Generalizable Black-Box Adversarial Attack with Meta Learning
In the scenario of black-box adversarial attack, the target model's parameters are unknown, and the attacker aims to find a successful adversarial perturbation based on query feedback under a query budget. Due to the limited feedback information, existing query-based black-box attack methods often require many queries for attacking each benign example. To reduce query cost, we propose to utilize the feedback information across historical attacks, dubbed example-level adversarial transferability. Specifically, by treating the attack on each benign example as one task, we develop a meta-learning framework by training a meta-generator to produce perturbations conditioned on benign examples. When attacking a new benign example, the meta generator can be quickly fine-tuned based on the feedback information of the new task as well as a few historical attacks to produce effective perturbations. Moreover, since the meta-train procedure consumes many queries to learn a generalizable generator, we utilize model-level adversarial transferability to train the meta-generator on a white-box surrogate model, then transfer it to help the attack against the target model. The proposed framework with the two types of adversarial transferability can be naturally combined with any off-the-shelf query-based attack methods to boost their performance, which is verified by extensive experiments.
Code (1)
Tasks
Adversarial AttackMeta-LearningSimilar Papers 제목 키워드 기반
Meta Gradient Adversarial Attack
In recent years, research on adversarial attacks has become a hot spot. Although current literature on the transfer-based adversarial attack has achieved promising results for improving the transferability to unseen blac…
Adversarial AttackMeta-LearningBoosting Black-Box Adversarial Attacks with Meta Learning
Deep neural networks (DNNs) have achieved remarkable success in diverse fields. However, it has been demonstrated that DNNs are very vulnerable to adversarial examples even in black-box settings. A large number of black-…
Adversarial AttackMeta-LearningMeta Invariance Defense Towards Generalizable Robustness to Unknown Adversarial Attacks
Despite providing high-performance solutions for computer vision tasks, the deep neural network (DNN) model has been proved to be extremely vulnerable to adversarial attacks. Current defense mainly focuses on the known a…
Adversarial DefenseAdversarial Robustnessimage-classificationImage ClassificationBehavior-Aware and Generalizable Defense Against Black-Box Adversarial Attacks for ML-Based IDS
Machine learning based intrusion detection systems are increasingly targeted by black box adversarial attacks, where attackers craft evasive inputs using indirect feedback such as binary outputs or behavioral signals lik…
Change Point DetectionIntrusion DetectionAdversarial AttackTowards Adaptive Meta-Gradient Adversarial Examples for Visual Tracking
In recent years, visual tracking methods based on convolutional neural networks and Transformers have achieved remarkable performance and have been successfully applied in fields such as autonomous driving. However, the …
Adversarial AttackAutonomous DrivingMeta-LearningVisual Tracking