Abstract:Adversarial attack techniques in deep learning have been studied extensively due to its stealthiness to human eyes and potentially dangerous consequences when applied to real-life applications. However, current attack methods in black-box settings mainly employ a large number of queries for crafting their adversarial examples, hence making them very likely to be detected and responded by the target system (e.g., artificial intelligence (AI) service provider) due to its high traffic volume. A recent proposal able to address the large query problem utilizes a gradient-free approach based on Particle Swarm Optimization (PSO) algorithm. Unfortunately, this original approach tends to have a low attack success rate, possibly due to the model’s difficulty of escaping local optima. This obstacle can be overcome by employing a multi-group approach for PSO algorithm, by which the PSO particles can be redistributed, preventing them from being trapped in local optima. In this paper, we present a black-box adversarial attack which can significantly increase the success rate of PSO-based attack while maintaining a low number of query by launching the attack in a distributed manner. Attacks are executed from multiple nodes, disseminating queries among the nodes, hence reducing the possibility of being recognized by the target system while also increasing scalability. Furthermore, we utilize Multi-Group PSO with Random Redistribution (MGRR-PSO) for perturbation generation, performing better than the original approach against local optima, thus achieving a higher success rate. Additionally, we propose to efficiently remove excessive perturbation (i.e, perturbation pruning) by utilizing again the MGRR-PSO rather than a standard iterative method as used in the original approach. We perform five different experiments: comparing our attack’s performance with existing algorithms, testing in high-dimensional space in ImageNet dataset, examining our hyperparameters (i.e., particle size, number of clients, search boundary), and testing on real digital attack to Google Cloud Vision. Our attack proves to obtain a 100% success rate on MNIST and CIFAR-10 datasets and able to successfully fool Google Cloud Vision as a proof of the real digital attack by maintaining a lower query and wide applicability.

An Adversarial Attack Based On Multi-Objective Optimization In The Black-Box Scenario: Moea-Apga Ii

A Multi-objective Examples Generation Approach to Fool the Deep Neural Networks in the Black-Box Scenario

Towards Efficient Data Free Blackbox Adversarial Attack

An efficient general black-box adversarial attack approach based on multi-objective optimization for high dimensional images

Adversarial Example Generation using Evolutionary Multi-objective Optimization

Query-Efficient Generation of Adversarial Examples for Defensive DNNs via Multi-Objective Optimization

Improving Query Efficiency of Black-box Adversarial Attack

Explanation-Guided Adversarial Example Attacks

Minimum Adversarial Examples

Generating Adversarial Examples with Task Oriented Multi-Objective Optimization

A Distributed Black-Box Adversarial Attack Based on Multi-Group Particle Swarm Optimization

Evolutionary Multi-objective Optimization for Contextual Adversarial Example Generation

Imperceptible and Sparse Adversarial Attacks Via a Dual-Population-Based Constrained Evolutionary Algorithm

They Might NOT Be Giants Crafting Black-Box Adversarial Examples Using Particle Swarm Optimization

Genetic Algorithm with Multiple Fitness Functions for Generating Adversarial Examples

GenAttack: Practical Black-box Attacks with Gradient-Free Optimization

They Might NOT Be Giants: Crafting Black-Box Adversarial Examples with Fewer Queries Using Particle Swarm Optimization.

Model-Agnostic Meta-Attack: Towards Reliable Evaluation of Adversarial Robustness

GCSA: A New Adversarial Example-Generating Scheme Towards Black-Box Adversarial Attacks

Efficient Query-based Black-box Attack against Cross-modal Hashing Retrieval

Black-Box Boundary Attack Based on Gradient Optimization