Making Targeted Black-box Evasion Attacks Effective and Efficient

Abstract

We investigate how an adversary can optimally use its query budget for targeted evasion attacks against deep neural networks in a blackbox setting. We formalize the problem setting and systematically evaluate what benefits the adversary can gain by using substitute models. We show that there is an exploration-exploitation tradeoff in that query efficiency comes at the cost of effectiveness. We present two new attack strategies for using substitute models and show that they are as effective as previous "query-only" techniques but require significantly fewer queries, by up to three orders of magnitude. We also show that an agile adversary capable of switching through different attack techniques can achieve pareto-optimal efficiency. We demonstrate our attack against Google Cloud Vision showing that the difficulty of black-box attacks against real-world prediction APIs is significantly easier than previously thought (requiring ≈500 queries instead of ≈20,000 as in previous works).

State of AI-Based Monitoring in Smart Manufacturing and Introduction to Focused Section

“…2) Robustness: In practical applications, it has been recently shown that machine learning models are vulnerable to uncertainties (i.e., data outliers and measurement noise) of the input data which may cause misclassification [73]. It is possible to enhance the robustness of machine learning model via robust loss functions, parameter regularization, and reliable optimizers.…”

A Generative Model based Adversarial Security of Deep Learning and Linear Classifier Models

“…Previous methods have shown success against a specific set of attack methods and have generally failed to provide complete and generic protection [14]. This field has been spreading rapidly, and, in this field, lots of dangers have attracted increasing attention from escaping the filters of unwanted and phishing e-mails, to poisoning the sensor data of a car or aircraft that drives itself [4,41]. Disaster scenarios can occur if any precautions are not taken in these systems [30].…”