Black-Box Adversarial Attack with Transferable Model-based Embedding

By Zhichao Huang, Tong Zhang. 2019

135 citations recorded by the source corpus.

We present a new method for black-box adversarial attack. Unlike previous methods that combined transfer-based and scored-based methods by using the gradient or initialization of a surrogate white-box model, this new method tries to learn a low-dimensional embedding using a pretrained model, and then performs efficient search within the embedding space to attack an unknown target network. The method produces adversarial perturbations with high level semantic patterns that are easily transferable. We show that this approach can greatly improve the query efficiency of black-box adversarial attack across different target network architectures. We evaluate our approach on MNIST, ImageNet and Google Cloud Vision API, resulting in a significant reduction on the number of queries. We also attack adversarially defended networks on CIFAR10 and ImageNet, where our method not only reduces the number of queries, but also improves the attack success rate.

Subfields: Artificial Intelligence, Molecular Biology, Safety, Robustness & Interpretability

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

1. William L. Hamilton
2. Avishek Joey Bose
3. Simon Lacoste-Julien
4. Gauthier Gidel
5. Yoshua Bengio
6. Pascal Vincent
7. Mubarak Shah
8. Ajmal Saeed Mian

In Molecular Biology

1. Avishek Joey Bose
2. Simon Lacoste-Julien
3. Mubarak Shah
4. Pascal Vincent
5. Ajmal Saeed Mian
6. Hugo Berrard
7. Navid Kardan
8. Andre Cianflone

In Safety, Robustness & Interpretability

1. Avishek Joey Bose
2. William L. Hamilton
3. Andre Cianflone
4. Mubarak Shah
5. Navid Kardan
6. Ajmal Saeed Mian
7. Naveed Akhtar
8. Simon Lacoste-Julien

Citations in the corpus

• Adversarial Example Games (2020, methodology): “In addition to non-interactive blackbox adversaries, we compare against there exists multiple hybrid approach’s that combine crafting attacks on surrogate models which then serve as a good initialization point for queries to the target model [54, 58, 37].”
• Advances in adversarial attacks and defenses in computer vision: A survey (2021, methodology): “A TRansferable EMbedding based Black-box Attack (TREMBA) [86] trains an encoder-decoder model to learn a low-dimensional embedding space, where an adversarial example is searched for a given target model in a querybased setup.”