A Survey of Black-Box Adversarial Attacks on Computer Vision Models

Bhambri, Siddhant; Muku, Sumanyu; Tulasi, Avinash; Buduru, Arun Balaji

doi:10.48550/arxiv.1912.01667

Cited by 20 publications

(27 citation statements)

References 40 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Finally, some works [17,35] have shown that it is possible to perform adversarial attacks even in real-world scenarios with physical objects. For a more thorough review of the state of the art, the reader can refer to [1,5,23,36].…”

Section: Related Workmentioning

confidence: 99%

Black-box adversarial attacks using evolution strategies

Qiu

Custode

Iacca

2021

Proceedings of the Genetic and Evolutionary Computation Conference Companion

View full text Add to dashboard Cite

In the last decade, deep neural networks have proven to be very powerful in computer vision tasks, starting a revolution in the computer vision and machine learning fields. However, deep neural networks, usually, are not robust to perturbations of the input data. In fact, several studies showed that slightly changing the content of the images can cause a dramatic decrease in the accuracy of the attacked neural network. Several methods able to generate adversarial samples make use of gradients, which usually are not available to an attacker in real-world scenarios. As opposed to this class of attacks, another class of adversarial attacks, called black-box adversarial attacks, emerged, which does not make use of information on the gradients, being more suitable for real-world attack scenarios. In this work, we compare three well-known evolution strategies on the generation of black-box adversarial attacks for image classification tasks. While our results show that the attacked neural networks can be, in most cases, easily fooled by all the algorithms under comparison, they also show that some black-box optimization algorithms may be better in "harder" setups, both in terms of attack success rate and efficiency (i.e., number of queries). CCS CONCEPTS• Computing methodologies → Machine learning; Computer vision; Search methodologies.

show abstract

Section: Related Workmentioning

confidence: 99%

Black-box adversarial attacks using evolution strategies

Qiu

Custode

Iacca

2021

Proceedings of the Genetic and Evolutionary Computation Conference Companion

View full text Add to dashboard Cite

show abstract

“…Black-box attacks assume that the attacker only knows the outputs of the target DNN, e.g., category labels or confidence scores. They are categorized into three main classes [25]: gradient estimation-based [26]- [28], transferability-based [20], [29], [30], and local search-based methods [31]- [33]. The gradient estimation-based methods perform adversarial attacks by estimating the gradient of the target model.…”

Section: B Black-box Adversarial Attacksmentioning

confidence: 99%

Attention-Guided Black-box Adversarial Attacks with Large-Scale Multiobjective Evolutionary Optimization

Wang¹,

Yin²,

Jiang³

et al. 2021

Preprint

View full text Add to dashboard Cite

Fooling deep neural networks (DNNs) with the black-box optimization has become a popular adversarial attack fashion, as the structural prior knowledge of DNNs is always unknown. Nevertheless, recent black-box adversarial attacks may struggle to balance their attack ability and visual quality of the generated adversarial examples (AEs) in tackling high-resolution images. In this paper, we propose an attention-guided blackbox adversarial attack based on the large-scale multiobjective evolutionary optimization, termed as LMOA. By considering the spatial semantic information of images, we firstly take advantage of the attention map to determine the perturbed pixels. Instead of attacking the entire image, reducing the perturbed pixels with the attention mechanism can help to avoid the notorious curse of dimensionality and thereby improves the performance of attacking. Secondly, a large-scale multiobjective evolutionary algorithm is employed to traverse the reduced pixels in the salient region. Benefiting from its characteristics, the generated AEs have the potential to fool target DNNs while being imperceptible by the human vision. Extensive experimental results have verified the effectiveness of the proposed LMOA on the ImageNet dataset. More importantly, it is more competitive to generate highresolution AEs with better visual quality compared with the existing black-box adversarial attacks.

show abstract

“…These methods aim to detect the adversarial examples or to restore the adversarial input to be closer to the original image space. Adversarial Detection methods (Bhambri et al 2020) include MagNet, Feature Squeezing, and Convex Adversarial Polytope. The MagNet (Meng and Chen 2017) method consists of two parts: detector and reformer.…”

Section: Common Defense Strategiesmentioning

confidence: 99%

Saliency Diversified Deep Ensemble for Robustness to Adversaries

Bogun¹,

Kostadinov²,

Borth³

2021

Preprint

View full text Add to dashboard Cite

Deep learning models have shown incredible performance on numerous image recognition, classification, and reconstruction tasks. Although very appealing and valuable due to their predictive capabilities, one common threat remains challenging to resolve. A specifically trained attacker can introduce malicious input perturbations to fool the network, thus causing potentially harmful mispredictions. Moreover, these attacks can succeed when the adversary has full access to the target model (white-box) and even when such access is limited (black-box setting). The ensemble of models can protect against such attacks but might be brittle under shared vulnerabilities in its members (attack transferability). To that end, this work proposes a novel diversity-promoting learning approach for the deep ensembles. The idea is to promote saliency map diversity (SMD) on ensemble members to prevent the attacker from targeting all ensemble members at once by introducing an additional term in our learning objective. During training, this helps us minimize the alignment between model saliencies to reduce shared member vulnerabilities and, thus, increase ensemble robustness to adversaries. We empirically show a reduced transferability between ensemble members and improved performance compared to the state-of-the-art ensemble defense against medium and highstrength white-box attacks. In addition, we demonstrate that our approach combined with existing methods outperforms state-of-the-art ensemble algorithms for defense under whitebox and black-box attacks.

show abstract

A Survey of Black-Box Adversarial Attacks on Computer Vision Models

Cited by 20 publications

References 40 publications

Black-box adversarial attacks using evolution strategies

Black-box adversarial attacks using evolution strategies

Attention-Guided Black-box Adversarial Attacks with Large-Scale Multiobjective Evolutionary Optimization

Saliency Diversified Deep Ensemble for Robustness to Adversaries

Contact Info

Product

Resources

About