Consensus-based optimization for closed-box adversarial attacks and a connection to evolution strategies

2025/06/30 by Roith, Tim, Bungert, Leon, Wacker, Philipp · 1 citation
#65K10 #65K15 #68Q32 #90C26 #FOS: Computer and information sciences #FOS: Mathematics #Machine Learning (cs.LG) #Optimization and Control (math.OC)

paper · doi:10.48550/arxiv.2506.24048

Abstract

Consensus-based optimization (CBO) has established itself as an efficient gradient-free optimization scheme, with attractive mathematical properties, such as mean-field convergence results for non-convex loss functions. In this work, we study CBO in the context of closed-box adversarial attacks, which are imperceptible input perturbations that aim to fool a classifier, without accessing its gradient. Our contribution is to establish a connection between the so-called consensus hopping as introduced by Riedl et al. and natural evolution strategies (NES) commonly applied in the context of adversarial attacks and to rigorously relate both methods to gradient-based optimization schemes. Beyond that, we provide a comprehensive experimental study that shows that despite the conceptual similarities, CBO can outperform NES and other evolutionary strategies in certain scenarios.

Citations

• Mathematical Analysis of the PDE Model for the Consensus-based Optimization
• Regularity and positivity of solutions of the Consensus-Based Optimization equation: unconditional global convergence
• MirrorCBO: A consensus-based optimization method in the spirit of mirror descent
• Micro-Macro Decomposition of Particle Swarm Optimization Methods
• Defending Against Diverse Attacks in Federated Learning Through Consensus-Based Bi-Level Optimization
• CB²O: Consensus-Based Bi-Level Optimization
• Constrained Consensus-Based Optimization and Numerical Heuristics for the Few Particle Regime
• A discrete Consensus-Based Global Optimization Method with Noisy Objective Function
• A particle consensus approach to solving nonconvex-nonconcave min-max problems
• Adversarial flows: A gradient flow characterization of adversarial attacks
• An interacting particle consensus method for constrained global optimization
• Consensus-based algorithms for stochastic optimization problems
• A PDE Framework of Consensus-Based Optimization for Objectives with Multiple Global Minimizers
• Discrete Consensus-Based Optimization
• Soft Prompt Threats: Attacking Safety Alignment and Unlearning in Open-Source LLMs through the Embedding Space
• An Optimal Transport Approach for Computing Adversarial Training Lower Bounds in Multiclass Classification
• BlackboxBench: A Comprehensive Benchmark of Black-box Adversarial Attacks
• SoK: Pitfalls in Evaluating Black-Box Attacks
• Certified Robustness via Dynamic Margin Maximization and Improved Lipschitz Regularization
• Consensus-Based Optimization for Saddle Point Problems
• Gamma-convergence of a nonlocal perimeter arising in adversarial machine learning
• Polarized consensus-based dynamics for optimization and sampling
• Polarized consensus-based dynamics for optimization and sampling
• Rethinking Lipschitz Neural Networks and Certified Robustness: A Boolean Function Perspective
• On the Existence of the Adversarial Bayes Classifier (Extended Version)
• Consensus-based Optimization and Ensemble Kalman Inversion for Global Optimization Problems with Constraints
• Training Certifiably Robust Neural Networks with Efficient Local\n Lipschitz Bounds
• A Constrained Consensus Based Optimization algorithm and its Application to Finance
• Back in Black: A Comparative Evaluation of Recent State-Of-The-Art Black-Box Attacks
• Mean-field particle swarm optimization
• Convergence analysis of the discrete consensus-based optimization algorithm with random batch interactions and heterogeneous noises
• EvoBA: An Evolution Strategy as a Strong Baseline forBlack-Box Adversarial Attacks
• Consensus‐based sampling
• Anisotropic Diffusion in Consensus-based Optimization on the Sphere
• A consensus-based global optimization method with adaptive momentum estimation
• Simple and Efficient Hard Label Black-box Adversarial Attacks in Low Query Budget Regimes
• Towards Query-Efficient Black-Box Adversary with Zeroth-Order Natural Gradient Descent
• PyTorch: An Imperative Style, High-Performance Deep Learning Library
• A Survey of Black-Box Adversarial Attacks on Computer Vision Models
• Square Attack: a query-efficient black-box adversarial attack via random search
• Yet another but more efficient black-box adversarial attack: tiling and evolution strategies
• A consensus-based global optimization method for high dimensional machine learning problems
• Simple Black-box Adversarial Attacks
• Parsimonious Black-Box Adversarial Attacks via Efficient Combinatorial Optimization
• NATTACK: Learning the Distributions of Adversarial Examples for an Improved Black-Box Attack on Deep Neural Networks
• There are No Bit Parts for Sign Bits in Black-Box Attacks
• Sorting out Lipschitz function approximation
• Prior Convictions: Black-Box Adversarial Attacks with Bandits and Priors
• Black-box Adversarial Attacks with Limited Queries and Information
• Generating Adversarial Examples with Adversarial Networks
• Visualizing the Loss Landscape of Neural Nets
• One Pixel Attack for Fooling Deep Neural Networks
• Towards Deep Learning Models Resistant to Adversarial Attacks
• Evolution Strategies as a Scalable Alternative to Reinforcement Learning
• Towards Evaluating the Robustness of Neural Networks
• Stein Variational Gradient Descent: A General Purpose Bayesian Inference\n Algorithm
• Practical Black-Box Attacks against Machine Learning
• An analytical framework for a consensus-based global optimization method
• Rethinking the Inception Architecture for Computer Vision
• Delving Deep into Rectifiers: Surpassing Human-Level Performance on ImageNet Classification
• Explaining and Harnessing Adversarial Examples
• Very Deep Convolutional Networks for Large-Scale Image Recognition
• One weird trick for parallelizing convolutional neural networks
• Intriguing properties of neural networks
• ImageNet classification with deep convolutional neural networks
• On discrete cosine transform
• Natural Gradient Works Efficiently in Learning
• Gradient-based learning applied to document recognition

Cited by

• Strong Global Convergence of the Consensus-Based Optimization Algorithm

Related

• Security of Gradient Tracking Algorithms Against Malicious Agents
• Defending Against Diverse Attacks in Federated Learning Through Consensus-Based Bi-Level Optimization
• Yet another but more efficient black-box adversarial attack: tiling and evolution strategies
• Adapting Step-size: A Unified Perspective to Analyze and Improve Gradient-based Methods for Adversarial Attacks
• Discrete Consensus-Based Optimization