Guessing Smart: Biased Sampling for Efficient Black-Box Adversarial Attacks

Abstract

We consider adversarial examples for image classification in the black-box decision-based setting. Here, an attacker cannot access confidence scores, but only the final label. Most attacks for this scenario are either unreliable or inefficient. Focusing on the latter, we show that a specific class of attacks, Boundary Attacks, can be reinterpreted as a biased sampling framework that gains efficiency from domain knowledge. We identify three such biases, image frequency, regional masks and surrogate gradients, and evaluate their performance against an ImageNet classifier. We show that the combination of these biases outperforms the state of the art by a wide margin. We also showcase an efficient way to attack the Google Cloud Vision API, where we craft convincing perturbations with just a few hundred queries. Finally, the methods we propose have also been found to work very well against strong defenses: Our targeted attack won second place in the NeurIPS 2018 Adversarial Vision Challenge.

For source code and videos, see https://github.com/ttbrunner/biased_boundary_attack

References in corpus (10)

• Explaining and Harnessing Adversarial Examples
• Intriguing properties of neural networks
• Ensemble Adversarial Training: Attacks and Defenses
• ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Models
• Synthesizing Robust Adversarial Examples
• The Space of Transferable Adversarial Examples
• Prior Convictions: Black-Box Adversarial Attacks with Bandits and Priors
• Query-Efficient Hard-label Black-box Attack:An Optimization-based Approach
• Low Frequency Adversarial Perturbation
• Evaluating and Understanding the Robustness of Adversarial Logit Pairing

Cited by in corpus (27)

• Hardware and Software Optimizations for Accelerating Deep Neural Networks: Survey of Current Trends, Challenges, and the Road Ahead
• Improving Black-box Adversarial Attacks with a Transfer-based Prior
• A Review of Adversarial Attack and Defense for Classification Methods
• Black-Box Adversarial Attack with Transferable Model-based Embedding
• Diversity can be Transferred: Output Diversification for White- and Black-box Attacks
• Sign-OPT: A Query-Efficient Hard-label Adversarial Attack
• A Survey of Black-Box Adversarial Attacks on Computer Vision Models
• Hybrid Batch Attacks: Finding Black-box Adversarial Examples with Limited Queries
• ML-LOO: Detecting Adversarial Examples with Feature Attribution
• An Efficient Adversarial Attack for Tree Ensembles
• $n$-ML: Mitigating Adversarial Examples via Ensembles of Topologically Manipulated Classifiers
• Stateful Detection of Black-Box Adversarial Attacks
• RamBoAttack: A Robust Query Efficient Deep Neural Network Decision Exploit
• Trust but Verify: An Information-Theoretic Explanation for the Adversarial Fragility of Machine Learning Systems, and a General Defense against Adversarial Attacks
• QEBA: Query-Efficient Boundary-Based Blackbox Attack
• Improving Robustness using Generated Data
• Spanning Attack: Reinforce Black-box Attacks with Unlabeled Data
• QAIR: Practical Query-efficient Black-Box Attacks for Image Retrieval
• Adversarial attacks to image classification systems using evolutionary algorithms
• Copy and Paste: A Simple But Effective Initialization Method for Black-Box Adversarial Attacks
• Simple and Efficient Hard Label Black-box Adversarial Attacks in Low Query Budget Regimes
• On the Convergence of Prior-Guided Zeroth-Order Optimization Algorithms
• Automated Decision-based Adversarial Attacks
• Do Deep Minds Think Alike? Selective Adversarial Attacks for Fine-Grained Manipulation of Multiple Deep Neural Networks
• Beyond Universal Person Re-ID Attack
• Adversarial Attacks with Time-Scale Representations
• LSDAT: Low-Rank and Sparse Decomposition for Decision-based Adversarial Attack