Energy Attack: On Transferring Adversarial Examples
arXiv:2109.04300
Abstract
In this work we propose Energy Attack, a transfer-based black-box -adversarial attack. The attack is parameter-free and does not require gradient approximation. In particular, we first obtain white-box adversarial perturbations of a surrogate model and divide these perturbations into small patches. Then we extract the unit component vectors and eigenvalues of these patches with principal component analysis (PCA). Base on the eigenvalues, we can model the energy distribution of adversarial perturbations. We then perform black-box attacks by sampling from the perturbation patches according to their energy distribution, and tiling the sampled patches to form a full-size adversarial perturbation. This can be done without the available access to victim models. Extensive experiments well demonstrate that the proposed Energy Attack achieves state-of-the-art performance in black-box attacks on various models and several datasets. Moreover, the extracted distribution is able to transfer among different model architectures and different datasets, and is therefore intrinsic to vision architectures.
arXiv commentUnder Review for AAAI-22
References in corpus (11)
- Very Deep Convolutional Networks for Large-Scale Image Recognition
- An Image is Worth 16x16 Words: Transformers for Image Recognition at Scale
- ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Models
- On Evaluating Adversarial Robustness
- Adversarial Examples that Fool both Computer Vision and Time-Limited Humans
- Simple Black-box Adversarial Attacks
- Do Adversarially Robust ImageNet Models Transfer Better?
- Adversarial Robustness as a Prior for Learned Representations
- Are Perceptually-Aligned Gradients a General Property of Robust Classifiers?
- What Do Neural Networks Learn When Trained With Random Labels?
- There are No Bit Parts for Sign Bits in Black-Box Attacks