The Relationship Between Network Similarity and Transferability of Adversarial Attacks

• URL: http://arxiv.org/abs/2501.18629v1
• Date: Mon, 27 Jan 2025 17:07:00 GMT
• Title: The Relationship Between Network Similarity and Transferability of Adversarial Attacks
• Abstract summary: We find a correlation between a large number of Convolutional Neural Networks (CNNs) and adversarial attacks.<n> Layer similarity was highest for consistent, basic layers such as DataParallel, Dropout and Conv2d.<n>A DecisionTreeRegressor can predict the success rate of transferred attacks with an accuracy of over 90%.
• Score: 0.0
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Neural networks are vulnerable to adversarial attacks, and several defenses have been proposed. Designing a robust network is a challenging task given the wide range of attacks that have been developed. Therefore, we aim to provide insight into the influence of network similarity on the success rate of transferred adversarial attacks. Network designers can then compare their new network with existing ones to estimate its vulnerability. To achieve this, we investigate the complex relationship between network similarity and the success rate of transferred adversarial attacks. We applied the Centered Kernel Alignment (CKA) network similarity score and used various methods to find a correlation between a large number of Convolutional Neural Networks (CNNs) and adversarial attacks. Network similarity was found to be moderate across different CNN architectures, with more complex models such as DenseNet showing lower similarity scores due to their architectural complexity. Layer similarity was highest for consistent, basic layers such as DataParallel, Dropout and Conv2d, while specialized layers showed greater variability. Adversarial attack success rates were generally consistent for non-transferred attacks, but varied significantly for some transferred attacks, with complex networks being more vulnerable. We found that a DecisionTreeRegressor can predict the success rate of transferred attacks for all black-box and Carlini & Wagner attacks with an accuracy of over 90%, suggesting that predictive models may be viable under certain conditions. However, the variability of results across different data subsets underscores the complexity of these relationships and suggests that further research is needed to generalize these findings across different attack scenarios and network architectures.

Related papers

• Investigating Human-Identifiable Features Hidden in Adversarial Perturbations [54.39726653562144]
  Our study explores up to five attack algorithms across three datasets. We identify human-identifiable features in adversarial perturbations. Using pixel-level annotations, we extract such features and demonstrate their ability to compromise target models.
  arXiv  Detail & Related papers  (2023-09-28T22:31:29Z)
• Thermal Heating in ReRAM Crossbar Arrays: Challenges and Solutions [0.5672132510411465]
  This paper studied robustness of new emerging models such as SpinalNet-based neural networks and Compact Convolutional Transformers (CCT) on image classification problem of CIFAR-10 dataset. It was shown that despite high effectiveness of the attack on the certain individual model, this does not guarantee the transferability to other models.
  arXiv  Detail & Related papers  (2022-12-28T05:47:19Z)
• Improving Hyperspectral Adversarial Robustness Under Multiple Attacks [2.741266294612776]
  We propose an Adversarial Discriminator Ensemble Network (ADE-Net) to combat this issue. In the proposed method, a discriminator network is used to separate data by attack type into their specific attack-expert ensemble network.
  arXiv  Detail & Related papers  (2022-10-28T18:21:45Z)
• Similarity of Neural Architectures using Adversarial Attack Transferability [47.66096554602005]
  We design a quantitative and scalable similarity measure between neural architectures. We conduct a large-scale analysis on 69 state-of-the-art ImageNet classifiers. Our results provide insights into why developing diverse neural architectures with distinct components is necessary.
  arXiv  Detail & Related papers  (2022-10-20T16:56:47Z)
• From Environmental Sound Representation to Robustness of 2D CNN Models Against Adversarial Attacks [82.21746840893658]
  This paper investigates the impact of different standard environmental sound representations (spectrograms) on the recognition performance and adversarial attack robustness of a victim residual convolutional neural network. We show that while the ResNet-18 model trained on DWT spectrograms achieves a high recognition accuracy, attacking this model is relatively more costly for the adversary.
  arXiv  Detail & Related papers  (2022-04-14T15:14:08Z)
• Adversarial Attack via Dual-Stage Network Erosion [7.28871533402894]
  Deep neural networks are vulnerable to adversarial examples, which can fool deep models by adding subtle perturbations. This paper proposes to improve the transferability of adversarial examples, and applies dual-stage feature-level perturbations to an existing model to implicitly create a set of diverse models. We conduct comprehensive experiments both on non-residual and residual networks, and obtain more transferable adversarial examples with the computational cost similar to the state-of-the-art method.
  arXiv  Detail & Related papers  (2022-01-01T02:38:09Z)
• Identification of Attack-Specific Signatures in Adversarial Examples [62.17639067715379]
  We show that different attack algorithms produce adversarial examples which are distinct not only in their effectiveness but also in how they qualitatively affect their victims. Our findings suggest that prospective adversarial attacks should be compared not only via their success rates at fooling models but also via deeper downstream effects they have on victims.
  arXiv  Detail & Related papers  (2021-10-13T15:40:48Z)
• Demystifying the Transferability of Adversarial Attacks in Computer Networks [23.80086861061094]
  CNN-based models are subject to various adversarial attacks. Some adversarial examples could potentially still be effective against different unknown models. This paper assesses the robustness of CNN-based models against adversarial transferability.
  arXiv  Detail & Related papers  (2021-10-09T07:20:44Z)
• TREND: Transferability based Robust ENsemble Design [6.663641564969944]
  We study the effect of network architecture, input, weight and activation quantization on transferability of adversarial samples. We show that transferability is significantly hampered by input quantization between source and target. We propose a new state-of-the-art ensemble attack to combat this.
  arXiv  Detail & Related papers  (2020-08-04T13:38:14Z)
• Understanding and Diagnosing Vulnerability under Adversarial Attacks [62.661498155101654]
  Deep Neural Networks (DNNs) are known to be vulnerable to adversarial attacks. We propose a novel interpretability method, InterpretGAN, to generate explanations for features used for classification in latent variables. We also design the first diagnostic method to quantify the vulnerability contributed by each layer.
  arXiv  Detail & Related papers  (2020-07-17T01:56:28Z)
• Bridging Mode Connectivity in Loss Landscapes and Adversarial Robustness [97.67477497115163]
  We use mode connectivity to study the adversarial robustness of deep neural networks. Our experiments cover various types of adversarial attacks applied to different network architectures and datasets. Our results suggest that mode connectivity offers a holistic tool and practical means for evaluating and improving adversarial robustness.
  arXiv  Detail & Related papers  (2020-04-30T19:12:50Z)
• Transferable Perturbations of Deep Feature Distributions [102.94094966908916]
  This work presents a new adversarial attack based on the modeling and exploitation of class-wise and layer-wise deep feature distributions. We achieve state-of-the-art targeted blackbox transfer-based attack results for undefended ImageNet models.
  arXiv  Detail & Related papers  (2020-04-27T00:32:25Z)
• Architectural Resilience to Foreground-and-Background Adversarial Noise [0.0]
  Adrial attacks in the form of imperceptible perturbations of normal images have been extensively studied. We propose distinct model-agnostic benchmark perturbations of images to investigate resilience and robustness of different network architectures.
  arXiv  Detail & Related papers  (2020-03-23T01:38:20Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.