[Paper Review] Switching Transferable Gradient Directions for Query-Efficient Black-Box Adversarial Attacks

Chen Ma, Shuyu Cheng+3 more|arXiv (Cornell University)|Sep 15, 2020

Adversarial Robustness in Machine Learning38 references4 citations

TL;DR

SWITCH proposes a query-efficient black-box adversarial attack that leverages transferable gradients from a surrogate model, dynamically switching between the gradient and its opposite direction when improvement stalls. It achieves state-of-the-art success rates with minimal queries—demonstrating superior performance under strict query budgets, especially in targeted and defense-protected settings.

ABSTRACT

We propose a simple and highly query-efficient black-box adversarial attack named SWITCH, which has a state-of-the-art performance in the score-based setting. SWITCH features a highly efficient and effective utilization of the gradient of a surrogate model $\hat{\mathbf{g}}$ w.r.t. the input image, i.e., the transferable gradient. In each iteration, SWITCH first tries to update the current sample along the direction of $\hat{\mathbf{g}}$, but considers switching to its opposite direction $-\hat{\mathbf{g}}$ if our algorithm detects that it does not increase the value of the attack objective function. We justify the choice of switching to the opposite direction by a local approximate linearity assumption. In SWITCH, only one or two queries are needed per iteration, but it is still effective due to the rich information provided by the transferable gradient, thereby resulting in unprecedented query efficiency. To improve the robustness of SWITCH, we further propose SWITCH$_ ext{RGF}$ in which the update follows the direction of a random gradient-free (RGF) estimate when neither $\hat{\mathbf{g}}$ nor its opposite direction can increase the objective, while maintaining the advantage of SWITCH in terms of query efficiency. Experimental results conducted on CIFAR-10, CIFAR-100 and TinyImageNet show that compared with other methods, SWITCH achieves a satisfactory attack success rate using much fewer queries, and SWITCH$_ ext{RGF}$ achieves the state-of-the-art attack success rate with fewer queries overall. Our approach can serve as a strong baseline for future black-box attacks because of its simplicity. The PyTorch source code is released on https://github.com/machanic/SWITCH.

Motivation & Objective

• To address the high query complexity of score-based black-box attacks that rely on gradient estimation.
• To improve query efficiency by leveraging transferable gradients from a surrogate model without requiring target model gradients.
• To detect when the surrogate gradient leads away from the adversarial region and dynamically switch to its opposite direction.
• To enhance robustness against defensive models by combining gradient-based updates with random gradient-free (RGF) fallback.
• To establish a simple yet effective baseline for future black-box attack research.

Proposed method

• In each iteration, SWITCH first attempts to update the adversarial example along the ℓp-normalized surrogate gradient $ar{oldsymbol{g}}$.
• If the attack objective (loss) does not increase after a step along $ar{oldsymbol{g}}$, SWITCH switches to the opposite direction $-ar{oldsymbol{g}}$ to avoid incorrect updates.
• The switch decision is justified by the local approximate linearity assumption of deep neural networks.
• The method uses only one or two queries per iteration—one to evaluate the loss at $oldsymbol{x}_{ ext{adv}} + heta ar{oldsymbol{g}}$, and optionally one at $oldsymbol{x}_{ ext{adv}} - heta ar{oldsymbol{g}}$.
• SWITCH${}_{ ext{RGF}}$ extends the method by using a random gradient-free (RGF) estimate when both $ar{oldsymbol{g}}$ and $-ar{oldsymbol{g}}$ fail to improve the loss.
• The approach maintains high query efficiency while improving robustness in challenging settings, such as targeted attacks and defensive models.

Experimental results

Research questions

• RQ1 Can dynamic switching between a surrogate gradient and its opposite direction improve query efficiency in black-box attacks?
• RQ2 How effective is the local approximate linearity assumption in guiding direction switching for adversarial attacks?
• RQ3 Can a hybrid strategy combining gradient-based and random gradient-free updates further improve success rates without sacrificing query efficiency?
• RQ4 How does SWITCH perform under extremely limited query budgets, especially in targeted and defense-protected scenarios?
• RQ5 Can a simple, gradient-based method outperform complex, random-search-based attacks in query efficiency and success rate?

Key findings

• SWITCH achieves a 92.5% untargeted attack success rate on CIFAR-10 with only 365 queries using WRN-40, outperforming prior methods under the same query budget.
• In targeted $oldsymbol{ ext{ℓ}}_2$ attacks on CIFAR-10, SWITCH achieves the highest success rate (74.7%) under 1,000 queries, demonstrating fast initial convergence.
• SWITCH${}_{ ext{RGF}}$ reduces query consumption by up to 50% compared to RGF while achieving higher success rates, especially in defense-protected settings.
• On defensive models (ComDefend, Feature Distillation, JPEG), SWITCH achieves the highest success rate against ComDefend and comparable results to SOTA on Feature Distillation.
• SWITCH converges faster than random-search-based attacks like Square Attack, making it particularly effective when query budgets are extremely limited (e.g., <1,000 queries).
• Despite its simplicity, SWITCH sets a new SOTA in query efficiency and success rate across multiple benchmarks including CIFAR-10, CIFAR-100, and TinyImageNet.