Prior Convictions: Black-Box Adversarial Attacks with Bandits and Priors

Abstract

We study the problem of generating adversarial examples in a black-box setting in which only loss-oracle access to a model is available. We introduce a framework that conceptually unifies much of the existing work on black-box attacks, and we demonstrate that the current state-of-the-art methods are optimal in a natural sense. Despite this optimality, we show how to improve black-box attacks by bringing a new element into the problem: gradient priors. We give a bandit optimization-based algorithm that allows us to seamlessly integrate any such priors, and we explicitly identify and incorporate two examples. The resulting methods use two to four times fewer queries and fail two to five times less often than the current state-of-the-art.

arXiv commentTo appear at ICLR 2019; Code available at https://git.io/blackbox-bandits

References in corpus (4)

• ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Models
• Delving into Transferable Adversarial Examples and Black-box Attacks
• Approximation with Random Bases: Pro et Contra
• Exploring the Space of Black-box Attacks on Deep Neural Networks

Cited by in corpus (68)

• Improving Black-box Adversarial Attacks with a Transfer-based Prior
• Guessing Smart: Biased Sampling for Efficient Black-Box Adversarial Attacks
• A Review of Adversarial Attack and Defense for Classification Methods
• Low Frequency Adversarial Perturbation
• Malware Makeover: Breaking ML-based Static Analysis by Modifying Executable Bytes
• HopSkipJumpAttack: A Query-Efficient Decision-Based Attack
• Security and Privacy Issues in Deep Learning
• Black-Box Adversarial Attack with Transferable Model-based Embedding
• Query-efficient Meta Attack to Deep Neural Networks
• Diversity can be Transferred: Output Diversification for White- and Black-box Attacks
• Learning Black-Box Attackers with Transferable Priors and Query Feedback
• Just Noticeable Difference for Deep Machine Vision
• Confidence-Calibrated Adversarial Training: Generalizing to Unseen Attacks
• Do Wider Neural Networks Really Help Adversarial Robustness?
• Sign-OPT: A Query-Efficient Hard-label Adversarial Attack
• Adversarial Learning in Statistical Classification: A Comprehensive Review of Defenses Against Attacks
• A Survey of Black-Box Adversarial Attacks on Computer Vision Models
• Towards Visual Distortion in Black-Box Attacks
• Yet another but more efficient black-box adversarial attack: tiling and evolution strategies
• AdvFlow: Inconspicuous Black-box Adversarial Attacks using Normalizing Flows
• Hybrid Batch Attacks: Finding Black-box Adversarial Examples with Limited Queries
• Min-Max Optimization without Gradients: Convergence and Applications to Adversarial ML
• On the Design of Black-box Adversarial Examples by Leveraging Gradient-free Optimization and Operator Splitting Method
• DaST: Data-free Substitute Training for Adversarial Attacks
• Local Black-box Adversarial Attacks: A Query Efficient Approach
• PatchAttack: A Black-box Texture-based Attack with Reinforcement Learning
• Adversarial Example Games
• Adversarial Binaries for Authorship Identification
• Adversarial Token Attacks on Vision Transformers
• Adversarial Robustness by Design through Analog Computing and Synthetic Gradients
• AdvSim: Generating Safety-Critical Scenarios for Self-Driving Vehicles
• Mini-batch graphs for robust image classification
• Boosting Black-Box Attack with Partially Transferred Conditional Adversarial Distribution
• Adversarial Attacks on Black Box Video Classifiers: Leveraging the Power of Geometric Transformations
• Random Noise Defense Against Query-Based Black-Box Attacks
• Headless Horseman: Adversarial Attacks on Transfer Learning Models
• RayS: A Ray Searching Method for Hard-label Adversarial Attack
• DAmageNet: A Universal Adversarial Dataset
• Improving Query Efficiency of Black-box Adversarial Attack
• GeoDA: a geometric framework for black-box adversarial attacks
• Motion-Excited Sampler: Video Adversarial Attack with Sparked Prior
• Robustness Certificates Against Adversarial Examples for ReLU Networks
• Adversarial Detection: Attacking Object Detection in Real Time
• A Method for Computing Class-wise Universal Adversarial Perturbations
• Spanning Attack: Reinforce Black-box Attacks with Unlabeled Data
• DeepSearch: A Simple and Effective Blackbox Attack for Deep Neural Networks
• QEBA: Query-Efficient Boundary-Based Blackbox Attack
• RAIN: A Simple Approach for Robust and Accurate Image Classification Networks
• A Frank-Wolfe Framework for Efficient and Effective Adversarial Attacks
• Delving into Data: Effectively Substitute Training for Black-box Attack
• Drawing Robust Scratch Tickets: Subnetworks with Inborn Robustness Are Found within Randomly Initialized Networks
• Provably Robust Metric Learning
• BO-DBA: Query-Efficient Decision-Based Adversarial Attacks via Bayesian Optimization
• Black-box Adversarial Sample Generation Based on Differential Evolution
• The Vulnerability of the Neural Networks Against Adversarial Examples in Deep Learning Algorithms
• On the Convergence of Prior-Guided Zeroth-Order Optimization Algorithms
• When Side-Channel Attacks Break the Black-Box Property of Embedded Artificial Intelligence
• Adversarial Attacks on Binary Image Recognition Systems
• Simulating Unknown Target Models for Query-Efficient Black-box Attacks
• Copy and Paste: A Simple But Effective Initialization Method for Black-Box Adversarial Attacks
• BOSH: An Efficient Meta Algorithm for Decision-based Attacks
• Query-Free Adversarial Transfer via Undertrained Surrogates
• Gaussian MRF Covariance Modeling for Efficient Black-Box Adversarial Attacks
• Improved Algorithms for White-Box Adversarial Streams
• EvoBA: An Evolution Strategy as a Strong Baseline forBlack-Box Adversarial Attacks
• LSDAT: Low-Rank and Sparse Decomposition for Decision-based Adversarial Attack
• Adversarial Eigen Attack on Black-Box Models
• Adversarial Imitation Attack