Original:  A DVERSARIAL A TTACK
Revised: B AYES O PT A DVERSARIAL A TTACK

Original: Anonymous authors

Original: Paper under double-blind review

Original: A BSTRACT
Revised: A BSTRACT

Original: Black-box adversarial attacks require a large number of attempts before ﬁnding successful adversarial examples that are visually indistinguishable from the original input.
Revised: Black-box adversarial attacks require a large number of attempts before ﬁnding successful adversarial examples that are visually indistinguishable from the original input.

Original: Current approaches relying on substitute model training, gradient estimation or genetic algorithms often require an excessive number of queries.
Revised: Current approaches relying on substitute model training, gradient estimation or genetic algorithms often require an excessive number of queries.

Original: Therefore, they are not suitable for real-world systems where the maximum query number is limited due to cost.
Revised: Therefore, they are not suitable for real-world systems where the maximum query number is limited due to cost.

Original: We propose a query-efﬁcient black-box attack which uses Bayesian optimisation in combination with Bayesian model selection to optimise over the adversarial perturbation and the optimal degree of search space dimension reduction.
Revised: We propose a query-efﬁcient black-box attack which uses Bayesian optimisation in combination with Bayesian model selection to optimise over the adversarial perturbation and the optimal degree of search space dimension reduction.

Original: We demonstrate empirically that our method  can achieve comparable success rates with 2-5 times fewer queries compared to previous stateof-the-art black-box attacks.
Revised: We demonstrate empirically that our method 1 can achieve comparable success rates with 2-5 times fewer queries compared to previous stateof-the-art black-box attacks.

Original:  I NTRODUCTION
Revised:  I NTRODUCTION

Original: Deep learning algorithms are widely deployed in many real-world systems and are increasingly being used for tasks, ranging from identity veriﬁcation (Liu et al., 2018), to ﬁnancial services (Heaton et al., 2017) to autonomous driving (Bojarski et al., 2016).
Revised: Deep learning algorithms are widely deployed in many real-world systems and are increasingly being used for tasks, ranging from identity veriﬁcation (Liu et al., 2018), to ﬁnancial services (Heaton et al., 2017) to autonomous driving (Bojarski et al., 2016).

Original: However, even the most accurate deep learning models can be easily deceived by perturbations which are visually imperceptible to the human eye (Szegedy et al., 2013; Carlini et al., 2016).
Revised: However, even the most accurate deep learning models can be easily deceived by perturbations which are visually imperceptible to the human eye (Szegedy et al., 2013; Carlini et al., 2016).

Original: The growing costs and risks associated with the potential model failures has led to the importance of studying adversarial attacks, both in assessing their robustness and their ability to detect such attacks.
Revised: The growing costs and risks associated with the potential model failures has led to the importance of studying adversarial attacks, both in assessing their robustness and their ability to detect such attacks.

Original: In this paper we focus on highly practical adversarial attacks that fulﬁll the following two criteria.
Revised: In this paper we focus on highly practical adversarial attacks that fulﬁll the following two criteria.

Original: First, the attack is designed for a black-box setting because in real-world examples, the attacker would normally have no knowledge of the target deep learning model and can only interact with the model by querying it.
Revised: First, the attack is designed for a black-box setting because in real-world examples, the attacker would normally have no knowledge of the target deep learning model and can only interact with the model by querying it.

Original: Second, query efﬁciency is highly prioritised because in practical cases where the damage caused by the attack is high, the query budget available to the attacker will be highly limited due to the risk of being detected by the defence system or other high inherent costs (monetary or computational) of model evaluations.
Revised: Second, query efﬁciency is highly prioritised because in practical cases where the damage caused by the attack is high, the query budget available to the attacker will be highly limited due to the risk of being detected by the defence system or other high inherent costs (monetary or computational) of model evaluations.

Original: Despite of the large array of adversarial attacks proposed in the literature, many of them are whitebox approaches that assume full access to the target model architecture and the ability of performing back-propagation to get gradient information (Moosavi-Dezfooli et al., 2016; Kurakin et al., 2016;
Revised: Despite of the large array of adversarial attacks proposed in the literature, many of them are whitebox approaches that assume full access to the target model architecture and the ability of performing back-propagation to get gradient information (Moosavi-Dezfooli et al., 2016; Kurakin et al., 2016;

Original: Gu & Rigazio, 2014; Goodfellow et al., 2014; Chen et al., 2018; Carlini & Wagner, 2017).
Revised: Gu & Rigazio, 2014; Goodfellow et al., 2014; Chen et al., 2018; Carlini & Wagner, 2017).

Original: On the other hand, for black-box attacks, there are various techniques that have been used which do not require access to the model architecture.
Revised: On the other hand, for black-box attacks, there are various techniques that have been used which do not require access to the model architecture.

Original: One class of methods trains a white-box substitute model and attacks the target model with adversarial examples that successfully fool the substitute (Papernot et al., 2017).
Revised: One class of methods trains a white-box substitute model and attacks the target model with adversarial examples that successfully fool the substitute (Papernot et al., 2017).

Original: However, this type of method requires the availability of the original training data or large query data to train the substitute network and the performance is often limited by the mismatch between the substitute and the target models (Su et al., 2018).
Revised: However, this type of method requires the availability of the original training data or large query data to train the substitute network and the performance is often limited by the mismatch between the substitute and the target models (Su et al., 2018).

Original: The second class of black-box attacks, which show better empirical performance than the substitute model approaches, numerically estimate the gradient of the target model by repeatedly querying it (Chen et al., 2017; Ilyas et al., 2018;
Revised: The second class of black-box attacks, which show better empirical performance than the substitute model approaches, numerically estimate the gradient of the target model by repeatedly querying it (Chen et al., 2017; Ilyas et al., 2018;

Original: Tu et al., 2018) and attack with the estimated gradient.
Revised: Tu et al., 2018) and attack with the estimated gradient.

Original: Although various techniques are employed to increase the query efﬁciency for the gradient estimation, they need an excessively large query budget to achieve a successful attack (Alzantot et al., 2018).
Revised: Although various techniques are employed to increase the query efﬁciency for the gradient estimation, they need an excessively large query budget to achieve a successful attack (Alzantot et al., 2018).

Original: Another line of work removes the need for gradient estimation and uses decision-based techniques (Brendel et al., 2017) or genetic algorithms (Alzantot et al., 2018) to generate adversarial examples.
Revised: Another line of work removes the need for gradient estimation and uses decision-based techniques (Brendel et al., 2017) or genetic algorithms (Alzantot et al., 2018) to generate adversarial examples.

Original: One popular technique that is adopted by many black-box attacks (Chen et al., 2017; Alzantot et al., 2018;
Revised: One popular technique that is adopted by many black-box attacks (Chen et al., 2017; Alzantot et al., 2018;

Original: Tu et al., 2018) to signiﬁcantly improve the query efﬁciency is to search for adversarial perturbations in a low-dimensional latent space (search dimensionality reduction).
Revised: Tu et al., 2018) to signiﬁcantly improve the query efﬁciency is to search for adversarial perturbations in a low-dimensional latent space (search dimensionality reduction).

Original: However, learning the effective dimensionality of the latent search space can be challenging by itself, and has not been investigated by the prior works to the best of our knowledge.
Revised: However, learning the effective dimensionality of the latent search space can be challenging by itself, and has not been investigated by the prior works to the best of our knowledge.

Original: In light of the above limitations, we propose a query efﬁcient black-box attack that iteratively optimises over both the adversarial perturbation and the effective dimensionality of the latent search space.
Revised: In light of the above limitations, we propose a query efﬁcient black-box attack that iteratively optimises over both the adversarial perturbation and the effective dimensionality of the latent search space.

Original: Our main contributions are summarised as follows:
Revised: Our main contributions are summarised as follows:

Original: • We introduce a novel gradient-free black-box attack method, BayesOpt attack, which uses Bayesian optimisation with Gaussian process surrogate models to ﬁnd the effective adversarial example and is capable of dealing with high-dimensional image inputs.
Revised: • We introduce a novel gradient-free black-box attack method, BayesOpt attack, which uses Bayesian optimisation with Gaussian process surrogate models to ﬁnd the effective adversarial example and is capable of dealing with high-dimensional image inputs.

Original: • We proposes a Bayesian technique which learns the optimal degree of search dimensionality reduction by harnessing our statistical surrogate and information from query data.
Revised: • We proposes a Bayesian technique which learns the optimal degree of search dimensionality reduction by harnessing our statistical surrogate and information from query data.

Original: This technique can be incorporated naturally into our attack procedure, leading to efﬁcient optimisation over both adversarial perturbation and the latent search space dimension.
Revised: This technique can be incorporated naturally into our attack procedure, leading to efﬁcient optimisation over both adversarial perturbation and the latent search space dimension.

Original: • We empirically demonstrate that under the L ∞ constraint, our proposed attack method can achieve comparable success rate with about 2 to 5 times fewer model queries in comparison to current state-of-the-art query-efﬁcient black box attack methods.
Revised: • We empirically demonstrate that under the L ∞ constraint, our proposed attack method can achieve comparable success rate with about 2 to 5 times fewer model queries in comparison to current state-of-the-art query-efﬁcient black box attack methods.

