AdvFlow: Inconspicuous Black-box Adversarial Attacks using Normalizing Flows
arXiv:2007.07435
Abstract
Deep learning classifiers are susceptible to well-crafted, imperceptible variations of their inputs, known as adversarial attacks. In this regard, the study of powerful attack models sheds light on the sources of vulnerability in these classifiers, hopefully leading to more robust ones. In this paper, we introduce AdvFlow: a novel black-box adversarial attack method on image classifiers that exploits the power of normalizing flows to model the density of adversarial examples around a given target image. We see that the proposed method generates adversaries that closely follow the clean data distribution, a property which makes their detection less likely. Also, our experimental results show competitive performance of the proposed approach with some of the existing attack methods on defended classifiers. The code is available at https://github.com/hmdolatabadi/AdvFlow.
arXiv commentAccepted to the 34th Conference on Neural Information Processing Systems (NeurIPS 2020)
References in corpus (21)
- ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Models
- Transferability in Machine Learning: from Phenomena to Black-Box Attacks using Adversarial Samples
- NICE: Non-linear Independent Components Estimation
- Variational Inference with Normalizing Flows
- Normalizing Flows: An Introduction and Review of Current Methods
- Adversarial Attacks on Neural Networks for Graph Data
- Evolution Strategies as a Scalable Alternative to Reinforcement Learning
- A Simple Unified Framework for Detecting Out-of-Distribution Samples and Adversarial Attacks
- Fast is better than free: Revisiting adversarial training
- Characterizing Adversarial Subspaces Using Local Intrinsic Dimensionality
- Deep Text Classification Can be Fooled
- Guided Image Generation with Conditional Invertible Neural Networks
- Prior Convictions: Black-Box Adversarial Attacks with Bandits and Priors
- GraphAF: a Flow-based Autoregressive Model for Molecular Graph Generation
- Simple Black-box Adversarial Attacks
- Low Frequency Adversarial Perturbation
- Functional Adversarial Attacks
- Parsimonious Black-Box Adversarial Attacks via Efficient Combinatorial Optimization
- Graph Normalizing Flows
- A Direct Approach to Robust Deep Learning Using Adversarial Networks
- A Survey of Black-Box Adversarial Attacks on Computer Vision Models