Square Attack: A Query-Efficient Black-Box Adversarial Attack via Random Search

Andriushchenko, Maksym; Croce, Francesco; Flammarion, Nicolas; Hein, Matthias

doi:10.1007/978-3-030-58592-1_29

Cited by 446 publications

(391 citation statements)

References 25 publications

Supporting

Mentioning

345

Contrasting

Order By: Relevance

“…In this section, we compare algorithms based on a selection of state-of-the-art DFO methods. In particular we consider an improved version of the BOBYQA based algorithm (Ughi et al 2019), GenAttack algorithm (Alzantot et al 2019), Parsimonious algorithm (Moon et al 2019), Square algorithm (Andriushchenko et al 2020) and Frank-Wolfe algorithm (Chen et al 2020) in the following two frameworks: -Section 4.3 considers the canonical setup for black-box adversarial attacks on which the considered algorithms have been tuned in their respective articles. Specifically, we consider attacks on networks trained adversarially or not on CIFAR10 and ImageNet, two popular datasets in the literature, and with no further defense implemented.…”

Section: Comparison Of Derivative Free Methodsmentioning

confidence: 99%

“…It was demonstrated in Chen et al (2017) that these algorithms are especially effective when numerous adversarial examples are computed, but become less efficient when an individual adversarial examples is considered. Following the introduction of ZOO, there have been numerous improvements using other model-free DFO based approaches, see for example (Al-Dujaili and O'Reilly 2020; Alzantot et al 2019;Andriushchenko et al 2020;Chen et al 2020;Ilyas et al 2018Ilyas et al , 2019Moon et al 2019). Many of these algorithms were developed in parallel, and so have not yet been bench-marked in a consistent setting, e.g.…”

Section: Adversarial Specificitymentioning

confidence: 99%

“…In this article, we present two frameworks for comparative evaluation of the existing algorithms that claim to have the fewest number of DNN queries to generate a successful attack. These are: GenAttack (Alzantot et al 2019) which is based on a genetic direct-search method; Parsimonious algorithm (Moon et al 2019), based on a combinatorial direct-search method on the vertices of the perturbation domain; the Square algorithm (Andriushchenko et al 2020), based on a randomized direct-search method on the vertices of the perturbation domain; the Frank-Wolfe algorithm (Chen et al 2020) based on a momentum mechanism that approximates the gradient via finite differences; and BOBYQA (Ughi et al 2019), which explicitly develops models to approximate the loss function and then minimizes the model over a trust region using techniques from continuous optimization. The aforementioned list of algorithms covers the leading classes of DFO algorithms for limited function evaluations, see e.g., (Conn et al 2009;Larson et al 2019) for recent reviews of DFO methods.…”

Section: Adversarial Specificitymentioning

confidence: 99%

“…The Parsimonious algorithm (Moon et al 2019) implements a combinatorial direct-search within the different possible vertices, initializing the perturbation to − ∞ for all the pixels and then switching collections of them to + ∞ , when such an action decreases the loss function. The Square algorithm (Andriushchenko et al 2020) instead implements a randomized direct-search method where square blocks of pixels are iteratively perturbed to be either + ∞ or − ∞ ; -Those where a direct search over the perturbation domain is performed using a genetic method such as GenAttack (Alzantot et al 2019). -Those referred to as model-based methods, where the loss function ( 1) is approximated from its samples with a continuous function which is then minimized using techniques from continuous optimization.…”

Section: Derivative Free Optimization For Adversarial Examplesmentioning

confidence: 99%

See 3 more Smart Citations

An empirical study of derivative-free-optimization algorithms for targeted black-box attacks in deep neural networks

