Black-box Adversarial Attacks against Dense Retrieval Models: A Multi-view Contrastive Learning Method

Liu, Yu-An; Zhang, Ruqing; Guo, Jiafeng; de Rijke, Maarten; Chen, Wei; Fan, Yixing; Cheng, Xueqi

doi:10.1145/3583780.3614793

Cited by 6 publications

(4 citation statements)

References 24 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…This method can effectively bypass the defense mechanisms of different models, improving the success rate and transferability of the attack. Liu et al [58] first proposed ensemble attacks by averaging the predictions (probability) of multiple models and using existing adversarial attack methods (such as FGSM and PGD) to improve the transferability of adversarial examples. Dong et al [56] Although existing methods have shown some improvement in the transferability of adversarial examples, the effect is insignificant.…”

Section: Model Ensemble Attacksmentioning

confidence: 99%

Enhance Stealthiness and Transferability of Adversarial Attacks with Class Activation Mapping Ensemble Attack

Xia,

Zhang,

Kang

et al. 2024

Proceedings 2024 Network and Distributed System Security Symposium

View full text Add to dashboard Cite

Although there has been extensive research on the transferability of adversarial attacks, existing methods for generating adversarial examples suffer from two significant drawbacks: poor stealthiness and low attack efficacy under low-round attacks. To address the above issues, we creatively propose an adversarial example generation method that ensembles the class activation maps of multiple models, called class activation mapping ensemble attack. We first use the class activation mapping method to discover the relationship between the decision of the Deep Neural Network and the image region. Then we calculate the class activation score for each pixel and use it as the weight for perturbation to enhance the stealthiness of adversarial examples and improve attack performance under low attack rounds. In the optimization process, we also ensemble class activation maps of multiple models to ensure the transferability of the adversarial attack algorithm. Experimental results show that our method generates adversarial examples with high perceptibility, transferability, attack performance under low-round attacks, and evasiveness. Specifically, when our attack capability is comparable to the most potent attack (VMIFGSM), our perceptibility is close to the best-performing attack (TPGD). For non-targeted attacks, our method outperforms the VMIFGSM by an average of 11.69% in attack capability against 13 target models and outperforms the TPGD by an average of 37.15%. For targeted attacks, our method achieves the fastest convergence, the most potent attack efficacy, and significantly outperforms the eight baseline methods in lowround attacks. Furthermore, our method can evade defenses and be used to assess the robustness of models 1 .

show abstract

Section: Model Ensemble Attacksmentioning

confidence: 99%

Enhance Stealthiness and Transferability of Adversarial Attacks with Class Activation Mapping Ensemble Attack

Xia,

Zhang,

Kang

et al. 2024

Proceedings 2024 Network and Distributed System Security Symposium

View full text Add to dashboard Cite

show abstract

“…The study of transfer-based attacks reveals that different classification models tend to have similar decision boundaries for the same classification tasks [13]. In this paper, we assume that the attacker can access pretrained local models, which is a common assumption used in transfer-based attacks.…”

Section: Basic Ideamentioning

confidence: 99%

“…In this paper, we assume that the attacker can access pretrained local models, which is a common assumption used in transfer-based attacks. Inspired by [13], for a non-targeted attack, if a point within the perturbation constraint is far from the decision boundary of the clean image which is found in the local surrogate model, it may be an adversarial example for the target model or it may accelerate the adversarial attack. Based on this idea, we roughly regard the process of searching for adversarial examples as a problem of minimizing the true class probability along the correct classification direction of the surrogate model.…”

Section: Basic Ideamentioning

confidence: 99%

“…Current existing black-box attacks can be categorized into transfer-based and query-based methods according to whether the attacker needs to query the target model. Transfer-based methods [12,13] can launch a black-box attack without model queries, which leverages the transferability of adversarial examples, i.e., an adversarial example generated by one visual model may fool other neural networks with different architectures trained on the same task. In consequence, the consistency between the victim model and the surrogate model is crucial, and greatly influences the attack success rate.…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

ADDA: An Adversarial Direction-Guided Decision-Based Attack via Multiple Surrogate Models

Li,

Liu

2023

Mathematics

View full text Add to dashboard Cite

Over the past decade, Convolutional Neural Networks (CNNs) have been extensively deployed in security-critical areas; however, the security of CNN models is threatened by adversarial attacks. Decision-based adversarial attacks, wherein an attacker relies solely on the final output label of the target model to craft adversarial examples, are the most challenging yet practical adversarial attacks. However, existing decision-based adversarial attacks generally suffer from poor query efficiency or low attack success rate, especially for targeted attacks. To address these issues, we propose a query-efficient Adversarial Direction-guided Decision-based Attack (ADDA), which exploits the advantages of transfer-based priors and the benefits of a single query. The transfer-based priors provided by the gradients of multiple different surrogate models can be utilized to suggest the most promising search directions for generating adversarial examples. The query consumption during the ADDA attack is mainly derived from a single query evaluation of the candidate adversarial samples, which significantly saves the number of queries. Experimental results on several ImageNet classifiers, including l∞ and l2 threat models, demonstrate that our proposed approach overwhelmingly outperforms existing state-of-the-art decision-based attacks in terms of both query efficiency and attack success rate. We show case studies of ADDA against a real-world API in which it is successfully able to fool the Google Cloud Vision API after only a few queries.

show abstract

Towards Robustness Analysis of E-Commerce Ranking System

Wang,

Huang,

Cheng

et al. 2024

Companion Proceedings of the ACM Web Conference 2024

View full text Add to dashboard Cite

Information retrieval (IR) is a pivotal component in various applications. Recent advances in machine learning (ML) have enabled the integration of ML algorithms into IR, particularly in ranking systems. While there is a plethora of research on the robustness of ML-based ranking systems, these studies largely neglect commercial e-commerce systems and fail to establish a connection between real-world and manipulated query relevance. In this paper, we present the first systematic measurement study on the robustness of e-commerce ranking systems. We define robustness as the consistency of ranking outcomes for semantically identical queries. To quantitatively analyze robustness, we propose a novel metric that considers both ranking position and item-specific information that are absent in existing metrics. Our large-scale measurement study with real-world data from e-commerce retailers reveals an open opportunity to measure and improve robustness since semantically identical queries often yield inconsistent ranking results. Based on our observations, we propose several solution directions to enhance robustness, such as the use of Large Language Models. Note that the issue of robustness discussed herein does not constitute an error or oversight. Rather, in scenarios where there exists a vast array of choices, it is feasible to present a multitude of products in various permutations, all of which could be equally appealing. However, this extensive selection may lead to customer confusion. As e-commerce retailers use various techniques to improve the quality of search results, we hope that this research offers valuable guidance for measuring the robustness of the ranking systems.

show abstract

Black-box Adversarial Attacks against Dense Retrieval Models: A Multi-view Contrastive Learning Method

Cited by 6 publications

References 24 publications

Enhance Stealthiness and Transferability of Adversarial Attacks with Class Activation Mapping Ensemble Attack

Enhance Stealthiness and Transferability of Adversarial Attacks with Class Activation Mapping Ensemble Attack

ADDA: An Adversarial Direction-Guided Decision-Based Attack via Multiple Surrogate Models

Towards Robustness Analysis of E-Commerce Ranking System

Contact Info

Product

Resources

About