[Paper Review] Nonlinear Projection Based Gradient Estimation for Query Efficient Blackbox Attacks

Huichen Li, Linyi Li+4 more|arXiv (Cornell University)|Feb 25, 2021

Adversarial Robustness in Machine Learning28 references4 citations

TL;DR

This paper proposes NonLinear-BA, a query-efficient blackbox adversarial attack that uses nonlinear projection via deep generative models (VAEs, GANs, autoencoders) to estimate gradients in a low-dimensional space. By theoretically analyzing cosine similarity bounds and query complexity, it achieves 100% attack success with significantly fewer queries and smaller perturbations than state-of-the-art methods on ImageNet, CIFAR-10, MNIST, and CelebA, including against the commercial MEGVII Face++ API.

ABSTRACT

Gradient estimation and vector space projection have been studied as two distinct topics. We aim to bridge the gap between the two by investigating how to efficiently estimate gradient based on a projected low-dimensional space. We first provide lower and upper bounds for gradient estimation under both linear and nonlinear projections, and outline checkable sufficient conditions under which one is better than the other. Moreover, we analyze the query complexity for the projection-based gradient estimation and present a sufficient condition for query-efficient estimators. Built upon our theoretic analysis, we propose a novel query-efficient Nonlinear Gradient Projection-based Boundary Blackbox Attack (NonLinear-BA). We conduct extensive experiments on four image datasets: ImageNet, CelebA, CIFAR-10, and MNIST, and show the superiority of the proposed methods compared with the state-of-the-art baselines. In particular, we show that the projection-based boundary blackbox attacks are able to achieve much smaller magnitude of perturbations with 100% attack success rate based on efficient queries. Both linear and nonlinear projections demonstrate their advantages under different conditions. We also evaluate NonLinear-BA against the commercial online API MEGVII Face++, and demonstrate the high blackbox attack performance both quantitatively and qualitatively. The code is publicly available at https://github.com/AI-secure/NonLinear-BA.

Motivation & Objective

• To bridge gradient estimation and vector space projection by analyzing how low-dimensional projections affect gradient estimation quality.
• To theoretically derive bounds on cosine similarity between estimated and true gradients under linear and nonlinear projections.
• To identify sufficient conditions for query-efficient gradient estimation using projection-based methods.
• To develop a practical, query-efficient blackbox attack framework leveraging nonlinear projections.
• To empirically validate the method on diverse datasets and real-world APIs, including MEGVII Face++.

Proposed method

• Proposes a general framework for gradient estimation via vector space projection from a low-dimensional subspace to the original gradient space.
• Uses deep generative models (VAEs, GANs, autoencoders) as nonlinear projection functions to map sampled latent vectors to high-dimensional perturbation directions.
• Employs Monte Carlo gradient estimation using queries to the target model, where perturbations are generated via the projected directions.
• Analyzes the cosine similarity between estimated and true gradients using Taylor expansion and sampling distribution analysis to derive theoretical bounds.
• Introduces a proxy metric ω to measure the fraction of perturbations with conflicting signs between prediction and gradient direction, used to assess estimation quality.
• Applies the method in a boundary attack setting, iteratively refining adversarial examples while minimizing query count and perturbation magnitude.

Experimental results

Research questions

• RQ1 Can gradient estimation be effectively performed using projections from a low-dimensional subspace, and what are the theoretical bounds on estimation quality?
• RQ2 How do nonlinear projections compare to linear projections in terms of improving the lower bound of cosine similarity between estimated and true gradients?
• RQ3 What conditions ensure query efficiency in projection-based gradient estimation, and how can they be checked?
• RQ4 Can nonlinear projection-based gradient estimation lead to more efficient blackbox attacks with lower query counts and smaller perturbations?
• RQ5 How does the proposed method perform against real-world commercial APIs like MEGVII Face++?

Key findings

• NonLinear-BA achieves 100% attack success rate on ImageNet, CelebA, CIFAR-10, and MNIST with significantly fewer queries than state-of-the-art baselines.
• The method produces adversarial examples with smaller perturbation magnitudes (measured by MSE) compared to baselines, indicating higher imperceptibility.
• Nonlinear projections outperform linear projections in terms of cosine similarity lower bounds under certain conditions, demonstrating theoretical superiority.
• The proxy metric ω shows a strong negative correlation with cosine similarity on ImageNet, CIFAR-10, and MNIST, validating its use as an indicator of estimation quality.
• Empirical results on the MEGVII Face++ API confirm high attack effectiveness, both quantitatively and qualitatively, across diverse image pairs.
• Theoretical analysis confirms that nonlinear projections can achieve strictly higher lower bounds on cosine similarity than linear projections, providing a foundation for improved estimation.