DaST: Data-free Substitute Training for Adversarial Attacks

Abstract

Machine learning models are vulnerable to adversarial examples. For the black-box setting, current substitute attacks need pre-trained models to generate adversarial examples. However, pre-trained models are hard to obtain in real-world tasks. In this paper, we propose a data-free substitute training method (DaST) to obtain substitute models for adversarial black-box attacks without the requirement of any real data. To achieve this, DaST utilizes specially designed generative adversarial networks (GANs) to train the substitute models. In particular, we design a multi-branch architecture and label-control loss for the generative model to deal with the uneven distribution of synthetic samples. The substitute model is then trained by the synthetic samples generated by the generative model, which are labeled by the attacked model subsequently. The experiments demonstrate the substitute models produced by DaST can achieve competitive performance compared with the baseline models which are trained by the same train set with attacked models. Additionally, to evaluate the practicability of the proposed method on the real-world task, we attack an online machine learning model on the Microsoft Azure platform. The remote model misclassifies 98.35% of the adversarial examples crafted by our method. To the best of our knowledge, we are the first to train a substitute model for adversarial attacks without any real data.

arXiv commentAccepted by CVPR2020

References in corpus (13)

• Ensemble Adversarial Training: Attacks and Defenses
• ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Models
• Characterizing Adversarial Subspaces Using Local Intrinsic Dimensionality
• Detecting Adversarial Samples from Artifacts
• On the (Statistical) Detection of Adversarial Examples
• Deep k-Nearest Neighbors: Towards Confident, Interpretable and Robust Deep Learning
• Prior Convictions: Black-Box Adversarial Attacks with Bandits and Priors
• On Detecting Adversarial Perturbations
• Simple Black-Box Adversarial Perturbations for Deep Networks
• Simple Black-box Adversarial Attacks
• advertorch v0.1: An Adversarial Robustness Toolbox based on PyTorch
• Early Methods for Detecting Adversarial Images
• Query-Efficient Hard-label Black-box Attack:An Optimization-based Approach

Cited by in corpus (2)

• QAIR: Practical Query-efficient Black-Box Attacks for Image Retrieval
• A Novel Data Encryption Method Inspired by Adversarial Attacks