Original:  R ELATED W ORK ON B LACK -B OX A TTACKS
Revised:  R ELATED W ORK ON B LACK -B OX A TTACKS

Original: Most of the existing adversarial attacks (Moosavi-Dezfooli et al., 2016; Kurakin et al., 2016; Gu &
Revised: Most of the existing adversarial attacks (Moosavi-Dezfooli et al., 2016; Kurakin et al., 2016; Gu &

Original: Rigazio, 2014; Goodfellow et al., 2014; Chen et al., 2018; Carlini & Wagner, 2017) focus on whitebox settings, where the attacker can get full access to the target model and has complete knowledge of the architecture, weights and gradients to generate successful adversarial examples.
Revised: Rigazio, 2014; Goodfellow et al., 2014; Chen et al., 2018; Carlini & Wagner, 2017) focus on whitebox settings, where the attacker can get full access to the target model and has complete knowledge of the architecture, weights and gradients to generate successful adversarial examples.

Original: However, real-world systems are usually attacked in a black-box setting, where one has no knowledge about the model and can only observe the input-output correspondences by querying the model.
Revised: However, real-world systems are usually attacked in a black-box setting, where one has no knowledge about the model and can only observe the input-output correspondences by querying the model.

Original: Here we give a brief overview of various existing black-box attacks.
Revised: Here we give a brief overview of various existing black-box attacks.

Original: Substitute model One class of black-box attacks uses data acquired from querying the target blackbox model to train a substitute model (Papernot et al., 2017), which mimics the classiﬁcation behaviour of the target model.
Revised: Substitute model One class of black-box attacks uses data acquired from querying the target blackbox model to train a substitute model (Papernot et al., 2017), which mimics the classiﬁcation behaviour of the target model.

Original: The adversary can then employ any white-box method to attack the fully observable substitute model and apply the successful adversarial example to the target model.
Revised: The adversary can then employ any white-box method to attack the fully observable substitute model and apply the successful adversarial example to the target model.

Original: Such approaches rely on the transferability assumption that adversarial examples which are effective to the substitute model are also very likely to conceive the target model given their similar classiﬁcation performance on the same data (Szegedy et al., 2013).
Revised: Such approaches rely on the transferability assumption that adversarial examples which are effective to the substitute model are also very likely to conceive the target model given their similar classiﬁcation performance on the same data (Szegedy et al., 2013).

Original: Moreover, to provide training data for the substitute model, the adversary either requires information on the target model’s training set, which is highly unrealistic in real-world applications, or needs to build a synthetic training set by querying the target model (Papernot et al., 2017), which implies a large number of model evaluations and becomes hardly feasible for large models or complex datasets (Brendel et al., 2017).
Revised: Moreover, to provide training data for the substitute model, the adversary either requires information on the target model’s training set, which is highly unrealistic in real-world applications, or needs to build a synthetic training set by querying the target model (Papernot et al., 2017), which implies a large number of model evaluations and becomes hardly feasible for large models or complex datasets (Brendel et al., 2017).

Original: Gradient estimation An alternative to training a substitute model is to estimate the gradient via ﬁnite differences and use the estimated gradient information to produce attacks.
Revised: Gradient estimation An alternative to training a substitute model is to estimate the gradient via ﬁnite differences and use the estimated gradient information to produce attacks.

Original: However, the naive coordinate-wise gradient estimation requires excessive queries to the target model (2 queries per coordinate per descent/attack step) and thus is not feasible for attacking models with high dimensional inputs (e.g. classiﬁers on ImageNet).
Revised: However, the naive coordinate-wise gradient estimation requires excessive queries to the target model (2 queries per coordinate per descent/attack step) and thus is not feasible for attacking models with high dimensional inputs (e.g. classiﬁers on ImageNet).

Original: Chen et al.
Revised: Chen et al.

Original: (2017) overcome this limitation by using stochastic coordinate gradient descent and selecting the batch of coordinates via importance sampling, introducing the state-of-the-art zeroth-order attack, ZOO, which achieves comparable attack success rate and perturbation costs as many white-box attacks.
Revised: (2017) overcome this limitation by using stochastic coordinate gradient descent and selecting the batch of coordinates via importance sampling, introducing the state-of-the-art zeroth-order attack, ZOO, which achieves comparable attack success rate and perturbation costs as many white-box attacks.

Original: Although ZOO makes it computationally tractable to perform black-box attack on high-dimensional image data, it still requires millions of queries to generate a successful adversarial example, making it impracticable for attacking real-world systems where model query can be expensive and the budget limited.
Revised: Although ZOO makes it computationally tractable to perform black-box attack on high-dimensional image data, it still requires millions of queries to generate a successful adversarial example, making it impracticable for attacking real-world systems where model query can be expensive and the budget limited.

Original: Improving on ZOO, AutoZOOM (Tu et al., 2018) signiﬁcantly enhances the query efﬁciency by using random vectors to estimate the full gradient and adjusting the estimation parameter adaptively to trade off query efﬁciency vs. input perturbation cost.
Revised: Improving on ZOO, AutoZOOM (Tu et al., 2018) signiﬁcantly enhances the query efﬁciency by using random vectors to estimate the full gradient and adjusting the estimation parameter adaptively to trade off query efﬁciency vs. input perturbation cost.

Original: More importantly, AutoZOOM shows the beneﬁts of employing dimension reduction techniques in accelerating attacks (i.e. searching for adversarial perturbation in a low-dimensional latent space and decoding it back to the high-dimensional input space).
Revised: More importantly, AutoZOOM shows the beneﬁts of employing dimension reduction techniques in accelerating attacks (i.e. searching for adversarial perturbation in a low-dimensional latent space and decoding it back to the high-dimensional input space).

Original: Parallel work by Ilyas et al.
Revised: Parallel work by Ilyas et al.

Original: (2018) estimate the gradient through a modiﬁed version of natural evolution strategy which can be viewed as a ﬁnite-difference method over a random Gaussian basis.
Revised: (2018) estimate the gradient through a modiﬁed version of natural evolution strategy which can be viewed as a ﬁnite-difference method over a random Gaussian basis.

Original: The estimated gradient is then used with projected gradient descent, a white-box attack method, to generate adversarial examples.
Revised: The estimated gradient is then used with projected gradient descent, a white-box attack method, to generate adversarial examples.

Original: Gradient-free optimisation As discussed, gradient-estimation approaches in general need an excessive number of queries to achieve successful attack.
Revised: Gradient-free optimisation As discussed, gradient-estimation approaches in general need an excessive number of queries to achieve successful attack.

Original: Moreover, their dependence on the gradient information makes them less robust to defences which manipulate the gradients (Athalye et al., 2018;
Revised: Moreover, their dependence on the gradient information makes them less robust to defences which manipulate the gradients (Athalye et al., 2018;

Original: Brendel et al., 2017; Guo et al., 2017).
Revised: Brendel et al., 2017; Guo et al., 2017).

Original: Thus, truly gradient-free methods are more likely to bypass such defences.
Revised: Thus, truly gradient-free methods are more likely to bypass such defences.

Original: One recent example, which has demonstrated state-of-the-art query efﬁciency, is
Revised: One recent example, which has demonstrated state-of-the-art query efﬁciency, is

Original: GenAttack (Alzantot et al., 2018).
Revised: GenAttack (Alzantot et al., 2018).

Original: GenAttack uses genetic algorithms to iteratively evolve a population of candidate adversarial examples.
Revised: GenAttack uses genetic algorithms to iteratively evolve a population of candidate adversarial examples.

Original: Besides having an annealing scheme for mutation rate and range, GenAttack also adopts dimensional reduction techniques, similar to AutoZOOM, to improve the query efﬁciency.
Revised: Besides having an annealing scheme for mutation rate and range, GenAttack also adopts dimensional reduction techniques, similar to AutoZOOM, to improve the query efﬁciency.

Original: In parallel to GenAttack, Brendel et al.
Revised: In parallel to GenAttack, Brendel et al.

Original: (2017) introduce a decision-based attack, Boundary Attack, which only requires access to the ﬁnal model decision.
Revised: (2017) introduce a decision-based attack, Boundary Attack, which only requires access to the ﬁnal model decision.

Original: Boundary Attack starts from a huge adversarial perturbation and then iteratively reduces the perturbation through a random walk along the decision boundary.
Revised: Boundary Attack starts from a huge adversarial perturbation and then iteratively reduces the perturbation through a random walk along the decision boundary.

Original: However, Boundary Attack takes about 72 times more queries than GenAttack to fool an undefended ImageNet model (Alzantot et al., 2018).
Revised: However, Boundary Attack takes about 72 times more queries than GenAttack to fool an undefended ImageNet model (Alzantot et al., 2018).

Original: Another recent approach introduced in Moon et al.
Revised: Another recent approach introduced in Moon et al.

Original: (2019) reduces the search space to a discrete domain and subsequently uses combinatorial optimisation to ﬁnd successful attacks, mostly focusing on the less challenging setting of untargeted attacks.
Revised: (2019) reduces the search space to a discrete domain and subsequently uses combinatorial optimisation to ﬁnd successful attacks, mostly focusing on the less challenging setting of untargeted attacks.

Original: Finally, the prior works that use Bayesian optimisation for adversarial attacks (Suya et al., 2017; Zhao et al., 2019) only investigate the use of simple Gaussian process as the surrogate model and are limited in their performance.
Revised: Finally, the prior works that use Bayesian optimisation for adversarial attacks (Suya et al., 2017; Zhao et al., 2019) only investigate the use of simple Gaussian process as the surrogate model and are limited in their performance.

Original: The method proposed in (Suya et al., 2017) deals with the untargetted attack setting and only demonstrates the effectiveness of
Revised: The method proposed in (Suya et al., 2017) deals with the untargetted attack setting and only demonstrates the effectiveness of

Original: Bayesian optimisation in comparison to random search on a low-dimensional ( d = 57 ) email attack task.
Revised: Bayesian optimisation in comparison to random search on a low-dimensional ( d = 57 ) email attack task.

