Query-efficient Meta Attack to Deep Neural Networks (1906.02398v3)

Abstract: Black-box attack methods aim to infer suitable attack patterns to targeted DNN models by only using output feedback of the models and the corresponding input queries. However, due to lack of prior and inefficiency in leveraging the query and feedback information, existing methods are mostly query-intensive for obtaining effective attack patterns. In this work, we propose a meta attack approach that is capable of attacking a targeted model with much fewer queries. Its high queryefficiency stems from effective utilization of meta learning approaches in learning generalizable prior abstraction from the previously observed attack patterns and exploiting such prior to help infer attack patterns from only a few queries and outputs. Extensive experiments on MNIST, CIFAR10 and tiny-Imagenet demonstrate that our meta-attack method can remarkably reduce the number of model queries without sacrificing the attack performance. Besides, the obtained meta attacker is not restricted to a particular model but can be used easily with a fast adaptive ability to attack a variety of models.The code of our work is available at https://github.com/dydjw9/MetaAttack_ICLR2020/.

Query-efficient Meta Attack to Deep Neural Networks

The paper presents a novel approach to adversarial attack on deep neural networks (DNNs), specifically targeting the black-box attack scenario. Black-box attacks are relevant in scenarios where the attacker has limited access to the model, typically restricted to input-output pairs. The primary challenge addressed by the authors is the query-intensive nature of current black-box attack methodologies, which often require extensive querying of the model to derive effective attack patterns.

Overview

To tackle the inefficiency in conventional black-box attacks, the authors propose a meta-learning-based framework that significantly reduces the number of queries needed to execute a successful attack. The proposed solution leverages meta learning, a methodology where models are enabled to learn from a distribution of tasks to acquire an ability to generalize quickly across new, unknown instances with minimal data. By applying meta learning, the authors design a meta attacker model that learns from previously observed attack patterns and subsequently applies this learned prior to infer attack patterns with fewer queries.

The paper demonstrates that such a meta attack approach retains robust attack performance across different datasets, including MNIST, CIFAR10, and tiny-Imagenet, without compromising on attack success rates. Importantly, the paper highlights that the meta attacker does not exhibit dependency on a specific model and readily adapts to attacking a variety of models swiftly, underscoring its generalization capacity.

Strong Results and Claims

The experimental results articulated in the paper are compelling. The meta attacker markedly reduces the required query numbers by a significant margin compared to existing state-of-the-art black-box attack methods such as Zoo, Decision-Boundary, AutoZoom, Opt-attack, and Bandits. Furthermore, the efficacy of the meta attacker is evident in both untargeted and targeted attack scenarios, showcasing comparable success rates with reduced queries and minimal noise imposition on the perturbations.

Implications and Future Directions

The implications of this research are multifaceted:

• Practical Efficiency: The ability to achieve effective attacks with reduced queries enhances the practical applicability of adversarial attacks in real-world scenarios. This efficiency is crucial for attackers who operate under constrained query budgets.
• Defensive Approaches: As adversarial attacks continue to evolve, defensive measures must adapt accordingly. Meta-learning-based attack strategies could spur the development of more sophisticated defensive mechanisms that anticipate meta attacker behaviors.
• Progress in Meta Learning: The integration of meta learning into adversarial attack methodologies may inspire further exploration of meta-learning techniques in other domains of artificial intelligence, fostering broader progress in real-time adaptation capabilities of AI models.

Looking ahead, future research may explore refining meta learning techniques, exploring higher-dimensional datasets, and robustifying meta attackers against evolving model architectures and defenses. Moreover, the adaptability and efficiency of meta attackers could be pivotal in real-world AI applications, offering a pathway to understanding and mitigating adversarial vulnerabilities.

Conclusion

This paper introduces a significant advancement in black-box adversarial attack techniques via query-efficient meta attackers. By harnessing meta learning, researchers can develop attacks that are both adaptable and efficient, paving the way for more intelligent and strategic adversarial methodologies and encouraging a reevaluation of current AI model defense systems.