Simple Black-box Adversarial Attacks

Abstract

We propose an intriguingly simple method for the construction of adversarial images in the black-box setting. In constrast to the white-box scenario, constructing black-box adversarial images has the additional constraint on query budget, and efficient attacks remain an open problem to date. With only the mild assumption of continuous-valued confidence scores, our highly query-efficient algorithm utilizes the following simple iterative principle: we randomly sample a vector from a predefined orthonormal basis and either add or subtract it to the target image. Despite its simplicity, the proposed method can be used for both untargeted and targeted attacks -- resulting in previously unprecedented query efficiency in both settings. We demonstrate the efficacy and efficiency of our algorithm on several real world settings including the Google Cloud Vision API. We argue that our proposed algorithm should serve as a strong baseline for future black-box attacks, in particular because it is extremely fast and its implementation requires less than 20 lines of PyTorch code.

arXiv commentPublished at ICML 2019

Cited by in corpus (70)

• Interpreting and Improving Adversarial Robustness of Deep Neural Networks with Neuron Sensitivity
• A Review of Adversarial Attack and Defense for Classification Methods
• Rethinking the Trigger of Backdoor Attack
• Low Frequency Adversarial Perturbation
• Adversarial Training against Location-Optimized Adversarial Patches
• FDA3 : Federated Defense Against Adversarial Attacks for Cloud-Based IIoT Applications
• Security and Privacy Issues in Deep Learning
• Vulnerability of deep neural networks for detecting COVID-19 cases from chest X-ray images to universal adversarial attacks
• ModelDiff: Testing-Based DNN Similarity Comparison for Model Reuse Detection
• Diversity can be Transferred: Output Diversification for White- and Black-box Attacks
• Learning Black-Box Attackers with Transferable Priors and Query Feedback
• Denoised Smoothing: A Provable Defense for Pretrained Classifiers
• Provably Robust Boosted Decision Stumps and Trees against Adversarial Attacks
• Machine Learning (In) Security: A Stream of Problems
• Investigating the significance of adversarial attacks and their relation to interpretability for radar-based human activity recognition systems
• Accelerated Zeroth-Order and First-Order Momentum Methods from Mini to Minimax Optimization
• A Survey of Black-Box Adversarial Attacks on Computer Vision Models
• Black-box adversarial attacks using Evolution Strategies
• AdvFlow: Inconspicuous Black-box Adversarial Attacks using Normalizing Flows
• Adversarial Laser Beam: Effective Physical-World Attack to DNNs in a Blink
• Hybrid Batch Attacks: Finding Black-box Adversarial Examples with Limited Queries
• GeCo: Quality Counterfactual Explanations in Real Time
• DaST: Data-free Substitute Training for Adversarial Attacks
• Adversarial Example Games
• Local Black-box Adversarial Attacks: A Query Efficient Approach
• PatchAttack: A Black-box Texture-based Attack with Reinforcement Learning
• ATHENA: A Framework based on Diverse Weak Defenses for Building Adversarial Defense
• Explaining in Style: Training a GAN to explain a classifier in StyleSpace
• AdvSim: Generating Safety-Critical Scenarios for Self-Driving Vehicles
• Mini-batch graphs for robust image classification
• Boosting Black-Box Attack with Partially Transferred Conditional Adversarial Distribution
• Decision-based Universal Adversarial Attack
• Protecting Against Image Translation Deepfakes by Leaking Universal Perturbations from Black-Box Neural Networks
• Convolutional Normalization: Improving Deep Convolutional Network Robustness and Training
• Orthogonal Convolutional Neural Networks
• Random Noise Defense Against Query-Based Black-Box Attacks
• Second Order Optimization for Adversarial Robustness and Interpretability
• Adversarial Detection Avoidance Attacks: Evaluating the robustness of perceptual hashing-based client-side scanning
• On the Effectiveness of Regularization Against Membership Inference Attacks
• SOAR: Second-Order Adversarial Regularization
• Performance Evaluation of Adversarial Attacks: Discrepancies and Solutions
• DeepSearch: A Simple and Effective Blackbox Attack for Deep Neural Networks
• Meta-Learning with Neural Tangent Kernels
• Projection & Probability-Driven Black-Box Attack
• Switching Transferable Gradient Directions for Query-Efficient Black-Box Adversarial Attacks
• Beware the Black-Box: on the Robustness of Recent Defenses to Adversarial Examples
• Delving into Data: Effectively Substitute Training for Black-box Attack
• Perception Improvement for Free: Exploring Imperceptible Black-box Adversarial Attacks on Image Classification
• Drawing Robust Scratch Tickets: Subnetworks with Inborn Robustness Are Found within Randomly Initialized Networks
• Rethinking Image-Scaling Attacks: The Interplay Between Vulnerabilities in Machine Learning Systems
• Noise Optimization for Artificial Neural Networks
• Yet Another Intermediate-Level Attack
• On Procedural Adversarial Noise Attack And Defense
• Meta-Learning the Search Distribution of Black-Box Random Search Based Adversarial Attacks
• MAD-VAE: Manifold Awareness Defense Variational Autoencoder
• Simple and Efficient Hard Label Black-box Adversarial Attacks in Low Query Budget Regimes
• On the Robustness of Domain Adaption to Adversarial Attacks
• Energy Attack: On Transferring Adversarial Examples
• Simulating Unknown Target Models for Query-Efficient Black-box Attacks
• Towards Imperceptible Universal Attacks on Texture Recognition
• Adversarial Eigen Attack on Black-Box Models
• A Black-box Adversarial Attack Strategy with Adjustable Sparsity and Generalizability for Deep Image Classifiers
• Luring of transferable adversarial perturbations in the black-box paradigm
• Evaluating Adversarial Attacks on ImageNet: A Reality Check on Misclassification Classes
• Human Imperceptible Attacks and Applications to Improve Fairness
• Adversarial Imitation Attack
• PDPGD: Primal-Dual Proximal Gradient Descent Adversarial Attack
• EvoBA: An Evolution Strategy as a Strong Baseline forBlack-Box Adversarial Attacks
• Examining the Human Perceptibility of Black-Box Adversarial Attacks on Face Recognition
• Are L2 adversarial examples intrinsically different?