Abstract:Black-box adversarial attacks have demonstrated strong potential to compromise machine learning models by iteratively querying the target model or leveraging transferability from a local surrogate model. Recently, such attacks can be effectively mitigated by state-of-the-art (SOTA) defenses, e.g., detection via the pattern of sequential queries, or injecting noise into the model. To our best knowledge, we take the first step to study a new paradigm of black-box attacks with provable guarantees -- certifiable black-box attacks that can guarantee the attack success probability (ASP) of adversarial examples before querying over the target model. This new black-box attack unveils significant vulnerabilities of machine learning models, compared to traditional empirical black-box attacks, e.g., breaking strong SOTA defenses with provable confidence, constructing a space of (infinite) adversarial examples with high ASP, and the ASP of the generated adversarial examples is theoretically guaranteed without verification/queries over the target model. Specifically, we establish a novel theoretical foundation for ensuring the ASP of the black-box attack with randomized adversarial examples (AEs). Then, we propose several novel techniques to craft the randomized AEs while reducing the perturbation size for better imperceptibility. Finally, we have comprehensively evaluated the certifiable black-box attacks on the CIFAR10/100, ImageNet, and LibriSpeech datasets, while benchmarking with 16 SOTA black-box attacks, against various SOTA defenses in the domains of computer vision and speech recognition. Both theoretical and experimental results have validated the significance of the proposed attack. The code and all the benchmarks are available at \url{<a class="link-external link-https" href="https://github.com/datasec-lab/CertifiedAttack" rel="external noopener nofollow">this https URL</a>}.

Et Tu Certifications: Robustness Certificates Yield Better Adversarial Examples

CC-CERT: A Probabilistic Approach to Certify General Robustness of Neural Networks

Is Certifying $\ell_p$ Robustness Still Worthwhile?

On Using Certified Training towards Empirical Robustness

Towards Certifying the Asymmetric Robustness for Neural Networks: Quantification and Applications

Towards Bridging the gap between Empirical and Certified Robustness against Adversarial Examples

It's Simplex! Disaggregating Measures to Improve Certified Robustness

Limitations of Piecewise Linearity for Efficient Robustness Certification

FullCert: Deterministic End-to-End Certification for Training and Inference of Neural Networks

Certified Robustness to Programmable Transformations in LSTMs

How robust accuracy suffers from certified training with convex relaxations

Towards Certified Probabilistic Robustness with High Accuracy

Certifiable Black-Box Attacks with Randomized Adversarial Examples: Breaking Defenses with Provable Confidence

Certifiable Robustness to Adversarial State Uncertainty in Deep Reinforcement Learning

Towards Certification of Uncertainty Calibration under Adversarial Attacks

A Recipe for Improved Certifiable Robustness

Certifiers Make Neural Networks Vulnerable to Availability Attacks

Certified Adversarial Robustness Within Multiple Perturbation Bounds

Raising the Bar for Certified Adversarial Robustness with Diffusion Models

Adversarial Robustness Certification for Bayesian Neural Networks

Semidefinite relaxations for certifying robustness to adversarial examples