Black-Box Adversarial Attack with Transferable Model-based Embedding
We present a new method for black-box adversarial attack. Unlike previous methods that combined transfer-based and scored-based methods by using the gradient or initialization of a surrogate white-box model, this new method tries to learn a low-dimensional embedding using a pretrained model, and then performs efficient search within the embedding space to attack an unknown target network. The method produces adversarial perturbations with high level semantic patterns that are easily transferable. We show that this approach can greatly improve the query efficiency of black-box adversarial attack across different target network architectures. We evaluate our approach on MNIST, ImageNet and Google Cloud Vision API, resulting in a significant reduction on the number of queries. We also attack adversarially defended networks on CIFAR10 and ImageNet, where our method not only reduces the number of queries, but also improves the attack success rate.
Code (1)
Tasks
Adversarial AttackSimilar Papers 제목 키워드 기반
Generating Transferable and Stealthy Adversarial Patch via Attention-guided Adversarial Inpainting
Adversarial patch attacks can fool the face recognition (FR) models via small patches. However, previous adversarial patch attacks often result in unnatural patterns that are easily noticeable. Generating transferable an…
Face RecognitionDP-TRAE: A Dual-Phase Merging Transferable Reversible Adversarial Example for Image Privacy Protection
In the field of digital security, Reversible Adversarial Examples (RAE) combine adversarial attacks with reversible data hiding techniques to effectively protect sensitive data and prevent unauthorized analysis by malici…
A Theory of Transfer-Based Black-Box Attacks: Explanation and Implications
Transfer-based attacks are a practical method of black-box adversarial attacks, in which the attacker aims to craft adversarial examples from a source (surrogate) model that is transferable to the target model. A wide ra…
Two Sides of the Same Coin: White-box and Black-box Attacks for Transfer Learning
Transfer learning has become a common practice for training deep learning models with limited labeled data in a target domain. On the other hand, deep models are vulnerable to adversarial attacks. Though transfer learnin…
Transfer LearningTowards Transferable Targeted Attack
An intriguing property of adversarial examples is their transferability, which suggests that black-box attacks are feasible in real-world applications. Previous works mostly study the transferability on non-targeted sett…
Metric Learning