Finding Optimal Tangent Points for Reducing Distortions of Hard-label Attacks

1 Introduction . Adversarial attacks cause deep neural networks ( DNNs ) to make incorrect predictions by slightly perturbing benign images during the test time . They can be divided into two main categories on the basis of the amount of information exposed by the target model , namely white-box and black-box attacks . Many white-box attacks [ 6 , 29 , 32 ] have been proposed , and they can compute the gradients w.r.t . the target model ’ s input images to generate adversarial examples with the first-order optimization techniques . In contrast , black-box attacks are more practical because they craft adversarial examples without requiring the target model ’ s gradients . Over the past years , the community has made considerable efforts in developing black-box attacks , and the proposed methods can be divided into transfer- and query-based attacks . Transfer-based attacks [ 25 , 37 , 38 ] generate adversarial examples by using a white-box attack method against a surrogate model to fool the target model . Although there is no need to query the target model in these attacks , the attack success rate can not be guaranteed , especially in the case of targeted attacks . To achieve satisfactory attack success rates , the query-based attacks use elaborate queries to obtain the feedback of the target model for crafting adversarial examples . In the score-based setting , the query-based attacks [ 2 , 12 , 22 , 28 ] estimate approximate gradients by querying the predicted scores of the target model at multiple points . However , in most real-world scenarios , the score-based setting ∗Corresponding author . 35th Conference on Neural Information Processing Systems ( NeurIPS 2021 ) . is not applicable because the public service returns only the top-1 predicted label ( i.e. , the hard label ) rather than the predicted score . In this case , since the feedback information is limited and the objective function is discontinuous , the attack requires solving a high-dimensional combinatorial optimization problem , which is often challenging . To reformulate the attack as a real-valued continuous optimization problem , OPT [ 10 ] , Sign-OPT [ 11 ] , and RayS [ 8 ] focus on minimizing an objective function g ( θ ) , which is defined as the distance from the original image to the nearest adversarial example along the direction θ . However , when attacking complex models , it may be difficult to find a suitable direction θ along which adversarial examples exist . Boundary Attack ( BA ) [ 4 ] , HopSkipJumpAttack ( HSJA ) [ 7 ] , QEBA [ 24 ] , qFool [ 26 ] , and Policy Driven Attack ( PDA ) [ 40 ] eliminate the search of the direction θ . Instead , they start from a large adversarial perturbation and then reduce its distortion while staying in the adversarial region . Because the output labels of the target model flip only near the decision boundary , these attacks restrict their explorations to the regions near the decision boundary . However , they do not thoroughly investigate the geometric properties of the decision boundary to accelerate the attack . For example , PDA uses a reinforcement learning framework to train a policy network to predict search directions , which are not geometrically optimal . In addition , the prediction accuracy of the policy network decreases significantly in the later stages of the iterations , resulting in worse performance of these iterations . HSJA and qFool simply use the gradient u estimated at the decision boundary as the direction of each update , while ignoring a geometrically critical issue , i.e. , u is not the optimal direction to be followed ( Fig . 1 ) . We could explore better search directions at each attack iteration . To find the optimal search direction for minimizing the distortions of attack , we propose a new geometric-based approach whose motivation is illustrated in Fig . 1 . We construct a virtual semicircle B centered at xt−1 to indicate all possible locations that xt−1 can reach along different directions , and the radius ofB limits the range of updates for successful attacks . It is easy to observe that moving along the tangent line can reach the nearest location of the decision boundary to the original image x , thereby producing the adversarial example with the minimum distortion . In real attack scenarios , the image data reside in a high-dimensional space , and the semicircle becomes a hemisphere . In this case , the benefit of using tangent points still exists , and we provide the detailed description and the formal proof in Section 3 and appendix . To summarize , the main contributions of this study are as follows . 1 . We cast the problem of minimizing the distortion in hard-label attacks into a geometric problem . We discover that the minimum distortion can be obtained by searching the optimal tangent point of a virtual hemisphere around the adversarial example at each iteration . 2 . We propose a novel geometric-based method to obtain a closed-form solution of the optimal tangent point . We provide an intuitive explanation of our approach , as well as a formal proof of its correctness . 3 . To improve robustness , we further propose a generalized method that replaces the hemisphere with a semi-ellipsoid to adapt to the target models with curved decision boundaries . 4 . Extensive experiments conducted on the CIFAR-10 [ 23 ] and ImageNet [ 14 ] datasets demonstrate the effectiveness of our approach . 2 Related Work . Query-based black-box attacks can be divided into score- and decision-based attack ( a.k.a . the hard-label attack ) . Score-based attacks [ 1–3 , 9 , 12 , 22 , 28 , 31 ] use the predicted probability score to craft adversarial examples , which is not always available in most real-world systems . Hard-label attacks are more useful , but obviously more challenging , because only the top-1 predicted label can be obtained . The hard-label attacks usually fall into three categories . The first category starts from the original image x0 and attempts to find a optimal direction θ to reach the adversarial example . OPT [ 10 ] searches an optimal θ to minimize the distance from x0 to the nearest adversarial example . Sign-OPT [ 11 ] improves the query efficiency of OPT by using a single query to estimate the sign of the directional derivative . RayS [ 8 ] eliminates the gradient estimation and proposes a fast check step to efficiently find the direction θ . However , RayS is only applicable to the untargeted attack under the ` ∞ norm because it is difficult to find a suitable direction to reach the region of the target class in a targeted attack , especially in the case of a large number