Original: BO-ADMM proposed in (Zhao et al., 2019) works on image data but it applies Bayesian optimisation directly on the search space of image dimension to minimise the joint objective of attack loss and distortion loss.
Revised: BO-ADMM proposed in (Zhao et al., 2019) works on image data but it applies Bayesian optimisation directly on the search space of image dimension to minimise the joint objective of attack loss and distortion loss.

Original: Despite its query efﬁciency, BO-ADMM leads to poor-quality adversarial examples of large distortion loss.
Revised: Despite its query efﬁciency, BO-ADMM leads to poor-quality adversarial examples of large distortion loss.

Original:  P RELIMINARIES 3. P ROBLEM D EFINITION
Revised:  P RELIMINARIES 3. P ROBLEM D EFINITION

Original: We focus on the black-box attack setting, where the adversary has no knowledge about the network architecture, weights, gradient or training data of the target model f , and can only query the target model with an input x to observe its prediction scores on all C classes (i.e. f : R d −→ [0 , 1] C )
Revised: We focus on the black-box attack setting, where the adversary has no knowledge about the network architecture, weights, gradient or training data of the target model f , and can only query the target model with an input x to observe its prediction scores on all C classes (i.e. f : R d −→ [0 , 1] C )

Original: (Tu et al., 2018; Alzantot et al., 2018).
Revised: (Tu et al., 2018; Alzantot et al., 2018).

Original: Moreover, we aim to perform targeted attacks, which is more challenging than untargeted attacks, subject to a constraint on the maximum change to any of the coordinates (i.e., a L ∞ constraint)
Revised: Moreover, we aim to perform targeted attacks, which is more challenging than untargeted attacks, subject to a constraint on the maximum change to any of the coordinates (i.e., a L ∞ constraint)

Original: (Warde-Farley & Goodfellow, 2016; Alzantot et al., 2018).
Revised: (Warde-Farley & Goodfellow, 2016; Alzantot et al., 2018).

Original: Speciﬁcally, targeted attacks refer to the case where given a valid input x origin of class t origin (i.e. arg max i ∈{ 1 ,...,C } f ( x origin )
Revised: Speciﬁcally, targeted attacks refer to the case where given a valid input x origin of class t origin (i.e. arg max i ∈{ 1 ,...,C } f ( x origin )

Original: i =
Revised: i =

Original: t origin ) and a target t (cid:54) =
Revised: t origin ) and a target t (cid:54) =

Original: t origin , we aim to ﬁnd an adversarial input x , which is close to x origin according to the L ∞ − norm, such that arg max i ∈{ 1 ,...,C } f ( x ) i =
Revised: t origin , we aim to ﬁnd an adversarial input x , which is close to x origin according to the L ∞ − norm, such that arg max i ∈{ 1 ,...,C } f ( x ) i =

Original: t .
Revised: t .

Original: Untargeted adversarial attacks refer to the case that instead of classifying x origin as t origin , we try to ﬁnd an input x so that arg max i ∈{ 1 ,...,C } f ( x ) i (cid:54)
Revised: Untargeted adversarial attacks refer to the case that instead of classifying x origin as t origin , we try to ﬁnd an input x so that arg max i ∈{ 1 ,...,C } f ( x ) i (cid:54)

Original: =
Revised: =

Original: t origin .
Revised: t origin .

Original: In our approach, we follow the convention to optimise over the perturbation δ instead of the adversarial example x directly (Chen et al., 2017; Alzantot et al., 2018;
Revised: In our approach, we follow the convention to optimise over the perturbation δ instead of the adversarial example x directly (Chen et al., 2017; Alzantot et al., 2018;

Original: Tu et al., 2018).
Revised: Tu et al., 2018).

Original: Therefore, our problem can be formulated as:
Revised: Therefore, our problem can be formulated as:

Original: [Equation]
Revised: [Equation]

Original: 3. B AYESIAN O PTIMISATION
Revised: 3. B AYESIAN O PTIMISATION

Original: Bayesian optimisation (BayesOpt) is a query-efﬁcient approach to tackle global optimisation problems (Brochu et al., 2010).
Revised: Bayesian optimisation (BayesOpt) is a query-efﬁcient approach to tackle global optimisation problems (Brochu et al., 2010).

Original: It is particularly useful when the objective function is a black-box and isvery costly to evaluate.
Revised: It is particularly useful when the objective function is a black-box and is costly to evaluate.

Original: There are 2 key components in BO: a statistical surrogate, such as a Gaussian process (GP) or a Bayesian neural network (BNN) which models the unknown objective, and an acquisition function α ( · ) which is maximised to recommend the next query location by trading off exploitation and exploration. The standard algorithm for BayesOpt is shown in Algorithm 3 in the Appendix.
Revised: There are 2 key components in BO: a statistical surrogate, such as a Gaussian process (GP) or a Bayesian neural network (BNN) which models the unknown objective, and an acquisition function α ( · ) which is maximised to recommend the next query location by trading off exploitation and exploration (see Algorithm 3 in Appendix A for standard BayesOpt).

Original:  B AYES O PT A TTACK 4. B AYES O PT ATTACK OBJECTIVE
Revised:  B AYES O PT A TTACK 4. B AYES O PT ATTACK OBJECTIVE

Original: It has been shown that reducing the dimensionality of the search space in Equation (1) increases query efﬁciency signiﬁcantly (Chen et al., 2017; Tu et al., 2018; Alzantot et al., 2018).
Revised: It has been shown that reducing the dimensionality of the search space in Equation (1) increases query efﬁciency signiﬁcantly (Chen et al., 2017; Tu et al., 2018; Alzantot et al., 2018).

Original: Due to our focus on the small query regime where our surrogate model needs to be trained with a very small number of observation data, we adopt the previously suggested dimensionality reduction technique, bilinear resizing, to reduce the challenging problem of optimising over high-dimensional input space of x ∈ R d to one over a relatively low-dimensional input space, setting x = x origin + g ( δ ) where δ ∈ R d r with d r < d and g : R d r −→ R d being the bilinear resizing decoder 1 .
Revised: Due to our focus on the small query regime where our surrogate model needs to be trained with a very small number of observation data, we adopt the previously suggested dimensionality reduction technique, bilinear resizing, to reduce the challenging problem of optimising over high-dimensional input space of x ∈ R d to one over a relatively low-dimensional input space, setting x = x origin + g ( δ ) where δ ∈ R d r with d r < d and g : R d r −→ R d being the bilinear resizing decoder 2 .

Original: Furthermore, we follow the approach of smoothing the discontinuous objective function in Equation (1), which has been found to be beneﬁcial in previous work (Chen et al., 2017; Tu et al., 2018;
Revised: Furthermore, we follow the approach of smoothing the discontinuous objective function in Equation (1), which has been found to be beneﬁcial in previous work (Chen et al., 2017; Tu et al., 2018;

Original: Alzantot et al., 2018).
Revised: Alzantot et al., 2018).

Original: Together with the dimensionality reduction, this leads to the following blackbox objective problem for our Bayesian optimisation:
Revised: Together with the dimensionality reduction, this leads to the following blackbox objective problem for our Bayesian optimisation:

Original: [Equation]
Revised: [Equation]

Original: where
Revised: where

Original: [Equation]
Revised: [Equation]

Original: 4. GP- BASED B AYES O PT A TTACK
Revised: 4. GP- BASED B AYES O PT A TTACK

Original: We ﬁrst use BayesOpt with a standard GP as the surrogate to solve for the black-box attack objective in the reduced input dimension in Equation (2).
Revised: We ﬁrst use BayesOpt with a standard GP as the surrogate to solve for the black-box attack objective in the reduced input dimension in Equation (2).

Original: The GP encodes our prior belief on the objective y :
Revised: The GP encodes our prior belief on the objective y :

Original: [Equation]
Revised: [Equation]

Original: which is speciﬁed by a mean function µ and a kernel/covariance function
Revised: which is speciﬁed by a mean function µ and a kernel/covariance function

Original: k (we use the Matern-5/ kernel in our work).
Revised: k (we use the Matern-5/ kernel in our work).

Original: In our work, we normalise the objective function value and thus use a zeromean prior µ ( · ) = 0 .
Revised: In our work, we normalise the objective function value and thus use a zeromean prior µ ( · ) = 0 .

Original: The predictive posterior distribution for y t at a test point δ t conditioned on the observation data D t − 1 =
Revised: The predictive posterior distribution for y t at a test point δ t conditioned on the observation data D t − 1 =

Original: { δ i , y i } t − 1 i =

Revised: { δ i , y i } t − 1 i =

Original: = { δ 1: t − 1 , y 1: t − 1 } then has the form:
Revised: = { δ 1: t − 1 , y 1: t − 1 } then has the form:

Original: [Equation]
Revised: [Equation]

Original: 4) where
Revised: where

Original: [Equation]
Revised: [Equation]

Original: where K 1: t − 1 = K ( δ 1: t − 1 , δ 1: t − 1 ) is the t − 1 × t − 1 matrix with pairwise covariances
Revised: where K 1: t − 1 = K ( δ 1: t − 1 , δ 1: t − 1 ) is the t − 1 × t − 1 matrix with pairwise covariances

Original: k ( δ l , δ (cid:48) m ) , l, m ≤ t − 1 as entries.
Revised: k ( δ l , δ (cid:48) m ) , l, m ≤ t − 1 as entries.

