Generalizable Black-Box Adversarial Attack With Meta Learning

Abstract

In the scenario of black-box adversarial attack, the target model's parameters are unknown, and the attacker aims to find a successful adversarial perturbation based on query feedback under a query budget. Due to the limited feedback information, existing query-based black-box attack methods often require many queries for attacking each benign example. To reduce query cost, we propose to utilize the feedback information across historical attacks, dubbed example-level adversarial transferability. Specifically, by treating the attack on each benign example as one task, we develop a meta-learning framework by training a meta generator to produce perturbations conditioned on benign examples. When attacking a new benign example, the meta generator can be quickly fine-tuned based on the feedback information of the new task as well as a few historical attacks to produce effective perturbations. Moreover, since the meta-train procedure consumes many queries to learn a generalizable generator, we utilize model-level adversarial transferability to train the meta generator on a white-box surrogate model, then transfer it to help the attack against the target model. The proposed framework with the two types of adversarial transferability can be naturally combined with any off-the-shelf query-based attack methods to boost their performance, which is verified by extensive experiments. The source code is available at https://github.com/SCLBD/MCG-Blackbox.

Adversarial Machine Learning: A Systematic Survey of Backdoor Attack, Weight Attack and Adversarial Example

“…We think that the potentials of further improving the score-based attack performance lie in how to shrink the gap between surrogate and target models, extracting what kinds of priors from surrogate models, and how to effectively combine surrogate priors and the query feedback returned by the target model. Besides, it is notable that the reported results in some latest works (e.g., CG-Attack [64] and MCG [222]) are very good, and the median query number even achieves 1 and the attack success rate achieves 100% at some easy cases (e.g., small data dimension, untargeted attack, target model with standard training). It gives us an impression that the performance of score-based attacks is hitting the ceiling, and there is limited room for improvement.…”

“…The Simulator attack [131] utilized meta learning to learn a generalized simulator (i.e., surrogate model), which can be fine-tuned by the limited feedback returned by target models. Similar to CG-Attack, the meta conditional generator (MCG) method [222] also aimed to learn the conditional adversarial distribution (CAD). The main difference is that MCG proposed a meta learning framework which captures both the example-level and modellevel adversarial transferability (introduced later in Section 5.4), such that the CAD could be adjusted according to different benign examples, and the surrogate model can also be updated based on the query feedback.…”

“…The concept example-level adversarial transferability was firstly and explicitly defined in a recent work called meta conditional generator (MCG) [222], as follows: "adversarial perturbations around different benign examples may have some similar properties". Meanwhile, some other works also implied or utilized similar ideas.…”

“…For example, the CG-Attack method [64]) proposed to learn a common conditional distribution P(x ε |x 0 ) via the conditional Glow model [130] (a variant of the flow-based model). This assumption was further relaxed in MCG method [222] that the conditional adversarial distributions around different benign examples were similar but might be slightly different. MCG proposed a meta learning framework to firstly learn a meta conditional adversarial distribution, which could be fine-tuned to more accurately capture the conditional adversarial distribution for new benign examples.…”

Benchmarking Adversarial Patch Against Aerial Detection

“…The objective of study [61] is to train a generalizable surrogate model, termed "Simulator," capable of emulating the behavior of an unknown target model. To mitigate the query cost, the authors of [132] suggest using feedback information obtained from past attacks, i.e., examplelevel adversarial transferability. By considering each attack on a benign example as an individual task, they construct a metalearning framework that involves training a meta-generator to produce perturbations based on specific benign examples.…”