Diversity can be Transferred: Output Diversification for White- and Black-box Attacks

2020/03/15 by Yusuke Tashiro, Yang Song, Tashiro, Yusuke +3
Computer Science · Engineering · Mathematics · #Advanced Malware Detection Techniques #Advancements in Semiconductor Devices and Circuit Design #Adversarial Robustness in Machine Learning #Computer Vision and Pattern Recognition (cs.CV) #FOS: Computer and information sciences #Machine Learning (cs.LG) #Machine Learning (stat.ML) #cs.CV #cs.LG #stat.ML

paper · pdf · doi:10.48550/arxiv.2003.06878

NeurIPS 2020

openalex publication_date 2020/03/15 · arxiv created 2020/10/30 · arxiv updated 2020/11/02 · openalex created_date 2025/10/10 · openalex updated_date 2026/07/28

Abstract

Adversarial attacks often involve random perturbations of the inputs drawn from uniform or Gaussian distributions, e.g., to initialize optimization-based white-box attacks or generate update directions in black-box attacks. These simple perturbations, however, could be sub-optimal as they are agnostic to the model being attacked. To improve the efficiency of these attacks, we propose Output Diversified Sampling (ODS), a novel sampling strategy that attempts to maximize diversity in the target model's outputs among the generated samples. While ODS is a gradient-based strategy, the diversity offered by ODS is transferable and can be helpful for both white-box and black-box attacks via surrogate models. Empirically, we demonstrate that ODS significantly improves the performance of existing white-box and black-box attacks. In particular, ODS reduces the number of queries needed for state-of-the-art black-box attacks on ImageNet by a factor of two.

Citations

• Transferability in Machine Learning: from Phenomena to Black-Box Attacks using Adversarial Samples
• Delving into Transferable Adversarial Examples and Black-box Attacks
• Certified Adversarial Robustness via Randomized Smoothing
• Theoretically Principled Trade-off between Robustness and Accuracy
• PixelDefend: Leveraging Generative Models to Understand and Defend against Adversarial Examples
• Decision-Based Adversarial Attacks: Reliable Attacks Against Black-Box Machine Learning Models
• Improving the Adversarial Robustness and Interpretability of Deep Neural Networks by Regularizing their Input Gradients
• Provable defenses against adversarial examples via the convex outer adversarial polytope
• Defense-GAN: Protecting Classifiers Against Adversarial Attacks Using Generative Models
• Metric Learning for Adversarial Robustness
• Subspace Attack: Exploiting Promising Subspaces for Query-Efficient Black-box Attacks
• An Alternative Surrogate Loss for PGD-based Adversarial Testing

Related

• Use as Many Surrogates as You Want: Selective Ensemble Attack to Unleash Transferability without Sacrificing Resource Efficiency
• Minimizing Maximum Model Discrepancy for Transferable Black-box Targeted Attacks
• Learning Black-Box Attackers with Transferable Priors and Query Feedback
• Everywhere Attack: Attacking Locally and Globally to Boost Targeted Transferability
• Boosting Black-Box Attack with Partially Transferred Conditional Adversarial Distribution