Diversity can be Transferred: Output Diversification for White- and Black-box Attacks

Abstract

Adversarial attacks often involve random perturbations of the inputs drawn from uniform or Gaussian distributions, e.g., to initialize optimization-based white-box attacks or generate update directions in black-box attacks. These simple perturbations, however, could be sub-optimal as they are agnostic to the model being attacked. To improve the efficiency of these attacks, we propose Output Diversified Sampling (ODS), a novel sampling strategy that attempts to maximize diversity in the target model's outputs among the generated samples. While ODS is a gradient-based strategy, the diversity offered by ODS is transferable and can be helpful for both white-box and black-box attacks via surrogate models. Empirically, we demonstrate that ODS significantly improves the performance of existing white-box and black-box attacks. In particular, ODS reduces the number of queries needed for state-of-the-art black-box attacks on ImageNet by a factor of two.

arXiv commentNeurIPS 2020

References in corpus (20)

• SqueezeNet: AlexNet-level accuracy with 50x fewer parameters and <0.5MB model size
• Transferability in Machine Learning: from Phenomena to Black-Box Attacks using Adversarial Samples
• Theoretically Principled Trade-off between Robustness and Accuracy
• Delving into Transferable Adversarial Examples and Black-box Attacks
• Provable defenses against adversarial examples via the convex outer adversarial polytope
• Certified Adversarial Robustness via Randomized Smoothing
• Certified Defenses against Adversarial Examples
• Adversarial Risk and the Dangers of Evaluating Against Weak Attacks
• Improving the Adversarial Robustness and Interpretability of Deep Neural Networks by Regularizing their Input Gradients
• Prior Convictions: Black-Box Adversarial Attacks with Bandits and Priors
• Adversarial Robustness through Local Linearization
• Are Labels Required for Improving Adversarial Robustness?
• Improving Black-box Adversarial Attacks with a Transfer-based Prior
• Simple Black-box Adversarial Attacks
• Guessing Smart: Biased Sampling for Efficient Black-Box Adversarial Attacks
• Metric Learning for Adversarial Robustness
• An Alternative Surrogate Loss for PGD-based Adversarial Testing
• Query-efficient Meta Attack to Deep Neural Networks
• Adversarially Robust Training through Structured Gradient Regularization
• Enhancing Gradient-based Attacks with Symbolic Intervals

Cited by in corpus (7)

• Adversarial Distributional Training for Robust Deep Learning
• Towards Understanding the Adversarial Vulnerability of Skeleton-based Action Recognition
• On Improving Adversarial Transferability of Vision Transformers
• Label Smoothing and Adversarial Robustness
• A Survey of the Metrics, Uses, and Subjects of Diversity-Based Techniques in Software Testing
• Imbalanced Gradients: A Subtle Cause of Overestimated Adversarial Robustness
• Efficient Adversarial Input Generation via Neural Net Patching