Black-box Adversarial Example Generation with Normalizing Flows

2020/07/06 by Hadi M. Dolatabadi, Sarah Erfani, Dolatabadi, Hadi M. +3
Computer Science · #Advanced Malware Detection Techniques #Adversarial Robustness in Machine Learning #Anomaly Detection Techniques and Applications #Computer Vision and Pattern Recognition (cs.CV) #Cryptography and Security (cs.CR) #FOS: Computer and information sciences #Machine Learning (cs.LG) #Machine Learning (stat.ML)

paper · pdf · doi:10.48550/arxiv.2007.02734

openalex publication_date 2020/07/06 · openalex created_date 2025/10/10 · openalex updated_date 2026/07/28

Abstract

Deep neural network classifiers suffer from adversarial vulnerability: well-crafted, unnoticeable changes to the input data can affect the classifier decision. In this regard, the study of powerful adversarial attacks can help shed light on sources of this malicious behavior. In this paper, we propose a novel black-box adversarial attack using normalizing flows. We show how an adversary can be found by searching over a pre-trained flow-based model base distribution. This way, we can generate adversaries that resemble the original data closely as the perturbations are in the shape of the data. We then demonstrate the competitive performance of the proposed approach against well-known black-box adversarial attack methods.

Citations

• NICE: Non-linear Independent Components Estimation
• Guided Image Generation with Conditional Invertible Neural Networks
• Variational Inference with Normalizing Flows
• Fast is better than free: Revisiting adversarial training
• Learning Multiple Layers of Features from Tiny Images

Related

• AdvFlow: Inconspicuous Black-box Adversarial Attacks using Normalizing\n Flows
• Exploring the Space of Black-box Attacks on Deep Neural Networks
• Data-Free Adversarial Perturbations for Practical Black-Box Attack
• Simple Black-Box Adversarial Perturbations for Deep Networks
• On the Matrix-Free Generation of Adversarial Perturbations for Black-Box Attacks