Enhancing Generalization of Universal Adversarial Perturbation through Gradient Aggregation

GitHub Link

The GitHub link is https://github.com/liuxuannan/stochastic-gradient-aggregation

Introduce

This repository, "Stochastic-Gradient-Aggregation," presents the official implementation of an ICCV2023 paper that focuses on enhancing the generalization of universal adversarial perturbation (UAP) through gradient aggregation. UAP is a perturbation that can fool various samples and models. The paper addresses the challenges of gradient vanishing and local optima in UAP generation methods by introducing Stochastic Gradient Aggregation (SGA). SGA combines small-batch training and gradient aggregation to enhance gradient stability and reduce errors. Experiments on ImageNet show that SGA significantly improves UAP's generalization and outperforms other methods. The code is available for training, generating, and evaluating UAP on ImageNet dataset. Deep neural networks are vulnerable to universal adversarial perturbation (UAP), an instance-agnostic perturbation capable of fooling the target model for most samples.

Content

Deep neural networks are vulnerable to universal adversarial perturbation (UAP), an instance-agnostic perturbation capable of fooling the target model for most samples. Compared to instance-specific adversarial examples, UAP is more challenging as it needs to generalize across various samples and models. In this paper, we examine the serious dilemma of UAP generation methods from a generalization perspective -- the gradient vanishing problem using small-batch stochastic gradient optimization and the local optima problem using large-batch optimization. To address these problems, we propose a simple and effective method called Stochastic Gradient Aggregation (SGA), which alleviates the gradient vanishing and escapes from poor local optima at the same time. Specifically, SGA employs the small-batch training to perform multiple iterations of inner pre-search. Then, all the inner gradients are aggregated as a one-step gradient estimation to enhance the gradient stability and reduce quantization errors. Extensive experiments on the standard ImageNet dataset demonstrate that our method significantly enhances the generalization ability of UAP and outperforms other state-of-the-art methods. We train SGA with Torch 1.10.0 and torchvision 0.11.0. Pre-trained ImageNet models are available online via torchvision. To generate UAP of ImageNet dataset by applying SGA with cross-entropy loss, based on surrgate model "VGG16", please do as follows. Other surrogate models can be used modifying "--model_name". Other parameters, please refer to the code. After generating the UAP, please refer to the evaluation part for fooling ratio. For ImageNet dataset, evaluation towards five target models is as follows. The UAP generated by SGA on ImageNet test set in the white-box setting achieve over 95% fooling rate on average. If you find our code useful, please consider citing our paper: This project is built on the open source repository sgd-uap-torch. Thanks the team for their impressive work!

---