[Paper Review] Learning Black-Box Attackers with Transferable Priors and Query Feedback

Jiancheng Yang, Yangzhou Jiang+3 more|arXiv (Cornell University)|Oct 21, 2020

Adversarial Robustness in Machine LearningComputer Science40 references42 citations

TL;DR

The paper introduces LeBA, a black-box attack that alternates transferability-based and query-based steps and learns a surrogate model online via High-Order Gradient Approximation to greatly improve efficiency and success on ImageNet defenses.

ABSTRACT

This paper addresses the challenging black-box adversarial attack problem, where only classification confidence of a victim model is available. Inspired by consistency of visual saliency between different vision models, a surrogate model is expected to improve the attack performance via transferability. By combining transferability-based and query-based black-box attack, we propose a surprisingly simple baseline approach (named SimBA++) using the surrogate model, which significantly outperforms several state-of-the-art methods. Moreover, to efficiently utilize the query feedback, we update the surrogate model in a novel learning scheme, named High-Order Gradient Approximation (HOGA). By constructing a high-order gradient computation graph, we update the surrogate model to approximate the victim model in both forward and backward pass. The SimBA++ and HOGA result in Learnable Black-Box Attack (LeBA), which surpasses previous state of the art by considerable margins: the proposed LeBA significantly reduces queries, while keeping higher attack success rates close to 100% in extensive ImageNet experiments, including attacking vision benchmarks and defensive models. Code is open source at https://github.com/TrustworthyDL/LeBA.

Motivation & Objective

• Motivate and address black-box adversarial attacks where only victim model confidence is accessible.
• Develop a simple yet strong baseline (SimBA++) by combining transferability-based and query-based attacks with a surrogate model.
• Propose High-Order Gradient Approximation (HOGA) to update the surrogate model using limited query feedback.
• Present LeBA, which learns a transferable surrogate and achieves high attack success with low query counts on large-scale benchmarks.
• Demonstrate robustness against defensive models and analyze the impact of surrogate choice and learning strategy.

Proposed method

• Introduce SimBA+ and SimBA++ to leverage a surrogate model for guiding query perturbations and integrate spatial priors.
• Combine transferability-based attack TIMI with the query-based SimBA-style updates in an alternating framework (SimBA++).
• Propose LeBA, which updates a learnable surrogate model using query feedback via High-Order Gradient Approximation (HOGA).
• Define forward and backward losses (FL and BL) and a gradient compensation factor to align surrogate gradients with victim gradients.
• Use a buffer of query samples and a dynamic surrogate update regime to improve efficiency and transferability.
• Provide open-source implementation (LeBA) for reproducible evaluation.

Experimental results

Research questions

• RQ1 Can a surrogate model guided, transferability-informed attack improve black-box attack efficiency?
• RQ2 Does alternating transferability-based and query-based attacks yield higher success rates than either approach alone?
• RQ3 Can a learnable surrogate model updated with query feedback (HOGA) closely approximate the victim model to further reduce queries?
• RQ4 How do surrogate choice and gradient compensation impact LeBA’s performance against strong defenses on ImageNet?

Key findings

• LeBA significantly reduces the average query count while achieving attack success rates close to 100% across several victim models on ImageNet.
• SimBA++ and LeBA outperform previous state-of-the-art black-box attacks in both efficiency and effectiveness, especially against defended models.
• Using a learned surrogate (via HOGA) transfers to new attack data and improves performance when combined with transferability-based attacks.
• The choice of surrogate model (ResNet variants or VGG-16) consistently improves query efficiency over SimBA++, indicating HOGA’s robustness to surrogate selection.
• Ablation shows adaptive gradient compensation and combined Forward/Backward losses yield the best performance for LeBA.
• In defense scenarios (JPEG, denoisers, adversarial training), LeBA maintains high ASR with substantially fewer queries compared to prior methods.