AutoZOOM: Autoencoder-based Zeroth Order Optimization Method for Attacking Black-box Neural Networks

2018/05/30 by Chun-Chen Tu, Chun‐Chen Tu, Tu, Chun-Chen +17 · 12 citations
Computer Science · Mathematics · #Advanced Neural Network Applications #Adversarial Robustness in Machine Learning #Computer Vision and Pattern Recognition (cs.CV) #Cryptography and Security (cs.CR) #Domain Adaptation and Few-Shot Learning #FOS: Computer and information sciences #Machine Learning (stat.ML) #cs.CR #cs.CV #stat.ML

paper · pdf · doi:10.48550/arxiv.1805.11770

Chun-Chen Tu, Paishun Ting and Pin-Yu Chen contribute equally to this work; Paper accepted to AAAI 2019; updated model information in Table S2

openalex publication_date 2018/05/30 · openalex created_date 2018/06/13 · arxiv created 2020/01/31 · arxiv updated 2020/02/03 · openalex updated_date 2026/07/28

Abstract

Recent studies have shown that adversarial examples in state-of-the-art image classifiers trained by deep neural networks (DNN) can be easily generated when the target model is transparent to an attacker, known as the white-box setting. However, when attacking a deployed machine learning service, one can only acquire the input-output correspondences of the target model; this is the so-called black-box attack setting. The major drawback of existing black-box attacks is the need for excessive model queries, which may give a false sense of model robustness due to inefficient query designs. To bridge this gap, we propose a generic framework for query-efficient black-box attacks. Our framework, AutoZOOM, which is short for Autoencoder-based Zeroth Order Optimization Method, has two novel building blocks towards efficient black-box attacks: (i) an adaptive random gradient estimation strategy to balance query counts and distortion, and (ii) an autoencoder that is either trained offline with unlabeled data or a bilinear resizing operation for attack acceleration. Experimental results suggest that, by applying AutoZOOM to a state-of-the-art black-box attack (ZOO), a significant reduction in model queries can be achieved without sacrificing the attack success rate and the visual quality of the resulting adversarial examples. In particular, when compared to the standard ZOO method, AutoZOOM can consistently reduce the mean query counts in finding successful adversarial examples (or reaching the same distortion level) by at least 93% on MNIST, CIFAR-10 and ImageNet datasets, leading to novel insights on adversarial robustness.

Citations

• Gradient-based learning applied to document recognition
• ImageNet Large Scale Visual Recognition Challenge
• Transferability in Machine Learning: from Phenomena to Black-Box Attacks using Adversarial Samples
• Simple Black-Box Adversarial Perturbations for Deep Networks
• Query-limited Black-box Attacks to Classifiers
• Decision-Based Adversarial Attacks: Reliable Attacks Against Black-Box Machine Learning Models
• Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples
• Zeroth-Order Online Alternating Direction Method of Multipliers: Convergence Analysis and Applications
• Learning Multiple Layers of Features from Tiny Images

Cited by

• MMT-ARD: Multimodal Multi-Teacher Adversarial Distillation for Robust Vision-Language Models
• Tuning for Two Adversaries: Enhancing the Robustness Against Transfer and Query-Based Attacks using Hyperparameter Tuning
• Online Distributed Zeroth-Order Optimization With Non-Zero-Mean Adverse Noises
• FlowOpt: Fast Optimization Through Whole Flow Processes for Training-Free Editing
• More Than Memory Savings: Zeroth-Order Optimization Mitigates Forgetting in Continual Learning
• Explainable Deep Learning Based Adversarial Defense for Automatic Modulation Classification
• Adversarial Attacks on Reinforcement Learning-based Medical Questionnaire Systems: Input-level Perturbation Strategies and Medical Constraint Validation
• Federated Learning on Riemannian Manifolds: A Gradient-Free Projection-Based Approach
• Non-Adaptive Adversarial Face Generation
• Low Frequency Adversarial Perturbation
• VAMO: Efficient Zeroth-Order Variance Reduction for SGD with Faster Convergence
• ChainMarks: Securing DNN Watermark with Cryptographic Chain

Related

• GenAttack: Practical Black-box Attacks with Gradient-Free Optimization
• Towards Query Efficient Black-box Attacks: An Input-free Perspective
• Improving Query Efficiency of Black-box Adversarial Attack
• Towards Query-Efficient Black-Box Adversary with Zeroth-Order Natural Gradient Descent
• How to Robustify Black-Box ML Models? A Zeroth-Order Optimization Perspective