Finding Optimal Tangent Points for Reducing Distortions of Hard-label Attacks

1 Introduction . Adversarial attacks cause deep neural networks ( DNNs ) to make incorrect predictions by slightly perturbing benign images during the test time . They can be divided into two main categories on the basis of the amount of information exposed by the target model , namely white-box and black-box attacks . Many white-box attacks [ 6 , 29 , 32 ] have been proposed , and they can compute the gradients w.r.t . the target model ’ s input images to generate adversarial examples with the first-order optimization techniques . In contrast , black-box attacks are more practical because they craft adversarial examples without requiring the target model ’ s gradients . Over the past years , the community has made considerable efforts in developing black-box attacks , and the proposed methods can be divided into transfer- and query-based attacks . Transfer-based attacks [ 25 , 37 , 38 ] generate adversarial examples by using a white-box attack method against a surrogate model to fool the target model . Although there is no need to query the target model in these attacks , the attack success rate can not be guaranteed , especially in the case of targeted attacks . To achieve satisfactory attack success rates , the query-based attacks use elaborate queries to obtain the feedback of the target model for crafting adversarial examples . In the score-based setting , the query-based attacks [ 2 , 12 , 22 , 28 ] estimate approximate gradients by querying the predicted scores of the target model at multiple points . However , in most real-world scenarios , the score-based setting ∗Corresponding author . 35th Conference on Neural Information Processing Systems ( NeurIPS 2021 ) . is not applicable because the public service returns only the top-1 predicted label ( i.e. , the hard label ) rather than the predicted score . In this case , since the feedback information is limited and the objective function is discontinuous , the attack requires solving a high-dimensional combinatorial optimization problem , which is often challenging . To reformulate the attack as a real-valued continuous optimization problem , OPT [ 10 ] , Sign-OPT [ 11 ] , and RayS [ 8 ] focus on minimizing an objective function g ( θ ) , which is defined as the distance from the original image to the nearest adversarial example along the direction θ . However , when attacking complex models , it may be difficult to find a suitable direction θ along which adversarial examples exist . Boundary Attack ( BA ) [ 4 ] , HopSkipJumpAttack ( HSJA ) [ 7 ] , QEBA [ 24 ] , qFool [ 26 ] , and Policy Driven Attack ( PDA ) [ 40 ] eliminate the search of the direction θ . Instead , they start from a large adversarial perturbation and then reduce its distortion while staying in the adversarial region . Because the output labels of the target model flip only near the decision boundary , these attacks restrict their explorations to the regions near the decision boundary . However , they do not thoroughly investigate the geometric properties of the decision boundary to accelerate the attack . For example , PDA uses a reinforcement learning framework to train a policy network to predict search directions , which are not geometrically optimal . In addition , the prediction accuracy of the policy network decreases significantly in the later stages of the iterations , resulting in worse performance of these iterations . HSJA and qFool simply use the gradient u estimated at the decision boundary as the direction of each update , while ignoring a geometrically critical issue , i.e. , u is not the optimal direction to be followed ( Fig . 1 ) . We could explore better search directions at each attack iteration . To find the optimal search direction for minimizing the distortions of attack , we propose a new geometric-based approach whose motivation is illustrated in Fig . 1 . We construct a virtual semicircle B centered at xt−1 to indicate all possible locations that xt−1 can reach along different directions , and the radius ofB limits the range of updates for successful attacks . It is easy to observe that moving along the tangent line can reach the nearest location of the decision boundary to the original image x , thereby producing the adversarial example with the minimum distortion . In real attack scenarios , the image data reside in a high-dimensional space , and the semicircle becomes a hemisphere . In this case , the benefit of using tangent points still exists , and we provide the detailed description and the formal proof in Section 3 and appendix . To summarize , the main contributions of this study are as follows . 1 . We cast the problem of minimizing the distortion in hard-label attacks into a geometric problem . We discover that the minimum distortion can be obtained by searching the optimal tangent point of a virtual hemisphere around the adversarial example at each iteration . 2 . We propose a novel geometric-based method to obtain a closed-form solution of the optimal tangent point . We provide an intuitive explanation of our approach , as well as a formal proof of its correctness . 3 . To improve robustness , we further propose a generalized method that replaces the hemisphere with a semi-ellipsoid to adapt to the target models with curved decision boundaries . 4 . Extensive experiments conducted on the CIFAR-10 [ 23 ] and ImageNet [ 14 ] datasets demonstrate the effectiveness of our approach . 2 Related Work . Query-based black-box attacks can be divided into score- and decision-based attack ( a.k.a . the hard-label attack ) . Score-based attacks [ 1–3 , 9 , 12 , 22 , 28 , 31 ] use the predicted probability score to craft adversarial examples , which is not always available in most real-world systems . Hard-label attacks are more useful , but obviously more challenging , because only the top-1 predicted label can be obtained . The hard-label attacks usually fall into three categories . The first category starts from the original image x0 and attempts to find a optimal direction θ to reach the adversarial example . OPT [ 10 ] searches an optimal θ to minimize the distance from x0 to the nearest adversarial example . Sign-OPT [ 11 ] improves the query efficiency of OPT by using a single query to estimate the sign of the directional derivative . RayS [ 8 ] eliminates the gradient estimation and proposes a fast check step to efficiently find the direction θ . However , RayS is only applicable to the untargeted attack under the ` ∞ norm because it is difficult to find a suitable direction to reach the region of the target class in a targeted attack , especially in the case of a large number of