On Trace of PGD-Like Adversarial Attacks
Not on the map. Why?
Abstract (arXiv)
Adversarial attacks pose safety and security concerns to deep learning applications, but their characteristics are under-explored. Yet largely imperceptible, a strong trace could have been left by PGD-like attacks in an adversarial example. Recall that PGD-like attacks trigger the ``local linearity'' of a network, which implies different extents of linearity for benign or adversarial examples. Inspired by this, we construct an Adversarial Response Characteristics (ARC) feature to reflect the model's gradient consistency around the input to indicate the extent of linearity. Under certain conditions, it qualitatively shows a gradually varying pattern from benign example to adversarial example, as the latter leads to Sequel Attack Effect (SAE). To quantitatively evaluate the effectiveness of ARC, we conduct experiments on CIFAR-10 and ImageNet for attack detection and attack type recognition in a challenging setting. The results suggest that SAE is an effective and unique trace of PGD-like attacks reflected through the ARC feature. The ARC feature is intuitive, light-weighted, non-intrusive, and data-undemanding.
Key facts. Cited by 2 papers in the map (data through 7 Oct 2026). Builds on 46 of its 67 references that are in the map. First posted on arXiv 19 May 2022.
Builds on
46 of 67 references.
References · 46
- 2015Deep Residual Learning for Image Recognitioncited by 51,809
- 2019PyTorch: An Imperative Style, High-Performance Deep Learning Librarycited by 20,160
- 2021Swin Transformer: Hierarchical Vision Transformer using Shifted Windowscited by 12,082
- 2016Communication-Efficient Learning of Deep Networks from Decentralized Datacited by 7,592
- 2014Explaining and Harnessing Adversarial Examplescited by 7,287
- 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
- 2013Intriguing properties of neural networkscited by 5,114
- 2016Towards Evaluating the Robustness of Neural Networkscited by 2,976
- 2016Adversarial examples in the physical worldcited by 1,762
- 2020Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attackscited by 1,442
- 2018Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examplescited by 1,259
- 2019Adversarial Examples Are Not Bugs, They Are Featurescited by 950
34 more
- 2016Universal adversarial perturbationscited by 774
- 2019Square Attack: a query-efficient black-box adversarial attack via random searchcited by 682
- 2017ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Modelscited by 656
- 2018Improving Transferability of Adversarial Examples with Input Diversitycited by 591
- 2020On Adaptive Attacks to Adversarial Example Defensescited by 547
- 2017Adversarial Examples Are Not Easily Detected: Bypassing Ten Detection Methodscited by 542
- 2018Black-box Adversarial Attacks with Limited Queries and Informationcited by 499
- 2018Certified Robustness to Adversarial Examples with Differential Privacycited by 462
- 2017Decision-Based Adversarial Attacks: Reliable Attacks Against Black-Box Machine Learning Modelscited by 459
- 2019Evading Defenses to Transferable Adversarial Examples by Translation-Invariant Attackscited by 440
- 2016Transferability in Machine Learning: from Phenomena to Black-Box Attacks using Adversarial Samplescited by 439
- 2019Minimally distorted Adversarial Examples with a Fast Adaptive Boundary Attackcited by 333
- 2017Defense against Adversarial Attacks Using High-Level Representation Guided Denoisercited by 329
- 2018Feature Denoising for Improving Adversarial Robustnesscited by 312
- 2017MagNet: a Two-Pronged Defense against Adversarial Examplescited by 268
- 2017Detecting Adversarial Samples from Artifactscited by 244
- 2017PixelDefend: Leveraging Generative Models to Understand and Defend against Adversarial Examplescited by 243
- 2017On Detecting Adversarial Perturbationscited by 232
- 2018Adversarial Risk and the Dangers of Evaluating Against Weak Attackscited by 221
- 2020Understanding and Improving Fast Adversarial Trainingcited by 213
- 2020Torchattacks: A PyTorch Repository for Adversarial Attackscited by 156
- 2021Poisoning and Backdooring Contrastive Learningcited by 149
- 2019Adversarial Robustness through Local Linearizationcited by 146
- 2016Adversarial Examples Detection in Deep Networks with Convolutional Filter Statisticscited by 77
- 2017SafetyNet: Detecting and Rejecting Adversarial Examples Robustlycited by 76
- 2019The Odds are Odd: A Statistical Test for Detecting Adversarial Examplescited by 75
- 2021Adversarial Example Detection for DNN Models: A Review and Experimental Comparisoncited by 51
- 2021Fast Minimum-norm Adversarial Attacks through Adaptive Norm Constraintscited by 50
- 2019A New Defense Against Adversarial Images: Turning a Weakness into a Strengthcited by 49
- 2021Adversarial Examples in Multi-Layer Random ReLU Networkscited by 26
- 2019GAT: Generative Adversarial Training for Adversarial Example Detection and Robust Classificationcited by 20
- 2022Reverse Engineering of Imperceptible Adversarial Image Perturbationscited by 17
- 2018Combating Adversarial Attacks Using Sparse Representationscited by 9
- 2021Identification of Attack-Specific Signatures in Adversarial Examplescited by 4
Built on by
Citing papers per year: 2023: 2.
2 papers.