{"id":38124,"date":"2023-02-06T15:16:34","date_gmt":"2023-02-06T15:16:34","guid":{"rendered":"https:\/\/hypersense.subex.com\/?p=38124"},"modified":"2023-02-06T15:16:34","modified_gmt":"2023-02-06T15:16:34","slug":"adversarial-attacks-a-detailed-review-part-2","status":"publish","type":"post","link":"https:\/\/dev.enki.studio\/test\/?p=38124","title":{"rendered":"Adversarial attacks: A detailed review – Part 2"},"content":{"rendered":"

In previous part, we understood what is and adversarial attack and how it can be classified based on various attributes. (In case you missed it, you can read it\u00a0here<\/a>). In this part, we will study some of the most common types of attacks in detail.<\/p>\n

Outline<\/strong><\/p>\n

In this part we will overview some of the most common attacks on image classifiers and implement a very popular method called FGSM (Fast Gradient Sign Method) attack proposed in\u00a0Goodfellow et al.<\/a>\u00a0and understand how it works as well as how it challenges the notion of non-linearity of neural networks<\/a> being the reason behind success of adversarial attacks<\/a>.<\/p>\n

L-BFGS Attack<\/strong><\/p>\n

This was one of the earliest attacks where\u00a0Szegedy et al.<\/a>\u00a0first discovered the vulnerability of deep visual models to adversarial perturbations by solving for the following optimization problem:<\/p>\n

\"Adversarial
equation for L-BFGS attack<\/figcaption><\/figure>\n

where we are trying to minimize \u03c1 (which is the adversary signal) with second-norm. If we look closely, this equation is similar to equation described in part \u2014 1, with norm-value p=2.<\/span><\/p>\n

For this problem, approximate solution was computed by\u00a0Szegedy et al<\/a>. with the Limited Memory Broyden\u2013Fletcher\u2013Goldfarb\u2013Shanno (L-BFGS) algorithm, upon which this method is named. However, solving this equation for large number of examples, is computationally prohibitive, which is addressed in next method. That is when the next method comes into picture.<\/p>\n

FGSM Attack<\/strong><\/p>\n

The FGSM is among the most influential attacks in the existing literature, especially in the\u00a0white-box<\/em><\/strong>\u00a0setup. Its core concept of performing gradient ascend over the model\u2019s loss surface to fool it, is the basis for a plethora of adversarial attacks. Many follow-up attacks can be strongly related to the original idea of FGSM. The most common image showing adversarial attacks has been of FGSM attack:<\/p>\n

\"Adversarial
A common example of FGSM attack<\/figcaption><\/figure>\n

The FGSM is a one-step gradient-based method that computes norm-bounded perturbations, focusing on the \u2018efficiency\u2019 of perturbation computation rather than achieving high fooling rates.\u00a0Goodfellow et al.<\/a>\u00a0also used this attack to corroborate their\u00a0linearity hypothesis<\/em><\/strong>, which considers the linear behavior of the modern neural networks in high dimension spaces (induced by ReLUs) as a sufficient reason for their vulnerability to adversarial perturbations. At the time, the linearity hypothesis was in sharp contrast to the developing idea that adversarial vulnerability was a result of high \u2018non-linearity<\/em>\u2019 of the complex modern networks.<\/p>\n

Goodfellow et al.<\/a>\u00a0claimed that adversarial examples expose fundamental blind spots in our training algorithms. They also claimed that linear behavior in high-dimensional spaces is sufficient to cause adversarial examples. And using this, they designed a fast method of generating adversarial examples that makes adversarial training practical.<\/p>\n

Linear explanation of adversarial examples<\/strong><\/p>\n

We start with explaining the existence of adversarial examples for linear models. Since the precision of the features is limited, we will see how the classifier can be forced to respond differently to an input x than to an adversarial input\u00a0x\u0303<\/em>\u00a0= x + \u03b7 if every element of the perturbation \u03b7 is smaller than the precision of the features.<\/p>\n

