BOSH: A N E FFICIENT M ETA A LGORITHM FOR D ECISION - BASED A TTACKS
Anonymous authors
Paper under double-blind review
A BSTRACT
Adversarial example generation becomes a viable method for evaluating the robustness of a machine learning model.
In this paper, we consider hard-label blackbox attacks (a.k.a.
decision-based attacks), which is a challenging setting that generates adversarial examples based on only a series of black-box hard-label queries.
This type of attacks can be used to attack discrete and complex models, such as Gradient Boosting Decision Tree (GBDT) and detection-based defense models.
Existing decision-based attacks based on iterative local updates often get stuck in a local minimum and fail to generate the optimal adversarial example with the smallest perturbation.
To remedy this issue, we propose an efﬁcient meta algorithm called BOSH-attack, which tremendously improves existing algorithms through Bayesian Optimization (BO) and Successive Halving (SH).
In particular, instead of traversing a single solution path when searching an adversarial example, we maintain a pool of solution paths to explore important regions.
We show empirically that the proposed algorithm converges to a better solution than existing approaches, while the query count is smaller than applying multiple random initializations by a factor of 10 .
I NTRODUCTION
It has been shown that machine learning models, including deep neural networks, are vulnerable to adversarial examples (Goodfellow et al., 2014;
Szegedy et al., 2013; Chen et al., 2017a).
Therefore, evaluating the robustness of a given model becomes crucial for security sensitive applications.
In order to evaluate the robustness of deep neural networks, researchers have developed “attack algorithms” to generate adversarial examples that can mislead a given neural network while being as close as possible to the original example (Goodfellow et al., 2014; Moosavi-Dezfooli et al., 2016;
Carlini & Wagner, 2017b; Chen et al., 2017b).
Most of these attack methods are based on maximizing a loss function with a gradient-based optimizer, where the gradient is either computed by back-propagation (in the white-box setting) or ﬁnite-difference estimation (in the soft-label blackbox setting).
Although these methods work well on standard neural networks, when it comes to complex or even discontinuous models, such as decision trees and detection-based defense models, they cannot be directly applied because the gradient is not available.
Hard-label black-box attacks, also known as decision-based attacks, consider the most difﬁcult but realistic setting where the attacker has no information about the model structure and parameters, and the only valid operation is to query the model to get the corresponding decision-based (hard-label) output (Brendel et al., 2017).
This type of attacks can be used as a “universal” way to evaluate robustness of any given models, no matter continuous or discrete.
For instance, Cheng et al.
Chen et al.
(2019a) have applied decision-based attacks for evaluating robustness of Gradient Boosting Decision Trees (GBDT) and random forest.
Current decision-based attacks, including Brendel et al.
; Cheng et al.
; Chen et al.
(2019b)
; Cheng et al.
(2019), are based on iterative local updates – starting from an initial point on the decision surface, they iteratively move the points along the surface until reaching a local minimum (in terms of distance to the original example).
The update is often based on gradient estimation or some other heuristics.
However, the local update nature makes these methods sensitive to the starting point.
As we demonstrate in Figure 1(a), the perturbation of converged adversarial examples for a neural network are quite different for different initialization conﬁgurations, and this phenomenon becomes more severe when it comes to discrete models such as GBDTs (see Figure 1(b)).
This makes decision-based attacks converge to a sub- optimal perturbation.
As a result, the solution cannot really reﬂect the robustness of the targeted model.
To overcome these difﬁculties and make decision-based attacks better reﬂect the robustness of models, we propose a meta algorithm called BOSH-attack that consistently boosts the solution quality of existing iterative local update based attacks.
Our main idea is to combine Bayesian optimization, which ﬁnds solution closer to global optimum but suffers from high computation cost, with iterative local updates, which converges fast but often get stuck in local minimum.
Speciﬁcally, given a decision based attack A , our algorithm maintains a pool of solutions and at each iteration we run A for m steps on each solution.
The proposed Bayesian Optimization resampling (BO) and Successive
Halving (SH) are then used to explore important solution space based on current information and cut out unnecessary solution paths.
Our contributions are summarized below:
We conduct thorough experiments to show that current decision-based attacks often converge to a local optimum, thus further improvements are required.
