[论文解读] Taking Care of The Discretization Problem: A Comprehensive Study of the Discretization Problem and A Black-Box Adversarial Attack in Discrete Integer Domain

Lei Bu, Yuchao Duan+2 more|arXiv (Cornell University)|May 19, 2019

Adversarial Robustness in Machine Learning参考文献 100被引用 4

一句话总结

本文提出了一种新颖的黑盒对抗攻击方法，直接在离散整数域中生成对抗样本，避免了现有方法中常见的离散化问题。通过将攻击问题建模为基于分类模型的无导数优化（DFO）问题，该方法在目标攻击和非目标攻击上均实现了接近100%的成功率，优于当前最先进的黑盒方法，并以100%的成功率突破了NIPS 2017防御竞赛冠军模型。

ABSTRACT

Numerous methods for crafting adversarial examples were proposed recently with high success rate. Since most existing machine learning based classifiers normalize images into some continuous, real vector, domain firstly, attacks often craft adversarial examples in such domain. However, "adversarial" examples may become benign after denormalizing them back into the discrete integer domain, known as the discretization problem. This problem was mentioned in some work, but has received relatively little attention. In this work, we first conduct a comprehensive study of existing methods and tools for crafting. We theoretically analyze 34 representative methods and empirically study 20 representative open source tools for crafting adversarial images. Our study reveals that the discretization problem is far more serious than originally thought. This suggests that the discretization problem should be taken into account seriously when crafting adversarial examples and measuring attack success rate. As a first step towards addressing this problem in black-box scenario, we propose a black-box method which reduces the adversarial example searching problem to a derivative-free optimization problem. Our method is able to craft adversarial images by derivative-free search in the discrete integer domain. Experimental results show that our method is comparable to recent white-box methods (e.g., FGSM, BIM and C\&W) and achieves significantly higher success rate in terms of adversarial examples in the discrete integer domain than recent black-box methods (e.g., ZOO, NES-PGD and Bandits). Moreover, our method is able to handle models that is non-differentiable and successfully break the winner of NIPS 2017 competition on defense with 95\% success rate. Our results suggest that discrete optimization algorithms open up a promising area of research into effective black-box attacks.

研究动机与目标

• 系统研究离散化问题对现有对抗攻击方法和工具的影响。
• 证明离散化问题在实际部署场景中严重降低攻击成功率。
• 开发一种直接在离散整数域中运行的黑盒对抗攻击方法，以避免离散化问题。
• 在保持对不可微或未知模型有效的同时，实现与白盒方法相当的高攻击成功率。
• 在鲁棒防御模型上验证该方法的有效性，包括NIPS 2017防御竞赛冠军模型。

提出的方法

• 将攻击问题建模为无导数优化（DFO）问题，避免依赖梯度信息。
• 提出一种基于分类模型的DFO算法，用于在离散整数空间中引导搜索。
• 该方法直接在原始图像域（如0–255的整数像素值）中生成对抗样本，绕过映射到连续域的归一化过程。
• 该算法从查询响应（类别概率）中学习，通过迭代改进对抗样本，而无需梯度信息。
• 该方法设计用于在梯度方法失效的不可微或黑盒模型上有效运行。
• 该方法实现为名为DFA（离散整数域攻击）的工具，支持目标攻击和非目标攻击。

实验结果

研究问题

• RQ1 在实际应用中，离散化问题在多大程度上降低了现有对抗攻击方法的成功率？
• RQ2 是否可以有效将黑盒对抗攻击直接在离散整数域中建模并执行？
• RQ3 基于分类模型的无导数优化方法在攻击成功率和查询效率方面，与基于梯度或其他黑盒方法相比如何？
• RQ4 此类方法是否能成功突破最先进的防御机制，包括在重大竞赛中获胜的防御模型？
• RQ5 在离散域中运行时，攻击成功率、不可察觉性与查询效率之间存在何种权衡？

主要发现

• 35种理论攻击方法中的29种以及20个开源工具中的14种显著受到离散化问题影响，成功率从100%下降至最低10%。
• 所提出的DFA方法在ImageNet和MNIST上实现了100%的目标攻击和非目标攻击成功率，与FGSM、BIM和C&W等白盒方法性能相当。
• DFA在成功率和查询效率方面均优于所有评估的黑盒方法（ZOO、AutoZOOM、NES-PGD、Bandits、FD、FD-PSO、GenAttack）。
• 该方法成功突破了HGD防御模型——NIPS 2017防御竞赛冠军模型，实现了100%的目标攻击成功率。
• 在MNIST对抗样本挑战赛中，DFA实现了10.5%的目标攻击成功率，与目前公开报告的最佳白盒攻击性能持平。
• 该方法保持了高不可察觉性，MSE值与或优于其他领先方法，尤其在Inception-v3模型上表现更优。