[Paper Review] AdvFlow: Inconspicuous Black-box Adversarial Attacks using Normalizing Flows

Hadi M. Dolatabadi, Sarah Erfani+1 more|arXiv (Cornell University)|Jul 15, 2020

Adversarial Robustness in Machine LearningComputer Science61 references20 citations

TL;DR

AdvFlow proposes a novel black-box adversarial attack that uses pre-trained normalizing flows to model the data distribution around clean images, generating perturbations that closely follow natural data structure. This results in more inconspicuous, less detectable adversarial examples with competitive success rates, lower query counts, and higher transferability on defended models compared to baseline methods like $σ$-Attack.

ABSTRACT

Deep learning classifiers are susceptible to well-crafted, imperceptible variations of their inputs, known as adversarial attacks. In this regard, the study of powerful attack models sheds light on the sources of vulnerability in these classifiers, hopefully leading to more robust ones. In this paper, we introduce AdvFlow: a novel black-box adversarial attack method on image classifiers that exploits the power of normalizing flows to model the density of adversarial examples around a given target image. We see that the proposed method generates adversaries that closely follow the clean data distribution, a property which makes their detection less likely. Also, our experimental results show competitive performance of the proposed approach with some of the existing attack methods on defended classifiers. The code is available at https://github.com/hmdolatabadi/AdvFlow.

Motivation & Objective

• To develop a black-box adversarial attack that generates imperceptible, data-structure-aware perturbations to evade detection.
• To leverage normalizing flows to model the true data distribution around clean images, ensuring adversarial examples remain within natural data manifolds.
• To improve robustness against adversarial detection by making perturbations indistinguishable from clean data in distribution.
• To achieve higher success rates and lower query counts on defended models compared to existing black-box attacks.
• To demonstrate the superiority of flow-based perturbations over independent, additive noise methods like $σ$-Attack.

Proposed method

• Pre-train a normalizing flow on clean data to learn the underlying data distribution.
• Use the learned flow to parameterize a search distribution for adversarial perturbations, ensuring they conform to natural data structure.
• Apply natural evolution strategies (NES) with search gradients to optimize the perturbation distribution in a black-box setting.
• Iteratively refine the perturbation by querying the target model and updating the flow-based distribution using gradient estimates.
• Generate adversarial examples as samples from the optimized flow-based distribution, which are structurally similar to clean data.
• Prove a lemma showing that AdvFlow perturbations can be approximated by a normal distribution with dependent components, unlike independent noise in $σ$-Attack.

Experimental results

Research questions

• RQ1 Can normalizing flows be effectively used to generate black-box adversarial examples that follow the natural data distribution?
• RQ2 How does the distributional similarity of AdvFlow-generated perturbations affect their detectability by adversarial example detectors?
• RQ3 Does modeling perturbations via a flow-based distribution lead to higher attack success rates and lower query counts compared to additive noise baselines?
• RQ4 How does AdvFlow perform on defended models, particularly in terms of transferability and robustness?
• RQ5 Can AdvFlow generate effective adversarial examples even when the normalizing flow is randomly initialized, without pre-training?

Key findings

• AdvFlow achieved a success rate of 97.78% on Inception-v3 for ImageNet with an average of 375.00 queries (median 200), outperforming $σ$-Attack (95.06%) and Bandits (87.80%) in query efficiency.
• On VGG16, AdvFlow reached 99.57% success rate with only 395.61 average queries (median 200), surpassing $σ$-Attack (99.57%) and Bandits (95.46%) in efficiency.
• For the defended Def. ResNet model, AdvFlow achieved 57.20% success rate with just 381.97 average queries (median 200), significantly outperforming $σ$-Attack (33.99%) and Bandits (50.77%).
• Visual comparisons showed that AdvFlow perturbations preserve image structure and are less detectable than $σ$-Attack’s pixel-level, independent noise.
• The lemma proved in the paper confirms that AdvFlow perturbations have dependent components, enabling more natural, data-consistent perturbations.
• Even with randomly initialized flows, AdvFlow achieved a 97.78% success rate on Inception-v3, outperforming Bandits and $σ$-Attack in both success rate and query efficiency.