Improving Black-box Adversarial Attacks with a Transfer-based Prior

By Shuyu Cheng, Yinpeng Dong, Tianyu Pang, Hang Su, Jun Zhu. Neural Information Processing Systems, 2019

306 citations recorded by the source corpus.

We consider the black-box adversarial setting, where the adversary has to generate adversarial perturbations without access to the target models to compute gradients. Previous methods tried to approximate the gradient either by using a transfer gradient of a surrogate white-box model, or based on the query feedback. However, these methods often suffer from low attack success rates or poor query efficiency since it is non-trivial to estimate the gradient in a high-dimensional space with limited information. To address these problems, we propose a prior-guided random gradient-free (P-RGF) method to improve black-box adversarial attacks, which takes the advantage of a transfer-based prior and the query information simultaneously. The transfer-based prior given by the gradient of a surrogate model is appropriately integrated into our algorithm by an optimal coefficient derived by a theoretical analysis. Extensive experiments demonstrate that our method requires much fewer queries to attack black-box models with higher success rates compared with the alternative state-of-the-art methods.

Subfields: Artificial Intelligence, Hardware and Architecture

View Paper: https://www.semanticscholar.org/paper/edabab811aaf44b7b626efe5278a32bddd3bb77f

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Hardware and Architecture

Citations in the corpus

Benchmarking Adversarial Robustness on Image Classification (2020, methodology): “Prior-guided random gradient free method (P-RGF) [10] estimates the gradient more accurately with a transfer-based prior.”
Boosting Decision-Based Black-Box Adversarial Attacks with Random Sign Flip (2020, background): “Recently, several works [14, 20, 23, 31, 42] consider additional models to improve query eﬃciency.”
Black-box Prompt Learning for Pre-trained Language Models (2022, background): “One of the applications of black-box optimization is the score-based black-box adversarial attack (Ilyas et al., 2018, 2019a; Huang and Zhang, 2020; Andriushchenko et al., 2020; Cheng et al., 2019), where the models are also invisible to the attacker.”
Square Attack: a query-efficient black-box adversarial attack via random search (2019, background): “, when the attacker already has a substitute model similar to the target one [44,57,17,23,52] and thus can generate adversarial examples for the substitute model and then transfer them to the target model.”
Bag of Tricks for Adversarial Training (2020, background): “These include transfer-based attacks (Dong et al., 2018; 2019; Cheng et al., 2019b), quasi-gradient attacks (Chen et al., 2017a; Uesato et al., 2018; Ilyas et al., 2018), and decision-based attacks (Brendel et al., 2018; Cheng et al., 2019a).”
Advances in adversarial attacks and defenses in computer vision: A survey (2021, methodology): “[85] also introduced a prior-guided random gradient-free method.”
On Evaluating Adversarial Robustness of Large Vision-Language Models (2023, background): “Previous research demonstrates that transfer-based and query-based attacking strategies can work in tandem to improve black-box evasion effectiveness [17, 24].”