Youtube: https://www.youtube.com/watch?v=gcrqC7M5uec Targeted attacks of image classifiers are difficult to transfer from one model to another. Only strong adversarial attacks with the knowledge of the classifier can bypass existing defenses. To defend against such attacks, we implement an “adversarial^2 training” method to strengthen the existing defenses. Yao Zhao is an applied scientist at Microsoft AI & Research working on natural language understanding/generation and search ranking. During his Ph.D. at Yale University, he worked in the field of computuer vision and optics. Yuzhe Zhao is a software engineer in Google Research, working on natural language understanding. He recently earned his Ph.D. from Yale University. Previously, he received his undergraduate degree in mathematics and physics from Shanghai Jiao Tong University.

2. High Frequency Targeted Attacks
Team YYZZ
Vicent Zhao, Yao Zhao

3. Neural Networks for Image Classification
Snail

4. Adversarial Attacks Against Neural Networks
Fox

5. Non-target Attacks and Targeted Attacks
Non-target Attacks:
anything but snail
Targeted Attacks:
Specific class: e.g. fox

6. Method of Constructing Adversarial Images
loss
gradient

7. Iterative Attacks
loss
gradient

8. Black-box Attacks vs White-box Attacks
White-box:
Model weights accessible to attacker
Perform gradient attacks
Black-box:
Model weights not accessible to attacker
Guess the neural network weights
Ensemble Attack (attack many neural
networks at the same time)

9. Ensemble Attacks Methods
loss
gradient
….

10. Transferability of Targeted Attack Methods

11. CAAD Competition
Attack
Image
Target
Class 3
Target
Class 1
Target
Class 5
Target
Class 2
Target
Class 4

12. Our Attack Strategy:
Testing Defender’s Defense Strategy

13. High Frequency Attack System

14. Thank You