Query-efficient Meta Attack to Deep Neural Networks

1 INTRODUCTION . Despite the great success in various tasks , deep neural networks ( DNNs ) are found to be susceptible to adversarial attacks and often suffer dramatic performance degradation in front of adversarial examples , even if only tiny and invisible noise is imposed on the input ( Szegedy et al. , 2014 ) . To investigate the safety and robustness of DNNs , many adversarial attack methods have been developed , which apply to either a white-box ( Goodfellow et al. , 2015 ; Moosavi-Dezfooli et al. , 2016 ; Carlini & Wagner , 2017 ; Madry et al. , 2018 ) or a black-box setting ( Papernot et al. , 2017 ; Brendel et al. , 2018 ; Narodytska & Kasiviswanathan , 2017 ) . In the white-box attack setting , the target model is transparent to the attacker and imperceptible adversarial noise can be easily crafted to mislead this model by leveraging its gradient information ( Goodfellow et al. , 2015 ) . In contrast , in the blackbox setting , the structure and parameters of the target DNN model are invisible , and the adversary can only access the input-output pair in each query . With a sufficient number of queries , black-box methods utilize the returned information to attack the target model generally by estimating gradient ( Chen et al. , 2017 ; Ilyas et al. , 2018a ; Narodytska & Kasiviswanathan , 2017 ; Cheng et al. , 2019 ) . Black-box attack is more feasible in realistic scenarios than white-box attack but it is much more query-intensive . Such a drawback is largely attributed to the fact that returned information for each queried example is sparse and limited . During inferring attack patterns , existing black-box methods simply integrate the information between two sequential iterations brutally and ignore the implicit but profound message , thus not fully exploiting the returned information . Although query-efficient algorithms for generating attack examples are very meaningful in practice ( Ilyas et al. , 2018a ) , how to enhance query-efficiency for black-box attack remains underexplored . ∗Equal contribution . In this work , we address a query-efficiency concerned attack problem . Particularly , we consider only top-k probability scores accessible from the target black-box model . With this practical but challenging scenario , we aim at three important objectives : lower query number , higher success rate and smaller noise magnitude . We develop a meta-learning based attack method , which applies meta learning to obtaining prior information from the successful attack patterns , and uses the prior for efficient optimization . Specifically , we propose to train a meta attacker model through meta learning ( Nichol et al. , 2018 ) , inspired by its success in solving few-shot learning problems . We first deploy several existing classification models to get pairs of ( images , gradients ) with the max-margin logit classification loss . Then we use the data pairs of each classification model to train the meta attacker . After obtaining the attacker , we use it to attack a new black-box model for accelerating the search process for adversarial examples by optimizing it with coordinate-wise gradient estimation . Different from previous methods , we use the estimated gradient not only to update adversarial noise but to fine-tune the well-trained attacker . After few-shot fine-tuning , the attacker is able to simulate the gradient distribution of the target model . We evaluate our method on MNIST , CIFAR10 and tiny-ImageNet datasets by comparing it with state-of-the-art black-box attack methods including Zoo ( Chen et al. , 2017 ) , DecisionBoundary ( Brendel et al. , 2018 ) , AutoZoom ( Tu et al. , 2019 ) , Opt-attack ( Cheng et al. , 2019 ) and Bandits ( Ilyas et al. , 2018b ) . In both targeted and untargeted settings , our proposed method achieves comparable attack success rate and adversarial perturbation to all baselines but with a significantly reduced query number . The detailed experiment results demonstrate our superior query-efficiency . 2 RELATED WORK . Classical white-box attack methods include Fast-Gradient Sign Method ( FGSM ) ( Goodfellow et al. , 2015 ) , IFGSM ( Madry et al. , 2018 ) , DeepFool ( Moosavi-Dezfooli et al. , 2016 ) and C & W attack ( Carlini & Wagner , 2017 ) , following a setting where detailed information about the target model ( gradients and losses ) is provided . Comparatively , the black-box setting better accords with the real world scenarios in that little information about the target model is visible to the attacker . The pioneer work on black-box attack ( Papernot et al. , 2017 ) tries to construct a substitute model with augmented data and transfer the black-box attack problem to a white-box one . However , its attack performance is very poor due to the limited transferability of adversarial examples between two different models . ( Brendel et al. , 2018 ) considers a more restricted case where only top-1 prediction classes are returned and proposes a random-walk based attack method around the decision boundary . It dispenses class prediction scores and hence requires extensive model queries . Zoo ( Chen et al. , 2017 ) is a black-box version of C & W attack , achieving a similar attack success rate and comparable visual quality as many white-box attack methods . However , its coordinate-wise gradient estimation requires extensive model evaluations . More recently , ( Ilyas et al. , 2018a ) proposes a query-limited setting with L∞ noise considered , and uses a natural evolution strategy ( NES ) to enhance query efficiency . Though this method successfully controls the query number , the noise imposed is larger than average . ( Narodytska & Kasiviswanathan , 2017 ) proposes a novel local-search based