[Paper Review] Subspace Attack: Exploiting Promising Subspaces for Query-Efficient Black-box Attacks

Ziang Yan, Yiwen Guo+1 more|arXiv (Cornell University)|Jun 11, 2019

Adversarial Robustness in Machine LearningComputer Science59 citations

TL;DR

The paper proposes Subspace Attack, which uses gradients from a set of reference models to define low-dimensional subspaces for zeroth-order gradient estimation, achieving substantial query-efficiency gains over prior black-box attacks. Dropout-based prior gradients further improve performance, enabling effective attacks even with disjoint training data.

ABSTRACT

Unlike the white-box counterparts that are widely studied and readily accessible, adversarial examples in black-box settings are generally more Herculean on account of the difficulty of estimating gradients. Many methods achieve the task by issuing numerous queries to target classification systems, which makes the whole procedure costly and suspicious to the systems. In this paper, we aim at reducing the query complexity of black-box attacks in this category. We propose to exploit gradients of a few reference models which arguably span some promising search subspaces. Experimental results show that, in comparison with the state-of-the-arts, our method can gain up to 2x and 4x reductions in the requisite mean and medium numbers of queries with much lower failure rates even if the reference models are trained on a small and inadequate dataset disjoint to the one for training the victim model. Code and models for reproducing our results will be made publicly available.

Motivation & Objective

• Motivate reducing query complexity in black-box adversarial attacks under limited access to victim models.
• Propose a subspace-based gradient estimation method that leverages prior gradients from reference models.
• Show that constraining search to promising subspaces improves query efficiency while maintaining low failure rates.
• Investigate practical techniques such as coordinate descent and dropout/layer to enhance efficiency and exploration.

Proposed method

• Construct low-dimensional subspaces spanned by gradients from a set of reference models (prior gradients).
• Use a bandit-like zeroth-order update within the subspace to estimate gradient directions for a PGD-style attack.
• Introduce coordinate-descent style optimization to reduce the computational burden when multiple priors are available.
• Apply dropout/layer techniques on reference models to generate diverse prior gradients and improve subspace alignment.
• Iteratively craft adversarial examples by updating along the sign of the estimated gradient within the subspace and clipping to the l-infinity budget.

Experimental results

Research questions

• RQ1 How can gradient information from multiple reference models be leveraged to define a low-dimensional subspace for black-box attacks?
• RQ2 Does restricting attacks to subspaces spanned by prior gradients reduce query counts while maintaining attack success rates?
• RQ3 Can coordinate-descent optimization and dropout-based priors improve the practicality and robustness of subspace attacks?
• RQ4 How does the method perform across CIFAR-10 and ImageNet with various victim/reference model pairings?
• RQ5 What is the impact of the number and choice of reference models on attack efficacy?

Key findings

• The subspace attack substantially reduces mean and median query counts compared to NES and Bandits-TD across CIFAR-10 and ImageNet.
• Using prior gradients from multiple reference models yields better subspace alignment with the victim gradient than random subspaces, lowering failure rates.
• Coordinate-descent with multiple priors achieves similar effectiveness to full subspace updates with reduced computation.
• Dropout-based priors improve exploration and reduce failure rates without excessive query overhead.
• Even with reference models trained on disjoint or smaller datasets, the method achieves strong attack performance, often outperforming baselines.