[Paper Review] Practical Black-Box Attacks against Machine Learning

Nicolas Papernot, Patrick McDaniel+4 more|arXiv (Cornell University)|Feb 8, 2016

Adversarial Robustness in Machine Learning35 references101 citations

TL;DR

Demonstrates a black-box attack that trains a substitute model using synthetic inputs labeled by a remote DNN, then crafts adversarial examples that transfer to the target model, achieving high misclassification rates without accessing the model internals or training data.

ABSTRACT

Machine learning (ML) models, e.g., deep neural networks (DNNs), are vulnerable to adversarial examples: malicious inputs modified to yield erroneous model outputs, while appearing unmodified to human observers. Potential attacks include having malicious content like malware identified as legitimate or controlling vehicle behavior. Yet, all existing adversarial example attacks require knowledge of either the model internals or its training data. We introduce the first practical demonstration of an attacker controlling a remotely hosted DNN with no such knowledge. Indeed, the only capability of our black-box adversary is to observe labels given by the DNN to chosen inputs. Our attack strategy consists in training a local model to substitute for the target DNN, using inputs synthetically generated by an adversary and labeled by the target DNN. We use the local substitute to craft adversarial examples, and find that they are misclassified by the targeted DNN. To perform a real-world and properly-blinded evaluation, we attack a DNN hosted by MetaMind, an online deep learning API. We find that their DNN misclassifies 84.24% of the adversarial examples crafted with our substitute. We demonstrate the general applicability of our strategy to many ML techniques by conducting the same attack against models hosted by Amazon and Google, using logistic regression substitutes. They yield adversarial examples misclassified by Amazon and Google at rates of 96.19% and 88.94%. We also find that this black-box attack strategy is capable of evading defense strategies previously found to make adversarial example crafting harder.

Motivation & Objective

• Motivate and formalize a practical black-box threat model for ML classifiers where only input-output labels are accessible.
• Show that a substitute model trained on synthetic data labeled by the target can generate transferable adversarial examples.
• Evaluate the attack on real remote DNN services and a local GTSRB classifier to assess transferability and defense evasion.

Proposed method

• Train a substitute DNN by querying the remote oracle with synthetic inputs and labeling them with the oracle’s outputs (no training data access).
• Use Jacobian-based dataset augmentation to efficiently explore the input space and reduce oracle queries while shaping the substitute’s decision boundaries.
• Craft adversarial samples on the substitute via established methods (Goodfellow’s fast gradient sign method and Papernot’s saliency-based approach) to induce misclassification in the target model.
• Demonstrate transferability of adversarial examples from substitute to target due to similar decision boundaries.
• Validate against multiple remote classifiers (MetaMind MNIST, Amazon/GG) and a local GTSRB model to show broad applicability.

Experimental results

Research questions

• RQ1 Can a black-box attacker induce misclassification of a target DNN using only label outputs from queries?
• RQ2 Does a substitute model trained on synthetic data labeled by the target can produce transferable adversarial examples that fool the target?
• RQ3 How effective is the attack across different architectures and remote ML services (MetaMind, Amazon, Google) and datasets (MNIST, GTSRB)?

Key findings

• Adversarial examples crafted on substitutes misclassify the target: 84.24% transfer rate on MetaMind MNIST experiments.
• Adversarial examples misclassify Amazon and Google hosted models at 96.19% and 88.94% respectively under certain conditions.
• GTSRB-targeted attack achieves transferability rates from 64.24% to 69.03% with perturbations small enough to be imperceptible.
• Substitute training with Jacobian-based augmentation yields effective decision boundary approximation with relatively few oracle queries.
• The attack can evade defenses that were designed to harden adversarial example crafting, indicating defense mechanisms may be insufficient against black-box substitutes.