ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Models

Abstract

Deep neural networks (DNNs) are one of the most prominent technologies of our time, as they achieve state-of-the-art performance in many machine learning tasks, including but not limited to image classification, text mining, and speech processing. However, recent research on DNNs has indicated ever-increasing concern on the robustness to adversarial examples, especially for security-critical tasks such as traffic sign identification for autonomous driving. Studies have unveiled the vulnerability of a well-trained DNN by demonstrating the ability of generating barely noticeable (to both human and machines) adversarial images that lead to misclassification. Furthermore, researchers have shown that these adversarial images are highly transferable by simply training and attacking a substitute model built upon the target model, known as a black-box attack to DNNs. Similar to the setting of training substitute models, in this paper we propose an effective black-box attack that also only has access to the input (images) and the output (confidence scores) of a targeted DNN. However, different from leveraging attack transferability from substitute models, we propose zeroth order optimization (ZOO) based attacks to directly estimate the gradients of the targeted DNN for generating adversarial examples. We use zeroth order stochastic coordinate descent along with dimension reduction, hierarchical attack and importance sampling techniques to efficiently attack black-box models. By exploiting zeroth order optimization, improved attacks to the targeted DNN can be accomplished, sparing the need for training substitute models and avoiding the loss in attack transferability. Experimental results on MNIST, CIFAR10 and ImageNet show that the proposed ZOO attack is as effective as the state-of-the-art white-box attack and significantly outperforms existing black-box attacks via substitute models.

Accepted by 10th ACM Workshop on Artificial Intelligence and Security (AISEC) with the 24th ACM Conference on Computer and Communications Security (CCS)

References in corpus (19)

• Adam: A Method for Stochastic Optimization
• Distilling the Knowledge in a Neural Network
• Explaining and Harnessing Adversarial Examples
• Intriguing properties of neural networks
• Ensemble Adversarial Training: Attacks and Defenses
• Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networks
• Towards Deep Learning Models Resistant to Adversarial Attacks
• Transferability in Machine Learning: from Phenomena to Black-Box Attacks using Adversarial Samples
• Delving into Transferable Adversarial Examples and Black-box Attacks
• Robust Physical-World Attacks on Deep Learning Models
• Generating Adversarial Malware Examples for Black-Box Attacks Based on GAN
• On the (Statistical) Detection of Adversarial Examples
• Adversarial Perturbations Against Deep Neural Networks for Malware Classification
• Adversarial Examples, Uncertainty, and Transfer Testing Robustness in Gaussian Process Hybrid Deep Networks
• Black-Box Attacks against RNN based Malware Detection Algorithms
• Extending Defensive Distillation
• A Comprehensive Linear Speedup Analysis for Asynchronous Stochastic Parallel Optimization from Zeroth-Order to First-Order
• Robust Convolutional Neural Networks under Adversarial Noise
• Feature Squeezing Mitigates and Detects Carlini/Wagner Adversarial Examples

Cited by in corpus (388)

• Ensemble Adversarial Training: Attacks and Defenses
• Wild Patterns: Ten Years After the Rise of Adversarial Machine Learning
• Synthesizing Robust Adversarial Examples
• On Evaluating Adversarial Robustness
• Adversarial Risk and the Dangers of Evaluating Against Weak Attacks
• Understanding Adversarial Training: Increasing Local Stability of Neural Nets through Robust Optimization
• Efficient Neural Network Robustness Certification with General Activation Functions
• Black-box Adversarial Attacks with Limited Queries and Information
• Prior Convictions: Black-Box Adversarial Attacks with Bandits and Priors
• Adversarial Examples: Attacks and Defenses for Deep Learning
• Resilient Machine Learning for Networked Cyber Physical Systems: A Survey for Machine Learning Security to Securing Machine Learning for CPS
• Transferring Robustness for Graph Neural Network Against Poisoning Attacks
