Abstract:Recent studies have highlighted that deep neural networks (DNNs) are vulnerable to adversarial attacks, even in a black-box scenario. However, most of the existing black-box attack algorithms need to make a huge amount of queries to perform attacks, which is not practical in the real world. We note one of the main reasons for the massive queries is that the adversarial example is required to be visually similar to the original image, but in many cases, how adversarial examples look like does not matter much. It inspires us to introduce a new attack called input-free attack, under which an adversary can choose an arbitrary image to start with and is allowed to add perceptible perturbations on it. Following this approach, we propose two techniques to significantly reduce the query complexity. First, we initialize an adversarial example with a gray color image on which every pixel has roughly the same importance for the target model. Then we shrink the dimension of the attack space by perturbing a small region and tiling it to cover the input image. To make our algorithm more effective, we stabilize a projected gradient ascent algorithm with momentum, and also propose a heuristic approach for region size selection. Recent studies have highlighted that deep neural networks (DNNs) are vulnerable to adversarial attacks, even in a black-box scenario. However, most of the existing black-box attack algorithms need to make a huge amount of queries to perform attacks, which is not practical in the real world. We note one of the main reasons for the massive queries is that the adversarial example is required to be visually similar to the original image, but in many cases, how adversarial examples look like does not matter much. It inspires us to introduce a new attack called input-free attack, under which an adversary can choose an arbitrary image to start with and is allowed to add perceptible perturbations on it. Following this approach, we propose two techniques to significantly reduce the query complexity. First, we initialize an adversarial example with a gray color image on which every pixel has roughly the same importance for the target model. Then we shrink the dimension of the attack space by perturbing a small region and tiling it to cover the input image. To make our algorithm more effective, we stabilize a projected gradient ascent algorithm with momentum, and also propose a heuristic approach for region size selection. Through extensive experiments, we show that with only 1,701 queries on average, we can perturb a gray image to any target class of ImageNet with a 100% success rate on InceptionV3. Besides, our algorithm has successfully defeated two real-world systems, the Clarifai food detection API and the Baidu Animal Identification API.

Adversarial Color Projection: A Projector-Based Physical-World Attack to DNNs

Adversarial Color Film: Effective Physical-World Attack to DNNs

Adversarial Neon Beam: A Light-Based Physical Attack to DNNs

Adversarial Laser Spot: Robust and Covert Physical-World Attack to DNNs

Adversarial catoptric light: An effective, stealthy and robust physical‐world attack to DNNs

Improving Query Efficiency of Black-box Adversarial Attack

Physical Adversarial Attack meets Computer Vision: A Decade Survey

SPAA: Stealthy Projector-based Adversarial Attacks on Deep Image Classifiers

Contextual Adversarial Attack Against Aerial Detection in the Physical World

A Survey on Physical Adversarial Attack in Computer Vision

Adversarial Cross-laser Attack: Effective Attack to DNNs in the Real World

Robust Physical-World Attacks on Deep Learning Models

Defense against adversarial attacks based on color space transformation

Attack Anything: Blind DNNs via Universal Background Adversarial Attack

Adversarial Camera Patch: An Effective and Robust Physical-World Attack on Object Detectors

Physical Adversarial Attacks on an Aerial Imagery Object Detector

Towards Query Efficient Black-box Attacks

Invisible Adversarial Attack Against Deep Neural Networks: an Adaptive Penalization Approach

Bio-Inspired Adversarial Attack Against Deep Neural Networks

Optical Adversarial Attack

Effective and Robust Physical-World Attacks on Deep Learning Face Recognition Systems