AutoZOOM: Autoencoder-based Zeroth Order Optimization Method for Attacking Black-box Neural Networks

By Chun-Chen Tu, Pai-Shun Ting, Pin-Yu Chen, Sijia Liu, Huan Zhang, Jinfeng Yi, Cho-Jui Hsieh, Shin-Ming Cheng. 2018

452 citations recorded by the source corpus.

Recent studies have shown that adversarial examples in state-of-the-art image classifiers trained by deep neural networks (DNN) can be easily generated when the target model is transparent to an attacker, known as the white-box setting. However, when attacking a deployed machine learning service, one can only acquire the input-output correspondences of the target model; this is the so-called black-box attack setting. The major drawback of existing black-box attacks is the need for excessive model queries, which may give a false sense of model robustness due to inefficient query designs. To bridge this gap, we propose a generic framework for query-efficient blackbox attacks. Our framework, AutoZOOM, which is short for Autoencoder-based Zeroth Order Optimization Method, has two novel building blocks towards efficient black-box attacks: (i) an adaptive random gradient estimation strategy to balance query counts and distortion, and (ii) an autoencoder that is either trained offline with unlabeled data or a bilinear resizing operation for attack acceleration. Experimental results suggest that, by applying AutoZOOM to a state-of-the-art black-box attack (ZOO), a significant reduction in model queries can be achieved without sacrificing the attack success rate and the visual quality of the resulting adversarial examples. In particular, when compared to the standard ZOO method, AutoZOOM can consistently reduce the mean query counts in finding successful adversarial examples (or reaching the same distortion level) by at least 93% on MNIST, CIFAR-10 and ImageNet datasets, leading to novel insights on adversarial robustness.

Subfields: Artificial Intelligence, Health Informatics, Radiology, Nuclear Medicine and Imaging, Safety, Robustness & Interpretability

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Health Informatics

In Radiology, Nuclear Medicine and Imaging

In Safety, Robustness & Interpretability

Citations in the corpus

Adversarial Example Games (2020, methodology): “Similar in spirit to our approach many attacks strategies beneﬁt from employing a latent space to craft attacks [73, 65, 9].”
Black-Box Adversarial Attack with Transferable Model-based Embedding (2019, methodology): “AutoZOOM tried to improve the query efﬁciency by reducing the sampling space with a bilinear transformation or an autoencoder (Tu et al., 2018).”
Universal Decision-Based Black-Box Perturbations: Breaking Security-Through-Obscurity Defenses (2018, background): “Interestingly, some recent works have shown that even in such a “black-box" setting, it is possible to fool the ML classiﬁer with a high probability Chen et al. [2017b], Papernot et al. [2017], Bhagoji et al. [2017], Liu et al. [2018], Tu et al. [2018].”
Simple Black-box Adversarial Attacks (2019, background): “To date, the average number of queries performed by the best known black-box attacks remains high despite a large amount of recent work in this area (Chen et al., 2017; Bren-del et al., 2017; Cheng et al., 2018; Guo et al., 2018; Tu et al., 2018; Ilyas et al., 2018a).”
Query-efficient Meta Attack to Deep Neural Networks (2019, methodology): “…evaluate our method on MNIST, CIFAR10 and tiny-ImageNet datasets by comparing it with state-of-the-art black-box attack methods including Zoo (Chen et al., 2017), Decision-Boundary (Brendel et al., 2018), AutoZoom (Tu et al., 2019), Opt-attack (Cheng et al., 2019) and Bandits (Ilyas et al., 2018b).”
Query-Efficient Hard-label Black-box Attack: An Optimization-based Approach (2018, background): “[16] further improves the query complexity of [10] by introducing two novel building blocks: (i) an adaptive random gradient estimation algorithm that balances query counts and distortion, and (ii) a well-trained autoencoder that achieves attack acceleration.”
Improving Black-box Adversarial Attacks with a Transfer-based Prior (2019, methodology): “The previous work [35] also uses the expected squared `2 distance E‖∇f(x)− ĝ‖(2)2 as the loss function, which is similar to ours.”
A Survey of Black-Box Adversarial Attacks on Computer Vision Models (2019, methodology): “As shown in Table 7, again the models proposed in [16, 19, 24] achieve a high attack success rate percentage while using less than 1000 queries on the targeted model.”
Square Attack: a query-efficient black-box adversarial attack via random search (2019, methodology): “While we focus on norm-bounded perturbations, some works aim at fooling perturbations with minimal l p -norm (e.g. [49]) which often require more queries to be found.”
A Primer on Zeroth-Order Optimization in Signal Processing and Machine Learning: Principals, Recent Advances, and Applications (2020, background): “This gives rise to the problem of blackbox adversarial attacks [23], [24], [66]–[69], where the only mode of interaction of the adversary with the system is via submission of inputs and receiving the corresponding predicted outputs.”