Abstract:Recent studies have highlighted that deep neural networks (DNNs) are vulnerable to adversarial attacks, even in a black-box scenario. However, most of the existing black-box attack algorithms need to make a huge amount of queries to perform attacks, which is not practical in the real world. We note one of the main reasons for the massive queries is that the adversarial example is required to be visually similar to the original image, but in many cases, how adversarial examples look like does not matter much. It inspires us to introduce a new attack called input-free attack, under which an adversary can choose an arbitrary image to start with and is allowed to add perceptible perturbations on it. Following this approach, we propose two techniques to significantly reduce the query complexity. First, we initialize an adversarial example with a gray color image on which every pixel has roughly the same importance for the target model. Then we shrink the dimension of the attack space by perturbing a small region and tiling it to cover the input image. To make our algorithm more effective, we stabilize a projected gradient ascent algorithm with momentum, and also propose a heuristic approach for region size selection. Recent studies have highlighted that deep neural networks (DNNs) are vulnerable to adversarial attacks, even in a black-box scenario. However, most of the existing black-box attack algorithms need to make a huge amount of queries to perform attacks, which is not practical in the real world. We note one of the main reasons for the massive queries is that the adversarial example is required to be visually similar to the original image, but in many cases, how adversarial examples look like does not matter much. It inspires us to introduce a new attack called input-free attack, under which an adversary can choose an arbitrary image to start with and is allowed to add perceptible perturbations on it. Following this approach, we propose two techniques to significantly reduce the query complexity. First, we initialize an adversarial example with a gray color image on which every pixel has roughly the same importance for the target model. Then we shrink the dimension of the attack space by perturbing a small region and tiling it to cover the input image. To make our algorithm more effective, we stabilize a projected gradient ascent algorithm with momentum, and also propose a heuristic approach for region size selection. Through extensive experiments, we show that with only 1,701 queries on average, we can perturb a gray image to any target class of ImageNet with a 100% success rate on InceptionV3. Besides, our algorithm has successfully defeated two real-world systems, the Clarifai food detection API and the Baidu Animal Identification API.

Untargeted Adversarial Attack Via Expanding the Semantic Gap

SemanticAdv: Generating Adversarial Examples via Attribute-conditional Image Editing

Improving Query Efficiency of Black-box Adversarial Attack

Attention-SA: Exploiting Model-approximated Data Semantics for Adversarial Attack

A Universal Defense Strategy Against Adversarial Attacks Based on Attention-Guided

Adversarial Examples for Semantic Segmentation and Object Detection

Natural Language Induced Adversarial Images

CSFAdv: Critical Semantic Fusion Guided Least-Effort Adversarial Example Attacks

Explanation-Guided Adversarial Example Attacks

A Universal Targeted Attack Method against Image Classification

Demiguise Attack: Crafting Invisible Semantic Adversarial Perturbations with Perceptual Similarity

Towards Query Efficient Black-box Attacks

Targeted Adversarial Attack against Deep Cross-modal Hashing Retrieval

Mutual-modality Adversarial Attack with Semantic Perturbation

Image Adversarial Example Generation Method Based on Adaptive Parameter Adjustable Differential Evolution

Minimizing Adversarial Training Samples for Robust Image Classifiers: Analysis and Adversarial Example Generator Design

ADSAttack: an Adversarial Attack Algorithm Via Searching Adversarial Distribution in Latent Space

Category-wise Attack: Transferable Adversarial Examples for Anchor Free Object Detection

Object-Attentional Untargeted Adversarial Attack

A Multi-objective Examples Generation Approach to Fool the Deep Neural Networks in the Black-Box Scenario

On-manifold Adversarial Attack Based on Latent Space Substitute Model