[Paper Review] Taking Care of The Discretization Problem: A Comprehensive Study of the Discretization Problem and A Black-Box Adversarial Attack in Discrete Integer Domain

Lei Bu, Yuchao Duan+2 more|arXiv (Cornell University)|May 19, 2019

Adversarial Robustness in Machine Learning100 references4 citations

TL;DR

This paper introduces a novel black-box adversarial attack method that directly generates adversarial examples in the discrete integer domain, avoiding the discretization problem common in existing attacks. By formulating the attack as a derivative-free optimization (DFO) problem using a classification model-based DFO algorithm, the method achieves near-100% success rates on both targeted and untargeted attacks, outperforming state-of-the-art black-box methods and breaking the NIPS 2017 defense competition winner with 100% success rate.

ABSTRACT

Numerous methods for crafting adversarial examples were proposed recently with high success rate. Since most existing machine learning based classifiers normalize images into some continuous, real vector, domain firstly, attacks often craft adversarial examples in such domain. However, "adversarial" examples may become benign after denormalizing them back into the discrete integer domain, known as the discretization problem. This problem was mentioned in some work, but has received relatively little attention. In this work, we first conduct a comprehensive study of existing methods and tools for crafting. We theoretically analyze 34 representative methods and empirically study 20 representative open source tools for crafting adversarial images. Our study reveals that the discretization problem is far more serious than originally thought. This suggests that the discretization problem should be taken into account seriously when crafting adversarial examples and measuring attack success rate. As a first step towards addressing this problem in black-box scenario, we propose a black-box method which reduces the adversarial example searching problem to a derivative-free optimization problem. Our method is able to craft adversarial images by derivative-free search in the discrete integer domain. Experimental results show that our method is comparable to recent white-box methods (e.g., FGSM, BIM and C\&W) and achieves significantly higher success rate in terms of adversarial examples in the discrete integer domain than recent black-box methods (e.g., ZOO, NES-PGD and Bandits). Moreover, our method is able to handle models that is non-differentiable and successfully break the winner of NIPS 2017 competition on defense with 95\% success rate. Our results suggest that discrete optimization algorithms open up a promising area of research into effective black-box attacks.

Motivation & Objective

• To systematically investigate the impact of the discretization problem on existing adversarial attack methods and tools.
• To demonstrate that the discretization problem severely undermines attack success rates in real-world deployment scenarios.
• To develop a black-box adversarial attack method that operates directly in the discrete integer domain to avoid discretization issues.
• To achieve high attack success rates comparable to white-box methods while remaining effective against non-differentiable or unknown models.
• To validate the method’s effectiveness on robust defense models, including the NIPS 2017 defense competition winner.

Proposed method

• The attack is formulated as a derivative-free optimization (DFO) problem, avoiding reliance on gradients.
• A classification model-based DFO algorithm is proposed to guide the search in the discrete integer space.
• The method directly crafts adversarial examples in the original image domain (e.g., 0–255 integer pixel values), bypassing normalization to continuous domains.
• The algorithm learns from query responses (class probabilities) to iteratively improve adversarial examples without requiring gradient information.
• The approach is designed to be effective against non-differentiable or black-box models where gradient-based methods fail.
• The method is implemented in a tool called DFA (Discrete-integer domain attack), which supports both targeted and untargeted attacks.

Experimental results

Research questions

• RQ1 To what extent does the discretization problem degrade the success rate of existing adversarial attack methods in practice?
• RQ2 Can a black-box adversarial attack be effectively formulated and executed directly in the discrete integer domain?
• RQ3 How does a classification model-based derivative-free optimization approach compare to gradient-based or other black-box methods in terms of attack success rate and query efficiency?
• RQ4 Can such a method successfully break state-of-the-art defenses, including those that won major competitions?
• RQ5 What are the trade-offs between attack success rate, imperceptibility, and query efficiency when operating in the discrete domain?

Key findings

• 29 out of 35 theoretical attack methods and 14 out of 20 open-source tools are significantly affected by the discretization problem, with success rates dropping from 100% to as low as 10%.
• The proposed DFA method achieves 100% targeted and untargeted attack success rates on ImageNet and MNIST, matching the performance of white-box methods like FGSM, BIM, and C&W.
• DFA outperforms all evaluated black-box methods (ZOO, AutoZOOM, NES-PGD, Bandits, FD, FD-PSO, GenAttack) in both success rate and query efficiency.
• The method successfully breaks the HGD defense model, the winner of the NIPS 2017 defense competition, achieving 100% targeted attack success rate.
• On the MNIST Adversarial Examples Challenge, DFA achieves a 10.5% targeted success rate, matching the best publicly reported white-box attack.
• The method maintains high imperceptibility, with MSE values comparable to or better than other leading methods, especially on Inception-v3.