On the Design of Black-Box Adversarial Examples by Leveraging Gradient-Free Optimization and Operator Splitting Method

Abstract

Robust machine learning is currently one of the most prominent topics which could potentially help shaping a future of advanced AI platforms that not only perform well in average cases but also in worst cases or adverse situations. Despite the long-term vision, however, existing studies on black-box adversarial attacks are still restricted to very specific settings of threat models (e.g., single distortion metric and restrictive assumption on target model's feedback to queries) and/or suffer from prohibitively high query complexity. To push for further advances in this field, we introduce a general framework based on an operator splitting method, the alternating direction method of multipliers (ADMM) to devise efficient, robust black-box attacks that work with various distortion metrics and feedback settings without incurring high query complexity. Due to the black-box nature of the threat model, the proposed ADMM solution framework is integrated with zeroth-order (ZO) optimization and Bayesian optimization (BO), and thus is applicable to the gradient-free regime. This results in two new black-box adversarial attack generation methods, ZO-ADMM and BO-ADMM. Our empirical evaluations on image classification datasets show that our proposed approaches have much lower function query complexities compared to state-of-the-art attack methods, but achieve very competitive attack success rates.

Threat of Adversarial Attacks on Deep Learning in Computer Vision: A Survey

“…Ilyas et al [88] revisited the zeroth-order optimization (zoo) and proposed a query-based attack using bandit optimization that exploits prior information about the target model gradient. From zoo perspective, Zhao et al [89] also proposed to augment the optimization with an ADMMbased framework.…”

Simple and Efficient Hard Label Black-box Adversarial Attacks in Low Query Budget Regimes

“…Finally, there has been some recent interest in leveraging Bayesian optimization (BO) for constructing adversarial perturbations. For example, Zhao et al [36] use BO to solve the -step of an alternating direction of method multipliers approach, Co et al [11] searches within a set of procedural noise perturbations using BO and Gopakumar et al [15] use BO to find maximal distortion error by optimizing perturbations defined using 3 parameters. On the other hand, prior work in which Bayesian optimization plays a central role, the use cases and experiments are performed only in relatively low-dimensional settings, highlighting the main challenge of its application: Suya et al [33] examine an attack on a spam email classifier with 57 input features, and in Co [10] image classifiers are attacked but notably, the attack does not scale beyond MNIST classifiers.…”

Towards Real-Time DNN Inference on Mobile Platforms with Model Pruning and Compiler Optimization

“…Although the structure constraints make the problem nondifferentiable and more complicated, ADMM is able to split the original problem into several easier sub-problems, and iteratively solve them until convergence Zhao et al, 2019a]. We apply column pruning for style transfer and kernel pruning for coloring and super resolution.…”