Abstract:Recent studies have highlighted that deep neural networks (DNNs) are vulnerable to adversarial attacks, even in a black-box scenario. However, most of the existing black-box attack algorithms need to make a huge amount of queries to perform attacks, which is not practical in the real world. We note one of the main reasons for the massive queries is that the adversarial example is required to be visually similar to the original image, but in many cases, how adversarial examples look like does not matter much. It inspires us to introduce a new attack called input-free attack, under which an adversary can choose an arbitrary image to start with and is allowed to add perceptible perturbations on it. Following this approach, we propose two techniques to significantly reduce the query complexity. First, we initialize an adversarial example with a gray color image on which every pixel has roughly the same importance for the target model. Then we shrink the dimension of the attack space by perturbing a small region and tiling it to cover the input image. To make our algorithm more effective, we stabilize a projected gradient ascent algorithm with momentum, and also propose a heuristic approach for region size selection. Recent studies have highlighted that deep neural networks (DNNs) are vulnerable to adversarial attacks, even in a black-box scenario. However, most of the existing black-box attack algorithms need to make a huge amount of queries to perform attacks, which is not practical in the real world. We note one of the main reasons for the massive queries is that the adversarial example is required to be visually similar to the original image, but in many cases, how adversarial examples look like does not matter much. It inspires us to introduce a new attack called input-free attack, under which an adversary can choose an arbitrary image to start with and is allowed to add perceptible perturbations on it. Following this approach, we propose two techniques to significantly reduce the query complexity. First, we initialize an adversarial example with a gray color image on which every pixel has roughly the same importance for the target model. Then we shrink the dimension of the attack space by perturbing a small region and tiling it to cover the input image. To make our algorithm more effective, we stabilize a projected gradient ascent algorithm with momentum, and also propose a heuristic approach for region size selection. Through extensive experiments, we show that with only 1,701 queries on average, we can perturb a gray image to any target class of ImageNet with a 100% success rate on InceptionV3. Besides, our algorithm has successfully defeated two real-world systems, the Clarifai food detection API and the Baidu Animal Identification API.

Query-Free Embedding Attack Against Deep Learning

Towards Query Efficient Black-box Attacks

Stealthy and Robust Glitch Injection Attack on Deep Learning Accelerator for Target with Variational Viewpoint.

Wolf in Sheep's Clothing - The Downscaling Attack Against Deep Learning Applications

Improving Query Efficiency of Black-box Adversarial Attack

Detecting Adversarial Examples Through Image Transformation

Unveiling Vulnerabilities in Interpretable Deep Learning Systems with Query-Efficient Black-box Attacks

Robust and Verifiable Information Embedding Attacks to Deep Neural Networks via Error-Correcting Codes

Adversarial Attack on Deep Product Quantization Network for Image Retrieval

Exploiting vulnerabilities of deep neural networks for privacy protection

LFAA: Crafting Transferable Targeted Adversarial Examples with Low-Frequency Perturbations

Hiding Images into Images with Real-world Robustness

Graphfool: Targeted Label Adversarial Attack on Graph Embedding

Mitigating Adversarial Attacks for Deep Neural Networks by Input Deformation and Augmentation

An effective deep learning adversarial defense method based on spatial structural constraints in embedding space

Adversarial example defense based on image reconstruction

When Deep Fool Meets Deep Prior: Adversarial Attack on Super-Resolution Network.

DeepDefense: Training Deep Neural Networks with Improved Robustness.

Adversarial Examples Generation for Deep Product Quantization Networks on Image Retrieval

ABCAttack: A Gradient-Free Optimization Black-Box Attack for Fooling Deep Image Classifiers

Query Attack by Multi-Identity Surrogates