• Adversarial Example Detection for DNN Models: A Review and Experimental Comparison
• DARTS: Deceiving Autonomous Cars with Toxic Signs
• Improving Black-box Adversarial Attacks with a Transfer-based Prior
• Adversarial Machine Learning in Image Classification: A Survey Towards the Defender's Perspective
• Threat of Adversarial Attacks on Deep Learning in Computer Vision: A Survey
• Evaluating the Robustness of Neural Networks: An Extreme Value Theory Approach
• Towards Fast Computation of Certified Robustness for ReLU Networks
• On Adaptive Attacks to Adversarial Example Defenses
• Decision-Based Adversarial Attacks: Reliable Attacks Against Black-Box Machine Learning Models
• Adversarial EXEmples: A Survey and Experimental Evaluation of Practical Attacks on Machine Learning for Windows Malware Detection
• Guessing Smart: Biased Sampling for Efficient Black-Box Adversarial Attacks
• Query-Efficient Hard-label Black-box Attack:An Optimization-based Approach
• A Review of Adversarial Attack and Defense for Classification Methods
• Rethinking Softmax Cross-Entropy Loss for Adversarial Robustness
• When Machine Learning Meets Privacy: A Survey and Outlook
• Recent advances for quantum classifiers
• Low Frequency Adversarial Perturbation
• Adversarial Training against Location-Optimized Adversarial Patches
• Towards Adversarial Malware Detection: Lessons Learned from PDF-based Attacks
• POBA-GA: Perturbation Optimized Black-Box Adversarial Attacks via Genetic Algorithm
• Towards quantum enhanced adversarial robustness in machine learning
• Black-box Adversarial Attacks on Commercial Speech Platforms with Minimal Information
• Semantic Robustness of Models of Source Code
• Optimizing Molecules using Efficient Queries from Property Evaluations
• Demon in the Variant: Statistical Analysis of DNNs for Robust Backdoor Contamination Detection
• Exploring the Space of Black-box Attacks on Deep Neural Networks
• HopSkipJumpAttack: A Query-Efficient Decision-Based Attack
• Boosting Adversarial Training with Hypersphere Embedding
• Constrained Concealment Attacks against Reconstruction-based Anomaly Detectors in Industrial Control Systems
• MACER: Attack-free and Scalable Robust Training via Maximizing Certified Radius
• EAD: Elastic-Net Attacks to Deep Neural Networks via Adversarial Examples
• Attacking Graph Convolutional Networks via Rewiring
• Security and Privacy Issues in Deep Learning
• The Internet of Federated Things (IoFT): A Vision for the Future and In-depth Survey of Data-driven Approaches for Federated Learning
• Characterizing and evaluating adversarial examples for Offline Handwritten Signature Verification
• Attack Graph Convolutional Networks by Adding Fake Nodes
• Procedural Noise Adversarial Examples for Black-Box Attacks on Deep Convolutional Networks
• Convergence of Adversarial Training in Overparametrized Neural Networks
• Survey on Adversarial Attack and Defense for Medical Image Analysis: Methods and Challenges
• Characterizing Attacks on Deep Reinforcement Learning
• Black-Box Adversarial Attack with Transferable Model-based Embedding
• Adversarial Examples in Modern Machine Learning: A Review
• CBA: Contextual Background Attack against Optical Aerial Detection in the Physical World
• Query-efficient Meta Attack to Deep Neural Networks
• Characterizing Adversarial Examples Based on Spatial Consistency Information for Semantic Segmentation
• On Success and Simplicity: A Second Look at Transferable Targeted Attacks
• Adversarial Examples - A Complete Characterisation of the Phenomenon
• NATTACK: Learning the Distributions of Adversarial Examples for an Improved Black-Box Attack on Deep Neural Networks
• Subspace Attack: Exploiting Promising Subspaces for Query-Efficient Black-box Attacks
• Evading Defenses to Transferable Adversarial Examples by Translation-Invariant Attacks
• Adaptative Perturbation Patterns: Realistic Adversarial Learning for Robust Intrusion Detection
• Learning Black-Box Attackers with Transferable Priors and Query Feedback
• On Robustness of Neural Ordinary Differential Equations
• Gradientless Descent: High-Dimensional Zeroth-Order Optimization
• Robustness Verification of Tree-based Models
• Hermes Attack: Steal DNN Models with Lossless Inference Accuracy
• Do Wider Neural Networks Really Help Adversarial Robustness?
