Magnitude Adversarial Spectrum Search-based Black-box Attack against Image Classification

Abstract

Recent development has revealed that deep neural networks used in image classification systems are vulnerable to adversarial attacks. In this thesis, we design an untargeted query-efficient decision-based black-box attack against robust image classification models that produce imperceptible adversarial examples. The proposed attack method, Magnitude Adversarial Spectrum Search-based Attack (MASSA), includes two novel components to generate the initial noise and reduce the noise in the frequency domain. Our experiments show that MASSA requires significantly fewer queries than the state-of-the-art HopSkipJumpAttack (HSJA). In addition, MASSA can create adversarial examples with 74, 16% lower l 2 distance than HSJA after only 250 queries. Finally, we demonstrate that MASSA bypasses two defense mechanisms and should be used to evaluate the robustness of future defenses.iii SammendragDe siste årene har forskning vist at dype nevrale nettverk som brukes i bildeklassifiseringssystemer er sårbare mot fiendtlige angrep. I denne oppgaven utformer vi et umålrettet søkeeffektivt beslutningsbasert svart-boks angrep mot robuste bildeklassifiseringsmodeller som produserer skjulte endringer i bilder. Den utviklede angrepsmetoden, Magnitude Adversarial Spectrum Search-based Attack (MASSA), inkluderer blant annet to nyskapende komponenter for å generere den initielle støyen og redusere støyen i frekvensdomenet. Eksperimentene våre viser at MASSA krever betydlig faerre spørringer enn dagens ledende angrep HopSkipJumpAttack (HSJA). I tillegg er MASSA i stand til å produsere fiendtlige bilder med 74, 16% lavere avstand enn HSJA etter kun 250 spørringer. Til slutt demonstrerer vi at MASSA slår to forsvarsmekanismer og bør brukes til å evaluere robustheten til fremtidige forsvar. v Preface This is the Master Thesis written by Kim André B. Midtlid and Johannes Åsheim. The thesis was conducted during the spring semester of 2022 at NTNU. Our work was supervised by Professor Jingyue Li at the Institute of Computer Science and Informatics at NTNU. We would like to thank Li for his continuous assistance and helpful insights. Additionally, we would like to thank friends and family for their motivation and ongoing support throughout our years of study. vii