Abstract:Deep Neural Networks (DNNs) are vulnerable to deliberately crafted adversarial examples. In the past few years, many efforts have been spent on exploring query-optimisation attacks to find adversarial examples of either black-box or white-box DNN models, as well as the defending countermeasures against those attacks. In this article, we explore vulnerabilities of DNN models under the umbrella of Man-in-the-Middle (MitM) attacks, which have not been investigated before. From the perspective of an MitM adversary, the aforementioned adversarial example attacks are not viable anymore. First, such attacks must acquire the outputs from the models multiple times before actually launching attacks, which is difficult for the MitM adversary in practice. Second, such attacks are one-off and cannot be directly generalised onto new data examples, which decreases the rate of return for the attacker. In contrast, using generative models to craft adversarial examples on the fly can mitigate the drawbacks. However, the adversarial capability of the generative models, such as Variational Auto-Encoder (VAE), has not been extensively studied. Therefore, given a classifier, we investigate using a VAE decoder to either transform benign inputs to their adversarial counterparts or decode outputs from benign VAE encoders to be adversarial examples. The proposed method can endue more capability to MitM attackers. Based on our evaluation, the proposed attack can achieve above 95 percent success rates on both MNIST and CIFAR10 datasets, which is better or comparable with state-of-the-art query-optimisation attacks. In the meantime, the attack is <span class="mjpage"><svg xmlns:xlink="http://www.w3.org/1999/xlink" width="3.379ex" height="2.676ex" style="vertical-align: -0.338ex;" viewBox="0 -1006.6 1454.9 1152.1" role="img" focusable="false" xmlns="http://www.w3.org/2000/svg"><g stroke="currentColor" fill="currentColor" stroke-width="0" transform="matrix(1 0 0 -1 0 0)"> <use xlink:href="#MJMAIN-31"></use> <use xlink:href="#MJMAIN-30" x="500" y="0"></use> <use transform="scale(0.707)" xlink:href="#MJMAIN-34" x="1415" y="557"></use></g></svg></span>104 times faster than the query-optimisation attacks.<svg xmlns="http://www.w3.org/2000/svg" style="display: none;"><defs id="MathJax_SVG_glyphs"><path stroke-width="1" id="MJMAIN-31" d="M213 578L200 573Q186 568 160 563T102 556H83V602H102Q149 604 189 617T245 641T273 663Q275 666 285 666Q294 666 302 660V361L303 61Q310 54 315 52T339 48T401 46H427V0H416Q395 3 257 3Q121 3 100 0H88V46H114Q136 46 152 46T177 47T193 50T201 52T207 57T213 61V578Z"></path><path stroke-width="1" id="MJMAIN-30" d="M96 585Q152 666 249 666Q297 666 345 640T423 548Q460 465 460 320Q460 165 417 83Q397 41 362 16T301 -15T250 -22Q224 -22 198 -16T137 16T82 83Q39 165 39 320Q39 494 96 585ZM321 597Q291 629 250 629Q208 629 178 597Q153 571 145 525T137 333Q137 175 145 125T181 46Q209 16 250 16Q290 16 318 46Q347 76 354 130T362 333Q362 478 354 524T321 597Z"></path><path stroke-width="1" id="MJMAIN-34" d="M462 0Q444 3 333 3Q217 3 199 0H190V46H221Q241 46 248 46T265 48T279 53T286 61Q287 63 287 115V165H28V211L179 442Q332 674 334 675Q336 677 355 677H373L379 671V211H471V165H379V114Q379 73 379 66T385 54Q393 47 442 46H471V0H462ZM293 211V545L74 212L183 211H293Z"></path></defs></svg>

Man-in-the-Middle Attacks Against Machine Learning Classifiers Via Malicious Generative Models

NetGuard: Protecting Commercial Web APIs from Model Inversion Attacks Using GAN-generated Fake Samples

The Secret Revealer: Generative Model-Inversion Attacks Against Deep Neural Networks

Black-Box Adversarial Attacks Against Deep Learning Based Malware Binaries Detection with GAN

A GAN-Based Defense Framework Against Model Inversion Attacks.

Stealthy and Robust Glitch Injection Attack on Deep Learning Accelerator for Target with Variational Viewpoint.

Generating Natural Language Adversarial Examples on a Large Scale with Generative Models

Boosting Adversarial Attacks with Nadam Optimizer

A Multi-objective Examples Generation Approach to Fool the Deep Neural Networks in the Black-Box Scenario

Undermining Image and Text Classification Algorithms Using Adversarial Attacks

Efficient Adversarial Attack Based on Moment Estimation and Lookahead Gradient

Generative Imperceptible Attack With Feature Learning Bias Reduction and Multi-Scale Variance Regularization

Mitigating Adversarial Attacks for Deep Neural Networks by Input Deformation and Augmentation

Query-Free Evasion Attacks Against Machine Learning-Based Malware Detectors with Generative Adversarial Networks

PETGEN: Personalized Text Generation Attack on Deep Sequence Embedding-based Classification Models

A Black-box NLP Classifier Attacker

A novel and universal GAN-based countermeasure to recover adversarial examples to benign examples

GPMT: Generating Practical Malicious Traffic Based on Adversarial Attacks with Little Prior Knowledge

Model Inversion Attacks Through Target-Specific Conditional Diffusion Models

MC-Net: Realistic Sample Generation for Black-Box Attacks

On-manifold Adversarial Attack Based on Latent Space Substitute Model