• Confidence-Calibrated Adversarial Training: Generalizing to Unseen Attacks
• Daedalus: Breaking Non-Maximum Suppression in Object Detection via Adversarial Examples
• PRADA: Protecting against DNN Model Stealing Attacks
• Threats and Defenses in Federated Learning Life Cycle: A Comprehensive Survey and Challenges
• Defend Deep Neural Networks Against Adversarial Examples via Fixed and Dynamic Quantized Activation Functions
• Bridging Mode Connectivity in Loss Landscapes and Adversarial Robustness
• Understanding Real-world Threats to Deep Learning Models in Android Apps
• PermuteAttack: Counterfactual Explanation of Machine Learning Credit Scorecards
• AutoZOOM: Autoencoder-based Zeroth Order Optimization Method for Attacking Black-box Neural Networks
• Improving the Transferability of Adversarial Examples with Arbitrary Style Transfer
• Sign-OPT: A Query-Efficient Hard-label Adversarial Attack
• Mitigating Adversarial Gray-Box Attacks Against Phishing Detectors
• T-BFA: Targeted Bit-Flip Adversarial Weight Attack
• A survey on Adversarial Recommender Systems: from Attack/Defense strategies to Generative Adversarial Networks
• When and How to Fool Explainable Models (and Humans) with Adversarial Examples
• Opportunities and Challenges in Deep Learning Adversarial Robustness: A Survey
• Gradient-free activation maximization for identifying effective stimuli
• Communication-Efficient Edge AI: Algorithms and Systems
• Are Generative Classifiers More Robust to Adversarial Attacks?
• Unadversarial Examples: Designing Objects for Robust Vision
• GenAttack: Practical Black-box Attacks with Gradient-Free Optimization
• Black-box Adversarial Attacks with Bayesian Optimization
• Query-Efficient Black-box Adversarial Examples (superceded)
• Hessian-Aware Zeroth-Order Optimization for Black-Box Adversarial Attack
• TrISec: Training Data-Unaware Imperceptible Security Attacks on Deep Neural Networks
• Two Sides of the Same Coin: White-box and Black-box Attacks for Transfer Learning
• A Survey of Black-Box Adversarial Attacks on Computer Vision Models
• Adversarial Detection of Flash Malware: Limitations and Open Issues
• GraphDefense: Towards Robust Graph Convolutional Networks
• Black-box adversarial attacks using Evolution Strategies
• Wild Networks: Exposure of 5G Network Infrastructures to Adversarial Examples
• SirenAttack: Generating Adversarial Audio for End-to-End Acoustic Systems
• Yet another but more efficient black-box adversarial attack: tiling and evolution strategies
• AdvFlow: Inconspicuous Black-box Adversarial Attacks using Normalizing Flows
• A Primer on Zeroth-Order Optimization in Signal Processing and Machine Learning
• Binary Black-box Evasion Attacks Against Deep Learning-based Static Malware Detectors with Adversarial Byte-Level Language Model
• Attacking Visual Language Grounding with Adversarial Examples: A Case Study on Neural Image Captioning
• Simple black-box universal adversarial attacks on medical image classification based on deep neural networks
• Hybrid Batch Attacks: Finding Black-box Adversarial Examples with Limited Queries
• Min-Max Optimization without Gradients: Convergence and Applications to Adversarial ML
• Deep-Dup: An Adversarial Weight Duplication Attack Framework to Crush Deep Neural Network in Multi-Tenant FPGA
• Adversarial Example Generation using Evolutionary Multi-objective Optimization
• Regional Homogeneity: Towards Learning Transferable Universal Adversarial Perturbations Against Defenses
• Interpretable Deep Learning under Fire
• Robust Sparse Regularization: Simultaneously Optimizing Neural Network Robustness and Compactness
• PAC-learning in the presence of evasion adversaries
• Zeroth-Order Online Alternating Direction Method of Multipliers: Convergence Analysis and Applications
• Invisible Optical Adversarial Stripes on Traffic Sign against Autonomous Vehicles
• Towards Analyzing Semantic Robustness of Deep Neural Networks
• A Formalization of Robustness for Deep Neural Networks
• Bit-Flip Attack: Crushing Neural Network with Progressive Bit Search
• Scratch that! An Evolution-based Adversarial Attack against Neural Networks
• Zeroth-Order Algorithms for Nonconvex Minimax Problems with Improved Complexities
• Physically Realizable Adversarial Examples for LiDAR Object Detection
