Universal Adversarial Attack on Attention and the Resulting Dataset DAmageNet
This addresses the challenge of universal adversarial attacks for AI security researchers, offering a benchmark for robustness testing, though it builds incrementally on existing transferability techniques.
The authors tackled the problem of adversarial attacks requiring extensive knowledge of the victim model by proposing Attack on Attention (AoA), which targets a semantic property shared across DNNs, achieving state-of-the-art transferability and creating DAmageNet, a dataset where 13 DNNs had error rates over 85% and most defenses still resulted in over 70% error rates.
Adversarial attacks on deep neural networks (DNNs) have been found for several years. However, the existing adversarial attacks have high success rates only when the information of the victim DNN is well-known or could be estimated by the structure similarity or massive queries. In this paper, we propose to Attack on Attention (AoA), a semantic property commonly shared by DNNs. AoA enjoys a significant increase in transferability when the traditional cross entropy loss is replaced with the attention loss. Since AoA alters the loss function only, it could be easily combined with other transferability-enhancement techniques and then achieve SOTA performance. We apply AoA to generate 50000 adversarial samples from ImageNet validation set to defeat many neural networks, and thus name the dataset as DAmageNet. 13 well-trained DNNs are tested on DAmageNet, and all of them have an error rate over 85%. Even with defenses or adversarial training, most models still maintain an error rate over 70% on DAmageNet. DAmageNet is the first universal adversarial dataset. It could be downloaded freely and serve as a benchmark for robustness testing and adversarial training.