Abstract:Recent studies have highlighted that deep neural networks (DNNs) are vulnerable to adversarial attacks, even in a black-box scenario. However, most of the existing black-box attack algorithms need to make a huge amount of queries to perform attacks, which is not practical in the real world. We note one of the main reasons for the massive queries is that the adversarial example is required to be visually similar to the original image, but in many cases, how adversarial examples look like does not matter much. It inspires us to introduce a new attack called input-free attack, under which an adversary can choose an arbitrary image to start with and is allowed to add perceptible perturbations on it. Following this approach, we propose two techniques to significantly reduce the query complexity. First, we initialize an adversarial example with a gray color image on which every pixel has roughly the same importance for the target model. Then we shrink the dimension of the attack space by perturbing a small region and tiling it to cover the input image. To make our algorithm more effective, we stabilize a projected gradient ascent algorithm with momentum, and also propose a heuristic approach for region size selection. Recent studies have highlighted that deep neural networks (DNNs) are vulnerable to adversarial attacks, even in a black-box scenario. However, most of the existing black-box attack algorithms need to make a huge amount of queries to perform attacks, which is not practical in the real world. We note one of the main reasons for the massive queries is that the adversarial example is required to be visually similar to the original image, but in many cases, how adversarial examples look like does not matter much. It inspires us to introduce a new attack called input-free attack, under which an adversary can choose an arbitrary image to start with and is allowed to add perceptible perturbations on it. Following this approach, we propose two techniques to significantly reduce the query complexity. First, we initialize an adversarial example with a gray color image on which every pixel has roughly the same importance for the target model. Then we shrink the dimension of the attack space by perturbing a small region and tiling it to cover the input image. To make our algorithm more effective, we stabilize a projected gradient ascent algorithm with momentum, and also propose a heuristic approach for region size selection. Through extensive experiments, we show that with only 1,701 queries on average, we can perturb a gray image to any target class of ImageNet with a 100% success rate on InceptionV3. Besides, our algorithm has successfully defeated two real-world systems, the Clarifai food detection API and the Baidu Animal Identification API.

An efficient general black-box adversarial attack approach based on multi-objective optimization for high dimensional images

You See What I Want You to See: Exploring Targeted Black-Box Transferability Attack for Hash-based Image Retrieval Systems

An Adversarial Attack Based On Multi-Objective Optimization In The Black-Box Scenario: Moea-Apga Ii

Attention-guided Black-Box Adversarial Attacks with Large-Scale Multiobjective Evolutionary Optimization

Improving Query Efficiency of Black-box Adversarial Attack

Towards Query Efficient Black-box Attacks

GenAttack: Practical Black-box Attacks with Gradient-Free Optimization

Simple Black-box Adversarial Attacks

A Black-Box Approach to Generate Adversarial Examples Against Deep Neural Networks for High Dimensional Input.

Black-box Adversarial Attacks Based on Random Coordinate Selection

EvoBA: An Evolution Strategy as a Strong Baseline forBlack-Box Adversarial Attacks

Art-Attack: Black-Box Adversarial Attack via Evolutionary Art

An Evolutionary-Based Black-Box Attack to Deep Neural Network Classifiers.

Bayesian Evolutionary Optimization for Crafting High-Quality Adversarial Examples with Limited Query Budget.

An Approximated Gradient Sign Method Using Differential Evolution For Black-box Adversarial Attack

Efficient Query-based Black-box Attack against Cross-modal Hashing Retrieval

Black-Box Boundary Attack Based on Gradient Optimization

Taking Care of the Discretization Problem:A Black-Box Adversarial Image Attack in Discrete Integer Domain

ABCAttack: A Gradient-Free Optimization Black-Box Attack for Fooling Deep Image Classifiers

PISA: Pixel Skipping-Based Attentional Black-Box Adversarial Attack