BOSH: An Efficient Meta Algorithm for Decision-based Attacks

Abstract

Adversarial example generation becomes a viable method for evaluating the robustness of a machine learning model. In this paper, we consider hard-label black-box attacks (a.k.a. decision-based attacks), which is a challenging setting that generates adversarial examples based on only a series of black-box hard-label queries. This type of attacks can be used to attack discrete and complex models, such as Gradient Boosting Decision Tree (GBDT) and detection-based defense models. Existing decision-based attacks based on iterative local updates often get stuck in a local minimum and fail to generate the optimal adversarial example with the smallest distortion. To remedy this issue, we propose an efficient meta algorithm called BOSH-attack, which tremendously improves existing algorithms through Bayesian Optimization (BO) and Successive Halving (SH). In particular, instead of traversing a single solution path when searching an adversarial example, we maintain a pool of solution paths to explore important regions. We show empirically that the proposed algorithm converges to a better solution than existing approaches, while the query count is smaller than applying multiple random initializations by a factor of 10.

References in corpus (16)

• Practical Bayesian Optimization of Machine Learning Algorithms
• ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Models
• Towards Deep Learning Models Resistant to Adversarial Attacks
• A Simple Unified Framework for Detecting Out-of-Distribution Samples and Adversarial Attacks
• Detecting Adversarial Samples from Artifacts
• Black-box Adversarial Attacks with Limited Queries and Information
• Prior Convictions: Black-Box Adversarial Attacks with Bandits and Priors
• Query-Efficient Hard-label Black-box Attack:An Optimization-based Approach
• Evasion and Hardening of Tree Ensemble Classifiers
• HopSkipJumpAttack: A Query-Efficient Decision-Based Attack
• Robust Decision Trees Against Adversarial Examples
• Sign-OPT: A Query-Efficient Hard-label Adversarial Attack
• GenAttack: Practical Black-box Attacks with Gradient-Free Optimization
• Attacking Visual Language Grounding with Adversarial Examples: A Case Study on Neural Image Captioning
• ML-LOO: Detecting Adversarial Examples with Feature Attribution
• Enhancing Gradient-based Attacks with Symbolic Intervals