Simple Black-Box Adversarial Attacks on Deep Neural Networks

By Nina Narodytska, Shiva Prasad Kasiviswanathan. 2017

321 citations recorded by the source corpus.

Subfields: Artificial Intelligence, Computer Vision and Pattern Recognition, Safety, Robustness & Interpretability

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Vision and Pattern Recognition

In Safety, Robustness & Interpretability

Citations in the corpus

One Pixel Attack for Fooling Deep Neural Networks (2017, methodology): “In particular, to the best of our knowledge, the only work before ours that ever mentioned using one-pixel modification to change class labels is carried out by Narodytska and Kasiviswanathan [15].”
Adversarial Attacks and Defences: A Survey (2018, background): “The defense is not robust for black-box attacks [56, 60] where an adversary generates malicious examples on a locally trained substitute model.”
Disentangling Adversarial Robustness and Generalization (2018, background): “), to black-box attacks [17, 10, 96, 38, 80, 67], with limited access to model queries.”
Square Attack: a query-efficient black-box adversarial attack via random search (2019, background): “Black-box attacks have recently become more popular [41,9,51] as their attack strategies are quite different from the ones employed for adversarial training, where often PGD-type attacks [37] are used.”
Adversarial Generative Nets: Neural Network Attacks on State-of-the-Art Face Recognition (2018, methodology): “local substitute-models which they later transfer to the black-box. We note that gradient approximation techniques can also be used to generalize our proposed method to blackbox settings (e.g., [17], [43]). B. Generative Adversarial Networks Our attacks build on Generative Adversarial Networks (GANs”
A Survey on Security Threats and Defensive Techniques of Machine Learning: A Data Driven View (2018, background): “However, recent works from late 2013 have demonstrated that DNN is also vulnerable to various adversarial attacks [29], [30].”
Towards Reverse-Engineering Black-Box Neural Networks (2017, background): “(1) Approximate gradients by numerical gradients (Narodytska & Kasiviswanathan, 2017; Chen et al., 2017).”
On Completeness-aware Concept-Based Explanations in Deep Neural Networks (2019, background): “In fact, DNNs are shown to be very sensitive to small perturbations in the input [47] – they can yield very different outputs although the difference in the input is small (and often perceptually hard to recognize to humans).”
On internal language representations in deep learning: an analysis of machine translation and speech recognition (2018, background): “Adversarial examples can be generated using access to model parameters (white-box attacks) or without such access (black-box attacks) [217, 255, 267, 269].”
Relating Adversarially Robust Generalization to Flat Minima (2021, background): “Adversarial Examples and Defenses: Adversarial examples, first reported in [122], can be generated using a wide-range of white-box attacks [122, 40, 67, 94, 87, 80, 14, 32, 78], with full access to the network, or black-box attacks [18, 11, 120, 54, 107, 88], with limited access to model queries.”
Prior Convictions: Black-Box Adversarial Attacks with Bandits and Priors (2018, methodology): “Soon after, Narodytska et. al [NK17] described the ﬁrst black-box attack on deep neural networks; the algorithm uses a greedy search algorithm that selectively changes individual pixel values.”
Query-efficient Meta Attack to Deep Neural Networks (2019, methodology): “[20] proposes a novel local-search based technique to construct numerical approximation to the network gradient, which is then carefully used to construct a small set of pixels in an image to perturb.”
Accurate and Robust Neural Networks for Security Related Applications Exampled by Face Morphing Attacks (2018, background): “Other black box attacks that also try to model the network’s behavior by questioning the network were published by Narodytska and Kasiviswanathan [13] and Dang et al. [14].”
Understanding the One Pixel Attack: Propagation Maps and Locality Analysis (2019, unknown): “To cite some (Narodytska & Kasiviswanathan, 2017),(Papernot et al., 2017),(Dang et al., 2017).”
A Survey of Black-Box Adversarial Attacks on Computer Vision Models (2019, methodology): “In [9], the authors have used this strategy over the image space to construct an approximated network gradient.”
A survey on adversarial attacks and defences (2021, background): “The defense is not robust for black ‐ box attacks [35,72] where an adversary generates malicious examples on a locally trained substitute model.”