Practical No-box Adversarial Attacks with Training-free Hybrid Image Transformation

1 INTRODUCTION . Deep neural networks ( DNNs ) are widely known to be vulnerable to adversarial examples ( Szegedy et al. , 2013 ; Goodfellow et al. , 2015 ) , i.e. , a human-imperceptible perturbation can lead to misclassification . In adversarial machine learning , the term threat model defines the rules of the attack , such as the resources the attacker can access . Based on the threat model , the attacks are often divided into white-box attacks and black-box attacks . In the white-box threat model ( Szegedy et al. , 2013 ; Goodfellow et al. , 2015 ; Madry et al. , 2018a ) , the attacker has full knowledge of a target model , such as the model weights and the whole training dataset . Recognizing the threat of these adversarial attacks , a model owner is unlikely to leak a model ’ s information to the public . Thus , the white-box attack is often used to evaluate the model robustness for revealing its weakest point ( Madry et al. , 2018a ) , but often not considered as a practical attack method ( Chen et al. , 2017 ) . To this end , numerous works have investigated a more realistic threat model , where the attacker does not require full knowledge of the target model , i.e. , the backpropagation on the target model is prohibited . This threat model is called black-box attack ( Papernot et al. , 2016 ; Tramèr et al. , 2016 ; Papernot et al. , 2017 ; Narodytska & Kasiviswanathan , 2017 ; Chen et al. , 2017 ; Brendel et al. , 2017 ; Dong et al. , 2019b ; Yan et al. , 2019 ; Chen et al. , 2020 ; Zhou et al. , 2020 ) . However , such a black-box threat model usually involves a major concern of being resource-intensive in terms of query cost and time . In real-world attack scenarios , even if we ignore such concerns , query-based black-box attack can still be infeasible , e.g. , the model API is inaccessible to the attacker . Moreover , it might cause suspicion due to repeated queries to the model with almost the same adversarial image . To alleviate this issue , another line of black-box threat model ( Dong et al. , 2018 ; Xie et al. , 2019b ; Dong et al. , 2019a ; Wu et al. , 2020 ; Lin et al. , 2020 ; Gao et al. , 2020a ; 2021 ) called transfer-based attack is proposed . In this threat model , adversarial examples are crafted via the local available pre-trained substitute model , which usually trains on the same training dataset as the target model . The resultant adversarial examples are expected to attack the target model . However , without the feedback from the target model , the transferability heavily depends on how large the gap between the substitute model and target model . In practice , this gap is large because the structure and the training technique of the target model are usually not publicly available due to security and privacy concerns . From the analysis above , we argue that both white-box and black-box attacks can hardly be considered as practical attacks . A practical attack should satisfy two criteria : ( a ) model-free , i.e. , no dependence on the pre-trained substitute model or the target model for either backward propagation or only forward query ; ( b ) data-free , i.e. , no dependence on the dataset for training a substitute model . We term it no-box attack . A recent work ( Li et al. , 2020a ) is the first ( to our knowledge ) as well as the only work to have attempted such an attack in a loose sense . Their threat model still requires a small number of auxiliary samples , such as 20 images . Admittedly , collecting a small number of samples might not be difficult in most cases , but might be still infeasible in some security-sensitive applications . Specifically , their approach ( Li et al. , 2020a ) attempts to train a substitute model by adopting the classical auto-encoder model instead of the supervised classification model due to the constraint of a small-scale dataset . Overall , to attack a certain sample , their approach consists of three steps : ( 1 ) collecting a small number of images ; ( 2 ) training a substitute model ; ( 3 ) white-box attack on the substitute model . If a new sample , especially from a different class , needs to be attacked , the above process needs to be repeated . Thus , their approach is very resource-intensive . Besides , their attack success rate is still significantly lower than existing black-box attacks . By contrast , our approach does not require any of the above three steps and is even training-free . With the help of visualization technique proposed by ( Zeiler & Fergus , 2014 ) , we observe that the high-frequency component ( HFC ) , e.g. , the edge and texture features , is dominant in shallow layers and the low-frequency component ( LFC ) , e.g. , the plain areas in the image , is paid less attention to be extracted . Combined with the insight into the classification logic of DNNs in Sec . 3.1 , we observe that HFC plays a crucial role in recognition . As shown in Fig . 1 , without LFC , the confidence of HFC is even higher than the raw image . Although it does not hold true for all samples , it does demonstrate the importance of HFC . Motivated by this , we take the idea of hybrid image ( Oliva , 2013 ) and propose a novel Hybrid Image Transformation ( HIT ) attack method to craft adversarial examples . Formally , it only needs three steps but can effectively fool various DNNs without any training : First , due to the trainingfree setting and inspired by the analysis from Sec . 3.2 , we simply utilize matplotlib1 tool to draw several geometric patterns which serve as the proto-patterns , and the resultant synthesized adversarial patches are thus richer in regionally homogeneous , repeating and dense HFC . Second , we extract the LFC of the raw image and HFC of the adversarial patch . Finally , we combine these two pieces of components and clip them to the ε-ball of the raw image to get the resultant adversarial hybrid example . Extensive experiments on ImageNet demonstrate the effectiveness of our method . By attacking ten state-of-the-art models in the no-box manner , our HIT significantly increases the average success rate from 68.74 % to 98.13 % . Notably , our HIT is even competitive to mainstream transfer-based black-box attacks . 