Black-Box Adversarial Attack with Transferable Model-based Embedding

Abstract

We present a new method for black-box adversarial attack. Unlike previous methods that combined transfer-based and scored-based methods by using the gradient or initialization of a surrogate white-box model, this new method tries to learn a low-dimensional embedding using a pretrained model, and then performs efficient search within the embedding space to attack an unknown target network. The method produces adversarial perturbations with high level semantic patterns that are easily transferable. We show that this approach can greatly improve the query efficiency of black-box adversarial attack across different target network architectures. We evaluate our approach on MNIST, ImageNet and Google Cloud Vision API, resulting in a significant reduction on the number of queries. We also attack adversarially defended networks on CIFAR10 and ImageNet, where our method not only reduces the number of queries, but also improves the attack success rate.

References in corpus (10)

• Very Deep Convolutional Networks for Large-Scale Image Recognition
• Conditional Generative Adversarial Nets
• ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Models
• Transferability in Machine Learning: from Phenomena to Black-Box Attacks using Adversarial Samples
• Prior Convictions: Black-Box Adversarial Attacks with Bandits and Priors
• Improving Black-box Adversarial Attacks with a Transfer-based Prior
• Guessing Smart: Biased Sampling for Efficient Black-Box Adversarial Attacks
• Feature Denoising for Improving Adversarial Robustness
• AutoZOOM: Autoencoder-based Zeroth Order Optimization Method for Attacking Black-box Neural Networks
• A Direct Approach to Robust Deep Learning Using Adversarial Networks

Cited by in corpus (6)

• Task dependent Deep LDA pruning of neural networks
• Towards Visual Distortion in Black-Box Attacks
• Cross-domain Cross-architecture Black-box Attacks on Fine-tuned Models with Transferred Evolutionary Strategies
• Improving White-box Robustness of Pre-processing Defenses via Joint Adversarial Training
• Adversarial Eigen Attack on Black-Box Models
• LSDAT: Low-Rank and Sparse Decomposition for Decision-based Adversarial Attack