Abstract:Image classifiers based on deep neural networks suffer from harassment caused by adversarial examples. Two defects exist in black-box iterative attacks that generate adversarial examples by incrementally adjusting the noise-adding direction for each step. On the one hand, existing iterative attacks add noises monotonically along the direction of gradient ascent, resulting in a lack of diversity and adaptability of the generated iterative trajectories. On the other hand, it is trivial to perform adversarial attack by adding excessive noises, but currently there is no refinement mechanism to squeeze redundant noises. In this work, we propose Curls & Whey black-box attack to fix the above two defects. During Curls iteration, by combining gradient ascent and descent, we `curl' up iterative trajectories to integrate more diversity and transferability into adversarial examples. Curls iteration also alleviates the diminishing marginal effect in existing iterative attacks. The Whey optimization further squeezes the `whey' of noises by exploiting the robustness of adversarial perturbation. Extensive experiments on Imagenet and Tiny-Imagenet demonstrate that our approach achieves impressive decrease on noise magnitude in l2 norm. Curls & Whey attack also shows promising transferability against ensemble models as well as adversarially trained models. In addition, we extend our attack to the targeted misclassification, effectively reducing the difficulty of targeted attacks under black-box condition.

What problem does this paper attempt to address?

The main problem that this paper attempts to solve is to improve the effectiveness and efficiency of adversarial attacks in a black - box environment, especially for image classifiers based on deep neural networks. Specifically, the paper points out two main flaws in current black - box iterative attack methods: 1. **Monotonicity problem**: Existing iterative attack methods usually monotonically increase noise in the direction of gradient ascent, which leads to a lack of diversity and adaptability in the generated iterative trajectories and makes it difficult to effectively cross the decision boundaries of the target model. 2. **Redundant noise problem**: Although adversarial attacks can be easily achieved by increasing the amount of noise, there is currently a lack of effective mechanisms to reduce redundant noise, thus affecting the effectiveness and efficiency of the attacks. To overcome these flaws, the paper proposes the **Curls & Whey** black - box attack method, which mainly consists of the following two parts: ### 1. Curls iteration Curls iteration makes the iterative trajectories more diverse and transferable by combining the gradient ascent and gradient descent directions. The specific steps are as follows: - Initial step: First, update the original image once in the direction of gradient descent. - Dynamic adjustment: Dynamically adjust the update direction according to the value of the loss function of the target model. If the loss value of the current adversarial sample on the target model is lower than that in the previous step, continue to update in the direction of gradient descent; otherwise, switch to the direction of gradient ascent. - Binary search: After each iteration, use binary search to find a smaller noise perturbation between the original image and the found adversarial sample. ### 2. Whey optimization Whey optimization further reduces redundant noise by taking advantage of the robustness of adversarial perturbations. The specific steps are as follows: - Group squeezing: Group the adversarial noise according to pixel values and gradually reduce the noise in each group. - Random squeezing: Randomly squeeze each pixel to gradually reduce redundant noise. ### Experimental results The paper conducted extensive experiments on the ImageNet and Tiny - ImageNet datasets to verify the effectiveness of the Curls & Whey method. The experimental results show that: - **Noise magnitude reduction**: The Curls & Whey method significantly reduces the noise magnitude of adversarial samples under the ℓ2 norm, reducing it by 20% - 30% compared to other methods, and even reaching 40% in some cases. - **Stronger transferability**: The generated adversarial samples have higher transferability and can effectively attack ensemble models and adversarially trained models. - **Targeted attacks**: When extended to the targeted attack scenario, the Curls & Whey method significantly reduces the difficulty of targeted attacks. ### Summary The Curls & Whey method proposed in the paper significantly improves the effectiveness and efficiency of adversarial attacks in a black - box environment by improving the diversity of iterative trajectories and reducing redundant noise. This method not only performs well in non - targeted attacks but also achieves significant improvements in targeted attacks.

Curls & Whey: Boosting Black-Box Adversarial Attacks

You See What I Want You to See: Exploring Targeted Black-Box Transferability Attack for Hash-based Image Retrieval Systems

An Adversarial Attack Via Feature Contributive Regions

Improving Query Efficiency of Black-box Adversarial Attack

An Effective Way to Boost Black-Box Adversarial Attack.

Towards Query Efficient Black-box Attacks

Patch-Wise Attack for Fooling Deep Neural Network

An efficient adversarial example generation algorithm based on an accelerated gradient iterative fast gradient

Procedural Noise Adversarial Examples for Black-Box Attacks on Deep Convolutional Networks

Object-Aware Transfer-Based Black-Box Adversarial Attack on Object Detector.

ABCAttack: A Gradient-Free Optimization Black-Box Attack for Fooling Deep Image Classifiers

Patch-wise++ Perturbation for Adversarial Targeted Attacks

Detecting Adversarial Examples Through Image Transformation

Boosting Black-box Adversarial Attack with a Better Convergence

NATTACK: Learning the Distributions of Adversarial Examples for an Improved Black-Box Attack on Deep Neural Networks

Data-free Defense of Black Box Models Against Adversarial Attacks

Adversarial scratches: Deployable attacks to CNN classifiers

An Evolutionary, Gradient-Free, Query-Efficient, Black-Box Algorithm for Generating Adversarial Instances in Deep Convolutional Neural Networks

Query-Efficient Black-box Adversarial Examples (superceded)

Query-efficient Black-box Adversarial Attack with Customized Iteration and Sampling

Efficient Query-based Black-box Attack against Cross-modal Hashing Retrieval