Gaussian MRF Covariance Modeling for Efficient Black-Box Adversarial Attacks

1 INTRODUCTION . Most methods for adversarial attacks on deep learning models operate in the so-called white-box setting ( Goodfellow et al. , 2014 ) , where the model being attacked , and its gradients , are assumed to be fully known . Recently , however there has also been considerable attention given to the black-box setting as well , where the model is unknown and can only be queried by a user , and which much better captures the “ typical ” state by which an attack can interact with a model ( Chen et al. , 2017 ; Tu et al. , 2019 ; Ilyas et al. , 2019 ; Moon et al. , 2019 ) . And several past methods in this area have conclusively demonstrated that , given sufficient number of queries , it is possible to achieve similarly effective attacks in the black-box setting akin to the white-box setting . However , as has also been demonstrated by past work Ilyas et al . ( 2019 ; 2018 ) , the efficiency of these black-box attacks ( the number of queries need to find an adversarial example ) is fundamentally limited unless they can exploit the spatial correlation structure inherent in the model ’ s gradients . Yet , at the same time , most previous methods have used rather ad-hoc methods of modeling such correlation structure , such as using “ tiling ” bases and priors over time Ilyas et al . ( 2019 ) that require attack vectors be constant over large regions , or by other means such as using smoothly-varying perturbations Ilyas et al . ( 2018 ) to estimate these gradients . In this work , we present a new , more rigorous approach to model the correlation structure of the gradients within the black-box adversarial setting . In particular , we propose to model the gradient of the model loss function with respect to the input image using a Gaussian Markov Random Field ( GMRF ) . This approach offers a number of advantages over prior methods : 1 ) it naturally captures the spatial correlation observed empirically in most deep learning models ; 2 ) using the model , we are able to compute exact posterior estimates over the true gradient given observed data , while also fitting the parameters of the GMRF itself via an expectation maximization ( EM ) approach ; and 3 ) the method provides a natural alternative to uniformly sampling perturbations , based upon the eigenvectors of the covariance matrix . Although representing the joint covariance over the entire input image may seem intractable for large-scale images , we can efficiently compute necessary terms for very general forms of grid-based GMRFs using the Fast Fourier Transform ( FFT ) . We evaluate our approach by attempting to find adversarial examples , over multiple different data sets and model architectures , using the GMRF combined with a very simple greedy zeroth order search technique ; the method effectively forms a “ black-box ” version of the fast gradient sign method ( FGSM ) , by constructing an estimate of the gradient at the input image itself , then taking a single signed step in this direction . Despite its simplicity , we show that owing to the correlation structure provided by the GMRF model , the approach outperforms more complex approaches such as the BANDITS-TD ( Ilyas et al. , 2019 ) or PARSIMONIOUS ( Moon et al. , 2019 ) methods ( the current state of the art in black-box attacks ) , especially for small query budgets . 2 RELATED WORK . Black-box adversarial attacks can be broadly categorized across a few different dimensions : optimization-based versus transfer-based attacks , and score-based versus decision-based attacks . In the optimization-based adversarial setting , the adversarial attack is formulated as the problem of maximizing some loss function ( e.g. , the accuracy of the classifier or some continuous variant ) using a zeroth order oracle , i.e. , by making queries to the classifier . And within this optimization setting , there is an important distinction between score-based attacks , which directly observe a traditional model loss , class probability , or other continuous output of the classifier on a given a example , versus decision-based attacks , which only observe the hard label predicted by the classifier . Decision based attacks have been studied by Brendel et al . ( 2017 ) ; Chen et al . ( 2019 ; 2017 ) , and ( not surprisingly ) typically require more queries to the classifier than the score-based setting . In the regime of score-based attacks , the first such iterative attack on a class of binary classifiers was first studied by Nelson et al . ( 2012 ) . A real-world application of black-box attacks to fool a PDF malware classifier was demonstrated by ( Xu et al. , 2016 ) , for which