Abstract:Adversarial attack techniques in deep learning have been studied extensively due to its stealthiness to human eyes and potentially dangerous consequences when applied to real-life applications. However, current attack methods in black-box settings mainly employ a large number of queries for crafting their adversarial examples, hence making them very likely to be detected and responded by the target system (e.g., artificial intelligence (AI) service provider) due to its high traffic volume. A recent proposal able to address the large query problem utilizes a gradient-free approach based on Particle Swarm Optimization (PSO) algorithm. Unfortunately, this original approach tends to have a low attack success rate, possibly due to the model’s difficulty of escaping local optima. This obstacle can be overcome by employing a multi-group approach for PSO algorithm, by which the PSO particles can be redistributed, preventing them from being trapped in local optima. In this paper, we present a black-box adversarial attack which can significantly increase the success rate of PSO-based attack while maintaining a low number of query by launching the attack in a distributed manner. Attacks are executed from multiple nodes, disseminating queries among the nodes, hence reducing the possibility of being recognized by the target system while also increasing scalability. Furthermore, we utilize Multi-Group PSO with Random Redistribution (MGRR-PSO) for perturbation generation, performing better than the original approach against local optima, thus achieving a higher success rate. Additionally, we propose to efficiently remove excessive perturbation (i.e, perturbation pruning) by utilizing again the MGRR-PSO rather than a standard iterative method as used in the original approach. We perform five different experiments: comparing our attack’s performance with existing algorithms, testing in high-dimensional space in ImageNet dataset, examining our hyperparameters (i.e., particle size, number of clients, search boundary), and testing on real digital attack to Google Cloud Vision. Our attack proves to obtain a 100% success rate on MNIST and CIFAR-10 datasets and able to successfully fool Google Cloud Vision as a proof of the real digital attack by maintaining a lower query and wide applicability.

Adversarial Example Generation Based on Particle Swarm Optimization

Misleading Sentiment Analysis: Generating Adversarial Texts by the Ensemble Word Addition Algorithm

A Distributed Black-Box Adversarial Attack Based on Multi-Group Particle Swarm Optimization

Adversarial machine learning in Network Intrusion Detection Systems

Query-Efficient Generation of Adversarial Examples for Defensive DNNs via Multi-Objective Optimization

Poisoning Attacks against Support Vector Machines

Generating Adversarial Examples Against Machine Learning-Based Intrusion Detector in Industrial Control Systems

Security Matters: A Survey on Adversarial Machine Learning

An Empirical Study of Adversarial Examples on Remote Sensing Image Scene Classification

AdverSPAM: Adversarial SPam Account Manipulation in Online Social Networks

Adversarial Examples: Attacks and Defenses for Deep Learning

Explanation-Guided Adversarial Example Attacks

Adversarial example detection based on saliency map features

Generating Natural Language Adversarial Examples Through Probability Weighted Word Saliency

Adversarial Examples for Hamming Space Search.

Adversarial example detection using semantic graph matching

A Survey of Practical Adversarial Example Attacks

Adversarial Example in Remote Sensing Image Recognition

Adversarial Machine Learning on Social Network: A Survey

Black-Box Evasion Attack Method Based on Confidence Score of Benign Samples

A Review of Adversarial Attack and Defense for Classification Methods