RED-Attack: Resource Efficient Decision based Attack for Machine Learning

Abstract

Due to data dependency and model leakage properties, Deep Neural Networks (DNNs) exhibit several security vulnerabilities. Several security attacks exploited them but most of them require the output probability vector. These attacks can be mitigated by concealing the output probability vector. To address this limitation, decision-based attacks have been proposed which can estimate the model but they require several thousand queries to generate a single untargeted attack image. However, in real-time attacks, resources and attack time are very crucial parameters. Therefore, in resource-constrained systems, e.g., autonomous vehicles where an untargeted attack can have a catastrophic effect, these attacks may not work efficiently. To address this limitation, we propose a resource efficient decision-based methodology which generates the imperceptible attack, i.e., the RED-Attack, for a given black-box model. The proposed methodology follows two main steps to generate the imperceptible attack, i.e., classification boundary estimation and adversarial noise optimization. Firstly, we propose a half-interval search-based algorithm for estimating a sample on the classification boundary using a target image and a randomly selected image from another class. Secondly, we propose an optimization algorithm which first, introduces a small perturbation in some randomly selected pixels of the estimated sample. Then to ensure imperceptibility, it optimizes the distance between the perturbed and target samples. For illustration, we evaluate it for CFAR-10 and German Traffic Sign Recognition (GTSR) using state-of-the-art networks.

References in corpus (9)

• ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Models
• Wild Patterns: Ten Years After the Rise of Adversarial Machine Learning
• BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chain
• Detecting Backdoor Attacks on Deep Neural Networks by Activation Clustering
• Decision-Based Adversarial Attacks: Reliable Attacks Against Black-Box Machine Learning Models
• The Limitations of Deep Learning in Adversarial Settings
• PoTrojan: powerful neural-level trojan designs in deep learning models
• GenAttack: Practical Black-box Attacks with Gradient-Free Optimization
• Hu-Fu: Hardware and Software Collaborative Attack Framework against Neural Networks

Cited by in corpus (4)

• Hardware and Software Optimizations for Accelerating Deep Neural Networks: Survey of Current Trends, Challenges, and the Road Ahead
• TrISec: Training Data-Unaware Imperceptible Security Attacks on Deep Neural Networks
• Stateful Detection of Black-Box Adversarial Attacks
• QEBA: Query-Efficient Boundary-Based Blackbox Attack