Unrestricted Black-box Adversarial Attack Using GAN with Limited Queries
Adversarial examples are inputs intentionally generated for fooling a deep neural network. Recent studies have proposed unrestricted adversarial attacks that are not norm-constrained. However, the previous unrestricted attack methods still have limitations to fool real-world applications in a black-box setting. In this paper, we present a novel method for generating unrestricted adversarial examples using GAN where an attacker can only access the top-1 final decision of a classification model. Our method, Latent-HSJA, efficiently leverages the advantages of a decision-based attack in the latent space and successfully manipulates the latent vectors for fooling the classification model. With extensive experiments, we demonstrate that our proposed method is efficient in evaluating the robustness of classification models with limited queries in a black-box setting. First, we demonstrate that our targeted attack method is query-efficient to produce unrestricted adversarial examples for a facial identity recognition model that contains 307 identities. Then, we demonstrate that the proposed method can also successfully attack a real-world celebrity recognition service.
Code (1)
Tasks
Adversarial AttackClassificationMethods 이 논문이 사용한 방법론
Similar Papers 제목 키워드 기반
ColorFool: Semantic Adversarial Colorization
Adversarial attacks that generate small L_p-norm perturbations to mislead classifiers have limited success in black-box settings and with unseen classifiers. These attacks are also not robust to defenses that use denoisi…
Adversarial AttackColorizationDenoisingStyleFool: Fooling Video Classification Systems via Style Transfer
Video classification systems are vulnerable to adversarial attacks, which can create severe security problems in video verification. Current black-box attacks need a large number of queries to succeed, resulting in high …
Adversarial AttackClassificationDenoisingStyle Transfer+1Towards Certified Defense for Unrestricted Adversarial Attacks
Certified defenses against adversarial examples are very important in safety-critical applications of machine learning. However, existing certified defense strategies only safeguard against perturbation-based adversarial…
Adversarial AttackQuery-Efficient Black-box Adversarial Examples (superceded)
Note that this paper is superceded by "Black-Box Adversarial Attacks with Limited Queries and Information." Current neural network-based image classifiers are susceptible to adversarial examples, even in the black-box …
Adversarial AttackNatural Color Fool: Towards Boosting Black-box Unrestricted Attacks
Unrestricted color attacks, which manipulate semantically meaningful color of an image, have shown their stealthiness and success in fooling both human eyes and deep neural networks. However, current works usually sacrif…
Adversarial Attack