• Potential adversarial samples for white-box attacks
• ML-LOO: Detecting Adversarial Examples with Feature Attribution
• Efficient Decision-based Black-box Adversarial Attacks on Face Recognition
• MetaAdvDet: Towards Robust Detection of Evolving Adversarial Attacks
• A Unified Approach to Interpreting and Boosting Adversarial Transferability
• On the Convergence of SGD with Biased Gradients
• Universal Perturbation Attack Against Image Retrieval
• Stochastic Zeroth-order Optimization via Variance Reduction method
• Adversarial Attacks for Tabular Data: Application to Fraud Detection and Imbalanced Data
• Adversarial Attacks on Monocular Depth Estimation
• On the Design of Black-box Adversarial Examples by Leveraging Gradient-free Optimization and Operator Splitting Method
• There are No Bit Parts for Sign Bits in Black-Box Attacks
• 2-in-1 Accelerator: Enabling Random Precision Switch for Winning Both Adversarial Robustness and Efficiency
• Voice2Series: Reprogramming Acoustic Models for Time Series Classification
• Zeroth-Order Algorithms for Smooth Saddle-Point Problems
• Evaluating the Robustness of Nearest Neighbor Classifiers: A Primal-Dual Perspective
• A survey on practical adversarial examples for malware classifiers
• Security and Privacy for Artificial Intelligence: Opportunities and Challenges
• On the Robustness of Cooperative Multi-Agent Reinforcement Learning
• DaST: Data-free Substitute Training for Adversarial Attacks
• Learning Transferable Adversarial Examples via Ghost Networks
• Attacking Adversarial Attacks as A Defense
• RED-Attack: Resource Efficient Decision based Attack for Machine Learning
• Adversarial Attacks on Brain-Inspired Hyperdimensional Computing-Based Classifiers
• An Evolutionary, Gradient-Free, Query-Efficient, Black-Box Algorithm for Generating Adversarial Instances in Deep Networks
• Bag of Tricks for Adversarial Training
• Adversarial Example Games
• PatchAttack: A Black-box Texture-based Attack with Reinforcement Learning
• Generic Black-Box End-to-End Attack Against State of the Art API Call Based Malware Classifiers
• GreedyFool: Distortion-Aware Sparse Adversarial Attack
• Local Black-box Adversarial Attacks: A Query Efficient Approach
• LTD: Low Temperature Distillation for Gradient Masking-free Adversarial Training
• Transferability of Adversarial Examples to Attack Cloud-based Image Classifier Service
• Heuristic Black-box Adversarial Attacks on Video Recognition Models
• On the Limitation of MagNet Defense against $L_1$-based Adversarial Examples
• Adversarial Examples on Object Recognition: A Comprehensive Survey
• Physical Adversarial Textures that Fool Visual Object Tracking
• Appending Adversarial Frames for Universal Video Attack
• Learning to Collide: An Adaptive Safety-Critical Scenarios Generating Method
• Generating Image Adversarial Examples by Embedding Digital Watermarks
• Cloud-based XAI Services for Assessing Open Repository Models Under Adversarial Attacks
• Bridging the Performance Gap between FGSM and PGD Adversarial Training
• On Improving Adversarial Transferability of Vision Transformers
• A One-bit, Comparison-Based Gradient Estimator
• Certification of embedded systems based on Machine Learning: A survey
• Elephant in the Room: An Evaluation Framework for Assessing Adversarial Examples in NLP
• Adversarial Attacks Beyond the Image Space
• Zeroth and First Order Stochastic Frank-Wolfe Algorithms for Constrained Optimization
• Towards Robust Neural Networks via Orthogonal Diversity
• MAFT: Efficient Model-Agnostic Fairness Testing for Deep Neural Networks via Zero-Order Gradient Search
• Black-box Adversarial Attacks on Video Recognition Models
• DSRNA: Differentiable Search of Robust Neural Architectures
• Towards Effective and Efficient Adversarial Defense with Diffusion Models for Robust Visual Tracking
• Dynamics-aware Adversarial Attack of Adaptive Neural Networks
• Towards Efficiently Evaluating the Robustness of Deep Neural Networks in IoT Systems: A GAN-based Method
• Asynchronous Distributed Reinforcement Learning for LQR Control via Zeroth-Order Block Coordinate Descent
• Effective Universal Unrestricted Adversarial Attacks using a MOE Approach
• Adversarial Robustness by Design through Analog Computing and Synthetic Gradients
• Input Validation for Neural Networks via Runtime Local Robustness Verification
