Sparse-RS: a versatile framework for query-efficient sparse black-box adversarial attacks

2020/06/23 by Croce, Francesco, Andriushchenko, Maksym, Singh, Naman D. +2 · 5 citations
#Computer Vision and Pattern Recognition (cs.CV) #Cryptography and Security (cs.CR) #FOS: Computer and information sciences #Machine Learning (cs.LG) #Machine Learning (stat.ML)

paper · doi:10.48550/arxiv.2006.12834

Abstract

We propose a versatile framework based on random search, Sparse-RS, for score-based sparse targeted and untargeted attacks in the black-box setting. Sparse-RS does not rely on substitute models and achieves state-of-the-art success rate and query efficiency for multiple sparse attack models: l₀-bounded perturbations, adversarial patches, and adversarial frames. The l₀-version of untargeted Sparse-RS outperforms all black-box and even all white-box attacks for different models on MNIST, CIFAR-10, and ImageNet. Moreover, our untargeted Sparse-RS achieves very high success rates even for the challenging settings of 20×20 adversarial patches and 2-pixel wide adversarial frames for 224×224 images. Finally, we show that Sparse-RS can be applied to generate targeted universal adversarial patches where it significantly outperforms the existing approaches. The code of our framework is available at https://github.com/fra31/sparse-rs.

Cited by

• Superpixel Attack: Enhancing Black-box Adversarial Attack with Image-driven Division Areas
• Power Homotopy for Zeroth-Order Non-Convex Optimizations
• Tight Robustness Certification through the Convex Hull of ℓ₀ Attacks
• CertMask: Certifiable Defense Against Adversarial Patches via Theoretically Optimal Mask Coverage
• FeatureFool: Zero-Query Fooling of Video Models via Feature Map

Related

• BruSLeAttack: A Query-Efficient Score-Based Black-Box Sparse Adversarial Attack
• Square Attack: a query-efficient black-box adversarial attack via random search
• Sparse-PGD: A Unified Framework for Sparse Adversarial Perturbations Generation
• LSDAT: Low-Rank and Sparse Decomposition for Decision-based Adversarial Attack
• Simple and Efficient Hard Label Black-box Adversarial Attacks in Low Query Budget Regimes