PDPGD: Primal-Dual Proximal Gradient Descent Adversarial Attack

Alexander Matyasko, Lap-Pui Chau, PDPGD: Primal-Dual Proximal Gradient Descent Adversarial Attack.

State-of-the-art deep neural networks are sensitive to small input perturbations. Since the discovery of this intriguing vulnerability, many defence methods have been proposed that attempt to improve robustness to adversarial noise. Fast and accurate attacks are required to compare various defence methods. However, evaluating adversarial robustness has proven to be extremely challenging. Existing norm minimisation adversarial attacks require thousands of iterations (e.g. Carlini & Wagner attack), are limited to the specific norms (e.g. Fast Adaptive Boundary), or produce sub-optimal results (e.g. Brendel & Bethge attack). On the other hand, PGD attack, which is fast, general and accurate, ignores the norm minimisation penalty and solves a simpler perturbation-constrained problem. In this work, we introduce a fast, general and accurate adversarial attack that optimises the original non-convex constrained minimisation problem. We interpret optimising the Lagrangian of the adversarial attack optimisation problem as a two-player game: the first player minimises the Lagrangian wrt the adversarial noise; the second player maximises the Lagrangian wrt the regularisation penalty. Our attack algorithm simultaneously optimises primal and dual variables to find the minimal adversarial perturbation. In addition, for non-smooth lp-norm minimisation, such as linf-, l1-, and l0-norms, we introduce primal-dual proximal gradient descent attack. We show in the experiments that our attack outperforms current state-of-the-art linf-, l2-, l1-, and l0-attacks on MNIST, CIFAR-10 and Restricted ImageNet datasets against unregularised and adversarially trained models.

@Article{	  matyasko2021pdpgd,
  author	= {Alexander Matyasko, Lap-Pui Chau},
  title		= {PDPGD: Primal-Dual Proximal Gradient Descent Adversarial
		  Attack},
  journal	= {arXiv e-prints},
  year		= 2021,
  pages		= {arXiv:2106.01538},
  primaryclass	= {cs.LG}
}

Installation

Clone the repository and add the repository directory to PYTHONPATH. git-lfs must be installed to automatically download the naturally trained, linf- and l2- adversarially trained models for MNIST and CIFAR-10. The models for the experiments on Restricted ImageNet can be downloaded from url.

git clone https://github.com/aam-at/cpgd
export PYTHONPATH="$PYTHONPATH:<PATH_TO_CLONE_DIR>"

Requirements (tested with python 3.6)

Tensorflow v2.2.0
Pytorch v1.5.0
Foolbox v3.2.1
Cleverhans (https://github.com/aam-at/cleverhans_tf2)
Adversarial Robustness Toolbox v1.4.2

See requirements.txt for the list of full requirements.

Implementation details

Our attacks and utilities are implemented in lib directory. attack_lp implements abstract classes PrimalDualGradientAttack and ProximalPrimalDualGradientAttack, which corresponds to our PDGD and PDPGD attacks, respectively.

Steps to reproduce results

We provide scripts to reproduce all the results for all datasets, attacks and models in folder experiments.

For example, one can run all experiments on MNIST for DeepFool li- and l2-norm attack using the following commands:

cd experiments
./mnist_deepfool.sh

We provide scripts to parse the results of all experiments and export it as an Excel spreadsheet:

cd mnist
python parse_results.py