• They Might NOT Be Giants: Crafting Black-Box Adversarial Examples with Fewer Queries Using Particle Swarm Optimization
• Query-Efficient Black-Box Attack by Active Learning
• Adaptive Adversarial Attack on Scene Text Recognition
• Understanding Adversarial Robustness: The Trade-off between Minimum and Average Margin
• Multimodal Safety-Critical Scenarios Generation for Decision-Making Algorithms Evaluation
• Increasing-Margin Adversarial (IMA) Training to Improve Adversarial Robustness of Neural Networks
• Decision-based Universal Adversarial Attack
• Bit Error Robustness for Energy-Efficient DNN Accelerators
• Adversarial Visual Robustness by Causal Intervention
• Protecting Against Image Translation Deepfakes by Leaking Universal Perturbations from Black-Box Neural Networks
• Adaptive First-and Zeroth-order Methods for Weakly Convex Stochastic Optimization Problems
• Efficiently avoiding saddle points with zero order methods: No gradients required
• Frequency-Tuned Universal Adversarial Attacks
• Linear Convergence of First- and Zeroth-Order Primal-Dual Algorithms for Distributed Nonconvex Optimization
• RayS: A Ray Searching Method for Hard-label Adversarial Attack
• Improving Query Efficiency of Black-box Adversarial Attack
• Is Robustness the Cost of Accuracy? -- A Comprehensive Study on the Robustness of 18 Deep Image Classification Models
• Better the Devil you Know: An Analysis of Evasion Attacks using Out-of-Distribution Adversarial Examples
• Adversarial Attacks on Black Box Video Classifiers: Leveraging the Power of Geometric Transformations
• Identify Susceptible Locations in Medical Records via Adversarial Attacks on Deep Predictive Models
• An Efficient Adversarial Attack for Tree Ensembles
• GeoDA: a geometric framework for black-box adversarial attacks
• Boosting One-Point Derivative-Free Online Optimization via Residual Feedback
• A Target-Agnostic Attack on Deep Models: Exploiting Security Vulnerabilities of Transfer Learning
• Adversarial Exposure Attack on Diabetic Retinopathy Imagery Grading
• AdaDGS: An adaptive black-box optimization method with a nonlocal directional Gaussian smoothing gradient
• The Intriguing Relation Between Counterfactual Explanations and Adversarial Examples
• A Backdoor Attack against 3D Point Cloud Classifiers
• Learning to Learn by Zeroth-Order Oracle
• CorrAttack: Black-box Adversarial Attack with Structured Search
• ADI: Adversarial Dominating Inputs in Vertical Federated Learning Systems
• BASAR:Black-box Attack on Skeletal Action Recognition
• Enhanced Adversarial Strategically-Timed Attacks against Deep Reinforcement Learning
• Adversarial Diffusion Attacks on Graph-based Traffic Prediction Models
• Spatial-Frequency Discriminability for Revealing Adversarial Perturbations
• Staircase Sign Method for Boosting Adversarial Attacks
• Robust Proxy: Improving Adversarial Robustness by Robust Proxy Learning
• Improving Certified Robustness via Statistical Learning with Logical Reasoning
• A geometry-inspired decision-based attack
• 3D Adversarial Attacks Beyond Point Cloud
• On Isometry Robustness of Deep 3D Point Cloud Models under Adversarial Attacks
• A Zeroth-Order Block Coordinate Descent Algorithm for Huge-Scale Black-Box Optimization
• A Comprehensive Evaluation Framework for Deep Model Robustness
• Robustness Certificates Against Adversarial Examples for ReLU Networks
• Investigating Imperceptibility of Adversarial Attacks on Tabular Data: An Empirical Analysis
• Adversarial Defense by Stratified Convolutional Sparse Coding
• Optimal Transport Classifier: Defending Against Adversarial Attacks by Regularized Deep Embedding
• Certified Adversarial Defenses Meet Out-of-Distribution Corruptions: Benchmarking Robustness and Simple Baselines
• Performance Evaluation of Adversarial Attacks: Discrepancies and Solutions
• DiffDefense: Defending against Adversarial Attacks via Diffusion Models
• $n$-ML: Mitigating Adversarial Examples via Ensembles of Topologically Manipulated Classifiers
• Nonconvex Zeroth-Order Stochastic ADMM Methods with Lower Function Query Complexity
• A New One-Point Residual-Feedback Oracle For Black-Box Learning and Control
• Progressive-Scale Boundary Blackbox Attack via Projective Gradient Estimation
• Is Face Recognition Safe from Realizable Attacks?