classes . The second category starts from a large perturbation or an image of the target class , and then reduces its distortion while staying in adversarial region , thereby gradually making it closer to the original image . BA [ 4 ] and NES [ 1 ] are two representative methods , but they have high query complexity . Biased BA [ 5 ] reinterprets BA as a biased sampling framework and incorporates different biases to improve the query efficiency . HSJA [ 7 ] utilizes the gradient estimation and the binary search to outperform BA . HSJA can be used as the baseline of hard-label attacks . QEBA [ 24 ] improves HSJA by using dimension reduction techniques . SurFree [ 30 ] and GeoDA [ 33 ] improve the performance of HSJA by exploiting geometric properties of DNNs . However , the geometric features of DNNs have not been fully explored , and they do not support the targeted attack . PDA [ 40 ] uses a reinforcement learning framework to train a policy network to predict promising directions . However , PDA requires a high-cost pre-training , which is not always available in all tasks . The third category uses a random sampling technique to improve query efficiency . Customized Adversarial Boundary ( CAB ) attack [ 34 ] uses the current noise to select the sensitive area of images and customize sampling distribution . Evolutionary [ 16 ] improves the query efficiency by reducing the dimension of the search space with the stochastic coordinate selection . The issue of RayS and GeoDA is that they only support untargeted attacks . Because moving the original image far enough in any direction can always make it escape the non-adversarial region in untargeted attacks . However , in targeted attacks , it is difficult to find a suitable direction along which the target class ’ s region exists . In contrast , our approach supports all types of attacks , and we exploit the geometric characteristics of the decision boundaries of DNNs to boost the attack . 3 The Proposed Approach . 3.1 The Goal of Hard-label Attacks . Given a target model f : Rd → Rk and a benign image x ∈ [ 0 , 1 ] d that is correctly classified using f , the goal of the adversary is to slightly perturb x into xadv , such that f ( xadv ) outputs incorrect prediction . In the hard-label attack , the adversary can only observe the top-1 predicted label of f , denoted as ŷ = arg maxi f ( xadv ) i . We define an indicator function φ ( · ) of a successful attack : φ ( xadv ) : = 1 if ŷ = yadv in the targeted attack , or ŷ 6= y in the untargeted attack , 0 otherwise , ( 1 ) where y ∈ R is the true label of x and yadv ∈ R is a predefined target class label . In this study , we focus on generating an adversarial example xadv that satisfies φ ( xadv ) = 1 , such that the distortion d ( xadv , x ) : = ‖xadv − x‖p is minimized . This goal can be formulated as the optimization problem : min xadv d ( xadv , x ) s.t . φ ( xadv ) = 1 . ( 2 ) 3.2 Motivation . Most recent attacks belong to the second category ( Section 2 ) follow a common procedure : it starts from an adversarial image yet not close enough to the benign one , then it iteratively searches for a closer adversarial image . Let us take a typical attack HSJA [ 7 ] for example ( Fig . 1 ) . First , the attack initializes the adversarial example by using an image of the target class ( in a targeted attack ) or a noisy version of the original image ( in an untargeted attack ) . Next , it performs the binary search to map the initial sample onto the decision boundaryH , denoted as xt−1 . Then , the algorithm iteratively performs three steps to update xt−1 : estimating gradient u at H by sampling many probes around xt−1 ; jumping to the point g along the direction u with the step size determined by the geometric progression ; and mapping g onto H at xg by performing the binary search along the line passing through g and the original image x . However , geometrically speaking , the estimated gradient u is not the optimal search direction , and we can find a better boundary point xt by connecting x to a certain point on the semicircle B and then taking the intersection point on H . Fig . 1 shows that the tangent point k is the optimum update because it leads to the minimum distortion of the attack . 3.3 Definition of Optimal Tangent Points There is some experimental evidence that the decision boundaries of DNNs are smooth surfaces with the low curvature [ 17 , 33 ] . Based on this observation , we approximate the local decision boundary with a hyperplane H . Fig . 3 illustrates our problem in three-dimensional space . We will derive our algorithm from R3 and show that it can be directly extended to higher-dimensional spaces . Lastly , we address the case of curved decision boundaries . As described in Section 3.2 , xt−1 denotes the boundary sample that already lies on the decision boundary . We create a virtual hemisphere B centered at xt−1 with a radius R , which is an estimation of the safe region where we can search for adversarial examples . In the targeted attack , B represents the current estimation of the target class region around xt−1 . Ideally , B is small enough to be fully contained in the target class ’ s region , i.e. , φ ( x′ ) = 1 for ∀x′ ∈ B . Then , we need to find a point on B which would produce the minimum distortion when mapped to H . In two-dimensional case , this point is the tangent point . However , in n-dimensional space where n ≥ 3 , there are infinitely many tangent lines of B passing through x which create infinitely many tangent points on B , shown as the red points in Figs . 2 and 3 . Still , we will show that exactly one tangent point can lead to the minimum distortion when mapping it onto H along the tangent line . Formally , let k be any point on the surface of B , u be the approximate gradient of H estimated at xt−1 , and xt be the intersection of H and the line passing through x and k , we have the following theorem . Theorem 1 Let H , u , k , x , and xt−1 be defined above , then the distance ‖x− xt‖ is minimized if k is the optimal solution of the following constrained optimization problem : arg max k 〈k− xt−1 , u〉 ( 3 ) s.t . 〈k− xt−1 , x− k〉 = 0 , ( 4 ) ‖k− xt−1‖ = R , ( 5 ) 〈k− xt−1 , u〉 ≥ 0 . ( 6 )

Summary: In this paper, the authors proposed a new geometric-based method for query-efficient hard-label black-box attacks. The proposed method relies on the observation that the minimum l2 distortion can be obtained by searching a boundary point along a tangent line of a virtual hemisphere. The authors offered a closed-form solution for computing the optimal tangent point and provided a formal proof of its correctness. Lastly, the authors evaluated the proposed approach through extensive experiments.