of classes . The second category starts from a large perturbation or an image of the target class , and then reduces its distortion while staying in adversarial region , thereby gradually making it closer to the original image . BA [ 4 ] and NES [ 1 ] are two representative methods , but they have high query complexity . Biased BA [ 5 ] reinterprets BA as a biased sampling framework and incorporates different biases to improve the query efficiency . HSJA [ 7 ] utilizes the gradient estimation and the binary search to outperform BA . HSJA can be used as the baseline of hard-label attacks . QEBA [ 24 ] improves HSJA by using dimension reduction techniques . SurFree [ 30 ] and GeoDA [ 33 ] improve the performance of HSJA by exploiting geometric properties of DNNs . However , the geometric features of DNNs have not been fully explored , and they do not support the targeted attack . PDA [ 40 ] uses a reinforcement learning framework to train a policy network to predict promising directions . However , PDA requires a high-cost pre-training , which is not always available in all tasks . The third category uses a random sampling technique to improve query efficiency . Customized Adversarial Boundary ( CAB ) attack [ 34 ] uses the current noise to select the sensitive area of images and customize sampling distribution . Evolutionary [ 16 ] improves the query efficiency by reducing the dimension of the search space with the stochastic coordinate selection . The issue of RayS and GeoDA is that they only support untargeted attacks . Because moving the original image far enough in any direction can always make it escape the non-adversarial region in untargeted attacks . However , in targeted attacks , it is difficult to find a suitable direction along which the target class ’ s region exists . In contrast , our approach supports all types of attacks , and we exploit the geometric characteristics of the decision boundaries of DNNs to boost the attack . 3 The Proposed Approach . 3.1 The Goal of Hard-label Attacks . Given a target model f : Rd → Rk and a benign image x ∈ [ 0 , 1 ] d that is correctly classified using f , the goal of the adversary is to slightly perturb x into xadv , such that f ( xadv ) outputs incorrect prediction . In the hard-label attack , the adversary can only observe the top-1 predicted label of f , denoted as ŷ = arg maxi f ( xadv ) i . We define an indicator function φ ( · ) of a successful attack : φ ( xadv ) : = 1 if ŷ = yadv in the targeted attack , or ŷ 6= y in the untargeted attack , 0 otherwise , ( 1 ) where y ∈ R is the true label of x and yadv ∈ R is a predefined target class label . In this study , we focus on generating an adversarial example xadv that satisfies φ ( xadv ) = 1 , such that the distortion d ( xadv , x ) : = ‖xadv − x‖p is minimized . This goal can be formulated as the optimization problem : min xadv d ( xadv , x ) s.t . φ ( xadv ) = 1 . ( 2 ) 3.2 Motivation . Most recent attacks belong to the second category ( Section 2 ) follow a common procedure : it starts from an adversarial image yet not close enough to the benign one , then it iteratively searches for a closer adversarial image . Let us take a typical attack HSJA [ 7 ] for example ( Fig . 1 ) . First , the attack initializes the adversarial example by using an image of the target class ( in a targeted attack ) or a noisy version of the original image ( in an untargeted attack ) . Next , it performs the binary search to map the initial sample onto the decision boundaryH , denoted as xt−1 . Then , the algorithm iteratively performs three steps to update xt−1 : estimating gradient u at H by sampling many probes around xt−1 ; jumping to the point g along the direction u with the step size determined by the geometric progression ; and mapping g onto H at xg by performing the binary search along the line passing through g and the original image x . However , geometrically speaking , the estimated gradient u is not the optimal search direction , and we can find a better boundary point xt by connecting x to a certain point on the semicircle B and then taking the intersection point on H . Fig . 1 shows that the tangent point k is the optimum update because it leads to the minimum distortion of the attack . 3.3 Definition of Optimal Tangent Points There is some experimental evidence that the decision boundaries of DNNs are smooth surfaces with the low curvature [ 17 , 33 ] . Based on this observation , we approximate the local decision boundary with a hyperplane H . Fig . 3 illustrates our problem in three-dimensional space . We will derive our algorithm from R3 and show that it can be directly extended to higher-dimensional spaces . Lastly , we address the case of curved decision boundaries . As described in Section 3.2 , xt−1 denotes the boundary sample that already lies on the decision boundary . We create a virtual hemisphere B centered at xt−1 with a radius R , which is an estimation of the safe region where we can search for adversarial examples . In the targeted attack , B represents the current estimation of the target class region around xt−1 . Ideally , B is small enough to be fully contained in the target class ’ s region , i.e. , φ ( x′ ) = 1 for ∀x′ ∈ B . Then , we need to find a point on B which would produce the minimum distortion when mapped to H . In two-dimensional case , this point is the tangent point . However , in n-dimensional space where n ≥ 3 , there are infinitely many tangent lines of B passing through x which create infinitely many tangent points on B , shown as the red points in Figs . 2 and 3 . Still , we will show that exactly one tangent point can lead to the minimum distortion when mapping it onto H along the tangent line . Formally , let k be any point on the surface of B , u be the approximate gradient of H estimated at xt−1 , and xt be the intersection of H and the line passing through x and k , we have the following theorem . Theorem 1 Let H , u , k , x , and xt−1 be defined above , then the distance ‖x− xt‖ is minimized if k is the optimal solution of the following constrained optimization problem : arg max k 〈k− xt−1 , u〉 ( 3 ) s.t . 〈k− xt−1 , x− k〉 = 0 , ( 4 ) ‖k− xt−1‖ = R , ( 5 ) 〈k− xt−1 , u〉 ≥ 0 . ( 6 )

Summary: This work proposes a new type of hard-label attacking method. Hard-label attacking methods only allow access of the top-1 predicted labels. This method is based on geometric properties, i.e., tangent points to reduce the l2 distortion after attacks. The method is shown to be superior compared with the existing hard-label attacking methods. The authors also studied the performance under four different defense frameworks, all of which prove the superiority of the proposed method.