Delving into Data: Effectively Substitute Training for Black-box Attack
arXiv:2104.12378
Abstract
Deep models have shown their vulnerability when processing adversarial samples. As for the black-box attack, without access to the architecture and weights of the attacked model, training a substitute model for adversarial attacks has attracted wide attention. Previous substitute training approaches focus on stealing the knowledge of the target model based on real training data or synthetic data, without exploring what kind of data can further improve the transferability between the substitute and target models. In this paper, we propose a novel perspective substitute training that focuses on designing the distribution of data used in the knowledge stealing process. More specifically, a diverse data generation module is proposed to synthesize large-scale data with wide distribution. And adversarial substitute training strategy is introduced to focus on the data distributed near the decision boundary. The combination of these two modules can further boost the consistency of the substitute model and target model, which greatly improves the effectiveness of adversarial attack. Extensive experiments demonstrate the efficacy of our method against state-of-the-art competitors under non-target and target attack settings. Detailed visualization and analysis are also provided to help understand the advantage of our method.
arXiv comment10 pages, 6 figures, 6 tables, 1 algorithm, To appear in CVPR 2021 as a poster paper
References in corpus (9)
- Very Deep Convolutional Networks for Large-Scale Image Recognition
- Distributed Representations of Words and Phrases and their Compositionality
- ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Models
- Black-box Adversarial Attacks with Limited Queries and Information
- Prior Convictions: Black-Box Adversarial Attacks with Bandits and Priors
- Simple Black-box Adversarial Attacks
- Hermes Attack: Steal DNN Models with Lossless Inference Accuracy
- Towards Imperceptible and Robust Adversarial Example Attacks against Neural Networks
- Curls & Whey: Boosting Black-Box Adversarial Attacks