Strong Transferable Adversarial Attacks via Ensembled Asymptotically Normal Distribution Learning (Accepted by CVPR2024)

This is the official PyTorch code for ANDA and MultiANDA in our paper Strong Transferable Adversarial Attacks via Ensembled Asymptotically Normal Distribution Learning.

Abstract

Strong adversarial examples are crucial for evaluating and enhancing the robustness of deep neural networks. However, the performance of popular attacks is usually sensitive, for instance, to minor image transformations, stemming from limited information -- typically only one input example, a handful of white-box source models, and undefined defense strategies. Hence, the crafted adversarial examples are prone to overfit the source model, which hampers their transferability to unknown architectures. In this paper, we propose an approach named Multiple Asymptotically Normal Distribution Attacks (MultiANDA) which explicitly characterize adversarial perturbations from a learned distribution. Specifically, we approximate the posterior distribution over the perturbations by taking advantage of the asymptotic normality property of stochastic gradient ascent (SGA), then employ the deep ensemble strategy as an effective proxy for Bayesian marginalization in this process, aiming to estimate a mixture of Gaussians that facilitates a more thorough exploration of the potential optimization space. The approximated posterior essentially describes the stationary distribution of SGA iterations, which captures the geometric information around the local optimum. Thus, MultiANDA allows drawing an unlimited number of adversarial perturbations for each input and reliably maintains the transferability. Our proposed method outperforms ten state-of-the-art black-box attacks on deep learning models with or without defenses through extensive experiments on seven normally trained and seven defense models.

Requirements

• Python == 3.10.10
• torch == 2.0.1
• torchvision == 0.15.2
• numpy == 1.25.2
• scipy == 1.11.1

Datasets

Please download datasets.zip from ImageNet Subset, and unzip it as ./datasets

Run the code

Please refer to the scripts/ dir for how to run the code.

• ANDA and ANDA-CT in scripts/anda.sh
• MultiANDA and MultiANDA-CT in scripts/multianda.sh (implemented by torch.distributed)

Notes

1. Only support pytorch official model ckpts in this repo (for a simple demonstration), if you need to reproduce the results of our paper, please refer to the detailed model information and source listed below:

   • vgg19 (pytorch offical)
   • tf_inc_res_v2, tf_resnet_v2_50, tf_inception_v3, tf_ens3_adv_inc_v3, tf_ens_adv_inc_res_v2 (tf2torch)
   • HGD, R&P, NIPS-r3: We directly run the code from the corresponding repo.
   • NRP: purifier=NRP, dynamic=True, base_model=Inc_v3_ens

2. Output option (b) in Algorithm-(1/A.1) can be enabled by setting sample=True in attack function in anda.py/anda_ct.py/multianda.py/multianda_ct.py.

3. The CT version of ANDA/MultiANDA may not be CUDA memory friendly, one can enable minibatch forward to save CUDA memory by setting minibatch=True of attack function in attack/anda_ct.py and attack/multianda_ct.py, default minibatch=False.

Acknowledgments

We are very grateful for the contribution of following efforts to the community:

• https://github.com/ylhz/tf_to_pytorch_model
• https://github.com/JHL-HUST/VT

Citation

If you find this work is useful, please consider citing:

@InProceedings{Fang_2024_CVPR,
    author    = {Fang, Zhengwei and Wang, Rui and Huang, Tao and Jing, Liping},
    title     = {Strong Transferable Adversarial Attacks via Ensembled Asymptotically Normal Distribution Learning},
    booktitle = {Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR)},
    month     = {June},
    year      = {2024},
    pages     = {24841-24850}
}

Contact

Please feel free to email [email protected].