NATTACK: Learning the Distributions of Adversarial Examples for an Improved Black-Box Attack on Deep Neural Networks

By Yandong Li, Lijun Li, Liqiang Wang, Tong Zhang, Boqing Gong. 2019

273 citations recorded by the source corpus.

Powerful adversarial attack methods are vital for understanding how to construct robust deep neural networks (DNNs) and for thoroughly testing defense techniques. In this paper, we propose a black-box adversarial attack algorithm that can defeat both vanilla DNNs and those generated by various defense techniques developed recently. Instead of searching for an "optimal" adversarial example for a benign input to a targeted DNN, our algorithm finds a probability density distribution over a small region centered around the input, such that a sample drawn from this distribution is likely an adversarial example, without the need of accessing the DNN's internal layers or weights. Our approach is universal as it can successfully attack different neural networks by a single algorithm. It is also strong; according to the testing against 2 vanilla DNNs and 13 defended ones, it outperforms state-of-the-art black-box or white-box attack methods for most test cases. Additionally, our results reveal that adversarial training remains one of the best defense techniques, and the adversarial examples are not as transferable across defended DNNs as them across vanilla DNNs.

Subfields: Artificial Intelligence, Safety, Robustness & Interpretability, Signal Processing

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Safety, Robustness & Interpretability

In Signal Processing

Citations in the corpus

Adversarial Example Games (2020, methodology): “Additionally, we compare with two parametric blackbox query approaches that both utilize a latent space in AutoZoom [65] and N Attack [48].”
Boosting Decision-Based Black-Box Adversarial Attacks with Random Sign Flip (2020, background): “Recently, several works [14, 20, 23, 31, 42] consider additional models to improve query eﬃciency.”
Black-Box Adversarial Attack with Transferable Model-based Embedding (2019, methodology): “However, it is observed that more effective attacks can be obtained by removing the sign function (Li et al., 2019b).”
Generalizable Adversarial Attacks with Latent Variable Perturbation Modelling (2019, background): “[14] introducedNAttack to produce distributions of adversarial examples for blackbox image-based attacks.”
Square Attack: a query-efficient black-box adversarial attack via random search (2019, unknown): “Finally, [35] use extra information on the target data distribution to train a model that predicts adversarial images that are then refined by gradient estimation attacks.”
Benchmarking Adversarial Robustness on Image Classification (2020, background): “constrained l∞, l2 NATTACK [30] score un.”
Generalizable Adversarial Attacks Using Generative Models (2019, result): “Concurrent to our work, Li et al. [19] introduced N Attack to produce distributions of adversarial examples for blackbox image-based attacks.”
When Machine Learning Meets Privacy (2020, methodology): “, the latest black-box adversarial generation methods such as ZOO [19],N attack [79] and AdvFlow [28], could be potentially used for privacy protection.”
Adversarially Robust Generalization Just Requires More Unlabeled Data (2019, methodology): “step PGD (referred to as PGD-7), 40-step PGD (referred to as PGD-40), BPDA [1] and NAttack [20].”
A Survey of Black-Box Adversarial Attacks on Computer Vision Models (2019, background): “• N-Attack: A black box adversarial attack has been proposed in [21], which tries to learn the probability density over a small region (lp ball) centered around the input such that a sample drawn from the density is likely an adversarial image.”