Based on the idea of Bayesian optimization and successive halving, we design a meta algorithm to boost the performance of current decision-based attack algorithms and encourage them to ﬁnd a much smaller adversarial perturbation efﬁciently.
Comprehensive experiments demonstrate that BOSH-attack can consistently boost existing decision-based attacks to ﬁnd better examples with much smaller perturbation.
In addition to the standard neural network models, we also test our algorithms on attacking discrete GBDT models and detector-based defense models.
Moreover, our algorithm can reduce the computation cost by 10x compared to the naive approach.
B ACKGROUND AND R ELATED WORK
Given a classiﬁcation model F : R d → { 1 , . . .
, C } and an example x 0 , adversarial attacks aim to ﬁnd the adversarial example that is closest to x 0 .
For example, an untargeted attack aims to ﬁnd the minimum perturbation to change the predicted class, which corresponds to the following optimization problem:
[Equation]
Exactly minimizing (1) is usually intractable; therefore, we can only expect to get a feasible solution of (1) while hoping (cid:107) δ (cid:107) to be as small as possible.
White-box Attack.
For neural networks, we can replace the constraint in (1) by a loss function deﬁned on the logit layer output, leading to a continuous optimization problem which can be solved by gradient-based optimizers.
This approach has been used in popular methods such as
FGSM (Goodfellow et al., 2014), C&W attack (Carlini & Wagner, 2017b) and PGD attack (Madry et al., 2017).
All these white-box attacks developed for neural networks assume the existence of the gradient.
However, for models with discrete components such as GBDT, the objective cannot be easily deﬁned and gradient-based white-box attacks are not applicable.
There are few white-box attacks developed for speciﬁc discrete models, such as Mixed Integer Linear Programming (MILP) approach for attacking tree ensemble (Kantchelian et al., 2016).
However, those algorithms are time consuming and require signiﬁcant efforts for developing each model.
Soft-label Black-box Attack Black box setting considers the cases when an attacker has no direct access to the model’s parameter and architecture, and the only valid operation is to query input examples and get the corresponding model output.
In the soft-label black box setting, it is assumed that the model outputs the probability of each label for an input query.
Chen et al.
(2017b) showed that the attack can still be formulated as an optimization problem where the objective function value can be computed while the gradient is unavailable.
Based on this, various zeroth order optimization algorithms have been proposed, including NES-attack (Ilyas et al., 2018a), EAD attack (Chen et al., 2018), bandit-attack (Ilyas et al., 2018b), Autozoom (Tu et al., 2019), Genetic algorithm (Alzantot et al., 2018).
Hard-label Black-box attack Decision-based attack)
In this paper, we focus on the hard-label black box attack (also known as decision-based attack).
In contrast to the soft-label setting, the attacker can only query the model and get the top-1 predicted label without any probability information.
To minimize the perturbation in the decision-based setting, Brendel et al.
ﬁrst proposed a Boundary Attack based on random walk on the decision surface.
Later on, Cheng et al.
(2018) showed that hard-label attack can be reformulated as another continuous optimization problem, and zeroth order optimization algorithms such as NES can be used to solve this problem.
Cheng et al.
(2019) further reduces the queries by only calculating the sign of ZOO updating function, and Chen et al.
(2019b) proposed another algorithm to improve over boundary attack.
Such methods can converge quickly but suffer from local optimum problems, and thus require more careful and thorough search in the solution space.
Probability based black-box optimization There are two commonly used methods to solve a black-box or non-differentiable optimization problem: gradient-based and probabilistic-based algorithms.
Gradient-based methods are based on iterative local updates until convergence, while probabilistic-based algorithms such as Bayesian optimization (BO) (Pelikan et al., 1999; Snoek et al., 2012) approximate the objective function by a probabilistic model.
Generally speaking, gradient-based methods are commonly used in black-box attack because it converges fast.
However, these methods often stuck in some local optimal directions, especially when the searching space is high dimensional and non-convex.
Probabilistic-based algorithms are frequently used in low-dimensional problems such as hyperparameter tuning and can have a better chance to ﬁnd more global optimal values (Snoek et al., 2012; Bergstra et al., 2011).
