Query-Efficient Hard-label Black-box Attack:An Optimization-based Approach

Abstract

We study the problem of attacking a machine learning model in the hard-label black-box setting, where no model information is revealed except that the attacker can make queries to probe the corresponding hard-label decisions. This is a very challenging problem since the direct extension of state-of-the-art white-box attacks (e.g., CW or PGD) to the hard-label black-box setting will require minimizing a non-continuous step function, which is combinatorial and cannot be solved by a gradient-based optimizer. The only current approach is based on random walk on the boundary, which requires lots of queries and lacks convergence guarantees. We propose a novel way to formulate the hard-label black-box attack as a real-valued optimization problem which is usually continuous and can be solved by any zeroth order optimization algorithm. For example, using the Randomized Gradient-Free method, we are able to bound the number of iterations needed for our algorithm to achieve stationary points. We demonstrate that our proposed method outperforms the previous random walk approach to attacking convolutional neural networks on MNIST, CIFAR, and ImageNet datasets. More interestingly, we show that the proposed algorithm can also be used to attack other discrete and non-continuous machine learning models, such as Gradient Boosting Decision Trees (GBDT).

References in corpus (5)

• ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Models
• Searching for Exotic Particles in High-Energy Physics with Deep Learning
• Exploring the Space of Black-box Attacks on Deep Neural Networks
• Seq2Sick: Evaluating the Robustness of Sequence-to-Sequence Models with Adversarial Examples
• Query-Efficient Black-box Adversarial Examples (superceded)

Cited by in corpus (52)

• Transferring Robustness for Graph Neural Network Against Poisoning Attacks
• Guessing Smart: Biased Sampling for Efficient Black-Box Adversarial Attacks
• A Review of Adversarial Attack and Defense for Classification Methods
• Black-box Adversarial Attacks on Commercial Speech Platforms with Minimal Information
• Attacking Graph Convolutional Networks via Rewiring
• Attack Graph Convolutional Networks by Adding Fake Nodes
• Adaptative Perturbation Patterns: Realistic Adversarial Learning for Robust Intrusion Detection
• Provably Robust Boosted Decision Stumps and Trees against Adversarial Attacks
• Hermes Attack: Steal DNN Models with Lossless Inference Accuracy
• Black-box Adversarial Attacks with Bayesian Optimization
• A Survey of Black-Box Adversarial Attacks on Computer Vision Models
• GraphDefense: Towards Robust Graph Convolutional Networks
• Evaluations and Methods for Explanation through Robustness Analysis
• Efficient Decision-based Black-box Adversarial Attacks on Face Recognition
• Zero-Shot Knowledge Distillation from a Decision-Based Black-Box Model
• On the Design of Black-box Adversarial Examples by Leveraging Gradient-free Optimization and Operator Splitting Method
• DaST: Data-free Substitute Training for Adversarial Attacks
• PatchAttack: A Black-box Texture-based Attack with Reinforcement Learning
• Heuristic Black-box Adversarial Attacks on Video Recognition Models
• Cost-Aware Robust Tree Ensembles for Security Applications
• DSRNA: Differentiable Search of Robust Neural Architectures
• Decision-based Universal Adversarial Attack
• Is Robustness the Cost of Accuracy? -- A Comprehensive Study on the Robustness of 18 Deep Image Classification Models
• GeoDA: a geometric framework for black-box adversarial attacks
• Learning to Learn by Zeroth-Order Oracle
• Performance Evaluation of Adversarial Attacks: Discrepancies and Solutions
• QEBA: Query-Efficient Boundary-Based Blackbox Attack
• Training Meta-Surrogate Model for Transferable Adversarial Attack
• Taking Care of The Discretization Problem: A Comprehensive Study of the Discretization Problem and A Black-Box Adversarial Attack in Discrete Integer Domain
• Zeroth-Order Hybrid Gradient Descent: Towards A Principled Black-Box Optimization Framework
• RamBoAttack: A Robust Query Efficient Deep Neural Network Decision Exploit
• Adversarial Attack across Datasets
• QAIR: Practical Query-efficient Black-Box Attacks for Image Retrieval
• Improved Adversarial Training via Learned Optimizer
• A Hard Label Black-box Adversarial Attack Against Graph Neural Networks
• Assessing the Adversarial Robustness of Monte Carlo and Distillation Methods for Deep Bayesian Neural Network Classification
• Meta Gradient Adversarial Attack
• BO-DBA: Query-Efficient Decision-Based Adversarial Attacks via Bayesian Optimization
• Simple and Efficient Hard Label Black-box Adversarial Attacks in Low Query Budget Regimes
• Towards Imperceptible Query-limited Adversarial Attacks with Perceptual Feature Fidelity Loss
• Generating Adversarial Inputs Using A Black-box Differential Technique
• The Human Visual System and Adversarial AI
• Towards Model-Agnostic Adversarial Defenses using Adversarially Trained Autoencoders
• Learning to Initialize Gradient Descent Using Gradient Descent
• Exploring Adversarial Examples for Efficient Active Learning in Machine Learning Classifiers
• Enhancing Transformation-based Defenses using a Distribution Classifier
• Derivation of Information-Theoretically Optimal Adversarial Attacks with Applications to Robust Machine Learning
• A Simple and Strong Baseline for Universal Targeted Attacks on Siamese Visual Tracking
• Adaptive Verifiable Training Using Pairwise Class Similarity
• BOSH: An Efficient Meta Algorithm for Decision-based Attacks
• Adversarial Imitation Attack
• LSDAT: Low-Rank and Sparse Decomposition for Decision-based Adversarial Attack