Deep neural networks (DNNs) have been found to be vulnerable to adversarial examples resulting from adding small-magnitude perturbations to inputs. Such adversarial examples can mislead DNNs to produce adversary-selected results.
 Different attack strategies have been proposed to generate adversarial examples, but how to produce them with high perceptual quality and more efficiently requires more research efforts. 
 In this paper, we propose AdvGAN to generate adversarial examples with generative adversarial networks (GANs), which can learn and approximate the distribution of original instances. 
 For AdvGAN, once the generator is trained, it can generate adversarial perturbations efficiently for any instance, so as to potentially accelerate adversarial training as defenses.  
 We apply AdvGAN in both semi-whitebox and black-box attack settings. In semi-whitebox attacks, there is no need to access the original target model after the generator is trained, in contrast to traditional white-box attacks. In black-box attacks, we dynamically train a distilled model for the black-box model and optimize the generator accordingly.
 Adversarial examples generated by AdvGAN on different target models have high attack success rate under state-of-the-art defenses compared to other attacks. Our attack  has placed the first with 92.76% accuracy on a public MNIST black-box attack challenge. Deep Neural Networks (DNNs) have achieved great successes in a variety of applications ranging from image recognition BID19 BID12 to speech processing and from robotics training BID23 to medical diagnostics BID7 . However, recent work has demonstrated that DNNs are vulnerable to adversarial perturbations BID32 BID10 . An adversary can add small-magnitude perturbations to inputs and generate adversarial examples to mislead DNNs. Such maliciously perturbed instances can cause the learning system to misclassify them into either a maliciously-chosen target class (in a targeted attack) or classes that are different from the ground truth (in an untargeted attack). Different algorithms have been proposed for generating such adversarial examples, such as the fast gradient sign method (FGSM) BID10 and optimization-based methods (Opt.) BID4 BID24 .Most of the the current attack algorithms BID4 BID24 rely on optimization schemes with simple pixel space metrics, such as L ∞ distance from a benign image, to encourage visual realism. To generate more perceptually realistic adversarial examples, in this paper, we propose to train a feed-forward network to generate perturbations such that the resulting example must be realistic according to a discriminator network. We apply generative adversarial networks (GANs) to produce adversarial examples in both the semi-whitebox and black-box settings. As conditional GANs are capable of producing high-quality images BID16 , we apply a similar paradigm to produce perceptually realistic adversarial instances. We name our method AdvGAN.Note that in the previous white-box attacks, such as FGSM and optimization methods, the adversary needs to have white-box access to the architecture and parameters of the model all the time. However, by deploying AdvGAN, once the feed-forward network is trained, it can instantly pro-duce adversarial perturbations for any input instances without requiring access to the model itself anymore. We name this attack setting semi-whitebox.To evaluate the effectiveness of our attack strategy AdvGAN, we first generate adversarial instances based on AdvGAN and other attack strategies on different target models. We then apply the stateof-the-art defenses to defend against these generated adversarial examples BID10 BID33 BID27 . We evaluate these attack strategies in both semi-whitebox and black-box settings. We show that adversarial examples generated by AdvGAN can achieve a high attack success rate, potentially due to the fact that these adversarial instances appear closer to real instances compared to other recent attack strategies.Our contributions are listed as follows.• Different from the previous optimization-based methods, we train a conditional adversarial network to directly produce adversarial examples, which are both perceptually realistic and achieve state-of-the-art attack success rate against different target models.• We show that AdvGAN can attack black-box models by training a distilled model. We propose to dynamically train the distilled model with query information and achieve high black-box attack success rate and targeted black-box attack, which is difficult to achieve for transferability-based black-box attacks.• We use the state-of-the-art defense methods to defend against adversarial examples and show that AdvGAN achieves much higher attack success rate under current defenses.• We apply AdvGAN on Mądry et al.'s MNIST challenge (2017a ) and achieve 88.93% accuracy on the published robust model in the semi-whitebox setting and 92.76% in the blackbox setting, which wins the top position in the challenge BID28 . In this paper, we propose AdvGAN to generate adversarial examples using generative adversarial networks (GANs). In our AdvGAN framework, once trained, the feed-forward generator can produce adversarial perturbations efficiently. It can also perform both semi-whitebox and black-box attacks with high attack success rate. In addition, when we apply AdvGAN to generate adversarial instances on different models without knowledge of the defenses in place, the generated adversarial examples can attack the state-of-the-art defenses with higher attack success rate than examples generated by the competing methods. This property makes AdvGAN a promising candidate for improving adversarial training defense methods. The generated adversarial examples produced by AdvGAN preserve high perceptual quality due to GANs' distribution approximation property.A ARCHITECTURE OF MODELS BID16 . Let c3s1-k denotes 3 × 3 Convolution-InstanceNorm-ReLU layer with k filter and stride 1. Rk means residual block that contains two 3 × 3 convolution layers with the same numbers of filters. dk denotes the 3 × 3 Convolution-InstanceNorm-ReLU layer with k filters and stride 2. uk denotes a 3 × 3 fractional-strided-ConvolutionInstanceNorm-ReLU layer with k filters, and stride c3s1-8, d16, d32, r32, r32, r32, r32, u16, u8, c3s1-3 Discriminator architecture We use CNNs as our discriminator network BID31 . Let Ck denote a 4 × 4 Convolution-InstanceNorm-LeakyReLU layer with k filters and stride 2. After the last conv layer, we apply a FC layer to produce a 1 dimensional output. We do not use InstanceNorm for the first C8 layer. We use leaky ReLUs with slope 0.2. c7s1-8, d16, d32, d64, d64, d64, d64, r64, r64, r64, r64, u64, u64, u64, u64, u32, u16, u8, c7s1-3 The architecture of discriminator for ImageNet is: C8, C16, C32, FC
We propose to generate adversarial example based on generative adversarial networks in a semi-whitebox and black-box settings. Describes AdvGAN, a conditional GAN plus adversarial loss, and evaluates AdvGAN on semi-white box and black box setting, reporting state-of-art results. This paper proposes a way of generating adversarial examples that fool classification systems and wins MadryLab's mnist challenge.