A Distributed Biased Boundary Attack Method in Black-Box Attack
Source abstract
Abstract
The adversarial samples threaten the effectiveness of machine learning (ML) models and algorithms in many applications. In particular, black-box attack methods are quite close to actual scenarios. Research on black-box attack methods and the generation of adversarial samples is helpful to discover the defects of machine learning models. It can strengthen the robustness of machine learning algorithms models. Such methods require queries frequently, which are less efficient. This paper has made improvements in the initial generation and the search for the most effective adversarial examples. Besides, it is found that some indicators can be used to detect attacks, which is a new foundation compared with our previous studies. Firstly, the paper proposed an algorithm to generate initial adversarial samples with a smaller L2 norm; secondly, a combination between particle swarm optimization (PSO) and biased boundary adversarial attack (BBA) is proposed. It is the PSO-BBA. Experiments are conducted on the ImageNet. The PSO-BBA is compared with the baseline method. Experimental comparison results certificate that: (1) A distributed framework for adversarial attack methods is proposed; (2) The proposed initial point selection method can reduces query numbers effectively; (3) Compared to the original BBA, the proposed PSO-BBA algorithm accelerates the convergence speed and improves the accuracy of attack accuracy; (4) The improved PSO-BBA algorithm has preferable performance on targeted and non-targeted attacks; (5) The mean structural similarity (MSSIM) can be used as the indicators of adversarial attack.
Source: crossref · Quality: baseline
Research context
OpenAlex topics: Adversarial Robustness in Machine Learning · Anomaly Detection Techniques and Applications · Advanced Neural Network Applications
SciVX discovery tags are terminology-based. OpenAlex topics are source-provided classifications.
Affiliations
College of Intelligence Science and Technology, National University of Defense and Technology, Changsha 410000, China
School of Civil Engineering, Central South University, Changsha 410000, China
Funding
National Natural Science Foundation of China · Natural Science Foundation of Hunan Province
References (28)
Show source-provided references
1. Recent advances in multimedia security and information hiding10.1002/ett.4193 ↗
2. VerifyNet: Secure and Verifiable Federated Learning10.1109/TIFS.2019.2929409 ↗
3. Privacy-Preserving Deep Learning via Additively Homomorphic Encryption10.1109/TIFS.2017.2787987 ↗
4. Analysis of the Security of Internet of Multimedia Things
5. Xu, J., Wang, C., Li, T., and Xiang, F. (2020, January 6–8). Improved Adversarial Attack against Black-box Machine Learning Models. Proceedings of the 2020 Chinese Automation Congress (CAC 2020), Shanghai, China.10.1109/CAC51589.2020.9326714 ↗
6. Goodfellow, I.J., Shlens, J., and Szegedy, C. (2014). Explaining and Harnessing Adversarial Examples. arXiv, 1–11.
7. Kurakin, A., Goodfellow, I.J., and Bengio, S. (2018). Adversarial Examples in the Physical World. Artificial Intelligence Safety and Security, CRC Press.10.1201/9781351251389-8 ↗
8. Moosavi-Dezfooli, S.M., Fawzi, A., and Frossard, P. (2016, January 27–30). DeepFool: A simple and accurate method to fool deep neural networks. Proceedings of the 2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR), Seattle, WA, USA.10.1109/CVPR.2016.282 ↗
9. Papernot, N., McDaniel, P., Jha, S., Fredrikson, M., Celik, Z.B., and Swami, A. (2016, January 21–24). The Limitations of Deep Learning in Adversarial Settings. Proceedings of the 2016 IEEE European Symposium on Security and Privacy (EuroS&P), Saarbruecken, Germany.10.1109/EuroSP.2016.36 ↗
10. Cisse, M., Adi, Y., Neverova, N., and Keshet, J. (2017). Houdini: Fooling deep structured prediction models. arXiv.
11. Carlini, N., and Wagner, D. (2017, January 22–26). Towards Evaluating the Robustness of Neural Networks. Proceedings of the 2017 IEEE Symposium on Security and Privacy (SP), San Jose, CA, USA.10.1109/SP.2017.49 ↗
12. Brendel, W., Rauber, J., and Bethge, M. (May, January 30). Decision-Based Adversarial Attacks: Reliable Attacks Against Black-Box Machine Learning Models. Proceedings of the 6th International Conference on Learning Representations (ICLR), Vancouver, BC, Canada.
