[Paper Review] Switching Gradient Directions for Query-Efficient Black-Box Adversarial Attacks.

Chen Ma, Shuyu Cheng+2 more|arXiv (Cornell University)|Sep 15, 2020

Adversarial Robustness in Machine Learning37 references4 citations

TL;DR

This paper proposes SWITCH, a query-efficient black-box adversarial attack that dynamically switches gradient directions using surrogate model gradients and random search to improve optimization. By only using queries to decide when to switch directions—never to estimate gradients—SWITCH achieves state-of-the-art performance under ℓ₂ and ℓ∞ norms, outperforming 10 SOTA attacks on CIFAR-10, CIFAR-100, and TinyImageNet with unprecedented query efficiency.

ABSTRACT

We propose a simple and highly query-efficient black-box adversarial attack named SWITCH, which has a state-of-the-art performance under $\ell_2$ and $\ell_\infty$ norms in the score-based setting. In the black box attack setting, designing query-efficient attacks remains an open problem. The high query efficiency of the proposed approach stems from the combination of transfer-based attacks and random-search-based ones. The surrogate model's gradient $\hat{\mathbf{g}}$ is exploited for the guidance, which is then switched if our algorithm detects that it does not point to the adversarial region by using a query, thereby keeping the objective loss function of the target model rising as much as possible. Two switch operations are available, i.e., SWITCH$_ ext{neg}$ and SWITCH$_ ext{rnd}$. SWITCH$_ ext{neg}$ takes $-\hat{\mathbf{g}}$ as the new direction, which is reasonable under an approximate local linearity assumption. SWITCH$_ ext{rnd}$ computes the gradient from another model, which is randomly selected from a large model set, to help bypass the potential obstacle in optimization. Experimental results show that these strategies boost the optimization process whereas following the original surrogate gradients does not work. In SWITCH, no query is used to estimate the gradient, and all the queries aim to determine whether to switch directions, resulting in unprecedented query efficiency. We demonstrate that our approach outperforms 10 state-of-the-art attacks on CIFAR-10, CIFAR-100 and TinyImageNet datasets. SWITCH can serve as a strong baseline for future black-box attacks. The PyTorch source code is released in this https URL .

Motivation & Objective

• To address the challenge of designing query-efficient black-box adversarial attacks in the score-based setting.
• To improve optimization efficiency in black-box attacks by combining transfer-based and random-search-based strategies.
• To reduce the number of queries required to generate adversarial examples by avoiding gradient estimation through queries.
• To develop a method that intelligently switches gradient directions when the current direction fails to reduce the loss, based on query feedback.
• To establish a new SOTA baseline for query-efficient black-box attacks across multiple benchmark datasets.

Proposed method

• SWITCH uses a surrogate model to obtain an initial gradient direction, which guides the attack in the target model's direction.
• It employs two switching mechanisms: SWITCH_neg, which flips the gradient to −ĝ, and SWITCH_rnd, which samples a new gradient from a randomly selected model in a large ensemble.
• The algorithm uses a single query to determine whether the current gradient direction is ineffective, triggering a switch if the loss fails to decrease.
• All queries are used solely for decision-making on direction switching, not for gradient estimation, maximizing query efficiency.
• The method operates under the assumption of approximate local linearity, justifying the use of −ĝ when the original direction becomes unproductive.
• The approach is designed to keep the objective loss rising as much as possible when switching, ensuring continued progress toward adversarial examples.

Experimental results

Research questions

• RQ1 Can dynamic switching of gradient directions improve query efficiency in black-box adversarial attacks?
• RQ2 Does switching to −ĝ or a randomly sampled gradient from another model help bypass optimization obstacles when the surrogate gradient fails?
• RQ3 Can a method avoid gradient estimation queries while maintaining or improving attack success rates?
• RQ4 How does SWITCH compare to existing state-of-the-art attacks in terms of query efficiency and attack success rate across different datasets?
• RQ5 Can SWITCH serve as a strong, generalizable baseline for future black-box attack research?

Key findings

• SWITCH achieves state-of-the-art performance under both ℓ₂ and ℓ∞ norms in the score-based black-box attack setting.
• The method significantly outperforms 10 existing state-of-the-art attacks on CIFAR-10, CIFAR-100, and TinyImageNet in terms of query efficiency and attack success rate.
• By using queries only to decide when to switch directions, SWITCH achieves unprecedented query efficiency, with no queries used for gradient estimation.
• The SWITCH_neg and SWITCH_rnd strategies both boost optimization, with SWITCH_rnd being particularly effective in escaping local minima.
• Experimental results confirm that following the original surrogate gradient without switching leads to poor performance, validating the necessity of dynamic direction switching.
• The PyTorch code for SWITCH has been released, enabling reproducibility and adoption as a new SOTA baseline in black-box attack research.