Original: The optimal GP hyper-parameters θ ∗ such as the length scales and variance of the kernel function k can be learnt by maximising the marginal likelihood p ( D t − 1 | θ ) which has analytic form as presented in Appendix F. For a detailed introduction on GPs, please refer to (Rasmussen, 2003).
Revised: The optimal GP hyper-parameters θ ∗ such as the length scales and variance of the kernel function k can be learnt by maximising the marginal likelihood p ( D t − 1 | θ ) which has analytic form as presented in Appendix F. Please refer to (Rasmussen, 2003) for GPs.

Original: Based on the predictive posterior distribution, we construct the acquisition function α ( δ |D t − 1 ) to help select the next query point δ t .
Revised: Based on the predictive posterior distribution, we construct the acquisition function α ( δ |D t − 1 ) to help select the next query point δ t .

Original: The acquisition function can be considered as a utility measure which balances the exploration and exploitation by giving higher utility to input regions where the functional value is high (high µ y ) and where the model is very uncertain (high k y ).
Revised: The acquisition function can be considered as a utility measure which balances the exploration and exploitation by giving higher utility to input regions where the functional value is high (high µ y ) and where the model is very uncertain (high k y ).

Original: The approach of using BayesOpt with a GP surrogate to attack the target model is described in Algorithm 1.
Revised: The approach of using BayesOpt with a GP surrogate to attack the target model is described in Algorithm 1.

Original: 4. A DDITIVE GP- BASED B AYES O PT A TTACK
Revised: 4. A DDITIVE GP- BASED B AYES O PT A TTACK

Original: Although techniques such as bilinear resizing are able to reduce the input dimension from the original image size (e.g. d = 3072 for CIFAR10 image) to a signiﬁcantly lower dimension (e.g. d (cid:48) = 192 ),making the problem amenable to GP-based BO, the reduced search space for the adversarial attack is still considered very high dimensional for GP-based BayesOpt (which is usually applied on problems with d (cid:48) ≤ 20 ).
Revised: Although techniques such as bilinear resizing are able to reduce the input dimension from the original image size (e.g. d = 3072 for CIFAR10 image) to a much lower dimension (e.g. d (cid:48) = 192 ), the reduced search space for the adversarial attack is still considered very high dimensional for GP-based BayesOpt (which is usually applied on problems with d (cid:48) ≤ 20 ).

Original: There are two challenges in using BayesOpt for high dimensional problems.
Revised: There are two challenges in using BayesOpt for high dimensional problems.

Original: The ﬁrst is the curse of dimensionality in modelling the objective function.
Revised: The ﬁrst is the curse of dimensionality in modelling the objective function.

Original: When the unknown function is highdimensional, estimating it with non-parametric regression becomes very difﬁcult because it is impossible to densely ﬁll the input space with ﬁnite number of sample points, even if the sample size is very large (Gy¨orﬁ et al., 2006).
Revised: When the unknown function is highdimensional, estimating it with non-parametric regression becomes very difﬁcult because it is impossible to densely ﬁll the input space with ﬁnite number of sample points, even if the sample size is very large (Gy ¨ orﬁ et al., 2006).

Original: The second challenge is the computational difﬁculty in optimising the acquisition function.
Revised: The second challenge is the computational difﬁculty in optimising the acquisition function.

Original: The computation cost needed for optimising the acquisition function to within a desired accuracy grows exponentially with dimension (Kandasamy et al., 2015).
Revised: The computation cost needed for optimising the acquisition function to within a desired accuracy grows exponentially with dimension (Kandasamy et al., 2015).

Original: We adopt the additive-GP model (Duvenaud et al., 2011; Kandasamy et al., 2015) to deal with the above-mentioned challenges associated with searching for adversarial perturbation in the high dimensional space.
Revised: We adopt the additive-GP model (Duvenaud et al., 2011; Kandasamy et al., 2015) to deal with the above-mentioned challenges associated with searching for adversarial perturbation in the high dimensional space.

Original: The key assumption we make is that the objective can be decomposed into a sum of low-dimensional composite functions:
Revised: The key assumption we make is that the objective can be decomposed into a sum of low-dimensional composite functions:

Original: [Equation]
Revised: [Equation]

Original:  where δ ( A j ) denotes disjoint low-dimensional subspaces, δ = ∪ Mj
Revised: (7) where δ ( A j ) denotes disjoint low-dimensional subspaces, δ = ∪ Mj

Original: =1 δ ( A j ) and δ ( A j ) ∩ δ
Revised: =1 δ ( A j ) and δ ( A j ) ∩ δ

Original: ( A i )
Revised: ( A i )

Original: = ∅ for all j (cid:54)
Revised: = ∅ for all j (cid:54)

Original: =
Revised: =

Original: i .
Revised: i .

Original: If we impose a GP prior for each y ( j ) , the prior for the overall objective y is also a GP: y ∼
Revised: If we impose a GP prior for each y ( j ) , the prior for the overall objective y is also a GP: y ∼

Original: GP ( µ ( δ ) , k ( δ , δ (cid:48) ))
Revised: GP ( µ ( δ ) , k ( δ , δ (cid:48) ))

Original: where µ ( δ ) =
Revised: where µ ( δ ) =

Original: (cid:80) Mj
Revised: (cid:80) Mj

Original: =1 µ ( j ) (cid:0) δ
Revised: =1 µ ( j ) (cid:0) δ

Original: ( A j ) (cid:1) and k ( δ , δ (cid:48) )
Revised: ( A j ) (cid:1) and k ( δ , δ (cid:48) )

Original: = (cid:80) Mj
Revised: = (cid:80) Mj

Original: =1 k ( j ) (cid:0) δ
Revised: =1 k ( j ) (cid:0) δ

Original: ( A j ) , δ (cid:48)
Revised: ( A j ) , δ (cid:48)

Original: ( A j ) (cid:1) .
Revised: ( A j ) (cid:1) .

Original: The predictive posterior distribution for each subspace p ( y ( j ) 1: t − 1 | δ ( A j ) t , D t ) is:[Equation] [Equation] [Equation]
Revised: The predictive posterior distribution for each subspace p ( y ( j ) 1: t − 1 | δ ( A j ) t , D t ) is:

Original: [Equation]

Original: ( A j ) t ) =

Original: k

Original: [Equation]

Original: [Equation]

Original: [Equation]

Original: k ( j ) y ( δ ( A

Original: [Equation]
Revised: [Equation]

Original: ) t , δ (cid:48)

Original: ( A

Original: [Equation]

Original: ) t [Equation] [Equation] In our case, the exact decomposition (i.e. which input dimension belongs to which low-dimensional subspace) is unknown but we can learn it together with other GP hyperparameters by maximising marginal likelihood (Kandasamy et al., 2015).
Revised: In our case, the exact decomposition (i.e. which input dimension belongs to which low-dimensional subspace) is unknown but we can learn it together with other GP hyperparameters by maximising marginal likelihood (Kandasamy et al., 2015).

Original:  Note that in this case, the acquisition function is formulated based on p ( y ( j ) t | δ ( A j ) t , D t ) for each subspace and is also optimised in the low-dimensional subspace, thus leading to much more efﬁcient optimisation task.
Revised: We demonstrate the effectiveness of our decomposition learning in Appendix E. Note that in this case, the acquisition function is formulated based on p ( y ( j ) t | δ ( A j ) t , D t ) for each subspace and is also optimised in the low-dimensional subspace, thus leading to much more efﬁcient optimisation task.

Original: The optimal perturbations in all the subspaces { δ ( A j ) ∗ } Mj =1 are then combined to give the next query point δ t .
Revised: The optimal perturbations in all the subspaces { δ ( A j ) ∗ } Mj =1 are then combined to give the next query point δ t .

Original: 4. L EARNING T HE O PTIMAL d r
Revised: 4. L EARNING T HE O PTIMAL d r

Original: Generating the successful adversarial example x ∈ R d by searching perturbation in a reduced dimension δ ∈ R d r has become a popular practice that leads to signiﬁcant improvement in query efﬁciency (Chen et al., 2017; Tu et al., 2018;
Revised: Generating the successful adversarial example x ∈ R d by searching perturbation in a reduced dimension δ ∈ R d r has become a popular practice that leads to signiﬁcant improvement in query efﬁciency (Chen et al., 2017; Tu et al., 2018;

Original: Alzantot et al., 2018).
Revised: Alzantot et al., 2018).

Original: However, what the optimal d r is and how to decide it efﬁciently have not been investigated in previous work (Chen et al., 2017;
Revised: However, what the optimal d r is and how to decide it efﬁciently have not been investigated in previous work (Chen et al., 2017;

Original: Tu et al., 2018; Alzantot et al., 2018).
Revised: Tu et al., 2018; Alzantot et al., 2018).

Original: As we shown empirically in Section 5.1, setting d r arbitrarily can lead to suboptimal attack performance in terms of query efﬁciency, attack success rate as well where g (δ i ) ∈ R d and a set of possible d r
Revised: As we shown empirically in Section 5.1, setting d r arbitrarily can lead to suboptimal attack performance in terms of query efﬁciency, attack success rate as well 1: Input: A decoder g · ) , observation data D dt 1 = { g ( i ) , y i } t

Original: Fit a GP model to D d rj t − 1 and computes its maximum marginal likelihood d as perturbation costs while ﬁnding a good d r by trial and error or progressive increasing is computationally expensive and highly inefﬁcient because the optimal  d r varies with different attack input x origin .
Revised: 1 i =1 where g ( δ i ) ∈ R d and a set of possible d r : { d rj } Nj = 2: Output: The optimal reduced dimension d r ∗ and the corresponding GP model 3: for N do 4: D d t

Revised: = δ i y t

Revised: 1 i

Revised: 1 where g − g δ i )

Revised: R d rj 5:

Revised: Fit a GP model to D d rj t − 1 and computes its maximum marginal likelihood p

Revised: D dt d rj ) 6: end for 7: Select

Revised: = model as perturbation costs while ﬁnding a good d r by trial and error or progressive increasing is computationally expensive and highly inefﬁcient because the optimal d r varies with different attack input x origin .

