Local Black-box Adversarial Attacks: A Query Efficient Approach

Abstract

Adversarial attacks have threatened the application of deep neural networks in security-sensitive scenarios. Most existing blackbox attacks fool the target model by interacting with it many times and producing global perturbations. However, global perturbations change the smooth and insignificant background, which not only makes the perturbation more easily be perceived but also increases the query overhead. In this paper, we propose a novel framework to perturb the discriminative areas of clean examples only within limited queries in black-box attacks. Our framework is constructed based on two types of transferability. The first one is the transferability of model interpretations. Based on this property, we identify the discriminative areas of a given clean example easily for local perturbations. The second is the transferability of adversarial examples. It helps us to produce a local pre-perturbation for improving query efficiency. After identifying the discriminative areas and pre-perturbing, we generate the final adversarial examples from the pre-perturbed example by querying the targeted model with two kinds of black-box attack techniques, i.e., gradient estimation and random search. We conduct extensive experiments to show that our framework can significantly improve the query efficiency during black-box perturbing with a high attack success rate. Experimental results show that our attacks outperform state-of-the-art black-box attacks under various system settings.

A Local Perturbation Generation Method for GAN-Generated Face Anti-Forensics

“…Qian et al [38] proposed the CFR attack using the interpretability of neural networks and an optimization-based attack. Xiang et al [44] utilized model interpretability and a gradient-based attack to generate an initial adversarial example. Then, they generated the final example through gradient estimation and random search.…”

Saliency Attack: Towards Imperceptible Black-box Adversarial Attack

“…As aforementioned, there have been white-box attacks or transfer-based attacks that restrict the perturbations to a small salient region. Specifically, white-box attack JSMA [26] constructs a BP-saliency map by calculating derivatives of the model output w.r.t input pixels [32], while the two transfer-based attacks [10,40] utilize CAM and Grad-CAM to extract salient regions, respectively. CAM [46] replaces the final fully connected layers with convolutional layers and global average pooling of a CNN, and localizes class-specific salient regions through forward propagation.…”

“…Thus, we propose the Saliency Attack, a novel black-box attack that recursively refines the perturbations in the salient region. It is worth mentioning that except white-box attack JSMA, the idea of restricting perturbations to a small region has also been implemented in transfer-based attacks [10,40], where class activation mapping (CAM) [46] and Grad-CAM [30] are adopted to generate the saliency maps. However, transfer-based attacks assume the data distribution for training the target model is available and thus could build a substitute model to approximate it, which actually belong to the grey-box setting where partial knowledge of the target model is known.…”

Robust and Privacy-Preserving Collaborative Learning: A Comprehensive Survey

“…Deep models are vulnerable to adversarial examples that are maliciously constructed to mislead the models to output wrong predictions but visually indistinguishable from normal samples [182]- [185]. Adversarial training [186]- [188] is one of the most effective approaches to defend deep models against adversarial examples and enhance their robustness.…”