Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

A New Type of Adversarial Examples

Xingyang Nie, Guojie Xiao, Su Pan, Biao Wang, Huilin Ge, Tao Fang

TL;DR

This work addresses the vulnerability of neural classifiers to adversarial inputs by introducing a fundamentally opposite class of adversarial examples that are intentionally far from the original inputs yet preserve the correct class. The authors propose a family of gradient-based attacks—NI-FGSM, NI-FGM and their momentum variants NMI-FGSM, NMI-FGM—that enforce a large perturbation distance $\|X^{adv}-X\|_p \ge \delta$ while minimizing the loss $J(X^{adv}, y_{true})$, and show how momentum helps traverse nonconvex landscapes. Through experiments on ImageNet across four architectures, they demonstrate high white-box attack success with appropriate iterations and momentum settings, but limited transferability in black-box settings, highlighting that such opposite adversarial examples occupy a broad region of input space and reveal nonlocal blind spots in DNN decision boundaries. The findings suggest defenses should aim to contract the decision boundary to exclude these outliers, and point to potential applications and further method improvements for generating such adversarial examples.

Abstract

Most machine learning models are vulnerable to adversarial examples, which poses security concerns on these models. Adversarial examples are crafted by applying subtle but intentionally worst-case modifications to examples from the dataset, leading the model to output a different answer from the original example. In this paper, adversarial examples are formed in an exactly opposite manner, which are significantly different from the original examples but result in the same answer. We propose a novel set of algorithms to produce such adversarial examples, including the negative iterative fast gradient sign method (NI-FGSM) and the negative iterative fast gradient method (NI-FGM), along with their momentum variants: the negative momentum iterative fast gradient sign method (NMI-FGSM) and the negative momentum iterative fast gradient method (NMI-FGM). Adversarial examples constructed by these methods could be used to perform an attack on machine learning systems in certain occasions. Moreover, our results show that the adversarial examples are not merely distributed in the neighbourhood of the examples from the dataset; instead, they are distributed extensively in the sample space.

A New Type of Adversarial Examples

TL;DR

This work addresses the vulnerability of neural classifiers to adversarial inputs by introducing a fundamentally opposite class of adversarial examples that are intentionally far from the original inputs yet preserve the correct class. The authors propose a family of gradient-based attacks—NI-FGSM, NI-FGM and their momentum variants NMI-FGSM, NMI-FGM—that enforce a large perturbation distance while minimizing the loss , and show how momentum helps traverse nonconvex landscapes. Through experiments on ImageNet across four architectures, they demonstrate high white-box attack success with appropriate iterations and momentum settings, but limited transferability in black-box settings, highlighting that such opposite adversarial examples occupy a broad region of input space and reveal nonlocal blind spots in DNN decision boundaries. The findings suggest defenses should aim to contract the decision boundary to exclude these outliers, and point to potential applications and further method improvements for generating such adversarial examples.

Abstract

Most machine learning models are vulnerable to adversarial examples, which poses security concerns on these models. Adversarial examples are crafted by applying subtle but intentionally worst-case modifications to examples from the dataset, leading the model to output a different answer from the original example. In this paper, adversarial examples are formed in an exactly opposite manner, which are significantly different from the original examples but result in the same answer. We propose a novel set of algorithms to produce such adversarial examples, including the negative iterative fast gradient sign method (NI-FGSM) and the negative iterative fast gradient method (NI-FGM), along with their momentum variants: the negative momentum iterative fast gradient sign method (NMI-FGSM) and the negative momentum iterative fast gradient method (NMI-FGM). Adversarial examples constructed by these methods could be used to perform an attack on machine learning systems in certain occasions. Moreover, our results show that the adversarial examples are not merely distributed in the neighbourhood of the examples from the dataset; instead, they are distributed extensively in the sample space.
Paper Structure (14 sections, 11 equations, 7 figures, 1 table)

This paper contains 14 sections, 11 equations, 7 figures, 1 table.

Table of Contents

  1. Introduction
  2. Preliminaries
  3. Problem Formulation
  4. Attack Methods
  5. New Type of Adversarial Example and Its Generation
  6. New Type of Adversarial Example
  7. Adversarial Example Generation Methods
  8. Experiments
  9. Setup
  10. Size of perturbation
  11. Number of Iterations
  12. Decay factor $\mu$
  13. Comparison of NI-FGSM, NI-FGM, NMI-FGSM and NMI-FGM
  14. Conclusion

Figures (7)

  • Figure 1: Two input images to the DNN used in an autonomous driving system. (a) The original image. (b) The adversarial image generated from (a).
  • Figure 2: Success rates of adversarial examples generated for the Inc-v3 model against different models: white-box model for Inc-v3, and black-box models for Inc-v4, IncRes-v2,and Res-152. We compare the results of four methods with different sizes of perturbation.
  • Figure 3: Comparison of adversarial examples under different perturbations
  • Figure 4: The success rates of adversarial examples generated for the Inc-v3 model are evaluated against different models: the white-box model (Inc-v3) and the black-box models (Inc-v4, IncRes-v2, and Res-152). We compare the results of four methods with different numbers of iterations.
  • Figure 5: Comparison of adversarial examples under different iterations
  • ...and 2 more figures