Original: An effective way of learning d r is thus very important for adversarial attacks.
Revised: An effective way of learning d r is thus very important for adversarial attacks.

Original: In this section, we propose a rigorous method, which is neatly compatible with our attack technique, to learn the optimal d r from the query information.
Revised: In this section, we propose a rigorous method, which is neatly compatible with our attack technique, to learn the optimal d r from the query information.

Original: The optimal d r should be the one that both takes into consideration our prior knowledge on the discrete d r choices and at the same time best explain the observed query data.
Revised: The optimal d r should be the one that both takes into consideration our prior knowledge on the discrete d r choices and at the same time best explain the observed query data.

Original: Given that our
Revised: Given that our

Original: BayesOpt attack uses a statistical surrogate (i.e. GP in our case) to model the unknown relation between the attack objective score y and the adversarial perturbation δ , this naturally translates to the criterion of maximising the posterior for d r :
Revised: BayesOpt attack uses a statistical surrogate (i.e. GP in our case) to model the unknown relation between the attack objective score y and the adversarial perturbation δ , this naturally translates to the criterion of maximising the posterior for d r :

Original: [Equation]
Revised: [Equation]

Original: where p ( D t − 1 | d rj ) is the marginal likelihood (evidence) of adopting a speciﬁc d rj , p ( d rj ) is our prior over the possible d r values and p ( D t − 1 )
Revised: where p ( D t − 1 | d rj ) is the marginal likelihood (evidence) of adopting a speciﬁc d rj , p ( d rj ) is our prior over the possible d r values and p ( D t − 1 )

Original: = (cid:80) i
Revised: = (cid:80) i

Original: p
Revised: p

Original: ( D t − 1 | d rj ) p ( d rj ) is a normalising constant.
Revised: ( D t − 1 | d rj ) p ( d rj ) is a normalising constant.

Original: If we match different d rj to different model choice, the problem of choosing d r then becomes the classic
Revised: If we match different d rj to different model choice, the problem of choosing d r then becomes the classic

Original: Bayesian model selection task (Rasmussen, 2003).
Revised: Bayesian model selection task (Rasmussen, 2003).

Original: In most cases, our prior assumption is that we do not prefer one d r over another (i.e. ﬂat prior p ( d rj ) =
Revised: In most cases, our prior assumption is that we do not prefer one d r over another (i.e. ﬂat prior p ( d rj ) =

Original: p ( d ri ) for j (cid:54) = i ) and thus we can select d r by comparing their evidence(MacKay & Mac Kay, 2003):
Revised: p ( d ri ) for j (cid:54) = i ) and thus we can select d r by comparing their evidence(MacKay & Mac Kay, 2003):

Original: [Equation]
Revised: [Equation]

Original: The exact computation of the evidence term requires marginalisation over model hyper-parameters, which is intractable.
Revised: The exact computation of the evidence term requires marginalisation over model hyper-parameters, which is intractable.

Original: We approximate the integral with point estimates (i.e. marginal likelihood of our GP model): p ( D t − 1 | d rj ) =
Revised: We approximate the integral with point estimates (i.e. marginal likelihood of our GP model): p ( D t − [Equation] d rj ) =

Original: [Equation]
Revised: [Equation]

Original: p
Revised: p

Original: [Equation]
Revised: [Equation]

Original: D
Revised: rj

Original: [Equation]
Revised: [Equation]

Original: [Equation] θ , d rj ) p
Revised: p

Original: [Equation]
Revised: [Equation]

Original: θ | d rj ) d θ ≈ p ( D t − 1 | θ ∗ , d rj ) where θ ∗ = arg max θ p ( D t − 1 | θ , d r j ) .
Revised: d rj ) d θ ≈ p ( D t − 1 | θ ∗ , d rj ) where θ ∗ = arg max θ p ( D t − 1 | θ , d rj ) .

Original: For query efﬁciency, we project the same perturbation query data in the original image dimension Ddt − 1 =
Revised: For query efﬁciency, we project the same perturbation query data in the original image dimension D

Original:  { g ( δ i ) , y i } t − 1 i =1 to different latent spaces to get corresponding low-dimensional training data sets for separate GP models.
Revised: d t − 1 = { g ( δ i ) , y i } t − 1 i =1 to different latent spaces to get corresponding low-dimensional training data sets for separate GP models.

Original: The GP model that corresponds to d rj is trained on D d rj t − 1 = { g − 1 ( g ( δ i )) , y i } t − 1 i =1 where g − 1 ( g ( δ i ))
Revised: The GP model that corresponds to d rj is trained on D d rj t − 1 = { g − 1 ( g ( δ i )) , y i } t − 1 i =1 where g − 1 ( g ( δ i ))

Original: ∈ R d rj .
Revised: ∈ R d rj .

Original: Then we select the optimal d r by comparing the marginal likelihood p ( D d rj t − 1 | θ ∗ , d rj ) of each GP surrogate.
Revised: Then we select the optimal d r by comparing the marginal likelihood p ( D d rj t − 1 | θ ∗ , d rj ) of each GP surrogate.

Original: The overall procedure for d r selection is described in Algorithm 2.
Revised: The overall procedure for d r selection is described in Algorithm 2.

Original: We would like to highlight that the use of the statistical surrogate in our BayesOpt attack approach enables us to naturally use the Bayesian model selection technique to learn the optimal d r that automatically enjoy the trade-off between data-ﬁt quality and model complexity.
Revised: We would like to highlight that the use of the statistical surrogate in our BayesOpt attack approach enables us to naturally use the Bayesian model selection technique to learn the optimal d r that automatically enjoy the trade-off between data-ﬁt quality and model complexity.

Original: And we also show empirically in Section 5.3 that by automating and incorporating the learning of d r into our BayesOpt attack, we can gain higher success rate and query efﬁciency.
Revised: And we also show empirically in Section 5.3 that by automating and incorporating the learning of d r into our BayesOpt attack, we can gain higher success rate and query efﬁciency.

Original: Other adversarial attacks methods can also use our proposed approach to decide d r but it would require the additional efforts of constructing statistical models to provide p ( D t − 1 | d r j ) .
Revised: Other adversarial attacks methods can also use our proposed approach to decide d r but it would require the additional efforts of constructing statistical models to provide p ( D t − 1 | d r j ) .

Original:  E XPERIMENTS
Revised:  E XPERIMENTS

Original: We empirically compare the performance of our BayesOpt attacks against the state-of-the-art blackbox methods such as ZOO (Chen et al., 2017), AutoZOOM(Tu et al., 2018) and GenAttack (Alzantot et al., 2018).
Revised: We empirically compare the performance of our BayesOpt attacks against the state-of-the-art blackbox methods such as ZOO (Chen et al., 2017), AutoZOOM(Tu et al., 2018) and GenAttack (Alzantot et al., 2018).

Original: We denote the BayesOpt attack with standard GP surrogate as GP-BO, its variant that  learns the d r automatically is GP-BO-auto- d r as well as the attack with additive GP surrogate as
Revised: We denote the BayesOpt attack with standard GP surrogate as GP-BO, its variant that [Figure] learns the d r automatically is GP-BO-auto- d r as well as the attack with additive GP surrogate as

Original: ADDGP-BO.
Revised: ADDGP-BO.

Original: For all the BayesOpt methods, we use GP-UCB as the acquisition function 2 and update the GP hyperperameters every 5 BayesOpt iterations.
Revised: For all the BayesOpt methods, we use GP-UCB as the acquisition function 3 and update the GP hyperperameters every 5 BayesOpt iterations.

Original: We relearn the optimal d r for GP-BOauto- d r and the search space decomposition for ADDGP-BO every 40 iterations.
Revised: We relearn the optimal d r for GP-BOauto- d r and the search space decomposition for ADDGP-BO every 40 iterations.

Original: For ADDGP-BO, we decompose the search spaces into M = 12 sub-spaces of equal dimensions.
Revised: For ADDGP-BO, we decompose the search spaces into M = 12 sub-spaces of equal dimensions for MNIST and

Original: [Figure]
Revised: CIFAR10 and into M = 27 sub-spaces for ImageNet.

Original: The target models that we attack follow the same architectures as that used in AutoZOOM and GenAttack; These are image classiﬁers for MNIST (a CNN with 99.5 % test accuracy) and CIFAR10 (a CNN with 80 % test accuracy).
Revised: The target models that we attack follow the same architectures as that used in AutoZOOM and GenAttack; These are image classiﬁers for MNIST (a CNN with 99.5 % test accuracy) and CIFAR (a CNN with 80 % test accuracy).

Original: Following the experiment design in (Tu et al., 2018), we randomly select 50 correctly classiﬁed images from CIFAR10 test data andrandomly select 7 correctly classiﬁed images from MNIST test data.
Revised: Following the experiment design in (Tu et al., 2018), we randomly select 50 correctly classiﬁed images from CIFAR10 test data and MNIST test data.

Original: We then perform targeted attacks on these images.
Revised: We then perform targeted attacks on these images.

Original: Each selected image is attacked 9 times, targeting at all but its true class and this gives a total of 450 attack instances for CIFAR and63 attack instances for MNIST.
Revised: Each selected image is attacked 9 times, targeting at all but its true class and this gives a total of 450 attack instances for both CIFAR10 and MNIST.

Revised: For ImageNet, we also select 50 correctly classiﬁed images from the test set but perform one random targeted attack for each image.

