A Frank-Wolfe Framework for Efficient and Effective Adversarial Attacks

Abstract

Depending on how much information an adversary can access to, adversarial attacks can be classified as white-box attack and black-box attack. For white-box attack, optimization-based attack algorithms such as projected gradient descent (PGD) can achieve relatively high attack success rates within moderate iterates. However, they tend to generate adversarial examples near or upon the boundary of the perturbation set, resulting in large distortion. Furthermore, their corresponding black-box attack algorithms also suffer from high query complexities, thereby limiting their practical usefulness. In this paper, we focus on the problem of developing efficient and effective optimization-based adversarial attack algorithms. In particular, we propose a novel adversarial attack framework for both white-box and black-box settings based on a variant of Frank-Wolfe algorithm. We show in theory that the proposed attack algorithms are efficient with an $O(1/\sqrt{T})$ convergence rate. The empirical results of attacking the ImageNet and MNIST datasets also verify the efficiency and effectiveness of the proposed algorithms. More specifically, our proposed algorithms attain the best attack performances in both white-box and black-box attacks among all baselines, and are more time and query efficient than the state-of-the-art.

arXiv comment25 pages, 1 figure, 7 tables

References in corpus (10)

• Faster R-CNN: Towards Real-Time Object Detection with Region Proposal Networks
• ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Models
• Transferability in Machine Learning: from Phenomena to Black-Box Attacks using Adversarial Samples
• Evolution Strategies as a Scalable Alternative to Reinforcement Learning
• Delving into Transferable Adversarial Examples and Black-box Attacks
• Generating Adversarial Malware Examples for Black-Box Attacks Based on GAN
• Prior Convictions: Black-Box Adversarial Attacks with Bandits and Priors
• An Optimal Algorithm for Bandit and Zero-Order Convex Optimization with Two-Point Feedback
• Convergence Rate of Frank-Wolfe for Non-Convex Objectives
• Exploring the Space of Black-box Attacks on Deep Neural Networks

Cited by in corpus (1)

• Adversarial Framework with Certified Robustness for Time-Series Domain via Statistical Features