Simple and Efficient Hard Label Black-box Adversarial Attacks in Low Query Budget Regimes

Abstract

We focus on the problem of black-box adversarial attacks, where the aim is to generate adversarial examples for deep learning models solely based on information limited to output label~(hard label) to a queried data input. We propose a simple and efficient Bayesian Optimization~(BO) based approach for developing black-box adversarial attacks. Issues with BO's performance in high dimensions are avoided by searching for adversarial examples in a structured low-dimensional subspace. We demonstrate the efficacy of our proposed attack method by evaluating both ${\ell }_{\infty }$ and ${\ell }_2$ norm constrained untargeted and targeted hard label black-box attacks on three standard datasets - MNIST, CIFAR-10 and ImageNet. Our proposed approach consistently achieves 2x to 10x higher attack success rate while requiring 10x to 20x fewer queries compared to the current state-of-the-art black-box adversarial attacks.

Accepted at KDD 2021. arXiv admin note: substantial text overlap with arXiv:1909.13857

References in corpus (9)

• Very Deep Convolutional Networks for Large-Scale Image Recognition
• Practical Bayesian Optimization of Machine Learning Algorithms
• ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Models
• Delving into Transferable Adversarial Examples and Black-box Attacks
• Simple Black-box Adversarial Attacks
• Guessing Smart: Biased Sampling for Efficient Black-Box Adversarial Attacks
• Low Frequency Adversarial Perturbation
• Parsimonious Black-Box Adversarial Attacks via Efficient Combinatorial Optimization
• Query-limited Black-box Attacks to Classifiers

Cited by in corpus (1)

• LSDAT: Low-Rank and Sparse Decomposition for Decision-based Adversarial Attack