The need for adversarial sample transferability is to attack black-box deep learning models. While recent research has primarily focused on enhancing the transferability of untargeted adversarial attacks, limited attention has been given to developing transferable targeted adversarial instances capable of deceiving models into misclassifying them as a specific class. Current methods for targeted adversarial attacks lack effectiveness due to their inability to accurately capture the target class distribution. Recent research introduces a novel generative adversarial training system featuring a dual discriminator. One for features and one for labels to identify adversarial instances derived from target class images alongside a generator designed to create targeted adversarial examples.
Adversarial scenarios have significant real-world implications, particularly in safety-critical areas such as biometrics and autonomous driving. The current networks’ vulnerability to hostile attacks, even in challenging black-box conditions, poses serious societal risks. This highlights the need for further research into the mechanics of neural networks under adversarial attacks to develop robust defense mechanisms.
Deep neural networks and artificial intelligence
Deep neural networks (DNNs) are a key area of artificial intelligence (AI) with practical applications in face identification, voice recognition, image classification, and autonomous driving. Due to the significant impact of DNNs, extensive research has been conducted into their vulnerabilities, particularly in the context of adversarial attacks. These studies reveal how adversarial cases can deceive DNNs by introducing perturbations that closely resemble human inputs. Designing effective adversarial attacks remains challenging, as practical examples must evade human detection while misleading DNNs into making incorrect predictions.
Adversarial attack techniques are classified into untargeted and targeted attacks. Untargeted attacks aim to mislead the model into predicting any incorrect label. Meanwhile, targeted attacks focus on causing the model to misclassify a sample as a specific label. The transferability of adversarial samples is essential for both types, particularly in scenarios where the target model is unknown, such as in black-box attacks.
To address these challenges, a new technique has been developed that eliminates the need for task-specific replacement models by directly generating adversarial instances. This method extracts transferable features from various tasks, demonstrating that adversarial transferability is not limited to identical or similar tasks but extends to models trained on different tasks.
The approach is supported by findings showing that adversarial word substitution rules can produce highly transferable candidate phrases. By generating a broader range of adversarial instances, this method overcomes the limitations of previous techniques that relied on more restrictive searches. Specifically, adversarial sample data from multiple tasks is used to train a sequence-to-sequence generative model called Cross-Task Generative Adversarial Attack (CT-GAT).
Convolutional neural networks (CNNs)
Convolutional layers are used by CNNs to extract spatial properties from input images through weight sharing. While ResNets and DenseNets employ skip connections to address the vanishing gradient and over-fitting problem, allowing deeper learning and outstanding performance, InceptionV3 uses parallel convolutional filters to collect features of various sizes.
Understanding the transferability of attacks across generative models is crucial for enhancing AI security and developing more resilient systems.
Rohith Vallabhaneni
Vision transformers (ViTs)
ViTs represent an image as a list of patches and employ self-attention techniques to extract global features, unlike CNNs, which are limited by local features like convolution. Two well-liked ViT versions are data-efficient Image Transformers (DeiTs) and Vision Transformers with shifting windows. DeiTs achieve data efficiency by knowledge distillation, whereas Swin Transformers use a hierarchical network topology with moving windows to acquire context information for large-scale image processing applications effectively.
Spiking neural networks (SNNs)
SNNs have attracted much attention recently because of their biologically inspired computing and energy efficiency. A feature of SNNs is the integration of time. Rather than continually communicating information at each propagation cycle, neurons in the SNN fire discrete spikes when the accumulated stimulation exceeds the threshold. Three types of specific learning strategies are available to SNNs since spiking neurons are not differentiable: conversion-based training, supervised learning with surrogate gradients, and unsupervised learning. The conversion-based training method maps pre-trained CNN parameters to an SNN and modifies the weights to improve performance.
Instance-specific attacks
Many recent studies have used gradient-based optimization approaches to produce the data-dependent perturbations. MIM adds the momentum term to the iterative attack method to increase black-box transferability. DIM and TI seek to enhance transferability through input or gradient variety. By expensively training many auxiliary classifiers, recent research also sought to enhance the black-box performance of the iterative approaches. On the other hand, we contend that, compared to instance-specific approaches, it is crucial to enhance the transferability performance and the inference-time efficiency in the black box.
