NATTACK: Learning the Distributions of Adversarial Examples for an Improved Black-Box Attack on Deep Neural Networks

Abstract

Powerful adversarial attack methods are vital for understanding how to construct robust deep neural networks (DNNs) and for thoroughly testing defense techniques. In this paper, we propose a black-box adversarial attack algorithm that can defeat both vanilla DNNs and those generated by various defense techniques developed recently. Instead of searching for an "optimal" adversarial example for a benign input to a targeted DNN, our algorithm finds a probability density distribution over a small region centered around the input, such that a sample drawn from this distribution is likely an adversarial example, without the need of accessing the DNN's internal layers or weights. Our approach is universal as it can successfully attack different neural networks by a single algorithm. It is also strong; according to the testing against 2 vanilla DNNs and 13 defended ones, it outperforms state-of-the-art black-box or white-box attack methods for most test cases. Additionally, our results reveal that adversarial training remains one of the best defense techniques, and the adversarial examples are not as transferable across defended DNNs as them across vanilla DNNs.

References in corpus (19)

• Ensemble Adversarial Training: Attacks and Defenses
• Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networks
• ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Models
• Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples
• Evolution Strategies as a Scalable Alternative to Reinforcement Learning
• Delving into Transferable Adversarial Examples and Black-box Attacks
• Provable defenses against adversarial examples via the convex outer adversarial polytope
• Characterizing Adversarial Subspaces Using Local Intrinsic Dimensionality
• The Space of Transferable Adversarial Examples
• Efficient Neural Network Robustness Certification with General Activation Functions
• Black-box Adversarial Attacks with Limited Queries and Information
• An approach to reachability analysis for feed-forward ReLU neural networks
• Stochastic Activation Pruning for Robust Adversarial Defense
• On the Robustness of the CVPR 2018 White-Box Adversarial Example Defenses
• Adv-BNN: Improved Adversarial Defense through Robust Bayesian Neural Network
• Attacking the Madry Defense Model with $L_1$-based Adversarial Examples
• Deep Neural Networks as 0-1 Mixed Integer Linear Programs: A Feasibility Study
• Interpreting Adversarial Examples by Activation Promotion and Suppression
• A Direct Approach to Robust Deep Learning Using Adversarial Networks

Cited by in corpus (16)

• A Review of Adversarial Attack and Defense for Classification Methods
• DeepRobust: A PyTorch Library for Adversarial Attacks and Defenses
• Improving Adversarial Robustness via Channel-wise Activation Suppressing
• Black-box adversarial attacks using Evolution Strategies
• Probabilistic Margins for Instance Reweighting in Adversarial Training
• Min-Max Optimization without Gradients: Convergence and Applications to Adversarial ML
• CorrAttack: Black-box Adversarial Attack with Structured Search
• Generalizable Adversarial Attacks with Latent Variable Perturbation Modelling
• Analysis and Applications of Class-wise Robustness in Adversarial Training
• On Procedural Adversarial Noise Attack And Defense
• Adversarial Attacks on Binary Image Recognition Systems
• The Vulnerability of the Neural Networks Against Adversarial Examples in Deep Learning Algorithms
• An Integrated Approach to Produce Robust Models with High Efficiency
• Zeroth-Order Methods for Convex-Concave Minmax Problems: Applications to Decision-Dependent Risk Minimization
• Moiré Attack (MA): A New Potential Risk of Screen Photos
• Multi-way Encoding for Robustness