arXivDaily arXiv每日学术速递 周一至周五更新
arXiv周末暂无论文更新,休息一下吧,周末愉快~~
arXiv 2106.07445cs.LGcs.CRcs.CVmath.OCstat.ML
收藏

PopSkipJump:基于决策的概率分类器攻击

PopSkipJump: Decision-Based Attack for Probabilistic Classifiers

ETH Zürich(苏黎世联邦理工学院)

Carl-Johann Simon-Gabriel, Noman Ahmed Sheikh, Andreas Krause

摘要:

大多数当前的分类器容易受到对抗性样本的影响,这些样本是改变分类输出的小输入扰动。许多现有的攻击算法涵盖了从白盒到黑盒分类器的各种设置,但通常假设答案是确定性的,并且通常在答案不确定时失败。因此,我们提出了一种新的基于对抗性决策的攻击,专门为具有概率输出的分类器设计。它基于Chen等人的HopSkipJump攻击(2019,arXiv:1904.02144v5),这是一种最初为确定性分类器设计的强大且查询高效的基于决策的攻击。我们的P(robabilisticH)opSkipJump攻击适应其查询量,以保持HopSkipJump的原始输出质量在各种噪声水平,同时收敛到其查询效率的噪声水平降低。我们测试了我们对各种噪声模型的攻击,包括最先进的现成的随机防御,并表明它们对基于决策的攻击几乎没有额外的鲁棒性。代码可在https://github.com/cjsg/PopSkipJump上获得。

英文摘要:

Most current classifiers are vulnerable to adversarial examples, small input perturbations that change the classification output. Many existing attack algorithms cover various settings, from white-box to black-box classifiers, but typically assume that the answers are deterministic and often fail when they are not. We therefore propose a new adversarial decision-based attack specifically designed for classifiers with probabilistic outputs. It is based on the HopSkipJump attack by Chen et al. (2019, arXiv:1904.02144v5 ), a strong and query efficient decision-based attack originally designed for deterministic classifiers. Our P(robabilisticH)opSkipJump attack adapts its amount of queries to maintain HopSkipJump's original output quality across various noise levels, while converging to its query efficiency as the noise level decreases. We test our attack on various noise models, including state-of-the-art off-the-shelf randomized defenses, and show that they offer almost no extra robustness to decision-based attacks. Code is available at https://github.com/cjsg/PopSkipJump .

机构、总结、中文摘要均由AI分析而来,可能存在错误,请以论文正文为准。

↑