NATTACK: Learning the Distributions of Adversarial Examples for an Improved Black-Box Attack on Deep Neural Networks

2019/05/01 by Yandong Li, Lijun Li, Li, Yandong +7 · 25 citations
Computer Science · #Adversarial Robustness in Machine Learning #Anomaly Detection Techniques and Applications #Advanced Malware Detection Techniques

paper · pdf · doi:10.48550/arxiv.1905.00441

Abstract

Powerful adversarial attack methods are vital for understanding how to construct robust deep neural networks (DNNs) and for thoroughly testing defense techniques. In this paper, we propose a black-box adversarial attack algorithm that can defeat both vanilla DNNs and those generated by various defense techniques developed recently. Instead of searching for an "optimal" adversarial example for a benign input to a targeted DNN, our algorithm finds a probability density distribution over a small region centered around the input, such that a sample drawn from this distribution is likely an adversarial example, without the need of accessing the DNN's internal layers or weights. Our approach is universal as it can successfully attack different neural networks by a single algorithm. It is also strong; according to the testing against 2 vanilla DNNs and 13 defended ones, it outperforms state-of-the-art black-box or white-box attack methods for most test cases. Additionally, our results reveal that adversarial training remains one of the best defense techniques, and the adversarial examples are not as transferable across defended DNNs as them across vanilla DNNs.

Cited by

• SPOOF: Simple Pixel Operations for Out-of-Distribution Fooling
• Improving Query Efficiency of Black-box Adversarial Attack
• Adaptive Image Transformations for Transfer-based Adversarial Attack
• Adversarial Example Games
• RayS: A Ray Searching Method for Hard-label Adversarial Attack
• Performance Evaluation of Adversarial Attacks: Discrepancies and Solutions
• Decision-based Universal Adversarial Attack
• Learning to Defend by Learning to Attack
• Adaptive Perturbation for Adversarial Attack
• Black-Box Adversarial Attack with Transferable Model-based Embedding
• Enhancing the Transferability of Adversarial Attacks through Variance Tuning
• A Survey of Black-Box Adversarial Attacks on Computer Vision Models
• IWA: Integrated Gradient based White-box Attacks for Fooling Deep Neural Networks
• Neural Networks Are More Productive Teachers Than Human Raters: Active Mixup for Data-Efficient Knowledge Distillation from a Blackbox Model
• Reinforced Embodied Active Defense: Exploiting Adaptive Interaction for Robust Visual Perception in Adversarial 3D Environments
• One Man's Trash is Another Man's Treasure: Resisting Adversarial Examples by Adversarial Examples
• AdvFlow: Inconspicuous Black-box Adversarial Attacks using Normalizing\n Flows
• Ensemble of Models Trained by Key-based Transformed Images for Adversarially Robust Defense Against Black-box Attacks
• Statistical Inference for Polyak-Ruppert Averaged Zeroth-order Stochastic Gradient Algorithm
• PredCoin: Defense against Query-based Hard-label Attack
• Response Attack: Exploiting Contextual Priming to Jailbreak Large Language Models
• VATLD: A Visual Analytics System to Assess, Understand and Improve Traffic Light Detection
• Robust Local Features for Improving the Generalization of Adversarial Training
• Consensus-based optimization for closed-box adversarial attacks and a connection to evolution strategies
• Dynamic Defense Approach for Adversarial Robustness in Deep Neural Networks via Stochastic Ensemble Smoothed Model
• Boosting Black-Box Attack with Partially Transferred Conditional Adversarial Distribution

Related

• Efficient Defenses Against Adversarial Attacks
• Generating Adversarial Examples with Adversarial Networks
• Utilizing Adversarial Targeted Attacks to Boost Adversarial Robustness
• DI-AA: An Interpretable White-box Attack for Fooling Deep Neural Networks
• An Empirical Investigation of Randomized Defenses against Adversarial Attacks