Blackbox Attacks via Surrogate Ensemble Search
Nov 28, 2022
Speakers
Chengyu Song
Speaker · 0 followers
Srikanth V. Krishnamurthy
Speaker · 0 followers
Amit K. Roy-Chowdhury
Speaker · 0 followers
M. Salman Asif
Speaker · 0 followers
About
Blackbox adversarial attacks can be categorized into transfer- and query-based attacks. Transfer methods do not require any feedback from the victim model, but provide lower success rates compared to query-based methods. Query attacks often require a large number of queries for success. To achieve the best of both approaches, recent efforts have tried to combine them, but still require hundreds of queries to achieve high success rates (especially for targeted attacks). In this paper, we propose a novel method for blackbox attacks via surrogate ensemble search (BASES) that can generate highly successful blackbox attacks using an extremely small number of queries. We first define a perturbation machine that generates a perturbed image by minimizing a weighted loss function over a fixed set of surrogate models. To generate an attack for a given victim model, we search over the weights in the loss function using queries generated by the perturbation machine. Since the dimension of the search space is small (same as the number of surrogate models), the search requires a small number of queries. We demonstrate that our proposed method achieves better success rate with at least 30× fewer queries compared to state-of-the-art methods on different image classifiers trained with ImageNet (including VGG-19, DenseNet-121, and ResNext-50). In particular, our method requires as few as 3 queries per image (on average) to achieve more than a 90% success rate for targeted attacks and 1–2 queries per image for over a 99% success rate for untargeted attacks. Our method is also effective on Google Cloud Vision API and achieved a 91% untargeted attack success rate with 2.9 queries per image. We also show that the perturbations generated by our proposed method are highly transferable and can be adopted for hard-label blackbox attacks.Blackbox adversarial attacks can be categorized into transfer- and query-based attacks. Transfer methods do not require any feedback from the victim model, but provide lower success rates compared to query-based methods. Query attacks often require a large number of queries for success. To achieve the best of both approaches, recent efforts have tried to combine them, but still require hundreds of queries to achieve high success rates (especially for targeted attacks). In this paper, we propose…
Organizer
NeurIPS 2022
Account · 952 followers
Like the format? Trust SlidesLive to capture your next event!
Professional recording and live streaming, delivered globally.
Sharing
Recommended Videos
Presentations on similar topic, category or speaker
Cross-Image Context for Single Image Inpainting
Watch later
Total of 0 viewers voted for saving the presentation to eternal vault which is 0.0%
Controllable 3D Face Synthesis with Conditional Generative Occupancy Fields
Watch later
Keqiang Sun, …
Total of 0 viewers voted for saving the presentation to eternal vault which is 0.0%
FlashAttention: Fast and Memory-Efficient Exact Attention with IO-Awareness
Watch later
Tri Dao, …
Total of 0 viewers voted for saving the presentation to eternal vault which is 0.0%
Accelerated Training of Physics Informed Neural Networks (PINNs) using Meshless Discretizations
Watch later
Total of 0 viewers voted for saving the presentation to eternal vault which is 0.0%
Self-supervised Heterogeneous Graph Pre-training Based on Structural Clustering
Watch later
Yaming Yang, …
Total of 0 viewers voted for saving the presentation to eternal vault which is 0.0%
Generalization Gap in Amortized Inference
Watch later
Total of 0 viewers voted for saving the presentation to eternal vault which is 0.0%