However, the computation cost grows exponentially while the dimension increases and quickly become unacceptable.
Therefore, they cannot be directly applied to generate adversarial examples.
In this paper, we attempt to combine Bayesian Optimization and iterative local updates to improve the solution quality of current attack algorithms while being able to scale to high dimensional problems.
Combinatorial heuristic and genetic algorithms There exist various heuristic algorithms commonly applied to combinatorial optimization problems.
In these algorithms, they try to leverage the effects between greedy and random.
Commonly, they will search for different directions and drop the bad ones, and then put more attention on the relatively good candidates.
Greedy randomized adaptive search (Feo & Resende, 1995) ﬁnds good solutions in an iterative way.
It ﬁrst generates a set of solutions and use a greedy function to rank these solutions. Later, good candidates are placed in a restricted candidate list, and randomly chosen when forming the solution. Tabu search (Glover & Laguna, 1999) selects a candidate and checks its immediate neighbors, trying to ﬁnd an improved solution. In order to avoid stucking in local optimal areas, it maintains a list called tabu list to store past good solutions (often local optimal solutions).
In further searches, it will prevent from looking for this areas.
Other approaches like Genetic Algorithms (GA) and Simulated Annealing (SA) also try to adopt random in the searching process.
In this paper, we simply use Successive Halving (SH) (Jamieson & Talwalkar, 2016) to remove unimportant candidate conﬁgurations iteratively.
The details can be found in Section 3.1.
T HE P ROPOSED A LGORITHM
Observation: Decision based attacks are easily stuck in local optimum.
Most existing adversarial attacks adopt iterative local updates to ﬁnd adversarial examples – starting from an initial point, they iteratively update the solution until convergence.
For example, in white-box attacks such as C&W and PGD methods, they aim at optimizing a non-convex loss function by iterative gradient updates.
In Figure 1(a), we plot the 2-dimensional projection of the decision surface of a neural network.
We can observe that there are two local minimums 1 .
Results show that there are two local minimums and the attack algorithm converges to one of them according the the initialization region.
Similarly, in decision-based attacks, existing methods start from some point on the decision surface and then iteratively update the point locally on the surface either by gradient update (Cheng et al., 2018; Chen et al., 2019b) or random walk (Brendel et al., 2017).
In Figure 1(b) we plot the decision surface of a GBDT.
We observe a similar issue that there are many local minima in the GBDT decision boundary.
[Figure]
We further quantify how serious the problem is.
On an MNIST network, Figure 2(a) shows the distribution of converged adversarial perturbations of C&W attack (white-box attack) and SignOPT attack (decision-based attack) under approximately 400 random initial points.
We observe that the converged solutions of C&W attack are quite concentrated between [1 . 41 , 1 . 47] .
However, when considering decision-based attack such as Sign-OPT, the converged solutions are widely spread from 1.36 to 1.55.
In general, our experiments suggested that decision based attacks are much more sensitive to initialization .
This is because they only update solutions on the decision boundary while C&W and PGD attack can update solution inside/outside the boundary.
Furthermore, such phenomenon is obvious when the victim model is GBDT.
For example, in Figure 2(b) we can see the converged solution spread from 0.5 to 1.5 when applying Sign-OPT attack.
Therefore, the solution of any single run of Sign-OPT on GBDT cannot really reﬂect the minimum adversarial perturbation of the given model, and thus it is crucial to design an algorithm that converges to a better solution.
Since the phenomenon is more severe for decision based attacks, we will mainly focus on improving the quality of decision based attacks in this paper, while in general our method can also be used to boost the performance of white-box attacks marginally, as illustrated in
Appendix A.
[Figure]
i s t o r t
i o n (c) Distortion vs Queries curves.
3. A G ENERAL M ECHANISM FOR I MPROVED D ECISION B ASED A TTACK
Given a local update based attack A , our goal is to ﬁnd a solution with improved quality.
To this end, we propose a meta algorithm to address this issue by integrating probability-based (Bayesian) blackbox optimization with iterative local updates.
As shown in Algorithm 1, our algorithm maintains a candidate pool P a that stores all the active conﬁgurations, where each conﬁguration u ∈ P a is an intermediate iterate of algorithm A .