• Grey-box Adversarial Attack And Defence For Sentiment Classification
• Neural Networks Are More Productive Teachers Than Human Raters: Active Mixup for Data-Efficient Knowledge Distillation from a Blackbox Model
• Projection & Probability-Driven Black-Box Attack
• Identifying Model Weakness with Adversarial Examiner
• CAAD 2018: Generating Transferable Adversarial Examples
• One-Point Gradient-Free Methods for Smooth and Non-Smooth Saddle-Point Problems
• Zeroth-Order Hybrid Gradient Descent: Towards A Principled Black-Box Optimization Framework
• DeepSearch: A Simple and Effective Blackbox Attack for Deep Neural Networks
• Beware the Black-Box: on the Robustness of Recent Defenses to Adversarial Examples
• Training Meta-Surrogate Model for Transferable Adversarial Attack
• Spanning Attack: Reinforce Black-box Attacks with Unlabeled Data
• BUZz: BUffer Zones for defending adversarial examples in image classification
• Improve Single-Point Zeroth-Order Optimization Using High-Pass and Low-Pass Filters
• Switching Transferable Gradient Directions for Query-Efficient Black-Box Adversarial Attacks
• Taking Care of The Discretization Problem: A Comprehensive Study of the Discretization Problem and A Black-Box Adversarial Attack in Discrete Integer Domain
• Semantic-preserving Reinforcement Learning Attack Against Graph Neural Networks for Malware Detection
• Black Box Submodular Maximization: Discrete and Continuous Settings
• Adversarial Attacks on Classifiers for Eye-based User Modelling
• Practical Relative Order Attack in Deep Ranking
• Active Learning Under Malicious Mislabeling and Poisoning Attacks
• Consistent Valid Physically-Realizable Adversarial Attack against Crowd-flow Prediction Models
• Weight-Covariance Alignment for Adversarially Robust Neural Networks
• A Game Theoretic Analysis of Additive Adversarial Attacks and Defenses
• Simple Transparent Adversarial Examples
• Markpainting: Adversarial Machine Learning meets Inpainting
• Improving the Transferability of Adversarial Examples with New Iteration Framework and Input Dropout
• Certifiable Robustness to Adversarial State Uncertainty in Deep Reinforcement Learning
• RAIN: A Simple Approach for Robust and Accurate Image Classification Networks
• Region-Wise Attack: On Efficient Generation of Robust Physical Adversarial Examples
• Hessian Inverse Approximation as Covariance for Random Perturbation in Black-Box Problems
• Gradient-Free Adversarial Attacks for Bayesian Neural Networks
• You Only Query Once: Effective Black Box Adversarial Attacks with Minimal Repeated Queries
• Making targeted black-box evasion attacks effective and efficient
• QAIR: Practical Query-efficient Black-Box Attacks for Image Retrieval
• Delving into Data: Effectively Substitute Training for Black-box Attack
• A Frank-Wolfe Framework for Efficient and Effective Adversarial Attacks
• Bandlimiting Neural Networks Against Adversarial Attacks
• Towards Query Efficient Black-box Attacks: An Input-free Perspective
• Privacy-Preserving Distributed Zeroth-Order Optimization
• ATZSL: Defensive Zero-Shot Recognition in the Presence of Adversaries
• Minimax Defense against Gradient-based Adversarial Attacks
• Adversarial Attack across Datasets
• Drawing Robust Scratch Tickets: Subnetworks with Inborn Robustness Are Found within Randomly Initialized Networks
• D-square-B: Deep Distribution Bound for Natural-looking Adversarial Attack
