Improving Black-box Adversarial Attacks with a Transfer-based Prior

Abstract

We consider the black-box adversarial setting, where the adversary has to generate adversarial perturbations without access to the target models to compute gradients. Previous methods tried to approximate the gradient either by using a transfer gradient of a surrogate white-box model, or based on the query feedback. However, these methods often suffer from low attack success rates or poor query efficiency since it is non-trivial to estimate the gradient in a high-dimensional space with limited information. To address these problems, we propose a prior-guided random gradient-free (P-RGF) method to improve black-box adversarial attacks, which takes the advantage of a transfer-based prior and the query information simultaneously. The transfer-based prior given by the gradient of a surrogate model is appropriately integrated into our algorithm by an optimal coefficient derived by a theoretical analysis. Extensive experiments demonstrate that our method requires much fewer queries to attack black-box models with higher success rates compared with the alternative state-of-the-art methods.

arXiv commentNeurIPS 2019; Code available at https://github.com/thu-ml/Prior-Guided-RGF

References in corpus (9)

• ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Models
• Transferability in Machine Learning: from Phenomena to Black-Box Attacks using Adversarial Samples
• Delving into Transferable Adversarial Examples and Black-box Attacks
• Adversarial Risk and the Dangers of Evaluating Against Weak Attacks
• Prior Convictions: Black-Box Adversarial Attacks with Bandits and Priors
• Guessing Smart: Biased Sampling for Efficient Black-Box Adversarial Attacks
• Low Frequency Adversarial Perturbation
• Towards Reverse-Engineering Black-Box Neural Networks
• Guided evolutionary strategies: Augmenting random search with surrogate gradients

Cited by in corpus (39)

• A Review of Adversarial Attack and Defense for Classification Methods
• Survey on Adversarial Attack and Defense for Medical Image Analysis: Methods and Challenges
• Black-Box Adversarial Attack with Transferable Model-based Embedding
• Diversity can be Transferred: Output Diversification for White- and Black-box Attacks
• Learning Black-Box Attackers with Transferable Priors and Query Feedback
• Just Noticeable Difference for Deep Machine Vision
• Adversarial Distributional Training for Robust Deep Learning
• Investigating the significance of adversarial attacks and their relation to interpretability for radar-based human activity recognition systems
• Towards Visual Distortion in Black-Box Attacks
• Hybrid Batch Attacks: Finding Black-box Adversarial Examples with Limited Queries
• Bag of Tricks for Adversarial Training
• GreedyFool: Distortion-Aware Sparse Adversarial Attack
• Raze to the Ground: Query-Efficient Adversarial HTML Attacks on Machine-Learning Phishing Webpage Detectors
• EREBA: Black-box Energy Testing of Adaptive Neural Networks
• Boosting Black-Box Attack with Partially Transferred Conditional Adversarial Distribution
• DAmageNet: A Universal Adversarial Dataset
• TRS: Transferability Reduced Ensemble via Encouraging Gradient Diversity and Model Smoothness
• GeoDA: a geometric framework for black-box adversarial attacks
• Unrestricted Adversarial Attacks on ImageNet Competition
• Exploring the Back Alleys: Analysing The Robustness of Alternative Neural Network Architectures against Adversarial Attacks
• Towards an Awareness of Time Series Anomaly Detection Models' Adversarial Vulnerability
• RamBoAttack: A Robust Query Efficient Deep Neural Network Decision Exploit
• Switching Transferable Gradient Directions for Query-Efficient Black-Box Adversarial Attacks
• Spanning Attack: Reinforce Black-box Attacks with Unlabeled Data
• Adversarial Attack across Datasets
• Meta-Learning the Search Distribution of Black-Box Random Search Based Adversarial Attacks
• Simulating Unknown Target Models for Query-Efficient Black-box Attacks
• Adaptive Image Transformations for Transfer-based Adversarial Attack
• Cross-domain Cross-architecture Black-box Attacks on Fine-tuned Models with Transferred Evolutionary Strategies
• Sparse Perturbations for Improved Convergence in Stochastic Zeroth-Order Optimization
• On the Convergence of Prior-Guided Zeroth-Order Optimization Algorithms
• Evaluating Adversarial Attacks on ImageNet: A Reality Check on Misclassification Classes
• Automated Decision-based Adversarial Attacks
• Adaptive Perturbation for Adversarial Attack
• Adversarial Eigen Attack on Black-Box Models
• Adversarial Attacks with Time-Scale Representations
• Where Does the Robustness Come from? A Study of the Transformation-based Ensemble Defence
• Boosting Black-Box Adversarial Attacks with Meta Learning
• Query-Free Adversarial Transfer via Undertrained Surrogates