Also, we assume that there is an attack objective C such that C ( u ) measures the quality of the solution.
For decision based attacks, the goal is to ﬁnd the optimal direction to minimize the distance to the boundary along that direction (Cheng et al., 2018).
Therefore, u is the direction of adversarial perturbation and
[Equation]
where y 0 is the correct label.
This can be computed by a ﬁne-grained plus binary search procedure (see Cheng et al.
(2018)), and
in fact, in most of the algorithms C ( u ) is directly maintained during[-Algorithm 
 The proposed BOSH attack framework.-] the optimization procedure (Brendel et al., 2017; Cheng et al., 2019).
At each iteration, we run m iterations of A on each active conﬁguration u ∈ P a to get the improved conﬁgurations.
Then we conduct the following two operations to reduce the candidate pool size and to resample new conﬁgurations to explore important subspace based on Bayesian optimization.
We discuss each step in details as below.
Successive Halving (SH) to cut unimportant candidate conﬁguration.
After updating each candidate by m iterations, we compute the objective function value of each candidate and discard the worst half of them.
Iteratively reducing the candidate set into half accelerates the algorithm, while still maintaining an accurate solution pool.
This idea has been used in hyperparameter search (Jamieson & Talwalkar, 2016) but has not been used in adversarial attack.
Bayesian Optimization (BO) for Guided Resampling.
To introduce variance in the intermediate steps and explore other important region, we propose a guided resampling strategy to reﬁne the candidate pool.
The general idea is to resample from the solution space in the middle step based on the knowledge acquired before and focus on promising subareas.
Speciﬁcally, we use a Bayesian optimization method called Tree Parzen Estimator (TPE) (Bergstra et al., 2011) to resample new conﬁgurations.
In order to do resampling, we maintain another pool P s that stores all the previous iterations performed including the cutted ones, since all the information will be useful for resampling.
As shown in Algorithm 2, we ﬁrst divide the observed data in P s into worse and better parts based on the associated objective function value.
We then train two separate Kernel Density Estimators (KDE) denoted as l ( · ) and g ( · ) on these two subsets.
[Equation]
The parameter α is set to 20%, which ensures the better part l ( u ) has 20% of conﬁgurations in P s and the worse part g ( u ) has the remaining 80%, relatively.
Later, we sample new data with the minimum value of l ( · ) /g ( · ) , which can be proved to have maximum relative improvement in
Equation 4 (see more information in Appendix B).
Since we can not directly ﬁnd such points, we sample for a few times (the number is set to 100 during the experiment) from l ( · ) and keep the one with the minimal l ( · ) /g ( · ) . {+Algorithm 
 The proposed BOSH attack framework. in P a with u (cid:48) t .+}
// Update the conﬁguration in P a 9:
Delete the worst s % of conﬁgurations from P a 10:
P a ← P a ∪ TPE-resampling( P s , | P a | ∗ s % ) 11: M ← M · (1 + m )% . // Increase the searching interval The reason we use TPE for resampling is that the computational cost grows linearly with the number of data points in P s .
In comparison, traditional Bayesian optimization method like Gaussian Process (GP) will require cubic-time to generate new points.
Therefore, TPE is more suitable for high dimensional problems.
In the experiments we ﬁnd that the ﬁnal best conﬁguration mostly comes from resampling, instead of the set of starting conﬁgurations.
This proves the effectiveness of resampling during search, the quantitative results will be shown in Section 4.2.
E XPERIMENTS
We conduct experiments on various models and datasets to verify the efﬁciency and effectiveness of the proposed approach.
We try to enhance the performance of decision-based attack on image classiﬁcation tasks like MNIST, CIFAR-10 and ImageNet, and also conduct experiments on tree model like GBDT and detection model like LID.
Furthermore, we demonstrate that our meta-algorithm is also able to improve existing white-box attacks.
4. D ECISION - BASED ATTACK ON NEURAL NETWORKS
We conduct experiments on three standard datasets: MNIST (LeCun et al., 1998), CIFAR-
(Krizhevsky et al., 2010) and ImageNet-1000 (Deng et al., 2009).
