Yet another but more efficient black-box adversarial attack: tiling and evolution strategies

Abstract

We introduce a new black-box attack achieving state of the art performances. Our approach is based on a new objective function, borrowing ideas from ${\ell }_{\infty }$-white box attacks, and particularly designed to fit derivative-free optimization requirements. It only requires to have access to the logits of the classifier without any other information which is a more realistic scenario. Not only we introduce a new objective function, we extend previous works on black box adversarial attacks to a larger spectrum of evolution strategies and other derivative-free optimization methods. We also highlight a new intriguing property that deep neural networks are not robust to single shot tiled attacks. Our models achieve, with a budget limited to $10,000$ queries, results up to $99.2\%$ of success rate against InceptionV3 classifier with $630$ queries to the network on average in the untargeted attacks setting, which is an improvement by $90$ queries of the current state of the art. In the targeted setting, we are able to reach, with a limited budget of $100,000$, $100\%$ of success rate with a budget of $6,662$ queries on average, i.e. we need $800$ queries less than the current state of the art.

References in corpus (12)

• Very Deep Convolutional Networks for Large-Scale Image Recognition
• ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Models
• Transferability in Machine Learning: from Phenomena to Black-Box Attacks using Adversarial Samples
• Certified Adversarial Robustness via Randomized Smoothing
• Certifying Some Distributional Robustness with Principled Adversarial Training
• Black-box Adversarial Attacks with Limited Queries and Information
• Prior Convictions: Black-Box Adversarial Attacks with Bandits and Priors
• Information-Geometric Optimization Algorithms: A Unifying Picture via Invariance Principles
• Parsimonious Black-Box Adversarial Attacks via Efficient Combinatorial Optimization
• Robust Neural Networks using Randomized Adversarial Training
• There are No Bit Parts for Sign Bits in Black-Box Attacks
• Cumulative Step-size Adaptation on Linear Functions

Cited by in corpus (11)

• Towards Visual Distortion in Black-Box Attacks
• Adversarial Robustness by Design through Analog Computing and Synthetic Gradients
• DAmageNet: A Universal Adversarial Dataset
• CorrAttack: Black-box Adversarial Attack with Structured Search
• Adversarial Detection Avoidance Attacks: Evaluating the robustness of perceptual hashing-based client-side scanning
• You Only Query Once: Effective Black Box Adversarial Attacks with Minimal Repeated Queries
• Mitigating Adversarial Attacks by Distributing Different Copies to Different Users
• Meta-Learning the Search Distribution of Black-Box Random Search Based Adversarial Attacks
• EvoBA: An Evolution Strategy as a Strong Baseline forBlack-Box Adversarial Attacks
• Adversarial Eigen Attack on Black-Box Models
• Do Deep Minds Think Alike? Selective Adversarial Attacks for Fine-Grained Manipulation of Multiple Deep Neural Networks