Cycle-Consistent Adversarial GAN: the integration of adversarial attack and defense

TL;DR

This paper introduces CycleAdvGAN, a novel GAN framework that simultaneously generates adversarial examples and defenses, effectively integrating attack and defense mechanisms to enhance robustness and attack efficiency in deep neural networks.

Contribution

CycleAdvGAN is the first model to jointly learn adversarial attack and defense, improving both generation efficiency and robustness against various attack types.

Findings

Achieved state-of-the-art attack performance on MNIST and CIFAR10.

Effectively improves DNN robustness against adversarial attacks.

Enhances attack transferability across different attack methods.

Abstract

In image classification of deep learning, adversarial examples where inputs intended to add small magnitude perturbations may mislead deep neural networks (DNNs) to incorrect results, which means DNNs are vulnerable to them. Different attack and defense strategies have been proposed to better research the mechanism of deep learning. However, those research in these networks are only for one aspect, either an attack or a defense, not considering that attacks and defenses should be interdependent and mutually reinforcing, just like the relationship between spears and shields. In this paper, we propose Cycle-Consistent Adversarial GAN (CycleAdvGAN) to generate adversarial examples, which can learn and approximate the distribution of original instances and adversarial examples. For CycleAdvGAN, once the Generator and are trained, can generate adversarial perturbations efficiently for any instance, so as to make DNNs predict wrong, and recovery adversarial examples to clean instances, so as to make DNNs predict correct. We apply CycleAdvGAN under semi-white box and black-box settings on two public datasets MNIST and CIFAR10. Using the extensive experiments, we show that our method has achieved the state-of-the-art adversarial attack method and also efficiently improve the defense ability, which make the integration of adversarial attack and defense come true. In additional, it has improved attack effect only trained on the adversarial dataset generated by any kind of adversarial attack.