Gaussian MRF Covariance Modeling for Efficient Black-Box Adversarial Attacks

1 INTRODUCTION . Most methods for adversarial attacks on deep learning models operate in the so-called white-box setting ( Goodfellow et al. , 2014 ) , where the model being attacked , and its gradients , are assumed to be fully known . Recently , however there has also been considerable attention given to the black-box setting as well , where the model is unknown and can only be queried by a user , and which much better captures the “ typical ” state by which an attack can interact with a model ( Chen et al. , 2017 ; Tu et al. , 2019 ; Ilyas et al. , 2019 ; Moon et al. , 2019 ) . And several past methods in this area have conclusively demonstrated that , given sufficient number of queries , it is possible to achieve similarly effective attacks in the black-box setting akin to the white-box setting . However , as has also been demonstrated by past work Ilyas et al . ( 2019 ; 2018 ) , the efficiency of these black-box attacks ( the number of queries need to find an adversarial example ) is fundamentally limited unless they can exploit the spatial correlation structure inherent in the model ’ s gradients . Yet , at the same time , most previous methods have used rather ad-hoc methods of modeling such correlation structure , such as using “ tiling ” bases and priors over time Ilyas et al . ( 2019 ) that require attack vectors be constant over large regions , or by other means such as using smoothly-varying perturbations Ilyas et al . ( 2018 ) to estimate these gradients . In this work , we present a new , more rigorous approach to model the correlation structure of the gradients within the black-box adversarial setting . In particular , we propose to model the gradient of the model loss function with respect to the input image using a Gaussian Markov Random Field ( GMRF ) . This approach offers a number of advantages over prior methods : 1 ) it naturally captures the spatial correlation observed empirically in most deep learning models ; 2 ) using the model , we are able to compute exact posterior estimates over the true gradient given observed data , while also fitting the parameters of the GMRF itself via an expectation maximization ( EM ) approach ; and 3 ) the method provides a natural alternative to uniformly sampling perturbations , based upon the eigenvectors of the covariance matrix . Although representing the joint covariance over the entire input image may seem intractable for large-scale images , we can efficiently compute necessary terms for very general forms of grid-based GMRFs using the Fast Fourier Transform ( FFT ) . We evaluate our approach by attempting to find adversarial examples , over multiple different data sets and model architectures , using the GMRF combined with a very simple greedy zeroth order search technique ; the method effectively forms a “ black-box ” version of the fast gradient sign method ( FGSM ) , by constructing an estimate of the gradient at the input image itself , then taking a single signed step in this direction . Despite its simplicity , we show that owing to the correlation structure provided by the GMRF model , the approach outperforms more complex approaches such as the BANDITS-TD ( Ilyas et al. , 2019 ) or PARSIMONIOUS ( Moon et al. , 2019 ) methods ( the current state of the art in black-box attacks ) , especially for small query budgets . 2 RELATED WORK . Black-box adversarial attacks can be broadly categorized across a few different dimensions : optimization-based versus transfer-based attacks , and score-based versus decision-based attacks . In the optimization-based adversarial setting , the adversarial attack is formulated as the problem of maximizing some loss function ( e.g. , the accuracy of the classifier or some continuous variant ) using a zeroth order oracle , i.e. , by making queries to the classifier . And within this optimization setting , there is an important distinction between score-based attacks , which directly observe a traditional model loss , class probability , or other continuous output of the classifier on a given a example , versus decision-based attacks , which only observe the hard label predicted by the classifier . Decision based attacks have been studied by Brendel et al . ( 2017 ) ; Chen et al . ( 2019 ; 2017 ) , and ( not surprisingly ) typically require more queries to the classifier than the score-based setting . In the regime of score-based attacks , the first such iterative attack on a class of binary classifiers was first studied by Nelson et al . ( 2012 ) . A real-world application of black-box attacks to fool a PDF malware classifier was demonstrated by ( Xu et al. , 