Decision-based Universal Adversarial Attack
arXiv:2009.07024
Abstract
A single perturbation can pose the most natural images to be misclassified by classifiers. In black-box setting, current universal adversarial attack methods utilize substitute models to generate the perturbation, then apply the perturbation to the attacked model. However, this transfer often produces inferior results. In this study, we directly work in the black-box setting to generate the universal adversarial perturbation. Besides, we aim to design an adversary generating a single perturbation having texture like stripes based on orthogonal matrix, as the top convolutional layers are sensitive to stripes. To this end, we propose an efficient Decision-based Universal Attack (DUAttack). With few data, the proposed adversary computes the perturbation based solely on the final inferred labels, but good transferability has been realized not only across models but also span different vision tasks. The effectiveness of DUAttack is validated through comparisons with other state-of-the-art attacks. The efficiency of DUAttack is also demonstrated on real world settings including the Microsoft Azure. In addition, several representative defense methods are struggling with DUAttack, indicating the practicability of the proposed method.
References in corpus (25)
- Very Deep Convolutional Networks for Large-Scale Image Recognition
- Faster R-CNN: Towards Real-Time Object Detection with Region Proposal Networks
- YOLOv3: An Incremental Improvement
- Intriguing properties of neural networks
- An overview of gradient descent optimization algorithms
- Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networks
- ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Models
- Transferability in Machine Learning: from Phenomena to Black-Box Attacks using Adversarial Samples
- Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples
- Evolution Strategies as a Scalable Alternative to Reinforcement Learning
- Theoretically Principled Trade-off between Robustness and Accuracy
- Delving into Transferable Adversarial Examples and Black-box Attacks
- Synthesizing Robust Adversarial Examples
- High-Resolution Representations for Labeling Pixels and Regions
- Countering Adversarial Images using Input Transformations
- Black-box Adversarial Attacks with Limited Queries and Information
- Keeping the Bad Guys Out: Protecting and Vaccinating Deep Learning with JPEG Compression
- Simple Black-box Adversarial Attacks
- advertorch v0.1: An Adversarial Robustness Toolbox based on PyTorch
- Fast Feature Fool: A data independent approach to universal adversarial perturbations
- Query-Efficient Hard-label Black-box Attack:An Optimization-based Approach
- HopSkipJumpAttack: A Query-Efficient Decision-Based Attack
- Understanding and Mitigating the Tradeoff Between Robustness and Accuracy
- Robustness of classifiers to universal perturbations: a geometric perspective
- Universal Adversarial Perturbations: A Survey