Low Frequency Adversarial Perturbation

Abstract

Adversarial images aim to change a target model's decision by minimally perturbing a target image. In the black-box setting, the absence of gradient information often renders this search problem costly in terms of query complexity. In this paper we propose to restrict the search for adversarial images to a low frequency domain. This approach is readily compatible with many existing black-box attack frameworks and consistently reduces their query cost by 2 to 4 times. Further, we can circumvent image transformation defenses even when both the model and the defense strategy are unknown. Finally, we demonstrate the efficacy of this technique by fooling the Google Cloud Vision platform with an unprecedented low number of model queries.

arXiv comment9 pages, 9 figures. Accepted to UAI 2019

References in corpus (10)

• Ensemble Adversarial Training: Attacks and Defenses
• Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networks
• ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Models
• Towards Deep Learning Models Resistant to Adversarial Attacks
• Delving into Transferable Adversarial Examples and Black-box Attacks
• Countering Adversarial Images using Input Transformations
• Adversarial Machine Learning at Scale
• Prior Convictions: Black-Box Adversarial Attacks with Bandits and Priors
• Houdini: Fooling Deep Structured Prediction Models
• Simple Black-box Adversarial Attacks

Cited by in corpus (17)

• Improving Black-box Adversarial Attacks with a Transfer-based Prior
• Guessing Smart: Biased Sampling for Efficient Black-Box Adversarial Attacks
• A Review of Adversarial Attack and Defense for Classification Methods
• MMA Training: Direct Input Space Margin Maximization through Adversarial Training
• Natural Language Adversarial Defense through Synonym Encoding
• AdvFlow: Inconspicuous Black-box Adversarial Attacks using Normalizing Flows
• Regional Homogeneity: Towards Learning Transferable Universal Adversarial Perturbations Against Defenses
• Learning Transferable Adversarial Examples via Ghost Networks
• AdvDrop: Adversarial Attack to DNNs by Dropping Information
• Boosting Black-Box Attack with Partially Transferred Conditional Adversarial Distribution
• Projection & Probability-Driven Black-Box Attack
• Meta Adversarial Training against Universal Patches
• Bridging the Gap Between Adversarial Robustness and Optimization Bias
• Copy and Paste: A Simple But Effective Initialization Method for Black-Box Adversarial Attacks
• Simple and Efficient Hard Label Black-box Adversarial Attacks in Low Query Budget Regimes
• Gradient Frequency Modulation for Visually Explaining Video Understanding Models
• Training Efficiency and Robustness in Deep Learning