RamBoAttack: A Robust and Query Efficient Deep Neural Network Decision Exploit

Abstract

Machine learning models are critically susceptible to evasion attacks from adversarial examples. Generally, adversarial examples-modified inputs deceptively similar to the original input-are constructed under whitebox access settings by adversaries with full access to the model. However, recent attacks have shown a remarkable reduction in the number of queries to craft adversarial examples using blackbox attacks. Particularly alarming is the now, practical, ability to exploit simply the classification decision (hard-label only) from a trained model's access interface provided by a growing number of Machine Learning as a Service (MLaaS) providers-including Google, Microsoft, IBM-and used by a plethora of applications incorporating these models. An adversary's ability to exploit only the predicted hard-label from a model-query to craft adversarial examples is distinguished as a decision-based attack.In our study, we first deep-dive into recent state-of-theart decision-based attacks in ICLR and S&P to highlight the costly nature of discovering low distortion adversarial examples employing approximate gradient estimation methods. We develop a robust class of query efficient attacks capable of avoiding entrapment in a local minimum and misdirection from noisy gradients seen in gradient estimation methods. The attack method we propose, RamBoAttack, exploits the notion of Randomized Block Coordinate Descent to explore the hidden classifier manifold, targeting perturbations to manipulate only localized input features to address the issues of gradient estimation methods. Importantly, the RamBoAttack is demonstrably more robust to the different sample inputs available to an adversary and/or the targeted class. Overall, for a given target class, RamBoAttack is demonstrated to be more robust at achieving a lower distortion and higher attack success rate within a given query budget. We curate our results using the large-scale high-resolution ImageNet dataset and open-source our attack, test samples and artifacts.

D-BADGE: Decision-Based Adversarial Batch Attack With Directional Gradient Estimation

“…Reliable attack precisely selects the magnitude of an update [15], [19]. The genetic algorithm was proposed to be applied, finding the optimal step on a sparse decision space [29]. Wu et al introduced Decision-based Universal Attack (DUAttack), which is an algorithm to build a universal perturbation using decisions [11].…”

Cube-Evo: A Query-Efficient Black-Box Attack on Video Classification System

“…The mutation operation in DE encodes the real number space and realizes the diversity of offspring through the mutation operation, e.g., randomly changing the partial bits of p r (Ω r ) from 0 to 1 while we perform in the binary space. Since mutation operation is the critical component of the evolution strategy for population diversity, one recent work [38] proposed to combine the uniform crossover and mutation to achieve richer offspring diversity. Inspired by the DE algorithm and the GA, we obtain the optimal binary parameter Ω through the uniform crossover and mutation in a hybrid and sequential manner.…”

Efficient Query-Based Attack against ML-Based Android Malware Detection under Zero Knowledge Setting

“…Unfortunately, ML-based AMD techniques are vulnerable to attacks [20,22,24,30,64,65,71]. To evade them, adversaries can manipulate malicious applications in the problem space, causing the feature vector to cross the ML classifier's decision boundary.…”