a genetic algorithm was used . Narodytska & Kasiviswanathan ( 2017 ) demonstrated the first black-box attack on deep neural networks . Subsequently black-box attacks based on zeroth order optimization schemes , using techniques such as KWSA ( Kiefer et al. , 1952 ) and RDSA ( Nesterov & Spokoiny , 2017 ) were developed in Chen et al . ( 2017 ) ; Ilyas et al . ( 2018 ) . Though Chen et al . ( 2017 ) generated successful attacks attaining high attack accuracy , the method was found to be extremely query hungry which was then remedied to an extent by ( Ilyas et al. , 2018 ) . In Ilyas et al . ( 2019 ) , the authors exploit correlation of gradients across iterations by setting a prior and use a piece wise constant perturbation , i.e. , tiling to develop a query efficient black-box method . Recently Moon et al . ( 2019 ) used a combinatorial optimization perspective to address the black-box adversarial attack problem . A concurrent line of work Papernot et al . ( 2017 ) has considered the transfer-based setting , rather than the optimization setting . These approaches create adversarial attacks by training a surrogate network with the aim to mimic the target model ’ s decisions , which are then obtained through blackbox queries . With the substitute model in place , the attack method then uses white-box attack strategies in order to transfer the attacks to the original target model . However , substitute network based attack strategies have been found to have a higher query complexity than those based on gradient estimation . The exploitation of the structure of the input data space so as to append a regularizer has been recently found to be effective for robust learning . In particular , in Lin et al . ( 2019 ) showed that by using Wasserstein-2 geometry to capture semantically meaningful neighborhoods in the space of images helps to learn discriminative models that are robust to in-class variations of the input data . Setting of this work In this paper , we are specifically focused on the optimization-based , scorebased setting , following most directly upon the work of ( Chen et al. , 2017 ; Ilyas et al. , 2018 ; 2019 ; Moon et al. , 2019 ) . However , our contribution is also largely orthogonal to the methods presented in these prior works . Specifically , we show that by modeling the covariance structure of the gradient using a Gaussian MRF , a very simple approach ( which largely mirrors the simple black box search from ( Ilyas et al. , 2018 ) ) achieves performance that is competitive than the best current methods , especially when using relatively few queries . We further emphasize that while we focus on this simple search strategy here , nothing would prevent this GMRF approach from being applied to other black-box search strategies as well . 3 ADVERSARIAL ATTACKS . In the context of classifiers , adversarial examples are carefully crafted inputs to the classifier which have been perturbed by an additive perturbation so as to cause the classifier to misclassify the input . In particular , so as to ensure minimal visual distortion , the perturbation is subjected to a constraint in terms of its magnitude typically pre-specified in terms of ` p-norm , for some fixed p , less than some p. Furthermore in the context of classifiers , attacks can be further classified into targeted or untargeted attacks . For simplicity and brevity , in this paper , we restrict our attention to untargeted attacks . Formally , define a classifier C : X 7→ Y with a corresponding classification loss function L ( x , y ) , where x ∈ X is the input to the classifier , y ∈ Y , X is the set of inputs and Y is the set of labels . Technically speaking , the objective of generating a misclassified example can be posed as an optimization problem . In particular , the aim is to generate an adversarial example x′ for a given input x which maximizes L ( x′ , y ) but still remains p-close in terms of a specified metric , to the original input . Thus , the generation of an adversarial attack can be formalized as a constrained optimization as follows : x′ = arg max x′ : ‖x′−x‖p≤ p L ( x′ , y ) . ( 1 ) We give a brief overview of adversarial attacks categorized in terms of access to information namely , white-box and black-box attacks . 