AI2030 Responsible AI Tools Marketplace

Key Takeaways

Adversarial attacks are a serious real-world threat: The paper addresses how attackers can create slightly modified images that fool AI systems in one context and transfer those attacks to fool different AI systems in real-world applications, demonstrating a significant vulnerability in deployed AI systems.
Current attack methods focus on the wrong problem: Existing approaches to making adversarial attacks more transferable concentrate on complex mathematical calculations and image transformations, but this research shows that understanding the AI model's internal structure itself is equally important for creating more effective attacks.
AI models contain unnecessary redundancy that can be exploited: The research reveals that deep neural networks are "over-parameterized" (contain more parameters than needed), and attackers can exploit this redundancy by deliberately diversifying high-level features to find weaknesses that transfer across different models—a finding relevant to understanding AI system vulnerabilities.
The proposed method significantly improves attack transferability: When tested on ImageNet, the DHF approach substantially increased how well adversarial examples created against one model could fool other models and defense systems, with clear performance improvements over existing methods.
This work highlights the need for better AI defenses: The improved transferability of adversarial attacks demonstrated here underscores why organizations deploying AI systems need robust defense mechanisms and why responsible AI development must account for these cross-model attack vulnerabilities.

Abstract

Given the great threat of adversarial attacks against Deep Neural Networks (DNNs), numerous works have been proposed to boost transferability to attack real-world applications. However, existing attacks often utilize advanced gradient calculation or input transformation but ignore the white-box model. Inspired by the fact that DNNs are over-parameterized for superior performance, we propose diversifying the high-level features (DHF) for more transferable adversarial examples. In particular, DHF perturbs the high-level features by randomly transforming the high-level features and mixing them with the feature of benign samples when calculating the gradient at each iteration. Due to the redundancy of parameters, such transformation does not affect the classification performance but helps identify the invariant features across different models, leading to much better transferability. Empirical evaluations on ImageNet dataset show that DHF could effectively improve the transferability of existing momentum-based attacks. Incorporated into the input transformation-based attacks, DHF generates more transferable adversarial examples and outperforms the baselines with a clear margin when attacking several defense models, showing its generalization to various attacks and high effectiveness for boosting transferability. Code is available at https://github.com/Trustworthy-AI-Group/DHF.

Accepted by BMVC 2023 (Oral)

Key Takeaways

Adversarial attacks are a serious real-world threat: The paper addresses how attackers can create slightly modified images that fool AI systems in one context and transfer those attacks to fool different AI systems in real-world applications, demonstrating a significant vulnerability in deployed AI systems.
Current attack methods focus on the wrong problem: Existing approaches to making adversarial attacks more transferable concentrate on complex mathematical calculations and image transformations, but this research shows that understanding the AI model's internal structure itself is equally important for creating more effective attacks.
AI models contain unnecessary redundancy that can be exploited: The research reveals that deep neural networks are "over-parameterized" (contain more parameters than needed), and attackers can exploit this redundancy by deliberately diversifying high-level features to find weaknesses that transfer across different models—a finding relevant to understanding AI system vulnerabilities.
The proposed method significantly improves attack transferability: When tested on ImageNet, the DHF approach substantially increased how well adversarial examples created against one model could fool other models and defense systems, with clear performance improvements over existing methods.
This work highlights the need for better AI defenses: The improved transferability of adversarial attacks demonstrated here underscores why organizations deploying AI systems need robust defense mechanisms and why responsible AI development must account for these cross-model attack vulnerabilities.

Abstract

Accepted by BMVC 2023 (Oral)

Diversifying the High-level Features for better Adversarial Transferability

Key Takeaways

Abstract

Paper Info

Responsible AI Topics

Links

Diversifying the High-level Features for better Adversarial Transferability

Key Takeaways

Abstract

Paper Info

Responsible AI Topics

Links