[Paper Review] Boundary Attack++: Query-Efficient Decision-Based Adversarial Attack.

Jianbo Chen, Michael I. Jordan|arXiv (Cornell University)|Apr 3, 2019

Adversarial Robustness in Machine Learning29 citations

TL;DR

Boundary Attack++ proposes a query-efficient decision-based adversarial attack that uses binary decision feedback to estimate gradient directions at the boundary, enabling optimization for both $L_2$ and $L_\infty$ perturbations. It significantly reduces query counts compared to prior methods and outperforms state-of-the-art white-box attacks on adversarially trained MNIST models.

ABSTRACT

Decision-based adversarial attack studies the generation of adversarial examples that solely rely on output labels of a target model. In this paper, decision-based adversarial attack was formulated as an optimization problem. Motivated by zeroth-order optimization, we develop Boundary Attack++, a family of algorithms based on a novel estimate of gradient direction using binary information at the decision boundary. By switching between two types of projection operators, our algorithms are capable of optimizing $L_2$ and $L_\infty$ distances respectively. Experiments show Boundary Attack++ requires significantly fewer model queries than Boundary Attack. We also show our algorithm achieves superior performance compared to state-of-the-art white-box algorithms in attacking adversarially trained models on MNIST.

Motivation & Objective

• To develop a more query-efficient decision-based adversarial attack that operates solely on model labels.
• To address the limitation of existing boundary attack methods requiring high query counts.
• To enable optimization for both $L_2$ and $L_\infty$ perturbation norms using a unified framework.
• To improve performance against adversarially trained models, which are more robust to standard attacks.

Proposed method

• The method estimates gradient directions using binary information from model predictions at the decision boundary, inspired by zeroth-order optimization.
• It employs two distinct projection operators to optimize $L_2$ and $L_\infty$ distances separately, enabling adaptive perturbation search.
• The algorithm dynamically switches between projection types based on the current perturbation norm, improving convergence.
• It formulates the attack as an optimization problem using only label queries, avoiding gradient access.
• The approach leverages a novel binary feedback mechanism to approximate gradient direction without model gradients.

Experimental results

Research questions

• RQ1 Can a decision-based adversarial attack achieve significantly lower query complexity than existing methods?
• RQ2 Can the method effectively optimize both $L_2$ and $L_\infty$ perturbations using the same framework?
• RQ3 Does the proposed method outperform state-of-the-art white-box attacks on adversarially trained models?
• RQ4 Can binary decision feedback alone provide sufficient gradient estimation for effective adversarial example generation?

Key findings

• Boundary Attack++ reduces model query requirements substantially compared to the original Boundary Attack.
• The method achieves superior attack success rates on adversarially trained MNIST models compared to state-of-the-art white-box attacks.
• It successfully optimizes both $L_2$ and $L_\infty$ perturbations using a single, adaptive framework.
• The use of binary feedback enables effective gradient estimation without access to model gradients or logits.