Research map / Adversarial robustness and security / Black-box and transfer attacks
Where and How to Attack? A Causality-Inspired Recipe for Generating Counterfactual Adversarial Examples
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes CADE, a causality-inspired framework that generates counterfactual adversarial examples by intervening on causally selected variables (children/Markov blanket of target) using an SCM-based abduction-action-prediction procedure, including latent-space attacks on images via the DEAR causal generative model.
Problem
Standard adversarial attacks (L_p-bounded or unrestricted) assume adversaries can modify any feature freely and ignore the causal generating process, producing unrealistic examples; the paper asks where to attack and how to attack under causal constraints.
Approach
Theoretical characterization that DNN vulnerability stems from non-robustness to interventional distributions: intervening on children (or children plus co-parents) of the target shifts the conditional distribution while co-parent-only interventions do not; then generate counterfactuals via abduction, action, and prediction using a non-linear invertible SCM, with latent-space attacks through a cau
Key results
- On Pendulum, CADE(Mb) reaches 99.4% white-box ASR on Res-50 and achieves the highest transfer ASR among competitors on the adversarially trained defense models (e.g., 98.6% on R50(D)).
- On CelebA, CADE achieves 47.0% ASR on R50(D) and 52.7% on V16 transfer, outperforming baselines on the defended transfer setting, though it is not best in white-box.
- Random intervention without a substitute model reaches 57.7-87.6% ASR on Pendulum, with CADE(Mb) at 86.6-87.6%.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Intervene on the target's child variables rather than only its co-parent (CADE(2)/CADE(3) versus CADE(1)) (ablation) | CADE · Pendulum | ASR (%) | Helped |
| Intervene on light_angle, a co-parent of the target (CADE(1)) (ablation) | CADE · Pendulum | ASR (%) | Hurt |
| Intervene on shadow_length (CADE(2)) instead of light_angle (CADE(1)) (ablation) | CADE · Pendulum, Res-50 white-box | ASR (%): 75.3* -> 98.6* | Helped |
| Intervene on shadow_position (CADE(3)) instead of light_angle (CADE(1)) (ablation) | CADE · Pendulum, Res-50 white-box | ASR (%): 75.3* -> 95.0* | Helped |
| Intervene on the target's Markov blanket (CADE(Mb)) rather than only light_angle (CADE(1)) (ablation) | CADE · Pendulum, Res-50 white-box | ASR (%): 75.3* -> 99.4* | Helped |
| Use random intervention on child variables without a substitute model instead of intervening on the co-parent (ablation) | CADE · Pendulum, random intervention | ASR (%): 57.7 -> 84.2 | Helped |
| Intervene on the co-parent CP (with the prediction process) (ablation) | CADE · SynMeasurement | RMSE | No clear effect |
| Intervene on child C1 rather than co-parent CP (ablation) | CADE · SynMeasurement | RMSE | Helped |
| Intervene on one child C1 rather than two children C1+C2 (ablation) | CADE · SynMeasurement | RMSE | No clear effect |
| Include the prediction process when intervening on children rather than use perturbation without prediction (ablation) | CADE · SynMeasurement | RMSE | Helped |
Surprising findings
- Intervening on the co-parent variable alone yields no change in the conditional distribution and was the weakest CADE variant on Pendulum in white-box attacks.
- On SynMeasurement, intervention-based attacks (with the prediction step) achieved higher RMSE than the corresponding naive perturbations.
Limitations
- Requires the full causal generating process/graph, which is assumed known in experiments and is hard to obtain in practice.
- On CelebA, the causal graph is incomplete, so white-box ASR is lower than baselines.
- Evaluated only in digital simulation, not in the physical world.
Experimental setup
Datasets: Pendulum CelebA SynMeasurement
Benchmarks: Pendulum CelebA SynMeasurement
Metrics: attack success rate RMSE
Baselines: PGD C&W SAE ACE APGD(L_inf) APGD(L1)
Builds on: DEAR PGD structural causal model
Closest papers by meaning
- Adversarial Robustness Through the Lens of Causality (ICLR 2022 · similarity 0.91)
- Demystifying Causal Features on Adversarial Examples and Causal Inoculation for Robust Network by Adversarial Instrumental Variable Regression (CVPR 2023 · similarity 0.90)
- Excessive Invariance Causes Adversarial Vulnerability (ICLR 2019 · similarity 0.86)
- Adversarial Example Games (NeurIPS 2020 · similarity 0.86)
- NATTACK: Learning the Distributions of Adversarial Examples for an Improved Black-Box Attack on Deep Neural Networks (ICML 2019 · similarity 0.85)
- Visual Adversarial Examples Jailbreak Aligned Large Language Models (AAAI 2024 · similarity 0.84)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.