Query-efficient Meta Attack to Deep Neural Networks

Abstract

Black-box attack methods aim to infer suitable attack patterns to targeted DNN models by only using output feedback of the models and the corresponding input queries. However, due to lack of prior and inefficiency in leveraging the query and feedback information, existing methods are mostly query-intensive for obtaining effective attack patterns. In this work, we propose a meta attack approach that is capable of attacking a targeted model with much fewer queries. Its high queryefficiency stems from effective utilization of meta learning approaches in learning generalizable prior abstraction from the previously observed attack patterns and exploiting such prior to help infer attack patterns from only a few queries and outputs. Extensive experiments on MNIST, CIFAR10 and tiny-Imagenet demonstrate that our meta-attack method can remarkably reduce the number of model queries without sacrificing the attack performance. Besides, the obtained meta attacker is not restricted to a particular model but can be used easily with a fast adaptive ability to attack a variety of models.The code of our work is available at https://github.com/dydjw9/MetaAttack_ICLR2020/.

References in corpus (6)

• Very Deep Convolutional Networks for Large-Scale Image Recognition
• Model-Agnostic Meta-Learning for Fast Adaptation of Deep Networks
• ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Models
• On First-Order Meta-Learning Algorithms
• Adversarial Attacks on Graph Neural Networks via Meta Learning
• Prior Convictions: Black-Box Adversarial Attacks with Bandits and Priors

Cited by in corpus (12)

• Diversity can be Transferred: Output Diversification for White- and Black-box Attacks
• Adversarial Example Games
• Boosting Black-Box Attack with Partially Transferred Conditional Adversarial Distribution
• Improving Query Efficiency of Black-box Adversarial Attack
• CorrAttack: Black-box Adversarial Attack with Structured Search
• Motion-Excited Sampler: Video Adversarial Attack with Sparked Prior
• Training Meta-Surrogate Model for Transferable Adversarial Attack
• Adversarial Attack across Datasets
• Meta-Learning the Search Distribution of Black-Box Random Search Based Adversarial Attacks
• Simulating Unknown Target Models for Query-Efficient Black-box Attacks
• Model-Agnostic Meta-Attack: Towards Reliable Evaluation of Adversarial Robustness
• Adaptive Image Transformations for Transfer-based Adversarial Attack