Towards Query-Efficient Black-Box Adversary with Zeroth-Order Natural Gradient Descent

Abstract

Despite the great achievements of the modern deep neural networks (DNNs), the vulnerability/robustness of state-of-the-art DNNs raises security concerns in many application domains requiring high reliability. Various adversarial attacks are proposed to sabotage the learning performance of DNN models. Among those, the black-box adversarial attack methods have received special attentions owing to their practicality and simplicity. Black-box attacks usually prefer less queries in order to maintain stealthy and low costs. However, most of the current black-box attack methods adopt the first-order gradient descent method, which may come with certain deficiencies such as relatively slow convergence and high sensitivity to hyper-parameter settings. In this paper, we propose a zeroth-order natural gradient descent (ZO-NGD) method to design the adversarial attacks, which incorporates the zeroth-order gradient estimation technique catering to the black-box attack scenario and the second-order natural gradient descent to achieve higher query efficiency. The empirical evaluations on image classification datasets demonstrate that ZO-NGD can obtain significantly lower model query complexities compared with state-of-the-art attack methods.

Targeted Attention Attack on Deep Learning Models in Road Sign Recognition

“…The authors employed the natural evolution strategy (NES) to estimate the gradient and adopted the projected gradient descent to generate adversarial examples. Based on [26] , Zhao et al [27] derived the Fisher information matrix (FIM) and incorporated FIM with the second-order natural gradient descent (NGD) to achieve high query-efficiency.…”

“…Finally, transformation based attack [33], [34], [35], [36] crafts adversarial images by shifting pixels' spatial location [27] Boundary Attack [28] Pointwise Attack [29] Boundary Attack ++ [30] HSJA [31] QEBA [32] stAdv [33] Engstrom et al [34] Wang et al [35] Chen et al [36] instead of directly modifying their value. For example, Xiao et al [33] proposed the spatially transformed adversarial (stAdv) method, which replaces the L p -norm with local geometry distortion in measuring the magnitude of perturbations.…”

Back in Black: A Comparative Evaluation of Recent State-Of-The-Art Black-Box Attacks

“…New score based attacks include qMeta [24], P-RGF [25], ZO-ADMM [26], TREMBA [27], Square attack [28], ZO-NGD [29] and PPBA [30].…”

“…We cover 7 recently proposed score type attacks. These attacks include the square attack [28], the Zeroth-Order Natural Gradient Descent attack (ZO-NGD) [29], the Projection and Policy Driven Attack (PPBA) [30], the Zerothorder Optimization Alternating Direction Method of Multiplers (ZO-ADMM) attack [26], the prior-guided random gradient-free (P-RGF) attack [25], the TRansferable EMbedding based Black-box Attack (TREMBA) [27] and the qMeta attack [24].…”

“…The Zeroth-Order Natural Gradient Descent (ZO-NGD) attack is a score-based, black box attack proposed in [29] as a query efficient attack utilizing a novel attack optimization technique. In particular the attack approximates a Fisher information matrix over the distribution of inputs and subsequent outputs of the classifier.…”