Original: We set δ max = 0 .
Revised: We set δ max = 0 .

Original: 3 for attacking MNIST and δ max = 0 .
Revised: 3 for attacking MNIST and δ max = 0 .

Original: for CIFAR10, which are used in (Alzantot et al., 2018).
Revised: for CIFAR10 and ImageNet, which are used in (Alzantot et al., 2018).

Original: We use the recommended parameter setting and their open sourced implementations for performing all competing attack methods (Chen et al., 2017; Tu et al., 2018; Alzantot et al., 2018).
Revised: We use the recommended parameter setting and their open sourced implementations for performing all competing attack methods (Chen et al., 2017; Tu et al., 2018; Alzantot et al., 2018).

Original: 5. E FFECT OF d r
Revised: 5. E FFECT OF d r

Original: We ﬁrst empirically investigate the effect of the reduced dimensionality d r of the latent space in which we search for the adversarial perturbation.
Revised: We ﬁrst empirically investigate the effect of the reduced dimensionality d r of the latent space in which we search for the adversarial perturbation.

Original: We experiment with the GP-based BayesOpt attacks for the CIFAR10 classiﬁer using reduced dimension of d r = { 6 × 6 × 3 , 8 × 8 × 3 , 10 × 10 × 3 , 12 × 12 × 3 , 14 × 14 × 3 , 16 × 16 × 3 , 18 × 18 × 3 } and perform targeted attacks on 5 target images with each image being attacked 9 times, leading to 45 attack instances.
Revised: We experiment with the GP-based BayesOpt attacks for the CIFAR10 classiﬁer using reduced dimension of d r = { 6 × 6 × 3 , 8 × 8 × 3 , 10 × 10 × 3 , 12 × 12 × 3 , 14 × 14 × 3 , 16 × 16 × 3 , 18 × 18 × 3 } and perform targeted attacks on 5 target images with each image being attacked 9 times, leading to 45 attack instances.

Original: We ﬁrst investigate the attack success rate (ASR) achieved at different d r for all the 5 images.
Revised: We ﬁrst investigate the attack success rate (ASR) achieved at different d r for all the 5 images.

Original: The results on ASR out of the 9 targeted attacks for each of the 5 images, which are indicated by Image ID 1 to 5, are shown in the left subplot of Figure 2.
Revised: The results on ASR out of the 9 targeted attacks for each of the 5 images, which are indicated by Image ID 1 to 5, are shown in the left subplot of Figure 1.

Original: It’s evident that the d r which leads to highest attack success rate varies for different original images x origin .
Revised: It’s evident that the d r which leads to highest attack success rate varies for different original images x origin .

Original: We then examines how the d r affects the query efﬁciency and attack quality (average L 2 distance of the adversarial image from the original image) for the attack instances (e.g. make the classiﬁer to mis-classify a airplane image as a cat) that GP-based BayesOpt can attack successfully at all d r .
Revised: We then examines how the d r affects the query efﬁciency and attack quality (average L 2 distance of the adversarial image from the original image) for the attack instances (e.g. make the classiﬁer to mis-classify a airplane image as a cat) that GP-based BayesOpt can attack successfully at all d r .

Original: We present the results on 4 attack instances of a airplane image in the middle and right subplots of
Revised: We present the results on 4 attack instances of a airplane image in the middle and right subplots of

Original: Figure 2.
Revised: Figure 1.

Original: We can see that even for the same original image and attack instances, varying d r can  impact query efﬁciency and L 2 norm of the successful adversarial perturbation signiﬁcantly.
Revised: We can see that even for the same original image and attack instances, varying d r can [Table] [Table] impact query efﬁciency and L 2 norm of the successful adversarial perturbation signiﬁcantly.

Original: For example, d r = 8 × 8 × 3 is most query efﬁcient for attack instance 1 and 4 but is outperformed by other dimensions in attack instance 2 and 3.
Revised: For example, d r = 8 × 8 × 3 is most query efﬁcient for attack instance 1 and 4 but is outperformed by other dimensions in attack instance 2 and 3.

Original: Therefore, the importance of d r and the difﬁculty of ﬁnding the optimal d r for a speciﬁc target/image motivates us to derive our method for learning it automatically from the data.
Revised: Therefore, the importance of d r and the difﬁculty of ﬁnding the optimal d r for a speciﬁc target/image motivates us to derive our method for learning it automatically from the data.

Original: As shown in the following sections, our d r learner does lead to more superior attack performance.[Figure] u [Figure]
Revised: As shown in the following sections, our d r learner does lead to more superior attack performance.

Original: r

Original: [Figure]

Original: [Figure]

Original: Instances

Original: [Figure]

Original: [Figure]

Original: M e a n p e r - p i x

Original: e l L 2 ( 0 .)

Original: d^r=8x8x d^r=10x10x d^r=12x12x

Original: d^r=14x14x d^r=16x16x d^r=18x18x

Original: [Table]

Original: 5. P ERFORMANCE UNDER A FIXED QUERY BUDGET
Revised: 5. P ERFORMANCE UNDER A FIXED QUERY BUDGET

Original: In this experiment, we limit the total query number to be 1000, which is slightly above the median query counts needed for GenAttack to make a successful attack on MNIST and CIFAR

Revised: In this experiment, we limit the total query number to be 1000, which is slightly above the median query counts needed for GenAttack to make a successful attack on MNIST and CIFAR

Original: (Alzantot et al., 2018).
Revised: (Alzantot et al., 2018) and 2000 for ImageNet.

Original: We adopt the reduced search dimension recommended by AutoZOOM, d r = 14 × 14 × 3 for CIFAR10 and d r = 14 × 14 × 1 for MNIST.
Revised: We adopt the reduced search dimension recommended by AutoZOOM, d r = 14 × 14 × 3 for CIFAR10 and d r = 14 × 14 × 1 for MNIST and allow GP-BOauto- d

Revised: r to automatically learn the reduced dimension d r in a range between 6 × 6 × 1 and 28 × 28 ×for MNIST, and between 6 × 6 × 3 and 32 × 32 × 3 for CIFAR10.

Revised: For ImageNet, due to the high dimensionality of its images, we adopt a hierarchical decoding process: 1) ﬁrst performance BayesOpt attacks(ADDGP-BO and GP-BO) on a reduced dimension of d r 1 = 48 × 48 × 3 and then 2) decode the adversarial perturbation found in d r 1 to d r 2 = 96 × 96 × 3 via bilinear upsampling.

Revised: This is followed by another bilinear decoder projecting the adversarial perturbation in d r 2 back to image dimension of d = 299 × 299 × 3 .

Revised: As for the GP-BO-auto- d r , we allow the algorithm to automatically learn the reduced dimension d r 1 in the phase 1) in the range between 6 × 6 × 3 to 60 × 60 × 3 .

Original:  For BayesOpt attack, each iteration requires 1 query to the objective function so we limit its iteration to 1000 and early terminate the BayesOpt attack algorithm when successful adversarial example is found.
Revised: GenAttack is performed with the same upsampling as our methods. As for AutoZOOM and ZOO, we uses the optimal d r settings recommended in (Tu et al., 2018; Chen et al., 2017) for ImageNet. For BayesOpt attack, each iteration requires 1 query to the objective function so we limit its iteration to 1000 and early terminate the BayesOpt attack algorithm when successful adversarial example is found.

Original: AutoZOOM comprises 2 stages in their attack algorithm.
Revised: AutoZOOM comprises 2 stages in their attack algorithm.

Original: The ﬁrst exploration stage aims to ﬁnd the successful adversarial example.
Revised: The ﬁrst exploration stage aims to ﬁnd the successful adversarial example.

Original: Once a successful attack is found, it switches to the ﬁne-tuning stage to reduce the perturbation cost (e.g. Lnorm) of the successful attack.
Revised: Once a successful attack is found, it switches to the ﬁnetuning stage to reduce the perturbation cost (e.g. L 2 norm) of the successful attack.

Original: We report its performance on the attack success rate and L 2 norm of adversarial perturbations after a budget of 1000 queries, which allows it to ﬁne-tune the successful adversarial perturbations found.
Revised: We report its performance on the attack success rate and L 2 norm of adversarial perturbations after a budget of 1000 queries, which allows it to ﬁne-tune the successful adversarial perturbations found.

Original: Moreover, AutoZOOM uses L 2 norm to measure the perturbation costs but our method and GenAttack limit the search space via L ∞ norm.
Revised: Moreover, AutoZOOM uses L 2 norm to measure the perturbation costs but our method and GenAttack limit the search space via L ∞ norm.

Original: We observe that the successful attacks found by AutoZOOM incur  much higher perturbation costs in terms of L ∞ norm than GenAttack and our method.
Revised: We observe that the successful attacks found by AutoZOOM incur [Table] much higher perturbation costs in terms of L ∞ norm than GenAttack and our method.

Original: Therefore, we only consider the ﬁnal adversarial examples whose L ∞ distances from the original images lie within [ − δ max , δ max ] as the successful attacks 3 .
Revised: Therefore, we only consider the ﬁnal adversarial examples whose L ∞ distances from the original images lie within [ − δ max , δ max ] as the successful attacks 4 .

Original: The results on MNIST in Table 1 show that all our BayesOpt attack can achieve a comparable success rate but at a much lower query count( 71% less for simple GP-BO and 81% less for ADDGP-BO ) in comparison to GenAttack (Alzantot et al., 2018) andAutoZOOM (Tu et al., 2018). Note that [Figure] [Table]
Revised: The results on MNIST in Table 1 show that all our BayesOpt attacks can achieve a comparable success rate but at a much lower query count in comparison to GenAttack (Alzantot et al., 2018) and

Original: [Figure] [Table] [Figure]
Revised: AutoZOOM (Tu et al., 2018).