2021

View full text Add to dashboard Cite

We perform a comprehensive study on the performance of derivative free optimization (DFO) algorithms for the generation of targeted black-box adversarial attacks on Deep Neural Network (DNN) classifiers assuming the perturbation energy is bounded by an $$\ell _\infty$$ ℓ ∞ constraint and the number of queries to the network is limited. This paper considers four pre-existing state-of-the-art DFO-based algorithms along with a further developed algorithm built on BOBYQA, a model-based DFO method. We compare these algorithms in a variety of settings according to the fraction of images that they successfully misclassify given a maximum number of queries to the DNN. The experiments disclose how the likelihood of finding an adversarial example depends on both the algorithm used and the setting of the attack; algorithms limiting the search of adversarial example to the vertices of the $$\ell ^\infty$$ ℓ ∞ constraint work particularly well without structural defenses, while the presented BOBYQA based algorithm works better for especially small perturbation energies. This variance in performance highlights the importance of new algorithms being compared to the state-of-the-art in a variety of settings, and the effectiveness of adversarial defenses being tested using as wide a range of algorithms as possible.

show abstract

Section: Comparison Of Derivative Free Methodsmentioning

confidence: 99%

Section: Adversarial Specificitymentioning

confidence: 99%

Section: Adversarial Specificitymentioning

confidence: 99%

Section: Derivative Free Optimization For Adversarial Examplesmentioning

confidence: 99%

See 2 more Smart Citations

An empirical study of derivative-free-optimization algorithms for targeted black-box attacks in deep neural networks

2021

View full text Add to dashboard Cite

show abstract

“…For transfer-based attack, we generate adversarial example by applying PGD/CW attacks on an adversarial trained WideResNet34-10. For query-based attack, we adopt a representative attack: SQUARE, which outperforms other blackbox attacks and is comparable with white-box attacks[24]. As shown in Table3, we can observe significant improvements as claimed in white-box scenario.…”

mentioning

confidence: 91%

Class Aware Robust Training

Xia

Chen

Dai

et al. 2021

ICASSP 2021 - 2021 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP)

View full text Add to dashboard Cite

Adversarial training (AT) has been one of the most effective ways to defend adversarial attack. However, existing AT variants exhibit a large imbalanced robust accuracies among different classes, which might harm the robustness of some important class(es) in some real-world applications. For instance, diseased cells are much more important than healthy ones in medical image recognition. Given a certain task, the important class is often a priori. To improve robust accuracy of the important class(es), we are the first to propose a novel adversarial training method with class imbalance taken into account. We term it Class-Aware Robust Training (CART). CART can significantly increase the robustness of the important class(es) by an optional weighted combination of original adversarial example generation and that of the important class. Extensive experiments on three benchmark datasets verify the efficacy of CART for enhancing the robust accuracy of important classes while keeping competitive average robust accuracy.

show abstract

MA‐CAT: Misclassification‐Aware Contrastive Adversarial Training

Zhi,

Yu,

et al. 2024

Advanced Intelligent Systems

View full text Add to dashboard Cite

Vulnerability to adversarial examples poses a significant challenge to the secure application of deep neural networks. Adversarial training and its variants have shown great potential in addressing this problem. However, such approaches, which directly optimize the decision boundary, often result in overly complex adversarial decision boundaries that are detrimental to generalization. To deal with this issue, a novel plug‐and‐play method known as Misclassification‐Aware Contrastive Adversarial Training (MA‐CAT) from the perspective of data distribution optimization is proposed. MA‐CAT leverages supervised decoupled contrastive learning to cluster nature examples within the same class in the logit space, indirectly increasing the margins of examples. Moreover, by taking into account the varying difficulty levels of adversarial training for different examples, MA‐CAT adaptively customizes the strength of adversarial training for each example using an instance‐wise misclassification‐aware adaptive temperature coefficient. Extensive experiments on the CIFAR‐10, CIFAR‐100, and SVHN datasets demonstrate that MA‐CAT can be easily integrated into existing models and significantly improves robustness with minimal computational cost.

show abstract

Square Attack: A Query-Efficient Black-Box Adversarial Attack via Random Search

Cited by 446 publications

References 25 publications

An empirical study of derivative-free-optimization algorithms for targeted black-box attacks in deep neural networks

An empirical study of derivative-free-optimization algorithms for targeted black-box attacks in deep neural networks

Class Aware Robust Training

MA‐CAT: Misclassification‐Aware Contrastive Adversarial Training

Contact Info

Product

Resources

About