2 RELATED WORK . Adversarial Attack . Let x denote raw image without any perturbation , xadv and y denote the corresponding adversarial example and true label respectively . In generally , we use l∞-norm to measure the perceptibility of adversarial perturbations , i.e. , ||xadv − x||∞ ≤ ε . In this paper , we focus on non-targeted attacks ( Dong et al. , 2018 ; Xie et al. , 2019b ; Wu et al. , 2020 ; Lin et al. , 2020 ; Gao et al. , 2020a ) which aim to cause misclassification of DNNs f ( · ) , i.e. , f ( xadv ) 6= y . 1https : //matplotlib.org/ Competitors . Transferability is an important property for adversarial examples . With it , the resultant adversarial example crafted via one model may fool others . For the black-box threat model , Goodfellow et al . ( 2015 ) argue that the vulnerability of DNNs is their linear nature , and generate adversarial examples efficiently by performing FGSM which is a single-step attack . Papernot et al . ( 2017 ) train a local model with many queries to substitute for the target model . Dong et al . ( 2018 ) integrate a momentum term into I-FGSM Kurakin et al . ( 2017 ) to stabilize the update direction during the attack iterations . Xie et al . ( 2019b ) apply diverse input patterns to improve the transferability of adversarial examples . Dong et al . ( 2019a ) propose a translation-invariant attack to mitigate the effect of different discriminative regions between models . Gao et al . ( 2020a ) introduce patch-wise perturbation by amplifying the step size and reuse the cut noise to perturb more information in discriminative regions . For the no-box threat model , Li et al . ( 2020a ) attempt to attack the target model without any model query or the accessible pre-trained substitute model . In their work , with a limited amount of data , they try different mechanisms ( with or without supervised technique ) to train the substitute model , and then utilize this substitute model to craft transferable adversarial examples . Different from these approaches , our method does not depend on transferability since we do not need any substitute model . In this paper , we craft the adversarial examples from the perspective of the classification logic of DNNs . Frequency Perspective on DNNs . Our approach is highly inspired by existing works which explain the generalization and adversarial vulnerability of DNNs from the frequency perspective . The fact that DNNs have good generalization while being vulnerable to small adversarial perturbations has motivated ( Jo & Bengio , 2017 ; Wang et al. , 2020 ) to investigate the underlying mechanism , suggesting that surface-statistical content with high-frequency property is essential for the classification task . From the perspective of texture vs. shape , Geirhos et al . ( 2019 ) ; Wang et al . ( 2020 ) reveal that DNNs are biased towards texture instead of shape . Since the texture content is considered to have high-frequency property , their finding can be interpreted as the DNN being biased towards HFC . On the other hand , adversarial perturbations are also known to have the high-frequency property and various defense methods have also been motivated from this insight ( Aydemir et al. , 2018 ; Das et al. , 2018 ; Liu & JaJa , 2019 ; Xie et al. , 2019a ) . Nonetheless , it remains unknown whether manually designed high-frequency patterns are sufficient for attacking the network . 3 METHODOLOGY . Although many adversarial attack methods ( Papernot et al. , 2016 ; Dong et al. , 2018 ; Gao et al. , 2020a ; Li et al. , 2020a ) have achieved pretty high success rates in both black-box and no-box cases , they all need training , especially for query-based ( Papernot et al. , 2016 ; Zhou et al. , 2020 ) and nobox adversarial perturbations ( Li et al. , 2020a ) whose training is usually time-consuming . Then a natural question arises : Is it possible to generate robust adversarial perturbations without any training ? In the following subsections , we will give our answer and introduce our design . 3.1 MOTIVATION . To better understand the role of HFC and LFC for the classification results of DNNs , we split the information of raw images into these two pieces via Gaussian low-pass filter ( defined in Eq . 1 ) . As illustrated in Fig . 3 , when the kernel size is small , i.e. , the cutoff frequency is high , the average accuracy of LFC on ten state-of-the-art models is close to 100 % . However , if we continue to increase the kernel size , the average accuracy of HFC begins to exceed LFC one . To our surprise , for several specific raw images , e.g. , left image of Fig . 1 , the true label ’ s confidence of HFC which is mostly black is even higher than the raw image . To explain the above phenomenon , we turn to the perspective of feature space . Inspired by recent intermediate feature-based attacks ( Zhou et al. , 2018 ; Ganeshan & Babu , 2019 ; Inkawhich et al. , 2019 ) , we argue low-level features are critical to the classification . Interestingly , as shown in Fig . 2 , most2 feature maps in the shallow layers generally extract the edge and texture features ( typical ones are highlighted by red boxes ) , i.e. , HFC , and pay less attention to plain areas in images , i.e. , LFC . Therefore , if a perturbation can effectively manipulate the HFC of an image , totally different low-level features will be extracted and may lead to misclassification .

Summary: The proposed approach involves creating adversarial examples in a training-free manner by manipulating the frequency components of the image. High -frequency information is used from simple geometric patterns and combined with low-frequency component from the input to create a hybrid image. The resultant image is shown to fool classifiers under multiple settings which presents an easy way to construct adversarial examples.