Query-Efficient Hard-label Black-box Attack: An Optimization-based Approach
Query-Efficient Hard-label Black-box Attack: An Optimization-based Approach
复制标题
DOI：
--
复制
发表时间：
2018-07
期刊：
影响因子：
--
通讯作者：
Minhao Cheng;Thong Le;Pin-Yu Chen;Jinfeng Yi;Huan Zhang;Cho-Jui Hsieh
中科院分区：
文献类型：
--
作者：
Minhao Cheng;Thong Le;Pin-Yu Chen;Jinfeng Yi;Huan Zhang;Cho-Jui Hsieh
我们研究了在硬标签黑箱环境下攻击机器学习模型的问题，在这种情况下，除了攻击者可以通过查询来探测相应的硬标签决策外，没有任何模型信息被泄露。这是一个非常具有挑战性的问题，因为将最先进的白盒攻击（例如，CW或PGD）直接扩展到硬标签黑盒设置将需要最小化非连续阶跃函数，这是组合的，不能通过基于梯度的优化器来解决。目前唯一的方法是基于边界上的随机行走，这种方法需要大量的查询并且缺乏收敛性保证。我们提出了一种新的方法，将硬标签黑盒攻击表述为一个实值优化问题，该问题通常是连续的，可以用任何零阶优化算法求解。例如，使用随机梯度- free方法，我们能够限制算法实现平稳点所需的迭代次数。在MNIST、CIFAR和ImageNet数据集上，我们证明了我们提出的方法优于之前的随机漫步方法来攻击卷积神经网络。更有趣的是，我们表明所提出的算法也可以用来攻击其他离散和非连续的机器学习模型，如梯度增强决策树（GBDT）。
We study the problem of attacking a machine learning model in the hard-label black-box setting, where no model information is revealed except that the attacker can make queries to probe the corresponding hard-label decisions. This is a very challenging problem since the direct extension of state-of-the-art white-box attacks (e.g., CW or PGD) to the hard-label black-box setting will require minimizing a non-continuous step function, which is combinatorial and cannot be solved by a gradient-based optimizer. The only current approach is based on random walk on the boundary, which requires lots of queries and lacks convergence guarantees. We propose a novel way to formulate the hard-label black-box attack as a real-valued optimization problem which is usually continuous and can be solved by any zeroth order optimization algorithm. For example, using the Randomized Gradient-Free method, we are able to bound the number of iterations needed for our algorithm to achieve stationary points. We demonstrate that our proposed method outperforms the previous random walk approach to attacking convolutional neural networks on MNIST, CIFAR, and ImageNet datasets. More interestingly, we show that the proposed algorithm can also be used to attack other discrete and non-continuous machine learning models, such as Gradient Boosting Decision Trees (GBDT).