Black-box adversarial attacks using Evolution Strategies

Abstract

In the last decade, deep neural networks have proven to be very powerful in computer vision tasks, starting a revolution in the computer vision and machine learning fields. However, deep neural networks, usually, are not robust to perturbations of the input data. In fact, several studies showed that slightly changing the content of the images can cause a dramatic decrease in the accuracy of the attacked neural network. Several methods able to generate adversarial samples make use of gradients, which usually are not available to an attacker in real-world scenarios. As opposed to this class of attacks, another class of adversarial attacks, called black-box adversarial attacks, emerged, which does not make use of information on the gradients, being more suitable for real-world attack scenarios. In this work, we compare three well-known evolution strategies on the generation of black-box adversarial attacks for image classification tasks. While our results show that the attacked neural networks can be, in most cases, easily fooled by all the algorithms under comparison, they also show that some black-box optimization algorithms may be better in "harder" setups, both in terms of attack success rate and efficiency (i.e., number of queries).

arXiv commentTo be published in the proceedings of ACM Genetic and Evolutionary Computation Conference (GECCO) Companion 2021

References in corpus (17)

• Very Deep Convolutional Networks for Large-Scale Image Recognition
• Explaining and Harnessing Adversarial Examples
• Intriguing properties of neural networks
• ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Models
• One pixel attack for fooling deep neural networks
• Deep Neuroevolution: Genetic Algorithms Are a Competitive Alternative for Training Deep Neural Networks for Reinforcement Learning
• Black-box Adversarial Attacks with Limited Queries and Information
• Adversarial Transformation Networks: Learning to Generate Adversarial Examples
• Simple Black-Box Adversarial Perturbations for Deep Networks
• Simple Black-box Adversarial Attacks
• Decision-Based Adversarial Attacks: Reliable Attacks Against Black-Box Machine Learning Models
• A Survey On Universal Adversarial Attack
• POBA-GA: Perturbation Optimized Black-Box Adversarial Attacks via Genetic Algorithm
• NATTACK: Learning the Distributions of Adversarial Examples for an Improved Black-Box Attack on Deep Neural Networks
• Adversarial T-shirt! Evading Person Detectors in A Physical World
• Sign-OPT: A Query-Efficient Hard-label Adversarial Attack
• Online Selection of CMA-ES Variants

Cited by in corpus (2)

• When and How to Fool Explainable Models (and Humans) with Adversarial Examples
• EGAN: Evolutional GAN for Ransomware Evasion