2016 ) , for which a genetic algorithm was used . Narodytska & Kasiviswanathan ( 2017 ) demonstrated the first black-box attack on deep neural networks . Subsequently black-box attacks based on zeroth order optimization schemes , using techniques such as KWSA ( Kiefer et al. , 1952 ) and RDSA ( Nesterov & Spokoiny , 2017 ) were developed in Chen et al . ( 2017 ) ; Ilyas et al . ( 2018 ) . Though Chen et al . ( 2017 ) generated successful attacks attaining high attack accuracy , the method was found to be extremely query hungry which was then remedied to an extent by ( Ilyas et al. , 2018 ) . In Ilyas et al . ( 2019 ) , the authors exploit correlation of gradients across iterations by setting a prior and use a piece wise constant perturbation , i.e. , tiling to develop a query efficient black-box method . Recently Moon et al . ( 2019 ) used a combinatorial optimization perspective to address the black-box adversarial attack problem . A concurrent line of work Papernot et al . ( 2017 ) has considered the transfer-based setting , rather than the optimization setting . These approaches create adversarial attacks by training a surrogate network with the aim to mimic the target model ’ s decisions , which are then obtained through blackbox queries . With the substitute model in place , the attack method then uses white-box attack strategies in order to transfer the attacks to the original target model . However , substitute network based attack strategies have been found to have a higher query complexity than those based on gradient estimation . The exploitation of the structure of the input data space so as to append a regularizer has been recently found to be effective for robust learning . In particular , in Lin et al . ( 2019 ) showed that by using Wasserstein-2 geometry to capture semantically meaningful neighborhoods in the space of images helps to learn discriminative models that are robust to in-class variations of the input data . Setting of this work In this paper , we are specifically focused on the optimization-based , scorebased setting , following most directly upon the work of ( Chen et al. , 2017 ; Ilyas et al. , 2018 ; 2019 ; Moon et al. , 2019 ) . However , our contribution is also largely orthogonal to the methods presented in these prior works . Specifically , we show that by modeling the covariance structure of the gradient using a Gaussian MRF , a very simple approach ( which largely mirrors the simple black box search from ( Ilyas et al. , 2018 ) ) achieves performance that is competitive than the best current methods , especially when using relatively few queries . We further emphasize that while we focus on this simple search strategy here , nothing would prevent this GMRF approach from being applied to other black-box search strategies as well . 3 ADVERSARIAL ATTACKS . In the context of classifiers , adversarial examples are carefully crafted inputs to the classifier which have been perturbed by an additive perturbation so as to cause the classifier to misclassify the input . In particular , so as to ensure minimal visual distortion , the perturbation is subjected to a constraint in terms of its magnitude typically pre-specified in terms of ` p-norm , for some fixed p , less than some p. Furthermore in the context of classifiers , attacks can be further classified into targeted or untargeted attacks . For simplicity and brevity , in this paper , we restrict our attention to untargeted attacks . Formally , define a classifier C : X 7→ Y with a corresponding classification loss function L ( x , y ) , where x ∈ X is the input to the classifier , y ∈ Y , X is the set of inputs and Y is the set of labels . Technically speaking , the objective of generating a misclassified example can be posed as an optimization problem . In particular , the aim is to generate an adversarial example x′ for a given input x which maximizes L ( x′ , y ) but still remains p-close in terms of a specified metric , to the original input . Thus , the generation of an adversarial attack can be formalized as a constrained optimization as follows : x′ = arg max x′ : ‖x′−x‖p≤ p L ( x′ , y ) . ( 1 ) We give a brief overview of adversarial attacks categorized in terms of access to information namely , white-box and black-box attacks . 