Towards Query-Efficient Black-Box Adversary with Zeroth-Order Natural Gradient Descent
arXiv:2002.07891
Abstract
Despite the great achievements of the modern deep neural networks (DNNs), the vulnerability/robustness of state-of-the-art DNNs raises security concerns in many application domains requiring high reliability. Various adversarial attacks are proposed to sabotage the learning performance of DNN models. Among those, the black-box adversarial attack methods have received special attentions owing to their practicality and simplicity. Black-box attacks usually prefer less queries in order to maintain stealthy and low costs. However, most of the current black-box attack methods adopt the first-order gradient descent method, which may come with certain deficiencies such as relatively slow convergence and high sensitivity to hyper-parameter settings. In this paper, we propose a zeroth-order natural gradient descent (ZO-NGD) method to design the adversarial attacks, which incorporates the zeroth-order gradient estimation technique catering to the black-box attack scenario and the second-order natural gradient descent to achieve higher query efficiency. The empirical evaluations on image classification datasets demonstrate that ZO-NGD can obtain significantly lower model query complexities compared with state-of-the-art attack methods.
arXiv commentaccepted by AAAI 2020
References in corpus (15)
- ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Models
- Transferability in Machine Learning: from Phenomena to Black-Box Attacks using Adversarial Samples
- Optimizing Neural Networks with Kronecker-factored Approximate Curvature
- Security Evaluation of Pattern Classifiers under Attack
- Efficient Neural Network Robustness Certification with General Activation Functions
- Black-box Adversarial Attacks with Limited Queries and Information
- Did you hear that? Adversarial Examples Against Automatic Speech Recognition
- Structured Adversarial Attack: Towards General Implementation and Better Interpretability
- Adversarial Examples for Semantic Segmentation and Object Detection
- Topology Attack and Defense for Graph Neural Networks: An Optimization Perspective
- Randomized Prediction Games for Adversarial Machine Learning
- Universal Statistics of Fisher Information in Deep Neural Networks: Mean Field Approach
- Hessian-Aware Zeroth-Order Optimization for Black-Box Adversarial Attack
- An ADMM-Based Universal Framework for Adversarial Attacks on Deep Neural Networks
- On the Design of Black-box Adversarial Examples by Leveraging Gradient-free Optimization and Operator Splitting Method