On the Design of Black-box Adversarial Examples by Leveraging Gradient-free Optimization and Operator Splitting Method

Abstract

Robust machine learning is currently one of the most prominent topics which could potentially help shaping a future of advanced AI platforms that not only perform well in average cases but also in worst cases or adverse situations. Despite the long-term vision, however, existing studies on black-box adversarial attacks are still restricted to very specific settings of threat models (e.g., single distortion metric and restrictive assumption on target model's feedback to queries) and/or suffer from prohibitively high query complexity. To push for further advances in this field, we introduce a general framework based on an operator splitting method, the alternating direction method of multipliers (ADMM) to devise efficient, robust black-box attacks that work with various distortion metrics and feedback settings without incurring high query complexity. Due to the black-box nature of the threat model, the proposed ADMM solution framework is integrated with zeroth-order (ZO) optimization and Bayesian optimization (BO), and thus is applicable to the gradient-free regime. This results in two new black-box adversarial attack generation methods, ZO-ADMM and BO-ADMM. Our empirical evaluations on image classification datasets show that our proposed approaches have much lower function query complexities compared to state-of-the-art attack methods, but achieve very competitive attack success rates.

arXiv commentaccepted by ICCV 2019

References in corpus (16)

• Practical Bayesian Optimization of Machine Learning Algorithms
• ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Models
• Transferability in Machine Learning: from Phenomena to Black-Box Attacks using Adversarial Samples
• Delving into Transferable Adversarial Examples and Black-box Attacks
• Robust Physical-World Attacks on Deep Learning Models
• Prior Convictions: Black-Box Adversarial Attacks with Bandits and Priors
• Structured Adversarial Attack: Towards General Implementation and Better Interpretability
• Query-Efficient Hard-label Black-box Attack:An Optimization-based Approach
• Black-Box Attacks against RNN based Malware Detection Algorithms
• Topology Attack and Defense for Graph Neural Networks: An Optimization Perspective
• Exploring the Space of Black-box Attacks on Deep Neural Networks
• Interpreting Adversarial Examples by Activation Promotion and Suppression
• Truncated Variance Reduction: A Unified Approach to Bayesian Optimization and Level-Set Estimation
• Linearized ADMM for Non-convex Non-smooth Optimization with Convergence Analysis
• Query-limited Black-box Attacks to Classifiers
• Protecting Neural Networks with Hierarchical Random Switching: Towards Better Robustness-Accuracy Trade-off for Stochastic Defenses

Cited by in corpus (4)

• GeoDA: a geometric framework for black-box adversarial attacks
• Taking Care of The Discretization Problem: A Comprehensive Study of the Discretization Problem and A Black-Box Adversarial Attack in Discrete Integer Domain
• Towards Query-Efficient Black-Box Adversary with Zeroth-Order Natural Gradient Descent
• Statistical Inference for Polyak-Ruppert Averaged Zeroth-order Stochastic Gradient Algorithm