Query-limited Black-box Attacks to Classifiers

Abstract

We study black-box attacks on machine learning classifiers where each query to the model incurs some cost or risk of detection to the adversary. We focus explicitly on minimizing the number of queries as a major objective. Specifically, we consider the problem of attacking machine learning classifiers subject to a budget of feature modification cost while minimizing the number of queries, where each query returns only a class and confidence score. We describe an approach that uses Bayesian optimization to minimize the number of queries, and find that the number of queries can be reduced to approximately one tenth of the number needed through a random strategy for scenarios where the feature modification cost budget is low.

5 Pages, 2017 NIPS workshop on machine learning and computer security (12/08/2017-12/09/2017)

References in corpus (5)

• A Tutorial on Bayesian Optimization of Expensive Cost Functions, with Application to Active User Modeling and Hierarchical Reinforcement Learning
• Transferability in Machine Learning: from Phenomena to Black-Box Attacks using Adversarial Samples
• Predictive Entropy Search for Efficient Global Optimization of Black-box Functions
• Generating Adversarial Malware Examples for Black-Box Attacks Based on GAN
• Predictive Entropy Search for Bayesian Optimization with Unknown Constraints

Cited by in corpus (9)

• Why do deep convolutional networks generalize so poorly to small image transformations?
• Attack Graph Convolutional Networks by Adding Fake Nodes
• AutoZOOM: Autoencoder-based Zeroth Order Optimization Method for Attacking Black-box Neural Networks
• Black-box Adversarial Attacks with Bayesian Optimization
• GraphDefense: Towards Robust Graph Convolutional Networks
• Hybrid Batch Attacks: Finding Black-box Adversarial Examples with Limited Queries
• On the Design of Black-box Adversarial Examples by Leveraging Gradient-free Optimization and Operator Splitting Method
• Adversarial Attacks on Graph Classification via Bayesian Optimisation
• Simple and Efficient Hard Label Black-box Adversarial Attacks in Low Query Budget Regimes