Original: [Table] [Figure] [Table] [Figure]
Revised: Speciﬁcally, the median query count of ADDGP-BO is 68% less than

Original: [Table] [Figure] [Table] [Figure]
Revised: GenAttack and 80% less than AutoZOOM while that of GP-BO-auto- d r is 49% less than GenAttack and 67% less than AutoZOOM.

Original: [Table] [Figure] [Table] [Figure]
Revised: As for results on attacking on CIFAR

Original: [Table]
Revised: [Table]

Original: [Figure]

Original: ZOO’s result of 0 query means that ZOO succeeds in attacking the 2 simplest image-target pairs at its ﬁrst batch (batch size of 128) of adversarial perturbations but fails to make successful targeted attack on the other image-target pairs under the constraints.

Original: As for results on attacking on CIFAR10, Table 2 shows that all our BayesOpt attack can achieve signiﬁcantly higher success rate but again at a remarkably lower query counts than the existing blackbox approaches.
Revised: Table 2 shows that all our BayesOpt attack can achieve signiﬁcantly higher success rate but again at a remarkably lower query counts than the existing black-box approaches.

Original: For example, our ADDGP-BO can achieve 18% higher success rate while using 37 .
Revised: For example, our ADDGP-BO can achieve 18% higher success rate while using 37 .

Original: 4% less queries in terms of the median as compared to GenAttack.
Revised: 4% less queries in terms of the median as compared to GenAttack.

Original: In addition, our approaches also lead to better quality adversarial examples (Figure 1) which are closer to the original image than the benchmark methods as reﬂected by the lower average L 2 perturbation ( 20 . 5% less).
Revised: In addition, our approaches also lead to better quality adversarial examples (Figure 3 in Appendix B ) which are closer to the original image than the benchmark methods as reﬂected by the lower average L 2 perturbation ( 20 . 5% less).

Original: More importantly, this set of experiments also demonstrate the effectiveness of our Bayesian method for learning d r as GP-BO-auto- d r leads to 15% increase in attack success rate compared to GP-BO while maintaining the competitiveness in query efﬁciency and L 2 distance.
Revised: More importantly, this set of experiments also demonstrate the effectiveness of our Bayesian method for learning d r as GP-BO-auto- d r leads to 15% increase in attack success rate compared to GP-BO while maintaining the competitiveness in query efﬁciency and L 2 distance.

Revised: Similarly, the results on ImageNet in Table 3 shows that all our BayesOpt attacks can achieve higher attack success rate than the competing methods given a query budget of 2000.

Revised: ADDGP-BO is the clearly best performing method in this very high-dimensional setting, achieving 5 times higher success rate than the best competing method, GenAttack, while again obtaining successful adversarial perturbations with lower average L 2 perturbation (14 % less) than GenAttack.

Revised: This conﬁrms our hypothesis that the additive-GP surrogate together with decomposition learning is very effective for high-dimensional optimisation.

Original: 5. Q UERY EFFICIENCY COMPARISON
Revised: 5. Q UERY EFFICIENCY COMPARISON

Original: We ﬁnish by comparing the query efﬁciency, measuring the change in the attack success rate over query counts for all the methods.
Revised: We ﬁnish by comparing the query efﬁciency, measuring the change in the attack success rate over query counts for all the methods.

Original: We limit the query budget of our BayesOpt attacks to 1000 but let the competing methods to continue running until they achieve the same best attack success rate as our best BayesOpt attacks or exceeds a much higher limit (2000 queries for MNIST andqueries for CIFAR10).
Revised: We limit the query budget of our BayesOpt attacks to 1000 but let the competing methods to continue running until they achieve the same best attack success rate as our best BayesOpt attacks or exceeds a much higher limit (2000 queries for MNIST andqueries for CIFAR10 and 14000 queries for ImageNet).

Original: As shown in Figure 3, BayesOpt attacks converge much faster to the high attack success rates than the other methods.
Revised: As shown in Figure 2, BayesOpt attacks converge much faster to the high attack success rates than the other methods.

Original: Speciﬁcally, ADDGP-BO takes only 584 queries to achieve the success rate of 98% for MNIST, which is 50% of the query count by AutoZOOM(1000) and 30% of that by GenAttack (1481).
Revised: Speciﬁcally, GP-BO-auto- d r take less than 833 queries to achieve the success rate of 98% for MNIST, which is 24% of that by GenAttack (2500).

Original: As for CIFAR10, both ADDGP-BO and GP-BO-auto- d r takes around 890 queries to achieve a success rate of 87% which is 23% of the query count by AutoZOOM and 17% of that by GenAttack.
Revised: As for CIFAR10, both ADDGPBO and GP-BO-auto- d r takes around 890 queries to achieve a success rate of 87% which is 23% of the query count by AutoZOOM and 17% of that by GenAttack.

Original: One point to note is that AutoZOOM appears to be slightly more query efﬁcient than GenAttack in this set of experiments.
Revised: One point to note is that AutoZOOM appears to be slightly more query efﬁcient than GenAttack in this set of experiments.

Original: However, we need to bear in mind that although we limit the mean L inf norm of the adversarial perturbation found by AutoZOOM to δ max , AutoZOOM still have the advantage of exploring beyond the δ max for many dimensions. 
Revised: However, we need to bear in mind that although we limit the mean L inf norm of the adversarial perturbation found by AutoZOOM to δ max , AutoZOOM still have the advantage of exploring beyond the δ max for many dimensions. In the case of ImageNet, all our BayesOpt attacks again enjoy faster convergence, with [Figure] [Figure]

Original:   C ONCLUSION
Revised: ADDGP BO taking only 1985 queries to achieve 60% ASR. Meanwhile, GenAttack, takes a budget of 4711 queries, 2.4 times that of ADDGP-BO, to achieve the same ASR and AutoZOOM costs 19451 queries which is 9.8 times that of ADDGP-BO.  C ONCLUSION

Original: We introduce a new black-box adversarial attack which leverages Bayesian optimisation to ﬁnd successful adversarial perturbations with high query efﬁciency.
Revised: We introduce a new black-box adversarial attack which leverages Bayesian optimisation to ﬁnd successful adversarial perturbations with high query efﬁciency.

Original: We also improve our attack by adopting an additive surrogate structure to ease the optimisation challenge over the typically high-dimensional task.
Revised: We also improve our attack by adopting an additive surrogate structure to ease the optimisation challenge over the typically high-dimensional task.

Original: Moreover, we take full advantage of our statistical surrogate model and the available query data to learn the optimal degree of dimension reduction for the search space via Bayesian model selection.
Revised: Moreover, we take full advantage of our statistical surrogate model and the available query data to learn the optimal degree of dimension reduction for the search space via Bayesian model selection.

Original: In comparison to several existing black-box attack methods, our BayesOpt attacks can achieve high success rates with 2-5 times fewer queries while still producing adversarial examples that are closer to the original image (in terms of average L 2 distance).
Revised: In comparison to several existing black-box attack methods, our BayesOpt attacks can achieve high success rates with 2-5 times fewer queries while still producing adversarial examples that are closer to the original image (in terms of average L 2 distance).

Original: We believe our BayesOpt attacks can be a competitive alternative for accessing the model robustness, especially in real-world applications where the available query budget is highly limited and the model evaluation is expensive or risky
Revised: We believe our BayesOpt attacks can be a competitive alternative for accessing the model robustness. One limitation of our attack methods is that due to the poor scalability of GPs, the attack algorithms are computationally more expensive than most existing alternatives especially as the query number increases. Thus, our BayesOpt attacks are optimal for the setting where the cost of evaluating the target model, being it the monetary costs, computational costs or the risk of being detected, is much higher than the computational cost of the attack algorithm itself and thus query efﬁciency is highly prioritised. On the other hand, replacing the GP surrogates with more scalable models such as sparse

Revised: GPs or Bayesian neural networks can be an interesting future research direction.

Original: A B AYESIAN O PTIMISATION
Revised: A B AYESIAN O PTIMISATION

Original: Here we present a generic algorithm for Bayesian optimisation.
Revised: Here we present a generic algorithm for Bayesian optimisation.

Original: Algorithm for
Revised: Algorithm 3 BayesOpt Algorithm

Original:  B A DDITIONAL E XPERIMENTS ON MNIST AND CIFAR 
Revised: D t 7: end for B A DVERSARIAL E XAMPLES FOR CIFAR

Original: [Table]
Revised: [Figure]

Revised: f

Original: [Table]
Revised: [Figure]

Revised: h o r s

Original: [Figure]
Revised: [Figure]

Original: 0 objective value indicates successful attack. ADDGP-BO and GP-BO-auto-
Revised: s h

Original: d r enjoy faster convergence and thus higher attack success rates than simple GP-BO.
Revised: i p t r u c k

Original: C  O BJECTIVE VALUE OVER B AYES O PT ITERATIONS
Revised: C A DDITIONAL E XPERIMENTS ON MNIST AND CIFAR D O BJECTIVE VALUE OVER B AYES O PT ITERATIONS

Original: We illustrate this via the case of attacking a CIFAR10 image of label 9(class truck) on the other 9 target labels with original label 9We plot the value of objective function (Equation 2), which is equal to the negative of attack loss, against the BayesOpt iterations/query counts.
Revised: We illustrate this via the case of attacking a CIFAR10 image of label 9(class truck) on the other 9 target labels with original label 9We plot the value of objective function (Equation 2), which is equal to the negative of attack loss, against the BayesOpt iterations/query counts.

