[Paper Review] Hard Label Black-box Adversarial Attacks in Low Query Budget Regimes.

Satya Narayan Shukla, Anit Kumar Sahu+2 more|arXiv (Cornell University)|Jul 13, 2020

Adversarial Robustness in Machine Learning23 references4 citations

TL;DR

This paper proposes a Bayesian optimization-based black-box adversarial attack that operates efficiently under low query budgets by searching for adversarial examples in a structured, low-dimensional subspace. By avoiding high-dimensional optimization issues, the method achieves state-of-the-art performance with orders of magnitude fewer queries than existing approaches.

ABSTRACT

We focus on the problem of black-box adversarial attacks, where the aim is to generate adversarial examples for deep learning models solely based on information limited to output labels (hard label) to a queried data input. We use Bayesian optimization (BO) to specifically cater to scenarios involving low query budgets to develop efficient adversarial attacks. Issues with BO's performance in high dimensions are avoided by searching for adversarial examples in structured low-dimensional subspace. Our proposed approach achieves better performance to state of the art black-box adversarial attacks that require orders of magnitude more queries than ours.

Motivation & Objective

• To address the challenge of generating adversarial examples in black-box settings with limited access to model outputs, specifically hard labels only.
• To reduce the query budget required for effective adversarial attacks, which is critical in real-world deployment scenarios.
• To overcome the limitations of Bayesian optimization in high-dimensional spaces by focusing on a low-dimensional, structured subspace.
• To achieve state-of-the-art attack performance with significantly fewer queries than existing methods.

Proposed method

• The method employs Bayesian optimization (BO) to efficiently explore the input space for adversarial perturbations using only hard label feedback.
• It reduces the dimensionality of the search space by identifying and operating within a low-dimensional, structured subspace where adversarial examples are more likely to exist.
• The algorithm models the attack success probability as a Gaussian process over the low-dimensional subspace, enabling active and informed query selection.
• It uses acquisition functions to balance exploration and exploitation in the search for adversarial examples under strict query constraints.
• The approach is designed to be robust to the noise and sparsity inherent in hard-label feedback, improving sample efficiency.

Experimental results

Research questions

• RQ1 Can Bayesian optimization be effectively adapted to hard-label black-box adversarial attacks under extremely low query budgets?
• RQ2 How does searching in a low-dimensional, structured subspace improve the efficiency and success rate of black-box attacks?
• RQ3 What is the performance gain of this method compared to existing state-of-the-art black-box attack methods in terms of query efficiency?
• RQ4 To what extent does the method mitigate the scalability issues of Bayesian optimization in high-dimensional input spaces?

Key findings

• The proposed method achieves state-of-the-art attack success rates on standard benchmarks with significantly fewer queries than prior methods.
• It reduces the required query budget by orders of magnitude compared to existing black-box attack approaches.
• The use of a low-dimensional, structured subspace enables effective Bayesian optimization despite the high dimensionality of the original input space.
• The method demonstrates robust performance even under noisy and sparse hard-label feedback, maintaining high efficiency.