Multi-attacks: Many images $+$ the same adversarial attack $\to$ many target labels

TL;DR

This paper introduces multi-attacks, a method to generate a single adversarial perturbation that can simultaneously alter the classifications of many images to multiple target labels, revealing complex decision boundaries and challenging defenses.

Contribution

The paper presents the concept of multi-attacks, demonstrating their ability to change multiple images to multiple classes simultaneously and analyzing the structure of decision boundaries in pixel space.

Findings

Maximum number of images affected can reach hundreds.

Class decision boundaries are highly complex and numerous.

Ensembling and training on random labels influence susceptibility.

Abstract

We show that we can easily design a single adversarial perturbation $P$ that changes the class of $n$ images $X_1,X_2,\dots,X_n$ from their original, unperturbed classes $c_1, c_2,\dots,c_n$ to desired (not necessarily all the same) classes $c^*_1,c^*_2,\dots,c^*_n$ for up to hundreds of images and target classes at once. We call these \textit{multi-attacks}. Characterizing the maximum $n$ we can achieve under different conditions such as image resolution, we estimate the number of regions of high class confidence around a particular image in the space of pixels to be around $10^{\mathcal{O}(100)}$, posing a significant problem for exhaustive defense strategies. We show several immediate consequences of this: adversarial attacks that change the resulting class based on their intensity, and scale-independent adversarial examples. To demonstrate the redundancy and richness of class decision boundaries in the pixel space, we look for its two-dimensional sections that trace images and spell words using particular classes. We also show that ensembling reduces susceptibility to multi-attacks, and that classifiers trained on random labels are more susceptible. Our code is available on GitHub.