Abstract:Black-box adversarial attacks have demonstrated strong potential to compromise machine learning models by iteratively querying the target model or leveraging transferability from a local surrogate model. Recently, such attacks can be effectively mitigated by state-of-the-art (SOTA) defenses, e.g., detection via the pattern of sequential queries, or injecting noise into the model. To our best knowledge, we take the first step to study a new paradigm of black-box attacks with provable guarantees -- certifiable black-box attacks that can guarantee the attack success probability (ASP) of adversarial examples before querying over the target model. This new black-box attack unveils significant vulnerabilities of machine learning models, compared to traditional empirical black-box attacks, e.g., breaking strong SOTA defenses with provable confidence, constructing a space of (infinite) adversarial examples with high ASP, and the ASP of the generated adversarial examples is theoretically guaranteed without verification/queries over the target model. Specifically, we establish a novel theoretical foundation for ensuring the ASP of the black-box attack with randomized adversarial examples (AEs). Then, we propose several novel techniques to craft the randomized AEs while reducing the perturbation size for better imperceptibility. Finally, we have comprehensively evaluated the certifiable black-box attacks on the CIFAR10/100, ImageNet, and LibriSpeech datasets, while benchmarking with 16 SOTA black-box attacks, against various SOTA defenses in the domains of computer vision and speech recognition. Both theoretical and experimental results have validated the significance of the proposed attack. The code and all the benchmarks are available at \url{<a class="link-external link-https" href="https://github.com/datasec-lab/CertifiedAttack" rel="external noopener nofollow">this https URL</a>}.

Boosting Black-Box Attack to Deep Neural Networks With Conditional Diffusion Models

D-DAE: Defense-Penetrating Model Extraction Attacks.

B3: Backdoor Attacks Against Black-box Machine Learning Models

Towards Efficient Data Free Blackbox Adversarial Attack

Boosting Black-Box Attack with Partially Transferred Conditional Adversarial Distribution

Improving Query Efficiency of Black-box Adversarial Attack

NATTACK: Learning the Distributions of Adversarial Examples for an Improved Black-Box Attack on Deep Neural Networks

Towards Lightweight Black-Box Attacks against Deep Neural Networks

Enhancing the Adversarial Transferability with Channel Decomposition

Improving Query Efficiency of Black-Box Attacks via the Preference of Deep Learning Models

DTA: distribution transform-based attack for query-limited scenario

DCVAE-adv: A Universal Adversarial Example Generation Method for White and Black Box Attacks

Adaptive Multi-scale Degradation-Based Attack for Boosting the Adversarial Transferability

Certifiable Black-Box Attacks with Randomized Adversarial Examples: Breaking Defenses with Provable Confidence

Data-free Defense of Black Box Models Against Adversarial Attacks

Generalizable Black-Box Adversarial Attack With Meta Learning

Query Efficient Black-Box Adversarial Attack on Deep Neural Networks

Enhanced Attacks on Defensively Distilled Deep Neural Networks.

Query-Efficient Generation of Adversarial Examples for Defensive DNNs via Multi-Objective Optimization

Efficient Black-Box Adversarial Attack on Deep Clustering Models

Simulating Unknown Target Models for Query-Efficient Black-Box Attacks.