HopSkipJumpAttack: A Query-Efficient Decision-Based Attack

Abstract: The goal of a decision-based adversarial attack on a trained model is to generate adversarial examples based solely on observing output labels returned by the targeted model. We develop HopSkipJumpAttack, a family of algorithms based on a novel estimate of the gradient direction using binary information at the decision boundary. The proposed family includes both untargeted and targeted attacks optimized for $\ell_2$ and $\ell_\infty$ similarity metrics respectively. Theoretical analysis is provided for the proposed algorithms and the gradient direction estimate. Experiments show HopSkipJumpAttack requires significantly fewer model queries than Boundary Attack. It also achieves competitive performance in attacking several widely-used defense mechanisms. (HopSkipJumpAttack was named Boundary Attack++ in a previous version of the preprint.)

• The paper introduces an unbiased gradient-direction estimation approach that enhances adversarial sample generation at the decision boundary.
• It presents a hyperparameter-free algorithm employing geometric progression for step-size tuning and binary search for efficient boundary correction.
• Extensive experiments demonstrate that HopSkipJumpAttack achieves superior query efficiency and high success rates compared to existing decision-based attacks.

Overview of HopSkipJumpAttack: A Query-Efficient Decision-Based Attack

This paper presents "HopSkipJumpAttack," an innovative algorithm family designed for decision-based adversarial attacks on machine learning models. The primary goal of these attacks is to create adversarial examples by observing only the output labels of the target model, without accessing the model's internal information. The proposed algorithms focus on query efficiency and can be optimized for both $\ell_2$ and $\ell_\infty$ distance metrics, considering both untargeted and targeted attacks.

Key Contributions

The paper presents several critical contributions to the domain of adversarial attacks:

1. Unbiased Gradient-Direction Estimation: A novel approach to estimate the gradient direction based on binary outputs is proposed. This estimate is shown to be asymptotically unbiased at the decision boundary, which significantly enhances the accuracy and efficiency of adversarial example generation.
2. Algorithm Design: The paper introduces the HopSkipJumpAttack algorithm family, which is hyperparameter-free and demonstrates superior query efficiency relative to existing decision-based attacks. The algorithm structure involves gradient direction estimation, step-size tuning through geometric progression, and boundary correction using binary search.
3. Theoretical Analysis: Comprehensive theoretical analysis is provided, covering convergence properties and error control in gradient direction estimates. This analysis offers insights into hyperparameter tuning, ensuring the practical applicability of the presented algorithms.
4. Experimental Validation: Extensive experiments showcase the effectiveness of the proposed attack over various datasets, models, and defense mechanisms. The results indicate that HopSkipJumpAttack requires fewer queries than competing methods while maintaining high attack success rates.

Implications and Speculations

The implications of HopSkipJumpAttack are significant for understanding and mitigating security vulnerabilities in machine learning models. By demonstrating the potential to generate adversarial inputs using minimal model queries, this research highlights a practical approach for evaluating model robustness in real-world applications, such as autonomous vehicles and financial systems.

From a theoretical standpoint, the work introduces a novel gradient-direction estimation technique that might extend beyond adversarial attacks, potentially influencing other areas in machine learning that rely on zeroth-order optimization methods.

Looking ahead, further developments in AI might include enhancing the HopSkipJumpAttack to handle more complex and higher-dimensional data efficiently. Additionally, integrating transfer-based techniques could mitigate the limitations observed in targeted attacks on large datasets like ImageNet.

Conclusion

In conclusion, the HopSkipJumpAttack presents a robust framework for executing query-efficient adversarial attacks, thereby contributing to both the academic study of adversarial vulnerabilities and the practical assessment of machine learning models. This work not only advances the specific domain of decision-based attacks but also has implications for the broader field of secure AI development. The authors’ approach to combining theoretical insight with practical algorithms represents a noteworthy advancement in adversarial machine learning research.