Abstract:Recent studies have highlighted that deep neural networks (DNNs) are vulnerable to adversarial attacks, even in a black-box scenario. However, most of the existing black-box attack algorithms need to make a huge amount of queries to perform attacks, which is not practical in the real world. We note one of the main reasons for the massive queries is that the adversarial example is required to be visually similar to the original image, but in many cases, how adversarial examples look like does not matter much. It inspires us to introduce a new attack called input-free attack, under which an adversary can choose an arbitrary image to start with and is allowed to add perceptible perturbations on it. Following this approach, we propose two techniques to significantly reduce the query complexity. First, we initialize an adversarial example with a gray color image on which every pixel has roughly the same importance for the target model. Then we shrink the dimension of the attack space by perturbing a small region and tiling it to cover the input image. To make our algorithm more effective, we stabilize a projected gradient ascent algorithm with momentum, and also propose a heuristic approach for region size selection. Recent studies have highlighted that deep neural networks (DNNs) are vulnerable to adversarial attacks, even in a black-box scenario. However, most of the existing black-box attack algorithms need to make a huge amount of queries to perform attacks, which is not practical in the real world. We note one of the main reasons for the massive queries is that the adversarial example is required to be visually similar to the original image, but in many cases, how adversarial examples look like does not matter much. It inspires us to introduce a new attack called input-free attack, under which an adversary can choose an arbitrary image to start with and is allowed to add perceptible perturbations on it. Following this approach, we propose two techniques to significantly reduce the query complexity. First, we initialize an adversarial example with a gray color image on which every pixel has roughly the same importance for the target model. Then we shrink the dimension of the attack space by perturbing a small region and tiling it to cover the input image. To make our algorithm more effective, we stabilize a projected gradient ascent algorithm with momentum, and also propose a heuristic approach for region size selection. Through extensive experiments, we show that with only 1,701 queries on average, we can perturb a gray image to any target class of ImageNet with a 100% success rate on InceptionV3. Besides, our algorithm has successfully defeated two real-world systems, the Clarifai food detection API and the Baidu Animal Identification API.

A Black-Box Attack Algorithm Targeting Unlabeled Industrial AI Systems With Contrastive Learning

B3: Backdoor Attacks Against Black-box Machine Learning Models

Towards Efficient Data Free Blackbox Adversarial Attack

Improving Query Efficiency of Black-box Adversarial Attack

MC-Net: Realistic Sample Generation for Black-Box Attacks

BlackboxBench: A Comprehensive Benchmark of Black-box Adversarial Attacks

PointACL:Adversarial Contrastive Learning for Robust Point Clouds Representation under Adversarial Attack

Adversarial Eigen Attack on BlackBox Models

Black-Box Universal Adversarial Attack for DNN-Based Models of SAR Automatic Target Recognition

Generalizable Black-Box Adversarial Attack With Meta Learning

A Black-Box Attack Method against Machine-Learning-Based Anomaly Network Flow Detection Models

Certifiable Black-Box Attacks with Randomized Adversarial Examples: Breaking Defenses with Provable Confidence

Query-efficient label-only attacks against black-box machine learning models

ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Models

Generalization Bounds for Adversarial Contrastive Learning

Towards Query Efficient Black-box Attacks

ADBA:Approximation Decision Boundary Approach for Black-Box Adversarial Attacks

AdvQDet: Detecting Query-Based Adversarial Attacks with Adversarial Contrastive Prompt Tuning

Advancing Few-Shot Black-Box Attack With Alternating Training

Improving Query Efficiency of Black-Box Attacks via the Preference of Deep Learning Models

SemiAdv: Query-Efficient Black-Box Adversarial Attack with Unlabeled Images