3.1 WHITE-BOX ADVERSARIAL ATTACKS . White-box settings assume access to the entire classifier and the analytical form of the possibly nonconvex classifier loss function . White-box methods can be further categorized into single iteration and multiple iterations based methods . In the class of single iteration white-box methods , the Fast Gradient Sign Method ( FGSM ) has been very successful , which computes the adversarial input in the following way : x′ = x + psign ( ∇L ( x , y ) ) . ( 2 ) FGSM is however limited to generation of ` ∞ based bounded adversarial inputs . Given , a constrained optimization problem at hand with access to a first order oracle , the most effective method is projected gradient descent ( PGD ) . This multi iteration method generates the adversarial input xk by performing k iterations with x0 = x , where k is specified apriori . In particular , at the l-th iteration , PGD generates the perturbed input xl as follows : xl = ΠBp ( x , ) ( xl−1 + ηsl ) with sl = Π∂Bp ( 0,1 ) ∇xL ( xl−1 , y ) , ( 3 ) where ΠS denotes the projection onto the set S , Bp ( x′ , ε′ ) is the ` p ball of radius ε′ centered at x′ , η denotes the step size , and ∂U is the boundary of a set U . By making , sl to be the projection of the gradient ∇xL ( xl−1 , y ) at xl−1 onto the unit ` p ball , it is ensured that sl is the unit ` p-norm vector that has the largest inner product with ∇xL ( xl−1 , y ) . When p = 2 , the projection corresponds to the normalized gradient , while for p = ∞ , the projection corresponds to the sign of the gradient . Moreover , due to the projection at each iteration , the adversarial input generated at every iteration conforms to the specified constraint . However , in most real world deployments , it is impractical to assume complete access to the classifier and analytic form of the corresponding loss function , which makes black-box settings more realistic . 3.2 BLACK-BOX ADVERSARIAL ATTACKS . In a typical black-box setting , the adversary has only access to a zeroth order oracle , which when queried for an input ( x , y ) , yields the value of the loss function L ( x , y ) . In spite of the information constraints and typically high dimensional inputs , black-box attacks have been shown to be pretty effective ( Ilyas et al. , 2019 ; 2018 ; Moon et al. , 2019 ) . The main building block of black-box methods is finite difference schemes so as to estimate gradients . Two of the most widely finite difference schemes are the Kiefer-Wolfowitz Stochastic Approximation ( KWSA ) Kiefer et al . ( 1952 ) and Random Directions Stochastic Approximation ( RDSA ) ( Nesterov & Spokoiny , 2017 ) . KWSA operates as follows : ∇̂xL ( x , y ) = d∑ k=1 ek ( L ( x + δek , y ) − L ( x , y ) ) /δ ≈ d∑ k=1 ek∇xL ( x , y ) ek , ( 4 ) where e1 , . . . , ed are canonical basis vectors . The estimator can be further extended to higher order finite difference operators , but in the face of possibly non-smooth loss functions do not improve the accuracy of the estimator at the cost of additional queries . Hence , the first or the second order finite difference operators have been proven to be extremely effective . Though KWSA yields reasonably accurate gradient estimates , it is prohibitively query hungry . For instance , for Inception-v3 classifier for ImageNet , for every gradient estimate KWSA would require 299 × 299 × 3 queries . RDSA provides a better alternative which operates as follows : ∇̂xL ( x , y ) = 1 m m∑ k=1 zk ( L ( x + δzk , y ) − L ( x , y ) ) /δ , ( 5 ) where zk ’ s are usually drawn from a normal distribution . While RDSA is more query efficient than KWSA , it still needs a lot of queries to have a reasonably accurate estimate which typically scales with dimension . The step size δ > 0 in RDSA and KWSA is a key parameter of choice ; a higher δ could lead to extremely biased estimates , while a lower δ can lead to an unstable estimator . In light of the two aforementioned gradient estimation schemes , the PGD attack ( c.f . equation 3 ) can be suitably modified to suit black-box attacks as follows : xl = ΠBp ( x , ) ( xl−1 + ηŝl ) with ŝl = Π∂Bp ( 0,1 ) ∇̂xL ( xl−1 , y ) . ( 6 ) However , owing to the biased gradient estimates , though a PGD based black-box attack is successful turns out to be query hungry . In particular , in order to ensure sufficient increase of the objective at each iteration the query complexity scales with dimension and hence is prohibitively large . However , most if not all successful black-box adversarial attacks tend to be multi iteration based methods . In the sequel , we develop a query efficient single step black-box adversarial attack .

Summary: This paper deals with the problem of finding an adversarial examples when only the output of a model can be evaluated, but not its gradient. The key idea of the paper is building a Gaussian MRF (a Gaussian with a sparse inverse covariance matrix with a special band structure) to maintain a model for the gradients for predicting search directions. The approach is sensible and uses the FFT trick applicable for diagonalizing covariance matrices with circulant structure.