diversity and may help develop new potent attacks. The code is available at \url{https://github.com/yamamura-k/ReACG}

Figures (6)

• Figure 1: (a) Transition of $|\beta_{HS}^{(k)}|$. (b) Distribution of $|\bm{g}^{(k)}/\bm{s}^{(k)}|$.
• Figure 2: The percentage of images where APGD/ReACG found adversarial examples but ReACG/APGD did not.
• Figure 3: (a) Transition of $|\beta_{HS}^{(k)}|$. (b) Transition of the moving distance per iteration.
• Figure 4: Comparison in CTC variation. Let $c^{(k)}=\arg\max_{i\neq c}f_i(\bm{x}^{(k)})$ be a CTC at $k$-th iterateion. The number of CTCs appeared during an attack, #CTC, is defined as $\textrm{\#CTC}:=|\{c^{(i)}\mid i=1,\ldots,N\}|$. In the legend, "$K$: P%" means that the percentage of images for which #CTC=$K$ is P%.
• Figure 5: ACG vs. ReACG for different maximum numbers of iterations $N$.