Original: We can see that our additive GP surrogate (ADDGP-BO) as well as the Bayesian learning of optimal d r (GP-BOauto- d r ) lead to faster convergence and thus higher attack success rate for this instance.
Revised: We can see that our additive GP surrogate (ADDGP-BO) as well as the Bayesian learning of optimal d r (GP-BOauto- d r ) lead to faster convergence and thus higher attack success rate for this instance.

Original: D E FFECTIVENESS OF D ECOMPOSITION L EARNING
Revised: E E FFECTIVENESS OF D ECOMPOSITION L EARNING

Original: [Table] To learn the decomposition for the additive-GP surrogate in ADDGP-BO attack, we follow the approach proposed in (Kandasamy et al., 2015) to treat the decomposition as an additional hyperparameter and learn the optimal decomposition by maximising marginal likelihood.
Revised: To learn the decomposition for the additive-GP surrogate in ADDGP-BO attack, we follow the approach proposed in (Kandasamy et al., 2015) to treat the decomposition as an additional hyperparameter and learn the optimal decomposition by maximising marginal likelihood.

Original: However, exhaustive search over all M !
Revised: However, exhaustive search over all M !

Original: d ! / ( d s !
Revised: d ! / ( d s !

Original: M ) 4 possible decompositions is expensive.
Revised: M ) 5 possible decompositions is expensive.

Original: We adopt a computationally cheap alternative by randomly selecting 20 decompositions and choosing the one with  the largest marginal likelihood.
Revised: We adopt a computationally cheap alternative by randomly selecting 20 decompositions and choosing the one with [Table] [Table] the largest marginal likelihood.

Original: The method decomposition learning procedure is repeated every
Revised: The method decomposition learning procedure is repeated every

Original: BO iterations and we use M = 12 for CIFAR10.
Revised: BO iterations and we use M = 12 for CIFAR10.

Original: We denote the method as ADDGP-BO-LD in this section but as ADDGP-BO in the rest of the paper.
Revised: We denote the method as ADDGP-BO-LD in this section but as ADDGP-BO in the rest of the paper.

Original: We also experiment with another alternative way to learn the decomposition (ADDGP-BO-FD), which is similar to importance sampling in ZOO.
Revised: We also experiment with another alternative way to learn the decomposition (ADDGP-BO-FD), which is similar to importance sampling in ZOO.

Original: We group the pixels/dimensions together if the magnitude of average change in their pixel values over the past 5 BO iterations are closer (i.e. pixels that are subject to the most large adversarial perturbations are grouped together).
Revised: We group the pixels/dimensions together if the magnitude of average change in their pixel values over the past 5 BO iterations are closer (i [Table] e. pixels that are subject to the most large adversarial perturbations are grouped together).

Original: Again, we divide the dimensions into disjoint 12 groups as above to ensure fair comparison.
Revised: Again, we divide the dimensions into disjoint 12 groups as above to ensure fair comparison.

Original: [Figure] [Table] 
Revised: [Table] [Figure]

Original: We compare the both types of decomposition learning methods using 20 randomly selected CIFAR10 images, each of which is attacked on 9 other classes except its original class and a query budget of 1000. The results are shown in Table 5. It is evident that learning decomposition by maximising marginal likelihood (ADDGP-BO-LD) can achieve higher attack success rate than pixelvalue-change-based decomposition learning (ADDGP-BO-FD) given the query budget [Table]
Revised: objective value indicates successful attack.

Original: E E XPERIMENTS ON I MAGE N ET
Revised: ADDGP-BO and GP-BO-auto-

Original: To verify the feasibility/applicability of using BayesOpt to perform targeted attacks on ImageNet, we select 32 correctly classiﬁed images from the ImageNet and perform random targeted attacks with a query budget of 2000. We adopt a hierarchical decoding process: 1) ﬁrst performance BayesOpt(ADDGP-BO) on a reduced dimension of d r 1 = 48 × 48 × 3 and then 2) decode the adversarial perturbation found in d r 1 to d r 2 = 96 × 96 × 3 via bilinear upsampling.
Revised: d r enjoy faster convergence and thus higher attack success rates than simple GP-BO.

Original: This is followed by another bilinear decoder projecting the adversarial perturbation in d r 2 back to image dimension of d = 299 × 299 × 3 . The performance of our proposed ADDGP-BO is compared against GenAttackwith the same upsampling
Revised: We compare the both types of decomposition learning methods using 20 randomly selected CIFAR10 images, each of which is attacked on 9 other classes except its original class and a query budget of 1000.

Original: and the results are shown in Table 6 below.
Revised: The results are shown in Table 6.

Original: Similar to the cases of

Original: MNIST and CIFAR10, ADDGP-BO achieves signiﬁcantly higher (an increase of 59% ) ASR while obtaining successful adversarial perturbations with lower average L 2 perturbation (14 % less) than GenAttack. As shown in Figure 5, ADDGP-BO only takes 1797 queries to achieve 78% ASR on these ImageNet images but GenAttack takes a budget of 4711 queries, which is 2.6 time than that of ADDGP-BO, to achieve  the same ASR.
Revised: It is evident that learning decomposition by maximising marginal likelihood (ADDGP-BO-LD) can achieve higher attack success rate than pixelvalue-change-based decomposition learning (ADDGP-BO-FD) given the query budget.

Original: F G AUSSIAN P ROCESSES
Revised: F G AUSSIAN P ROCESSES

Original: Gaussian processes (GPs) are popular models for inference in regression problems, especially when a quantiﬁcation of the uncertainty around predictions is of relevance and little prior information is available to the inference problem.
Revised: Gaussian processes (GPs) are popular models for inference in regression problems, especially when a quantiﬁcation of the uncertainty around predictions is of relevance and little prior information is available to the inference problem.

Original: These qualities, together with their analytical tractability, make them the most commonly used surrogate model in Bayesian optimisation.
Revised: These qualities, together with their analytical tractability, make them the most commonly used surrogate model in Bayesian optimisation.

Original: A comprehensive overview on GPs can be found in Rasmussen & Williams (2006).
Revised: A comprehensive overview on GPs can be found in Rasmussen & Williams (2006).

Original: Below we highlight the concepts of marginal likelihood and how to use it for hyperparameter optimisation and model selection based on the notation introduced in Section 4.2.
Revised: Below we highlight the concepts of marginal likelihood and how to use it for hyperparameter optimisation and model selection based on the notation introduced in Section 4.2.

Original: Hyperparameter tuning.
Revised: Hyperparameter tuning.

Original: The key to ﬁnding the right hyperparameters θ ∗ in light of D t − 1 in a principled way is given by the marginal likelihood in Equation (10).
Revised: The key to ﬁnding the right hyperparameters θ ∗ in light of D t − 1 in a principled way is given by the marginal likelihood in Equation (10).

Original: [Equation]
Revised: [Equation]

Original: where we have introduced a slightly augmented notation of K 1: t − 1 ≡ K 1: t − 1 ( θ ) to highlight the dependence on the kernel hyperparamaters θ .
Revised: where we have introduced a slightly augmented notation of K 1: t − 1 ≡ K 1: t − 1 ( θ ) to highlight the dependence on the kernel hyperparamaters θ .

Original: In a truly Bayesian approach, one could shy away from ﬁxing one set of hyperparameters and use Equation (10) to derive a posterior distribution of θ based on one’s prior beliefs about θ expressed through some distribution p 0 ( θ ) .
Revised: In a truly Bayesian approach, one could shy away from ﬁxing one set of hyperparameters and use Equation (10) to derive a posterior distribution of θ based on one’s prior beliefs about θ expressed through some distribution p 0 ( θ ) .

Original: However, as such an approach generally requires sampling using methods like Markov chain Monte Carlo (MCMC) due to intractability of integrals, in practice it is often easier and computationally cheaper to replace the fully Bayesian approach by a maximum likelihood approach and simply maximise the likelihood p ( D t − 1 | θ ) w.r.t.
Revised: However, as such an approach generally requires sampling using methods like Markov chain Monte Carlo (MCMC) due to intractability of integrals, in practice it is often easier and computationally cheaper to replace the fully Bayesian approach by a maximum likelihood approach and simply maximise the likelihood p ( D t − 1 | θ ) w.r.t.

Original: θ .
Revised: θ .

Original: We follow this approach and perform a mix of grid- and gradient based search to maximise the logarithm of the r.h.s.
Revised: We follow this approach and perform a mix of grid- and gradient based search to maximise the logarithm of the r.h.s.

Original: of Equation (10).
Revised: of Equation (10).

Original: After evaluating a grid of 5 (cid:48) 000 points, we start gradient ascent on each of the 5 most promising points using the following equation for the gradient (Rasmussen & Williams, 2006) to ﬁnd the hyperparameters θ ∗ which maximise the marginal likelihood:
Revised: After evaluating a grid of 5 (cid:48) 000 points, we start gradient ascent on each of the 5 most promising points using the following equation for the gradient (Rasmussen & Williams, 2006) to ﬁnd the hyperparameters θ ∗ which maximise the marginal likelihood:

Original: [Equation]
Revised: [Equation]

Original: Model selection.
Revised: Model selection.

Original: Once the optimal hyperparameters θ ∗ are found as described above, they can be plugged back into Equation (10) to choose amongst different models.
Revised: Once the optimal hyperparameters θ ∗ are found as described above, they can be plugged back into Equation (10) to choose amongst different models.

Original: In Section 4.4 this is described for the case of choosing between different values of the reduced dimensionality d r .
Revised: In Section 4.4 this is described for the case of choosing between different values of the reduced dimensionality d r .