QEBA：基于查询效率的边界黑盒攻击
QEBA: Query-Efficient Boundary-Based Blackbox Attack
摘要：
机器学习（ML），特别是深度神经网络（DNN）已经广泛用于各种应用中，包括若干安全关键应用（例如，自动驾驶）。因此，最近关于对抗性例子的研究引起了极大的关注。这种对抗攻击可以通过向输入添加小幅度的扰动来误导模型预测来实现。虽然一些白盒攻击已经证明了它们的有效性，但它们假设攻击者可以完全访问机器学习模型;黑盒攻击在实践中更现实。在本文中，我们提出了一个查询有效的基于边界的黑盒攻击（QEBA）的基础上，只有模型的最终预测标签。我们从理论上证明了为什么以前的基于边界的攻击与梯度估计在整个梯度空间是不有效的查询数量，并提供最优性分析，我们的降维为基础的梯度估计。另一方面，我们在ImageNet和CelebA数据集上进行了广泛的实验，以评估QEBA。我们表明，与最先进的黑盒攻击相比，QEBA能够使用较少的查询，以实现100%的攻击成功率的扰动幅度较低。我们还展示了对真实世界API的攻击案例研究，包括MEGVII Face++和Microsoft Azure。
英文摘要：
Machine learning (ML), especially deep neural networks (DNNs) have been widely used in various applications, including several safety-critical ones (e.g. autonomous driving). As a result, recent research about adversarial examples has raised great concerns. Such adversarial attacks can be achieved by adding a small magnitude of perturbation to the input to mislead model prediction. While several whitebox attacks have demonstrated their effectiveness, which assume that the attackers have full access to the machine learning models; blackbox attacks are more realistic in practice. In this paper, we propose a Query-Efficient Boundary-based blackbox Attack (QEBA) based only on model's final prediction labels. We theoretically show why previous boundary-based attack with gradient estimation on the whole gradient space is not efficient in terms of query numbers, and provide optimality analysis for our dimension reduction-based gradient estimation. On the other hand, we conducted extensive experiments on ImageNet and CelebA datasets to evaluate QEBA. We show that compared with the state-of-the-art blackbox attacks, QEBA is able to use a smaller number of queries to achieve a lower magnitude of perturbation with 100% attack success rate. We also show case studies of attacks on real-world APIs including MEGVII Face++ and Microsoft Azure.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
