GenAttack: Practical Black-box Attacks with Gradient-Free Optimization

Abstract

Deep neural networks are vulnerable to adversarial examples, even in the black-box setting, where the attacker is restricted solely to query access. Existing black-box approaches to generating adversarial examples typically require a significant number of queries, either for training a substitute network or performing gradient estimation. We introduce GenAttack, a gradient-free optimization technique that uses genetic algorithms for synthesizing adversarial examples in the black-box setting. Our experiments on different datasets (MNIST, CIFAR-10, and ImageNet) show that GenAttack can successfully generate visually imperceptible adversarial examples against state-of-the-art image recognition models with orders of magnitude fewer queries than previous approaches. Against MNIST and CIFAR-10 models, GenAttack required roughly 2,126 and 2,568 times fewer queries respectively, than ZOO, the prior state-of-the-art black-box attack. In order to scale up the attack to large-scale high-dimensional ImageNet models, we perform a series of optimizations that further improve the query efficiency of our attack leading to 237 times fewer queries against the Inception-v3 model than ZOO. Furthermore, we show that GenAttack can successfully attack some state-of-the-art ImageNet defenses, including ensemble adversarial training and non-differentiable or randomized input transformations. Our results suggest that evolutionary algorithms open up a promising area of research into effective black-box attacks.

arXiv commentAccepted in The Genetic and Evolutionary Computation Conference (GECCO) 2019

References in corpus (16)

• Adam: A Method for Stochastic Optimization
• Ensemble Adversarial Training: Attacks and Defenses
• ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Models
• Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples
• Delving into Transferable Adversarial Examples and Black-box Attacks
• Synthesizing Robust Adversarial Examples
• Towards Deep Neural Network Architectures Robust to Adversarial Examples
• Deep Neuroevolution: Genetic Algorithms Are a Competitive Alternative for Training Deep Neural Networks for Reinforcement Learning
• Countering Adversarial Images using Input Transformations
• Black-box Adversarial Attacks with Limited Queries and Information
• Towards the first adversarially robust neural network model on MNIST
• Did you hear that? Adversarial Examples Against Automatic Speech Recognition
• Attacking the Madry Defense Model with $L_1$-based Adversarial Examples
• The Limitations of Adversarial Training and the Blind-Spot Attack
• Bypassing Feature Squeezing by Increasing Adversary Strength
• On the Limitation of MagNet Defense against $L_1$-based Adversarial Examples

Cited by in corpus (12)

• Daedalus: Breaking Non-Maximum Suppression in Object Detection via Adversarial Examples
• Are Generative Classifiers More Robust to Adversarial Attacks?
• Scratch that! An Evolution-based Adversarial Attack against Neural Networks
• RED-Attack: Resource Efficient Decision based Attack for Machine Learning
• Adversarial Examples on Object Recognition: A Comprehensive Survey
• Region-Wise Attack: On Efficient Generation of Robust Physical Adversarial Examples
• Man-in-the-Middle Attacks against Machine Learning Classifiers via Malicious Generative Models
• Bandlimiting Neural Networks Against Adversarial Attacks
• Adversarial attacks to image classification systems using evolutionary algorithms
• Perception-in-the-Loop Adversarial Examples
• Deep Latent Defence
• BOSH: An Efficient Meta Algorithm for Decision-based Attacks