QAIR: Practical Query-efficient Black-Box Attacks for Image Retrieval
arXiv:2103.02927
Abstract
We study the query-based attack against image retrieval to evaluate its robustness against adversarial examples under the black-box setting, where the adversary only has query access to the top-k ranked unlabeled images from the database. Compared with query attacks in image classification, which produce adversaries according to the returned labels or confidence score, the challenge becomes even more prominent due to the difficulty in quantifying the attack effectiveness on the partial retrieved list. In this paper, we make the first attempt in Query-based Attack against Image Retrieval (QAIR), to completely subvert the top-k retrieval results. Specifically, a new relevance-based loss is designed to quantify the attack effects by measuring the set similarity on the top-k retrieval results before and after attacks and guide the gradient optimization. To further boost the attack efficiency, a recursive model stealing method is proposed to acquire transferable priors on the target model and generate the prior-guided gradients. Comprehensive experiments show that the proposed attack achieves a high attack success rate with few queries against the image retrieval systems under the black-box setting. The attack evaluations on the real-world visual search engine show that it successfully deceives a commercial system such as Bing Visual Search with 98% attack success rate by only 33 queries on average.
References in corpus (12)
- ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Models
- Towards Deep Learning Models Resistant to Adversarial Attacks
- Countering Adversarial Images using Input Transformations
- Guessing Smart: Biased Sampling for Efficient Black-Box Adversarial Attacks
- Query-Efficient Hard-label Black-box Attack:An Optimization-based Approach
- Learning Black-Box Attackers with Transferable Priors and Query Feedback
- Sign-OPT: A Query-Efficient Hard-label Adversarial Attack
- Unsupervised Adversarial Attacks on Deep Feature-based Retrieval with GAN
- DaST: Data-free Substitute Training for Adversarial Attacks
- Adversarial Metric Attack and Defense for Person Re-identification
- Query Attack via Opposite-Direction Feature:Towards Robust Image Retrieval
- Adversarial Attack on Deep Product Quantization Network for Image Retrieval