Spanning Attack: Reinforce Black-box Attacks with Unlabeled Data
arXiv:2005.04871
Abstract
Adversarial black-box attacks aim to craft adversarial perturbations by querying input-output pairs of machine learning models. They are widely used to evaluate the robustness of pre-trained models. However, black-box attacks often suffer from the issue of query inefficiency due to the high dimensionality of the input space, and therefore incur a false sense of model robustness. In this paper, we relax the conditions of the black-box threat model, and propose a novel technique called the spanning attack. By constraining adversarial perturbations in a low-dimensional subspace via spanning an auxiliary unlabeled dataset, the spanning attack significantly improves the query efficiency of a wide variety of existing black-box attacks. Extensive experiments show that the proposed method works favorably in both soft-label and hard-label black-box attacks. Our code is available at https://github.com/wangwllu/spanning_attack.
References in corpus (12)
- ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Models
- Wild Patterns: Ten Years After the Rise of Adversarial Machine Learning
- Transferability in Machine Learning: from Phenomena to Black-Box Attacks using Adversarial Samples
- Delving into Transferable Adversarial Examples and Black-box Attacks
- Adversarial Risk and the Dangers of Evaluating Against Weak Attacks
- Prior Convictions: Black-Box Adversarial Attacks with Bandits and Priors
- Improving Black-box Adversarial Attacks with a Transfer-based Prior
- Guessing Smart: Biased Sampling for Efficient Black-Box Adversarial Attacks
- Evasion and Hardening of Tree Ensemble Classifiers
- Stochastic Zeroth-order Optimization in High Dimensions
- Robust Decision Trees Against Adversarial Examples
- Evaluating the Robustness of Nearest Neighbor Classifiers: A Primal-Dual Perspective