The neural network model architecture is the same with the ones reported in Cheng et al.
(2018): for both MNIST and CIFAR we use the network with four convolution layers, two max-pooling layers and two fully-connected layers, which achieve 99.5% accuracy on MNIST and 82.5% accuracy on CIFAR-10 as reported in (Carlini & Wagner, 2017b; Cheng et al., 2018).
For ImageNet, we use the pretrained Resnet-50 (He et al., 2016) network provided by torchvision (Marcel & Rodriguez, 2010), which achieves a Topaccuracy of 76.15%.
We randomly select 100 examples from test sets for evaluation.
The parameters of the proposed algorithms can be found in Table 6 in Appendix D.
Improved solution quality of existing methods We compare the solution quality of the proposed algorithm with three existing decision-based attack methods: Boundary attack (Brendel et al., 2017),
OPT-attack (Cheng et al., 2018) and Sign-OPT attack (Cheng et al., 2019) on MNIST, CIFARand ImageNet data sets.
For our algorithm, we use Sign-OPT attack as the base algorithm and set k = 30 for the initial candidate pool.
The average L 2 perturbation of our method and baselines are presented in Table 8.
Note that all the decision based attacks maintain intermediate iterates on the decision boundary, so they always output a successful attack.
The main comparison is the average
L 2 perturbation to alter the predictions.
We also follow Cheng et al.
(2018) to report Attack Success
Rate (ASR) by calculating ratio of adversarial examples with perturbation < (cid:15) ( (cid:15) is chosen based on different tasks).
The results show that can help decision-based attacks achieve lower L 2 perturbation and higher attack success rate.
The detailed analysis is shown in the next section.
The proposed algorithm can also be used to boost the performance of other decision based attacks.
Table 7 in the Appendix demonstrates that the proposed algorithm consistently improves the Lperturbation and success rate of Boundary attack and OPT-attack.
[Table]
A NALYSIS
We then conduct a study to test each component of our algorithm and compare with the baselines
[Table] The experiment is done on MNIST data using Sign-OPT attack as the base attack method.
The results are summarized in Table 2.
[Table]
Comparison with naive mulitple initialization approach.
A naive way to improve the solution quality of existing attack is to run the attack on multiple random initialization points.
This strategy has been used in white-box attack 3 and is also applicable to the decision based attacks.
We compare
Sign-OPT with 30, 50, 100 initial points and the proposed BOSH boosted Sign-OPT approach in
Table 2.
The results demonstrate that successive halving requires much less queries than naively running multiple initial conﬁgurations.
Due to resampling, the proposed approach converges to a better solution under the same initial pool size.
For example, to achieve average 0 .
91 L 2 perturbation,
BOSH boosted Sign-OPT requires 10 times less queries than multi-initial Sign-OPT.
Size of the initial pool.
The size of initial pool (denoted by k in our algorithm) is an important parameter.
Table 2 shows that increasing k only has a marginal effect after k ≈ 30 .
When introducing cutting and resampling mechanism into the Sign-OPT attack, the ﬁnal best perturbation is less sensitive to the number of starting directions, which means that resampling tend to make the search less dependent on the starting directions.
Detailed discussion is in Appendix C.
Effect of successive halving and TPE resampling.
We study the effect of these two components separately.
As shown in Figure 3(a), the approach of successive halving keeps throwing away the worse s percent of conﬁgurations until converge during a speciﬁc interval until there is only one sample left.
When combining this with resampling, as in Figure 3(b), our algorithm ﬁnds directions that are better than original ones.
We observed emperically that the ﬁnal best direction often comes from resampling instead of the original starting directions.
This observation demonstrates the importance of resampling in the intermediate steps.
Furthermore, Table 2 shows that combining Sign-OPT with successive halving (second column) has worse solutions compared with BOSH Sign-OPT.
This indicates that resampling is important for getting a better solution.
[Figure]
What is the best cutting interval?
The parameter M decides how many iterations are applied using base attacker before the next cutting/resampling stage.
This is an important parameter to be tuned.
If M is too small, some solution paths will be wrongly throwing away; while if M is too large, the whole procedure requires a large number of queries.
