[Paper Review] Black-Box Adversarial Attack with Transferable Model-based Embedding

Zhichao Huang, Tong Zhang|arXiv (Cornell University)|Nov 17, 2019

Adversarial Robustness in Machine LearningComputer Science39 references49 citations

TL;DR

TREMBA learns a low-dimensional embedding to generate transferable adversarial perturbations by training a generator on a source model and then performing NES-based search in embedding space to attack unknown targets, improving query efficiency and success, even on defended models and real APIs.

ABSTRACT

We present a new method for black-box adversarial attack. Unlike previous methods that combined transfer-based and scored-based methods by using the gradient or initialization of a surrogate white-box model, this new method tries to learn a low-dimensional embedding using a pretrained model, and then performs efficient search within the embedding space to attack an unknown target network. The method produces adversarial perturbations with high level semantic patterns that are easily transferable. We show that this approach can greatly improve the query efficiency of black-box adversarial attack across different target network architectures. We evaluate our approach on MNIST, ImageNet and Google Cloud Vision API, resulting in a significant reduction on the number of queries. We also attack adversarially defended networks on CIFAR10 and ImageNet, where our method not only reduces the number of queries, but also improves the attack success rate.

Motivation & Objective

• Motivate black-box attacks that balance transferability and query efficiency.
• Propose a two-stage framework (generator-based embedding and NES search) to attack unknown target networks.
• Show that embedding-space perturbations capture high-level semantic patterns transferable across models.
• Demonstrate effectiveness on undefended and defended datasets, including real-world API.

Proposed method

• Train an encoder–decoder generator G consisting of E (encoder) and D (decoder) to produce perturbations via delta = epsilon * tanh(D(E(x))).
• Train G on a white-box source network Fs using hinge loss (untargeted or targeted) as in the C&W formulation to shape perturbations that fool Fs.
• Perform black-box search on the low-dimensional embedding z with NES (natural evolution strategies) to find perturbations that fool an unknown target Ft, updating z via gradient estimates without sign normalization.
• Start from z0 = E(x) and iteratively update zt using NES-derived gradients, then output delta = epsilon * tanh(D(zt)).
• Use a Gaussian perturbation model around z, with sampling and a clipping step to keep delta within the L-infinity budget; handle both untargeted and targeted losses.
• Explain why embedding-space search accelerates finding effective adversarial patterns due to high-level transferable semantics learned from F s.

Experimental results

Research questions

• RQ1 Can a low-dimensional embedding learned from a pretrained source network enable efficient black-box attacks on unknown target networks?
• RQ2 Do perturbations generated in embedding space exhibit high-level semantic patterns that transfer across architectures and defenses?
• RQ3 How does TREMBA perform in terms of query efficiency and success rate on undefended and defended models, and against real-world APIs?

Key findings

• TREMBA reduces the number of queries by up to 2–6x on MNIST and ImageNet compared with baseline black-box attacks.
• Perturbations produced by TREMBA exhibit high-level semantic patterns (e.g., patterns resembling target class features) and transfer well to different target models.
• TREMBA achieves higher success rates with substantially fewer queries on defended models (CIFAR-10 and ImageNet) compared with competing methods, including AutoZOOM and P-RGF variants.
• On Google Cloud Vision API, TREMBA attains much higher success rates with far fewer queries than baseline methods.
• Using an optimized starting point z0* (OSP) further improves performance for defended models, especially at low query counts.