Simulating Unknown Target Models for Query-Efficient Black-box Attacks

Abstract

Many adversarial attacks have been proposed to investigate the security issues of deep neural networks. In the black-box setting, current model stealing attacks train a substitute model to counterfeit the functionality of the target model. However, the training requires querying the target model. Consequently, the query complexity remains high, and such attacks can be defended easily. This study aims to train a generalized substitute model called "Simulator", which can mimic the functionality of any unknown target model. To this end, we build the training data with the form of multiple tasks by collecting query sequences generated during the attacks of various existing networks. The learning process uses a mean square error-based knowledge-distillation loss in the meta-learning to minimize the difference between the Simulator and the sampled networks. The meta-gradients of this loss are then computed and accumulated from multiple tasks to update the Simulator and subsequently improve generalization. When attacking a target model that is unseen in training, the trained Simulator can accurately simulate its functionality using its limited feedback. As a result, a large fraction of queries can be transferred to the Simulator, thereby reducing query complexity. Results of the comprehensive experiments conducted using the CIFAR-10, CIFAR-100, and TinyImageNet datasets demonstrate that the proposed approach reduces query complexity by several orders of magnitude compared to the baseline method. The implementation source code is released at https://github.com/machanic/SimulatorAttack.

arXiv commentAccepted at CVPR 2021. Code and models are available at https://github.com/machanic/SimulatorAttack

References in corpus (12)

• PyTorch: An Imperative Style, High-Performance Deep Learning Library
• ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Models
• Transferability in Machine Learning: from Phenomena to Black-Box Attacks using Adversarial Samples
• Delving into Transferable Adversarial Examples and Black-box Attacks
• The Space of Transferable Adversarial Examples
• Prior Convictions: Black-Box Adversarial Attacks with Bandits and Priors
• ShakeDrop Regularization for Deep Residual Learning
• Improving Black-box Adversarial Attacks with a Transfer-based Prior
• Simple Black-box Adversarial Attacks
• Prediction Poisoning: Towards Defenses Against DNN Model Stealing Attacks
• Query-efficient Meta Attack to Deep Neural Networks
• Black-box Adversarial Attacks with Bayesian Optimization