Awesome

About

PyTorch code for our paper:"On Success and Simplicity: A Second Look at Transferable Targeted Attacks". <br> Zhengyu Zhao, Zhuoran Liu, Martha Larson. NeurIPS 2021.

We demonstrate that the conventional simple, iterative attacks can actually achieve even higher targeted transferability than the current SOTA, resource-intensive attacks. The key is to use enough iterations for ensuring convergence and to replace the widely-used Cross-Entropy loss with a simpler Logit loss for preventing the decreasing gradient problem.

Requirements

torch>=1.7.0; torchvision>=0.8.1; tqdm>=4.31.1; pillow>=7.0.0; matplotlib>=3.2.2; numpy>=1.18.1;

Dataset

The 1000 images from the NIPS 2017 ImageNet-Compatible dataset are provided in the folder dataset/images, along with their metadata in dataset/images.csv. More details about this dataset can be found in its official repository.

Evaluation

We evaluated three simple transferable targeted attacks (CE, Po+Trip, and Logit) in the following six transfer scenarios. If not mentioned specifically, all attacks are integrated with TI, MI, and DI, and run with 300 iterations to ensure convergence. L_∞=16 is applied.

eval_single.py: Single-model transfer.

eval_ensemble.py: Ensemble transfer.

eval_low_ranked.py: Transfer with low-ranked targets.

eval_10_targets.py: "10-Targets (all-source)" setting to compare with the resource-intensive SOTA, TTP, which is based on training target-class-specific GANs.

eval_unbounded.py: Undounded setting to the resource-intensive FDA^(N)+xent, which is based on training target-class-specific auxiliary binary classifiers.

eval_tUAP.py: Generating targeted UAPs.

Attacking the Google Cloud Vision API.