Adversarial attacks for linear model<\/p>\n

Thus, for high dimensional problems, we can make many infinitesimal changes to the input that will add up to one large change to the output.<\/p>\n

Linear Perturbation of Non-Linear Models<\/strong><\/p>\n

The linear view of adversarial examples suggests a fast way of generating them. We hypothesize that neural networks are too linear to resist linear adversarial perturbation. LSTMs, ReLUs, and maxout networks are all intentionally designed to behave in very linear ways, so that they are easier to optimize. More nonlinear models such as sigmoid networks are carefully tuned to spend most of their time in the non-saturating, more linear regime for the same reason. This linear behavior suggests that cheap, analytical perturbations of a linear model should also damage neural networks. Let us see how adversarial examples can be generated for the neural networks.<\/p>\n

\"Adversarial
Adversarial perturbation for neural networks<\/figcaption><\/figure>\n

We refer to this as the \u201cfast gradient sign method<\/strong>\u201d of generating adversarial examples. Note that the required gradient can be computed efficiently using backpropagation.<\/p>\n

Code Implementation for FGSM<\/strong><\/p>\n

Let us see how we can implement this in code. We will be using code from this\u00a0link<\/a>, which is part of tensorflow official documentation. We will analyze this function\u00a0\u2018create_adversarial_pattern\u2019,\u00a0<\/em>as it implements the crux of the paper,\u00a0i.e.\u00a0<\/em>calculates the gradient sign<\/strong>.<\/p>\n

def create_adversarial_pattern(input_image, input_label):\nwith tf.GradientTape() as tape:\ntape.watch(input_image)\nprediction = pretrained_model(input_image)\nloss = loss_object(input_label, prediction)\n\n# Get the gradients of the loss w.r.t to the input image.\ngradient = tape.gradient(loss, input_image)\n# Get the sign of the gradients to create the perturbation\nsigned_grad = tf.sign(gradient)\nreturn signed_grad\n\n# codel_url: https:\/\/www.tensorflow.org\/tutorials\/generative\/adversarial_fgsm<\/pre>\n
 <\/p>\n
Using below lines, we are basically asking tensorflow to keep track of computations related to \u2018input_image\u2019<\/em><\/p>\n
with tf.GradientTape() as tape:\ntape.watch(input_image)<\/pre>\n
 <\/p>\n
Using below two lines, we are making predictions for \u2018input_image\u2019,<\/em>\u00a0and calculating the loss related to this prediction.<\/p>\n
prediction = pretrained_model(input_image)\nloss = loss_object(input_label, prediction)<\/pre>\n
 <\/p>\n
Using below lines, we are calculating the gradient of loss wrt input image, this part contributes to the \u2018gradient<\/em>\u2019 term in the FGSM (Fast\u00a0Gradient\u00a0<\/strong>Sign Method)<\/p>\n
gradient = tape.gradient(loss, input_image)<\/pre>\n
 <\/p>\n
Once we have gradients, we need to calculate use \u2018sign\u2019 function of gradient, i.e, sign(gradient), and we have \u2018gradient sign<\/em>\u2019 term in FGSM (Fast\u00a0Gradient Sign<\/strong>\u00a0Method). Below is the input image, for which we are calculation adversarial perturbation (\u03b7).<\/p>\n
\"Adversarial
Prediction on input image<\/figcaption><\/figure>\n
 <\/p>\n
Calculated adversarial perturbation (\u03b7) using FGSM method comes out as:<\/p>\n
\"Adversarial
Calculated adversarial perturbation (\u03b7) using FGSM<\/figcaption><\/figure>\n
Adversarial image to fool the model is calculated using the below code:<\/p>\n
adv_x = image + eps*perturbations<\/pre>\n
 <\/p>\n
Here is what the generated result looks like for different values of \u03f5<\/p>\n
\"Adversarial
Generated adversarial examples for different values of epsilon (0.01, 0.1, 0.15)<\/figcaption><\/figure>\n
Goodfellow et al.<\/a>\u00a0concluded the following things as a result of this experiment:<\/p>\n