13. Brunner, T., Diehl, F., Le, M.T., and Knoll, A. (November, January 27). Guessing Smart: Biased Sampling for Efficient Black-Box Adversarial Attacks. Proceedings of the 2019 IEEE/CVF International Conference on Computer Vision (ICCV), Seoul, Korea.10.1109/ICCV.2019.00506 ↗
14. Hayes, J., and Danezis, G. (2018, January 24–24). Learning Universal Adversarial Perturbations with Generative Models. Proceedings of the 2018 IEEE Symposium on Security and Privacy Workshops, SPW 2018, San Francisco, CA, USA.10.1109/SPW.2018.00015 ↗
15. Guo, C., Gardner, J., You, Y., Wilson, A.G., and Weinberger, K. (2019, January 9–15). Simple Black-box Adversarial Attacks. Proceedings of the 36th International Conference on Machine Learning (ICML), Long Beach, CA, USA.
16. Cheng, M., Le, T., Chen, P.Y., Yi, J., Zhang, H., and Hsieh, C.J. (2019). Query-Efficient Hard-label Black-box Attack: An Optimization-based Approach, ICLR (Poster). arXiv.
17. Ilyas, A., Engstrom, L., Athalye, A., and Lin, J. (2018, January 10–15). Black-box Adversarial Attacks with Limited Queries and Information. Proceedings of the International Conference on Machine Learning (ICML), Stockholm, Sweden.
18. Papernot, N., McDaniel, P., Wu, X., Jha, S., and Swami, A. (2016, January 22–26). Distillation as a Defense to Adversarial Perturbations Against Deep Neural Networks. Proceedings of the 2016 IEEE Symposium on Security and Privacy, San Jose, CA, USA.10.1109/SP.2016.41 ↗
19. Liu, Y., Chen, X., Liu, C., and Song, D. (2016). Delving into transferable adversarial examples and black-box attacks. arXiv.
20. Cheng, S., Dong, Y., Pang, T., Su, H., and Zhu, J. (2019). Improving black-box adversarial attacks with a transfer-based prior. arXiv.
21. Narodytska, N., and Kasiviswanathan, S.P. (2016). Simple black-box adversarial perturbations for deep networks. arXiv.10.1109/CVPRW.2017.172 ↗
22. Li, H., Xu, X., Zhang, X., Yang, S., and Li, B. (2020, January 13–19). QEBA: Query-Efficient Boundary-Based Blackbox Attack. Proceedings of the 2020 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), Seattle, WA, USA.10.1109/CVPR42600.2020.00130 ↗
23. Query-efficient label-only attacks against black-box machine learning models10.1016/j.cose.2019.101698 ↗
24. Guo, C., Frank, J.S., and Weinberger, K.Q. (2018). Low frequency adversarial perturbation. arXiv.
25. Chen, P.Y., Zhang, H., Sharma, Y., Yi, J., and Hsieh, C.J. (2017, January 3). Zoo: Zeroth order optimization based black-box attacks to deep neural networks without training substitute models. Proceedings of the 10th ACM workshop on artificial intelligence and security, Dallas, TX, USA.10.1145/3128572.3140448 ↗
26. Deng, J., Dong, W., Socher, R., Li, L.J., Li, K., and Li, F.F. (2009, January 20–25). Imagenet: A Large-Scale Hierarchical Image Database. Proceedings of the 2009 IEEE Conference on Computer Vision and Pattern Recognition, Miami, FL, USA.10.1109/CVPR.2009.5206848 ↗
27. Image Quality Assessment: From Error Visibility to Structural Similarity10.1109/TIP.2003.819861 ↗
28. Classification score approach for detecting adversarial example in deep neural network10.1007/s11042-020-09167-z ↗