[Paper Review] Improving Black-box Adversarial Attacks with a Transfer-based Prior

Shuyu Cheng, Yinpeng Dong+3 more|arXiv (Cornell University)|Jun 17, 2019

Adversarial Robustness in Machine Learning35 references124 citations

TL;DR

The paper introduces P-RGF, a prior-guided random gradient-free method that combines a transfer-based surrogate gradient with query feedback to craft more query-efficient black-box adversarial attacks. It derives an optimal coupling coefficient to weight the surrogate gradient and demonstrates superior attack success rates and fewer queries across models and defenses.

ABSTRACT

We consider the black-box adversarial setting, where the adversary has to generate adversarial perturbations without access to the target models to compute gradients. Previous methods tried to approximate the gradient either by using a transfer gradient of a surrogate white-box model, or based on the query feedback. However, these methods often suffer from low attack success rates or poor query efficiency since it is non-trivial to estimate the gradient in a high-dimensional space with limited information. To address these problems, we propose a prior-guided random gradient-free (P-RGF) method to improve black-box adversarial attacks, which takes the advantage of a transfer-based prior and the query information simultaneously. The transfer-based prior given by the gradient of a surrogate model is appropriately integrated into our algorithm by an optimal coefficient derived by a theoretical analysis. Extensive experiments demonstrate that our method requires much fewer queries to attack black-box models with higher success rates compared with the alternative state-of-the-art methods.

Motivation & Objective

• Motivate and address inefficiency of black-box adversarial attacks (gradient estimation with limited information).
• Leverage transfer-based priors from a surrogate white-box model to improve gradient estimation.
• Derive an optimal coefficient to fuse transfer gradients with random gradient-free estimates.
• Show that combining priors with query feedback yields higher attack success and lower query counts.
• Demonstrate robustness across normal and defensive models on ImageNet.

Proposed method

• Propose prior-guided random gradient-free (P-RGF) which biases random gradient directions toward a transfer gradient from a surrogate model.
• Model the gradient estimation loss as the minimum achievable squared distance between the true gradient and a scaled estimator, optimizing a scale b.
• Derive an optimal mixing parameter λ* that weights the transfer gradient v in the sampling distribution C = λ v v^T + ((1−λ)/(D−1))(I−v v^T).
• Provide a closed-form solution for λ* as a function of the cosine similarity α between transfer and true gradients and the query budget q (and dimension D).
• Offer a practical procedure to estimate α (via finite differences) and to sample biased random directions u_i accordingly for q queries.
• Extend P-RGF to include a data-dependent prior by integrating a subspace projection V and deriving a corresponding λ* (with A^2 as the projected gradient power).
• Demonstrate the approach with the Inception-v3 surrogate for ImageNet under ℓ2 attacks, comparing against NES, Bandits, AutoZoom, and standard RGF.

Experimental results

Research questions

• RQ1 Can a transfer-based prior, optimally weighted, improve gradient estimation in black-box attacks?
• RQ2 How to compute the optimal coupling coefficient λ* to balance surrogate guidance and random exploration?
• RQ3 Does combining transfer priors with data-dependent priors further reduce query counts while maintaining high attack success?
• RQ4 Are the gains of P-RGF consistent across diverse target models and defensive mechanisms?

Key findings

• P-RGF achieves higher attack success rates and requires fewer queries than state-of-the-art methods on Inception-v3, VGG-16, and ResNet-50 under ℓ2 attacks.
• The optimal λ* increases with higher cosine similarity α and decreases with more queries q, confirming when to rely more on the transfer prior.
• Using the adaptive λ* outperforms fixed λ values and outperforms pure transfer gradient or uniform random gradient estimation.
• Incorporating a data-dependent prior (D) orthogonal to the transfer prior further improves performance, achieving additional reductions in average queries.
• Across defenses like JPEG compression, randomization, and guided denoisers, P-RGF (with or without data priors) yields higher ASR and lower query counts than baselines.
• The method demonstrates strong gradient estimation efficiency, with results indicating adaptive bias toward the surrogate gradient is most beneficial early in optimization, and still helpful later via improved gradient estimates.