Universal Adversarial Attack on Attention and the Resulting Dataset DAmageNet

• Published in: IEEE transactions on pattern analysis and machine intelligence Vol. 44; no. 4; pp. 2188 - 2197
• Main Authors: Chen, Sizhe, He, Zhengbao, Sun, Chengjin, Yang, Jie, Huang, Xiaolin
• Format: Journal Article
• Language: English
• Published: United States IEEE 01.04.2022; The Institute of Electrical and Electronics Engineers, Inc. (IEEE)
• Subjects: Adversarial attack; Algorithms; Artificial neural networks; Attention; Benchmarking; black-box attack; DAmageNet; Datasets; Error analysis; Heating systems; Neural networks; Neural Networks, Computer; Perturbation methods; Semantics; Training; transferability; Visualization
• ISSN: 0162-8828; 1939-3539; 2160-9292
• DOI: 10.1109/TPAMI.2020.3033291

Adversarial attacks on deep neural networks (DNNs) have been found for several years. However, the existing adversarial attacks have high success rates only when the information of the victim DNN is well-known or could be estimated by the structure similarity or massive queries. In this paper, we propose to Attack on Attention (AoA), a semantic property commonly shared by DNNs. AoA enjoys a significant increase in transferability when the traditional cross entropy loss is replaced with the attention loss. Since AoA alters the loss function only, it could be easily combined with other transferability-enhancement techniques and then achieve SOTA performance. We apply AoA to generate 50000 adversarial samples from ImageNet validation set to defeat many neural networks, and thus name the dataset as DAmageNet . 13 well-trained DNNs are tested on DAmageNet, and all of them have an error rate over 85 percent. Even with defenses or adversarial training, most models still maintain an error rate over 70 percent on DAmageNet. DAmageNet is the first universal adversarial dataset. It could be downloaded freely and serve as a benchmark for robustness testing and adversarial training.