In our experiment, we use a subset of images to tune this parameter and ﬁnd that the images in the same dataset often share similar best cutting interval.
This reduces lots of unnecessary computations.
The parameters for different datasets are shown in Appendix D.
4. D ECISION - BASED ATTACK ON OTHER MODELS
We conduct untargeted attack on gradient boosting decision tree (GBDT).
Since Sign-OPT does not include the experiment with GBDT, we use the OPT-based attack (Cheng et al., 2018) and apply our meta algorithm on top of it.
We consider two datasets, MNIST and HIGGS, and use the same models provided by (Cheng et al., 2018).
We compare the average L 2 perturbation and the attack success rate in Table 3.
The results show that the proposed method signiﬁcantly boosts the performance of OPT attack.
The overall improvement is more signiﬁcant than attacking neural networks.
This is mainly because that the decision boundary of GBDT contains more local minima than neural networks, as plotted in Figure
[Table] [Table]
[Table]
4.3. D ECISION - BASED ATTACK ON D ETECTION MODELS
To improve the performance of neural networks, a line of research, such as KD+BU (Feinman et al., 2017), LID (Ma et al., 2018), Mahalanobis (Lee et al., 2018) and ML-LOO (Yang et al., 2019), has been focusing on screening out adversarial examples in the test stage without touching the training of the original model.
Besides comprehensive evaluation of our attack on various classiﬁcation models with a variety of data sets, we carry out experimental analysis of our untargeted attack on one state-of-the-art detection model LID (Ma et al., 2018) on MNIST data set.
To train a detection model on MNIST, we ﬁrst train a simple classiﬁcation network composed of two convolutional layers followed by a hidden dense layer with 1024 units.
Then we apply C&W attack to this model to generate adversarial examples from the original test samples.
Finally we train LID detectors with the original test samples and adversarial examples we have generated with the standard train/test split.
The state-of-the-art detection model LID achieves 0 .
99 test accuracy.
C&W high conﬁdence attack (Carlini & Wagner, 2017a) has been shown to have great performance in attacking various detection models.
So we compare the average L 2 perturbation and attack success rate of three attacking methods C&W high conﬁdence attack, Sign-OPT attack and BOSH Sign-OPT attack in Table 4.
At each query, we deﬁne the attack to be successful if it fools both the detector model and the original model.
The results show that the proposed method can signiﬁcantly boost the performance of the Sign-OPT attack and it achieves much better performance than C&W high conﬁdence attack.
C ONCLUSION
In this paper, we propose a meta algorithm to boost the performance of existing decision based attacks.
In particular, instead of traversing a single solution path when searching for an adversarial example, we maintain a pool of solution paths to explore important regions.
We show empirically that the proposed algorithm consistently improves the solution quality of many existing decision based attacks, and can obtain adversarial examples with improved quality on not only neural networks, but also other decision based models, such as GBDT and detection-based models
A. R ESULTS
Although we focus on decision based attack throughout the paper, the proposed method can actually also boost the performance of white-box attacks.
We use C&W attack (Carlini & Wagner, 2017b) as the base method and perform experiments on MNIST and CIFAR-10 datasets.
In order to introduce variance and encourage the model to ﬁnd better and global optimal values, we randomly samplepoints inside the L 2 (cid:15) ball (we use (cid:15) = 0 .
3 during the experiment) as the starting points, and apply
C&W attack on each of them.
For simplicity, we ﬁx c described in (3) to be 0.2.
The results before and after applying our algorithm are shown in Table 5.
We can observe that although our algorithm can also improve C&W attack, the improvements are not as signiﬁcant as that in decision based attacks.
This is probably because C&W attack is less sensitive to the initial point, as demonstrated in Figure 2(a).
[Table]
B B AYESIAN O PTIMIZATION AND S UCCESSIVE H ALVING B. B AYESIAN O PTIMIZATION (BO)
Bayesian Optimization (BO) has been successfully applied to optimize a function which is nondifferentiable or black-box like ﬁnding the hyper-parameters of neural networks in AutoML area.
It mainly adopts the idea to sample new points based on the past knowledge.
Basically, Bayesian optimization ﬁnds the optimal value of a given function f : X → R in a iterative manner: at each iteration i, BO uses a probabilistic model p ( f |D ) to estimate and approach the unknown function f based on the data points that are already observed by the last iterations.