Instance-agnostic attacks
Instance-agnostic attacks fall under the broader category of image-independent (universal) approaches, differing from instance-specific attacks. The initial step in these attacks involves identifying a universal disturbance. Universal Adversarial Perturbations (UAP) propose using a learned universal noise vector to deceive a model. Another method generates adversarial samples through trained generative models. In contrast, approaches like GAP and AAA create adversarial perturbations and compress perceptions directly using target data. Training multiple models for various target classes, as required by earlier methods like universal perturbation, is resource-intensive.
Multi-target attacks
Instance-specific attacks can identify any target during the optimisation phase, but they often require labour-intensive iterative processes with limited transferability. The MAN method, for instance, creates a generative model for ImageNet with an ℓ2 norm constraint to assess specific risks. This model covers all 1,000 categories in ImageNet, delivering high performance and efficient storage. However, the complexity of managing multiple categories makes switching between models challenging. Additionally, there is a lack of comprehensive comparison between MAN’s multi-target black-box performance and previous instance-specific or instance-agnostic attacks. Recent methods aim to enhance single-target transferability.
Credit: Author
Generative modelling for adversarial examples
Generative modelling has long been a cornerstone in statistics, with applications extending across various domains, such as data generation, audio recognition, visual recognition, and natural language processing in machine learning. Traditional generative modelling techniques include Markov Random Fields, Hidden Markov Models, Bayesian Networks, Linear Discriminant Analysis (LDA), and Naive Bayes.
The advent of deep learning has enabled the development of more complex graphical models, including Sigmoid Belief Networks, Variational Autoencoders, Differentiable Generator Networks, Restricted Boltzmann Machines, and Deep Belief Networks. Recently, there has been significant interest in Generative Adversarial Networks (GANs) due to their exceptional ability to generate synthetic data. The process of generating synthetic data using GAN models is illustrated in Figure 2.
Credit: Author
A significant amount of labelled data is required for discriminative models or supervised learning algorithms to perform tasks such as generating new data examples, calculating the probability of an event, handling missing values using available unlabelled data, or inferring information from related activities.
Producing attack data with adversarial examples
Examining their vulnerabilities has become increasingly important, given machine learning models’ widespread use and effectiveness in security-sensitive applications.
In black-box attacks, an adversary can bypass limited knowledge of the target system by training a local substitute DNN using a fabricated dataset. The adversary generates artificial inputs and queries the remote DNN, receiving labels assigned by the target model. This process allows the adversary to build a model miming the target system’s behaviour.
Evaluating the transferability of attacks across generative models highlights vulnerabilities and strengths, guiding the development of adversarial defences and enhancing model robustness.
Increasing attack transferability
One intriguing aspect of adversarial attacks is their transferability. Instead of using a single surrogate network, an ensemble-based attack uses many. Ghost networks generate different surrogate networks by interfering with dropout layers and skipping connections. VT provides gradient variance in managing the stability of the localized gradients, while MI and other optimal approaches apply a momentum-based optimization.
3 Steps to achieve rapid innovation
The results indicate that the proposed technique outperforms state-of-the-art attacks across configurations and workloads. However, due to the limited availability of publicly accessible robust models across various architectures, the experiments were restricted to undefended models.
- DNNs will demonstrate incredible potential across several domains.
- In the latter case, generative methods should be employed to train a deep network to produce perturbations.
- Understanding the capabilities of adversary assaults is critical for future security development.
🔬🧫🧪🔍🤓👩🔬🦠🔭📚
Journal reference
Thabit, F., Can, O., Abdaljlil, S., & Alkhzaimi, H. A. (2024). Enhanced an Intrusion Detection System for IoT networks through machine learning techniques: an examination utilizing the AWID dataset. Cogent Engineering, 11(1), 2378603. https://doi.org/10.1080/23311916.2024.2378603