• An Empirical Study on the Relation between Network Interpretability and Adversarial Robustness
• Prototype-supervised Adversarial Network for Targeted Attack of Deep Hashing
• PICA: A Pixel Correlation-based Attentional Black-box Adversarial Attack
• Towards Query-Efficient Black-Box Adversary with Zeroth-Order Natural Gradient Descent
• AdvMind: Inferring Adversary Intent of Black-Box Attacks
• IWA: Integrated Gradient based White-box Attacks for Fooling Deep Neural Networks
• On Extensions of CLEVER: A Neural Network Robustness Evaluation Algorithm
• Scalable Derivative-Free Optimization for Nonlinear Least-Squares Problems
• Curvature-Aware Derivative-Free Optimization
• CCA: Exploring the Possibility of Contextual Camouflage Attack on Object Detection
• Yet Another Intermediate-Level Attack
• A Unified Game-Theoretic Interpretation of Adversarial Robustness
• Provably Robust Metric Learning
• Assessing the Adversarial Robustness of Monte Carlo and Distillation Methods for Deep Bayesian Neural Network Classification
• Smoothed Inference for Adversarially-Trained Models
• Deep Neural Network Perception Models and Robust Autonomous Driving Systems
• A Geometrical Approach to Evaluate the Adversarial Robustness of Deep Neural Networks
• ROBY: Evaluating the Robustness of a Deep Model by its Decision Boundaries
• Perception-in-the-Loop Adversarial Examples
• Faster Gradient-Free Proximal Stochastic Methods for Nonconvex Nonsmooth Optimization
• Sparse Perturbations for Improved Convergence in Stochastic Zeroth-Order Optimization
• Non-Singular Adversarial Robustness of Neural Networks
• Meta Gradient Adversarial Attack
• BO-DBA: Query-Efficient Decision-Based Adversarial Attacks via Bayesian Optimization
• A cryptographic approach to black box adversarial machine learning
• Adversarial robustness via stochastic regularization of neural activation sensitivity
• Statistical Inference for Polyak-Ruppert Averaged Zeroth-order Stochastic Gradient Algorithm
• On ${\ell }_p$-norm Robustness of Ensemble Stumps and Trees
• Copy and Paste: A Simple But Effective Initialization Method for Black-Box Adversarial Attacks
• Adversarial Distillation for Ordered Top-k Attacks
• Energy Attack: On Transferring Adversarial Examples
• When Side-Channel Attacks Break the Black-Box Property of Embedded Artificial Intelligence
• Query complexity of adversarial attacks
• Data-Free Adversarial Perturbations for Practical Black-Box Attack
• Simulating Unknown Target Models for Query-Efficient Black-box Attacks
• New Aspects of Black Box Conditional Gradient: Variance Reduction and One Point Feedback
• The Vulnerability of the Neural Networks Against Adversarial Examples in Deep Learning Algorithms
• Simple and Efficient Hard Label Black-box Adversarial Attacks in Low Query Budget Regimes
• Adaptive Image Transformations for Transfer-based Adversarial Attack
• Learning Sampling Policy for Faster Derivative Free Optimization
• Adversarial Attacks on Binary Image Recognition Systems
• On the Convergence of Prior-Guided Zeroth-Order Optimization Algorithms
• $Q$-fully Quadratic Modeling and its Application in a Random Subspace Derivative-free Method
• Colored Noise Injection for Training Adversarially Robust Neural Networks
• How stealthy is stealthy? Studying the Efficacy of Black-Box Adversarial Attacks in the Real World
• When AI reviews science: Can we trust the referee?