3.1 WHITE-BOX ADVERSARIAL ATTACKS . White-box settings assume access to the entire classifier and the analytical form of the possibly nonconvex classifier loss function . White-box methods can be further categorized into single iteration and multiple iterations based methods . In the class of single iteration white-box methods , the Fast Gradient Sign Method ( FGSM ) has been very successful , which computes the adversarial input in the following way : x′ = x + psign ( ∇L ( x , y ) ) . ( 2 ) FGSM is however limited to generation of ` ∞ based bounded adversarial inputs . Given , a constrained optimization problem at hand with access to a first order oracle , the most effective method is projected gradient descent ( PGD ) . This multi iteration method generates the adversarial input xk by performing k iterations with x0 = x , where k is specified apriori . In particular , at the l-th iteration , PGD generates the perturbed input xl as follows : xl = ΠBp ( x , ) ( xl−1 + ηsl ) with sl = Π∂Bp ( 0,1 ) ∇xL ( xl−1 , y ) , ( 3 ) where ΠS denotes the projection onto the set S , Bp ( x′ , ε′ ) is the ` p ball of radius ε′ centered at x′ , η denotes the step size , and ∂U is the boundary of a set U . By making , sl to be the projection of the gradient ∇xL ( xl−1 , y ) at xl−1 onto the unit ` p ball , it is ensured that sl is the unit ` p-norm vector that has the largest inner product with ∇xL ( xl−1 , y ) . When p = 2 , the projection corresponds to the normalized gradient , while for p = ∞ , the projection corresponds to the sign of the gradient . Moreover , due to the projection at each iteration , the adversarial input generated at every iteration conforms to the specified constraint . However , in most real world deployments , it is impractical to assume complete access to the classifier and analytic form of the corresponding loss function , which makes black-box settings more realistic . 3.2 BLACK-BOX ADVERSARIAL ATTACKS . In a typical black-box setting , the adversary has only access to a zeroth order oracle , which when queried for an input ( x , y ) , yields the value of the loss function L ( x , y ) . In spite of the information constraints and typically high dimensional inputs , black-box attacks have been shown to be pretty effective ( Ilyas et al. , 2019 ; 2018 ; Moon et al. , 2019 ) . The main building block of black-box methods is finite difference schemes so as to estimate gradients . Two of the most widely finite difference schemes are the Kiefer-Wolfowitz Stochastic Approximation ( KWSA ) Kiefer et al . ( 1952 ) and Random Directions Stochastic Approximation ( RDSA ) ( Nesterov & Spokoiny , 2017 ) . KWSA operates as follows : ∇̂xL ( x , y ) = d∑ k=1 ek ( L ( x + δek , y ) − L ( x , y ) ) /δ ≈ d∑ k=1 ek∇xL ( x , y ) ek , ( 4 ) where e1 , . . . , ed are canonical basis vectors . The estimator can be further extended to higher order finite difference operators , but in the face of possibly non-smooth loss functions do not improve the accuracy of the estimator at the cost of additional queries . Hence , the first or the second order finite difference operators have been proven to be extremely effective . Though KWSA yields reasonably accurate gradient estimates , it is prohibitively query hungry . For instance , for Inception-v3 classifier for ImageNet , for every gradient estimate KWSA would require 299 × 299 × 3 queries . RDSA provides a better alternative which operates as follows : ∇̂xL ( x , y ) = 1 m m∑ k=1 zk ( L ( x + δzk , y ) − L ( x , y ) ) /δ , ( 5 ) where zk ’ s are usually drawn from a normal distribution . While RDSA is more query efficient than KWSA , it still needs a lot of queries to have a reasonably accurate estimate which typically scales with dimension . The step size δ > 0 in RDSA and KWSA is a key parameter of choice ; a higher δ could lead to extremely biased estimates , while a lower δ can lead to an unstable estimator . In light of the two aforementioned gradient estimation schemes , the PGD attack ( c.f . equation 3 ) can be suitably modified to suit black-box attacks as follows : xl = ΠBp ( x , ) ( xl−1 + ηŝl ) with ŝl = Π∂Bp ( 0,1 ) ∇̂xL ( xl−1 , y ) . ( 6 ) However , owing to the biased gradient estimates , though a PGD based black-box attack is successful turns out to be query hungry . In particular , in order to ensure sufficient increase of the objective at each iteration the query complexity scales with dimension and hence is prohibitively large . However , most if not all successful black-box adversarial attacks tend to be multi iteration based methods . In the sequel , we develop a query efficient single step black-box adversarial attack .

Summary: In this paper, the authors propose a method for black box adversarial image generation. The idea is to learn a parameterization of a precision matrix so that gradients of a network's loss are assumed to be drawn from a corresponding Gaussian. The parameters of this model are fit efficiently using the spectral theorem that their particular parameterization of the precision matrix allows them to use. Gradient estimation is then viewed as a Gaussian conditioning problem given observations (see last equation on page 5).