RamBoAttack：一种鲁棒查询高效的深度神经网络决策开发
RamBoAttack: A Robust Query Efficient Deep Neural Network Decision Exploit
摘要：
机器学习模型非常容易受到来自对抗性示例的规避攻击。一般来说，对抗性示例，即与原始输入欺骗性相似的修改后的输入，是由具有完全访问模型权限的对手在白盒设置下构建的。然而，最近的攻击表明，使用黑盒攻击来制作对抗性示例的查询数量显着减少。特别地，令人担忧的是利用来自训练模型的访问接口的分类决策的能力，该训练模型由越来越多的机器学习即服务提供商（包括Google、Microsoft、IBM）提供，并由大量包含这些模型的应用使用。攻击者仅利用模型中的预测标签来制作对抗性示例的能力被区分为基于决策的攻击。在我们的研究中，我们首先深入研究了ICLR和SP中最近最先进的基于决策的攻击，以突出使用梯度估计方法发现低失真对抗的成本。我们开发了一个强大的查询有效的攻击，能够避免陷入局部最小值和错误的方向从噪声梯度中看到的梯度估计方法。我们提出的攻击方法，RamBoAttack，利用随机块坐标下降的概念来探索隐藏的分类器流形，目标扰动只操纵局部输入特征，以解决梯度估计方法的问题。重要的是，RamBoAttack对对手和目标类可用的不同样本输入更具鲁棒性。总的来说，对于一个给定的目标类，RamBoAttack被证明是更强大的在给定的查询预算内实现较低的失真。我们使用大规模高分辨率ImageNet数据集来管理我们的广泛结果，并在GitHub上开源我们的攻击，测试样本和工件。
英文摘要：
Machine learning models are critically susceptible to evasion attacks from adversarial examples. Generally, adversarial examples, modified inputs deceptively similar to the original input, are constructed under whitebox settings by adversaries with full access to the model. However, recent attacks have shown a remarkable reduction in query numbers to craft adversarial examples using blackbox attacks. Particularly, alarming is the ability to exploit the classification decision from the access interface of a trained model provided by a growing number of Machine Learning as a Service providers including Google, Microsoft, IBM and used by a plethora of applications incorporating these models. The ability of an adversary to exploit only the predicted label from a model to craft adversarial examples is distinguished as a decision-based attack. In our study, we first deep dive into recent state-of-the-art decision-based attacks in ICLR and SP to highlight the costly nature of discovering low distortion adversarial employing gradient estimation methods. We develop a robust query efficient attack capable of avoiding entrapment in a local minimum and misdirection from noisy gradients seen in gradient estimation methods. The attack method we propose, RamBoAttack, exploits the notion of Randomized Block Coordinate Descent to explore the hidden classifier manifold, targeting perturbations to manipulate only localized input features to address the issues of gradient estimation methods. Importantly, the RamBoAttack is more robust to the different sample inputs available to an adversary and the targeted class. Overall, for a given target class, RamBoAttack is demonstrated to be more robust at achieving a lower distortion within a given query budget. We curate our extensive results using the large-scale high-resolution ImageNet dataset and open-source our attack, test samples and artifacts on GitHub.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