• A Study on the Uncertainty of Convolutional Layers in Deep Neural Networks
• Amora: Black-box Adversarial Morphing Attack
• Is Ordered Weighted ${\ell }_1$ Regularized Regression Robust to Adversarial Perturbation? A Case Study on OSCAR
• Black-box Adversarial Sample Generation Based on Differential Evolution
• Minimalistic Attacks: How Little it Takes to Fool a Deep Reinforcement Learning Policy
• Robust binary classification with the 01 loss
• Search Space of Adversarial Perturbations against Image Filters
• An Accelerated Variance-Reduced Conditional Gradient Sliding Algorithm for First-order and Zeroth-order Optimization
• Compressive Sensing Based Adaptive Defence Against Adversarial Images
• Moiré Attack (MA): A New Potential Risk of Screen Photos
• On the Second-order Convergence Properties of Random Search Methods
• Adversarial Machine Learning for Cybersecurity and Computer Vision: Current Developments and Challenges
• Delving into the pixels of adversarial samples
• Defense-guided Transferable Adversarial Attacks
• Improved Complexities for Stochastic Conditional Gradient Methods under Interpolation-like Conditions
• Absum: Simple Regularization Method for Reducing Structural Sensitivity of Convolutional Neural Networks
• Learning to Disentangle Robust and Vulnerable Features for Adversarial Detection
• Towards Model-Agnostic Adversarial Defenses using Adversarially Trained Autoencoders
• Adaptive Verifiable Training Using Pairwise Class Similarity
• On the Matrix-Free Generation of Adversarial Perturbations for Black-Box Attacks
• Adversarial Interaction Attack: Fooling AI to Misinterpret Human Intentions
• Span Recovery for Deep Neural Networks with Applications to Input Obfuscation
• A Model-Based Derivative-Free Approach to Black-Box Adversarial Examples: BOBYQA
• Target Training Does Adversarial Training Without Adversarial Samples
• Exact and Consistent Interpretation of Piecewise Linear Models Hidden behind APIs: A Closed Form Solution
• Hard-label Manifolds: Unexpected Advantages of Query Efficiency for Finding On-manifold Adversarial Examples
• LSDAT: Low-Rank and Sparse Decomposition for Decision-based Adversarial Attack
• Deep Learning-Based Autonomous Driving Systems: A Survey of Attacks and Defenses
• Zeroth-Order Stochastic Alternating Direction Method of Multipliers for Nonconvex Nonsmooth Optimization
• Sparse Coding Frontend for Robust Neural Networks
• David and Goliath: An Empirical Evaluation of Attacks and Defenses for QNNs at the Deep Edge
• Skeletonization-Based Adversarial Perturbations on Large Vision Language Model's Mathematical Text Recognition
• Revisiting Backdoor Attacks on Time Series Classification in the Frequency Domain
• Feature Importance Guided Attack: A Model Agnostic Adversarial Attack
• Gaussian MRF Covariance Modeling for Efficient Black-Box Adversarial Attacks
• Where Does the Robustness Come from? A Study of the Transformation-based Ensemble Defence
• Tricking Adversarial Attacks To Fail
• FAdeML: Understanding the Impact of Pre-Processing Noise Filtering on Adversarial Machine Learning
• Zeroth-Order Methods for Convex-Concave Minmax Problems: Applications to Decision-Dependent Risk Minimization
• On Connections between Regularizations for Improving DNN Robustness
• ManiGen: A Manifold Aided Black-box Generator of Adversarial Examples
• Improving Resistance to Adversarial Deformations by Regularizing Gradients
• Oriole: Thwarting Privacy against Trustworthy Deep Learning Models
• Defending Against Adversarial Attacks Using Random Forests
• Convergence Analysis of Nonconvex Distributed Stochastic Zeroth-order Coordinate Method
• One-Point Feedback for Composite Optimization with Applications to Distributed and Federated Learning
• BOSH: An Efficient Meta Algorithm for Decision-based Attacks
• Online Adversarial Attacks
• Scalable Projection-Free Optimization
• Automated Decision-based Adversarial Attacks
• Adaptive Perturbation for Adversarial Attack
• Adversarial training may be a double-edged sword
• Do Deep Minds Think Alike? Selective Adversarial Attacks for Fine-Grained Manipulation of Multiple Deep Neural Networks
• Adversarial Attacks with Time-Scale Representations
• EvoBA: An Evolution Strategy as a Strong Baseline forBlack-Box Adversarial Attacks
• Adversarial Imitation Attack
• Interpreting Attributions and Interactions of Adversarial Attacks
• Thwarting finite difference adversarial attacks with output randomization
• Extending Adversarial Attacks to Produce Adversarial Class Probability Distributions
• Renofeation: A Simple Transfer Learning Method for Improved Adversarial Robustness
• HIRE-SNN: Harnessing the Inherent Robustness of Energy-Efficient Deep Spiking Neural Networks by Training with Crafted Input Noise