Query-Efficient Black-box Adversarial Examples (superceded)

Abstract

Note that this paper is superceded by "Black-Box Adversarial Attacks with Limited Queries and Information." Current neural network-based image classifiers are susceptible to adversarial examples, even in the black-box setting, where the attacker is limited to query access without access to gradients. Previous methods --- substitute networks and coordinate-based finite-difference methods --- are either unreliable or query-inefficient, making these methods impractical for certain problems. We introduce a new method for reliably generating adversarial examples under more restricted, practical black-box threat models. First, we apply natural evolution strategies to perform black-box attacks using two to three orders of magnitude fewer queries than previous methods. Second, we introduce a new algorithm to perform targeted adversarial attacks in the partial-information setting, where the attacker only has access to a limited number of target classes. Using these techniques, we successfully perform the first targeted adversarial attack against a commercially deployed machine learning system, the Google Cloud Vision API, in the partial information setting.

arXiv commentSuperceded by "Black-Box Adversarial Attacks with Limited Queries and Information."

References in corpus (9)

• Intriguing properties of neural networks
• ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Models
• Towards Deep Learning Models Resistant to Adversarial Attacks
• Transferability in Machine Learning: from Phenomena to Black-Box Attacks using Adversarial Samples
• Evolution Strategies as a Scalable Alternative to Reinforcement Learning
• Delving into Transferable Adversarial Examples and Black-box Attacks
• Synthesizing Robust Adversarial Examples
• Rethinking the Inception Architecture for Computer Vision
• Approximation with Random Bases: Pro et Contra

Cited by in corpus (12)

• Adversarial Risk and the Dangers of Evaluating Against Weak Attacks
• Query-Efficient Hard-label Black-box Attack:An Optimization-based Approach
• Opportunities and Challenges in Deep Learning Adversarial Robustness: A Survey
• Hiding Faces in Plain Sight: Disrupting AI Face Synthesis with Adversarial Perturbations
• Adversarial Training Versus Weight Decay
• Adversarial Example Games
• Transferability of Adversarial Examples to Attack Cloud-based Image Classifier Service
• Attacking and Defending Machine Learning Applications of Public Cloud
• Built-in Vulnerabilities to Imperceptible Adversarial Perturbations
• A geometry-inspired decision-based attack
• Cloud-based Image Classification Service Is Not Robust To Simple Transformations: A Forgotten Battlefield
• OFEI: A Semi-black-box Android Adversarial Sample Attack Framework Against DLaaS