technique to construct numerical approximation to the network gradient , which is then carefully used to construct a small set of pixels in an image to perturb . It suffers a similar problem as in ( Chen et al. , 2017 ) for pixel-wise attack . ( Cheng et al. , 2019 ) considers a hard-label black-box setting and formulates the problem as real-valued optimization that is solved by a zeroth order optimization algorithm . Ilyas et al . ( 2018b ) reduce the queries by introducing two gradient priors , the time-independent prior and the data-dependent prior , and reformulating the optimization problem . We then briefly introduce some works on meta-learning related to our work . Meta-learning is a process of learning how to learn . A meta-learning algorithm takes in a distribution of tasks , each being a learning problem , and produces a quick learner that can generalize from a small number of examples . Meta-learning is very popular recently for its fast adaptive ability . MAML ( Finn et al. , 2017 ) is the first to propose this idea . Recently , a simplified algorithm Reptile ( Nichol et al. , 2018 ) which is an approximation to the first-order MAML is proposed , achieving higher efficiency in computation and consuming less memory . With these superior properties , meta learning is applied to adversarial attack methods ( Zgner & Gnnemann , 2019 ; Edmunds et al. , 2017 ) . Zgner & Gnnemann ( 2019 ) try to attack the structure of a graph model in the training process to decrease the model generalization performance . Edmunds et al . ( 2017 ) investigate the susceptibility of MAML to adversarial attacks and the transferability of the obtained meta model to a specific task . 3 METHOD . 3.1 PRELIMINARIES : BLACK-BOX ATTACK SCHEMES . We first formulate the black-box attack problem and introduce the widely used solutions . We use ( x , t ) to denote the pair of a natural image and its true label , and x̂ and t̂ to denote the adversarial perturbed version of x and the returned label by the target classification modelMtar . The black-box attack aims to find an adversarial example x̂ with imperceivable difference from x to fail the target model , i.e. , t̂ 6= t through querying the target model for multiple times . It can be formulated as min x̂ ` ( x̂ , Mtar ( x̂ ) , t ) s.t . ‖x̂− x‖p ≤ ρ , # queries ≤ Q . ( 1 ) Here ‖ · ‖p denotes the ` p norm that measures how much perturbation is imposed . Mtar ( x̂ ) is the returned logit or probability by the target modelMtar . The loss function ` ( x̂ , Mtar ( x̂ ) , t ) measures the degree of certainty for model Mtar assigning the input x̂ into class t. One common used adversarial loss is the probability of class t : ` ( x̂ , Mtar ( x̂ ) , t ) = pMtar ( t|x̂ ) . The first constraint enforces high similarity between the clean image x and the adversarial one xadv and the second imposes a fixed budget Q for the number of queries allowed in the optimization . In the white-box attack setting , the adversary can access the true gradient ∇x̂t ` ( x̂t ) and perform gradient descent x̂t+1 = x̂t − ∇x̂t ` ( x̂t ) . But in the black-box setting , the gradient information ∇x̂t ` ( x̂t ) is not attainable . In this case , the attacker can estimate the gradient using only queried information from model evaluation such as hard label , logits and probability scores . This kind of estimator is the backbone of so-called zeroth-order optimization approaches ( Chen et al. , 2017 ; Narodytska & Kasiviswanathan , 2017 ; Tu et al. , 2019 ; Ilyas et al. , 2018a ; b ) . The estimation is done via finite difference method ( Chen et al. , 2017 ; Narodytska & Kasiviswanathan , 2017 ; Tu et al. , 2019 ) , which finds the k components of the gradient by estimating the inner products of the gradients with all the standard basis vector e1 , ... , ek : ∇ ` ( x ) ≈ k∑ i=1 f ( x+ hei ) − f ( x− hei ) 2h ei , ( 2 ) where step size h controls the quality of the estimated gradient . Another strategy is to reformulate the loss function ( Ilyas et al. , 2018a ; b ) . Instead of computing the gradient of ` ( x ) itself , the expected value of loss function ` ( x ) under the search distribution is minimized and when the search distribution of random Guassian noise is adopted , the gradient estimation problem transfers into a zeroth-order estimation problem , ∇E [ ` ( x ) ] ≈ 1 σn n∑ i=1 ` ( x+ σδi ) δi ( 3 ) where n is the amount of noise sampled from the distribution . After obtaining the estimated gradient , classical optimization algorithms ( Nesterov , 2013 ; Johnson & Zhang , 2013 ) can be used to infer the adversarial examples . Though the estimated gradient may not be accurate , it is still proved useful enough in adversarial attack . The convergence of these zeroth-order methods is guaranteed under mild assumptions ( Ghadimi & Lan , 2013 ; Nesterov & Spokoiny , 2017 ; Hazan et al. , 2016 ) . Since each model evaluation consumes a query , naively applying the above gradient estimation to black-box attack is quite query expensive due to its coordinate or noise sampling nature . Take the first strategy on tiny-Imagenet dataset for example . It consumes more than 20,000 queries for each image to obtain a full gradient estimate , which is not affordable in practice . In this work , we address such a limitation via developing a query-efficient meta-learning based attack model .

Summary: The authors proposed a meta-learning based black-box adversarial attack method to reduce the number of queries. Their proposed meta attacker is trained via a meta-learning approach, and it could utilize historical query information and fast adapted to different target models. The authors conduct experiments in three datasets, and the results show that their proposed meta attacker is more efficient than other black-box attack methods.