There are No Bit Parts for Sign Bits in Black-Box Attacks

Abstract

We present a black-box adversarial attack algorithm which sets new state-of-the-art model evasion rates for query efficiency in the ${\ell }_{\infty }$ and ${\ell }_2$ metrics, where only loss-oracle access to the model is available. On two public black-box attack challenges, the algorithm achieves the highest evasion rate, surpassing all of the submitted attacks. Similar performance is observed on a model that is secure against substitute-model attacks. For standard models trained on the MNIST, CIFAR10, and IMAGENET datasets, averaged over the datasets and metrics, the algorithm is 3.8x less failure-prone, and spends in total 2.5x fewer queries than the current state-of-the-art attacks combined given a budget of 10, 000 queries per attack attempt. Notably, it requires no hyperparameter tuning or any data/time-dependent prior. The algorithm exploits a new approach, namely sign-based rather than magnitude-based gradient estimation. This shifts the estimation from continuous to binary black-box optimization. With three properties of the directional derivative, we examine three approaches to adversarial attacks. This yields a superior algorithm breaking a standard MNIST model using just 12 queries on average!

arXiv commentAdded results of Ensemble Adv Learning. ICML template

References in corpus (7)

• ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Models
• Wild Patterns: Ten Years After the Rise of Adversarial Machine Learning
• Evolution Strategies as a Scalable Alternative to Reinforcement Learning
• Exploring the Space of Black-box Attacks on Deep Neural Networks
• A Simple Explanation for the Existence of Adversarial Examples with Small Hamming Distance
• On Visual Hallmarks of Robustness to Adversarial Malware
• Query Matrices for Retrieving Binary Vectors Based on the Hamming Distance Oracle

Cited by in corpus (7)

• Sign-OPT: A Query-Efficient Hard-label Adversarial Attack
• Yet another but more efficient black-box adversarial attack: tiling and evolution strategies
• Hybrid Batch Attacks: Finding Black-box Adversarial Examples with Limited Queries
• Meta-Learning the Search Distribution of Black-Box Random Search Based Adversarial Attacks
• Adversarial Attacks on Binary Image Recognition Systems
• Energy Attack: On Transferring Adversarial Examples
• Gaussian MRF Covariance Modeling for Efficient Black-Box Adversarial Attacks