Query-Efficient Black-Box Attack by Active Learning

Abstract

Deep neural network (DNN) as a popular machine learning model is found to be vulnerable to adversarial attack. This attack constructs adversarial examples by adding small perturbations to the raw input, while appearing unmodified to human eyes but will be misclassified by a well-trained classifier. In this paper, we focus on the black-box attack setting where attackers have almost no access to the underlying models. To conduct black-box attack, a popular approach aims to train a substitute model based on the information queried from the target DNN. The substitute model can then be attacked using existing white-box attack approaches, and the generated adversarial examples will be used to attack the target DNN. Despite its encouraging results, this approach suffers from poor query efficiency, i.e., attackers usually needs to query a huge amount of times to collect enough information for training an accurate substitute model. To this end, we first utilize state-of-the-art white-box attack methods to generate samples for querying, and then introduce an active learning strategy to significantly reduce the number of queries needed. Besides, we also propose a diversity criterion to avoid the sampling bias. Our extensive experimental results on MNIST and CIFAR-10 show that the proposed method can reduce more than $90\%$ of queries while preserve attacking success rates and obtain an accurate substitute model which is more than $85\%$ similar with the target oracle.

arXiv comment9 pages

References in corpus (14)

• Very Deep Convolutional Networks for Large-Scale Image Recognition
• Fashion-MNIST: a Novel Image Dataset for Benchmarking Machine Learning Algorithms
• ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Models
• Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples
• Synthesizing Robust Adversarial Examples
• Robust Physical-World Attacks on Deep Learning Models
• Countering Adversarial Images using Input Transformations
• Adversarial Examples Are Not Easily Detected: Bypassing Ten Detection Methods
• Mitigating Adversarial Effects Through Randomization
• Simple Black-Box Adversarial Perturbations for Deep Networks
• Seq2Sick: Evaluating the Robustness of Sequence-to-Sequence Models with Adversarial Examples
• Attacking Visual Language Grounding with Adversarial Examples: A Case Study on Neural Image Captioning
• Fooling Vision and Language Models Despite Localization and Attention Mechanism
• Identify Susceptible Locations in Medical Records via Adversarial Attacks on Deep Predictive Models

Cited by in corpus (6)

• Security and Privacy for Artificial Intelligence: Opportunities and Challenges
• Extraction of Complex DNN Models: Real Threat or Boogeyman?
• A geometry-inspired decision-based attack
• Stealing Black-Box Functionality Using The Deep Neural Tree Architecture
• A Novel Data Encryption Method Inspired by Adversarial Attacks
• Active Sentence Learning by Adversarial Uncertainty Sampling in Discrete Space