Speciﬁcally, it samples new data points x t = argmax x u ( x |D 1: t − 1 ) where u is the acquisition function and D 1: t − 1 = { ( x 1 , y 1 ) , . . .
, ( x t − 1 , y t − 1 ) } are the t − 1 samples queried from f so far.
The most widely used acquisition functions is the expected improvement (EI):
[Equation]
Where f ( x + ) is the value of the best sample generated so far and x + is the location of that sample, i.e. x + = arg max x i ∈D f
( x i ) .
B. T HE T REE P ARZEN E STIMATOR (TPE).
The Tree Parzen Estimator (TPE).
TPE (Bergstra et al., 2011) is a Bayesian optimization method proposed to solve the hyper-parameter tuning problems that uses a kernel density estimator (KDE) to approximate the distribution of D instead of trying to model the objective function f directly.
Speciﬁcally, it models the p ( x | y ) and p ( y ) instead of p ( y | x ) , and deﬁne p ( x | y ) using two separate
KDE l ( x ) and g ( x ) :
[Equation]
where α is a constant between the lowest and largest value of y in D .
Bergstra et al.
(2011) shows that maximizing the radio l ( x ) /g
( x ) is equivalent to optimizing the EI function described in Equation 4 (see Theorem 1 for more detail).
In such setting, the computational cost of generating a new data point by KDE grows linearly with the number of data points already generated, while traditional
Gaussian Process (GP) will require cubic-time.
Theorem 1 In Equation 5, maximizing the radio l ( x ) /g
( x ) is equal to optimizing the Expected
Improvement (EI) in Equation
Proof:
The Expected Improvement can also be written as:
[Equation]
Assume that γ = p ( y < α ) , then:
[Equation]
Therefore,
[Equation]
So ﬁnally,
[Equation]
Which means maximizing l ( x ) /g
( x ) is equivalent to maximize the EI function.
B. S UCCESSIVE H ALVING .
Successive Halving.
The idea behind Successive Halving (Jamieson & Talwalkar, 2016) can be easily illustrated by it’s name: ﬁrst initialize a set of conﬁgurations and perform some calculations on them, then evaluate the performance of all conﬁgurations and discard the worst half od these conﬁgurations, this process continues until there is only one conﬁguration left.
BOHB (Falkner et al., 2018) combines HyperBand (derived from Successive Halving)
(Li et al., 2016) and TPE to solve the AutoML problem and achieve greate success.
However, these methods are originally applied to the hyper-parameter tuning problem where the parameters need to be searched are not too much(approximately 10-20), it will suffer from ”dimensional curse” when the number of parameters grows larger and the computation cost needed will be unacceptable.
There are already some work (Moriconi et al., 2019; Wang et al., 2013) try to use BO in high dimension, while we still found in experiment that simply use BO can not converge as good as gradient-based methods.
C D ISCUSSION ABOUT THE NUMBER OF STARTING DIRECTIONS
[Figure]
We discuss the problem that how many starting points are enough for a successful attack.
In order to ﬁnd the best number of starting points, we conduct attack on an image with different number of starting directions, for a speciﬁc number of starting directions, we also run several times and average the result to reduce variance.
Figure 5 shows the attack on MNIST image using Sign-OPT method, we can see the effect that the number of starting direction have on the ﬁnal converging perturbation.
Also, We can ﬁnd that the standard deviation is smaller and the ﬁnal perturbation is lower when resampling by TPE is introduced.
This is probably because TPE resampling also introduce variance in the middle step and making the algorithm not completely depends on the starting directions, this will also helps increase the probability to ﬁnd a better optimal value .
D P ARAMETERS OR D IFFERENT D ATASETS
[Table]
E B OOSTING D ECISION - BASED A TTACK A LGORITHMS
To demonstrate that our algorithm can consistently boost existing hard-label attack algorithms, we try to enhance the performance of three decision-based algorithms described in Section 4.1.
All the parameters are equal to Section 4.1 and we use 30 starting directions for our boosting algorithm.
The results are shown in Table
[Table] [Table]
F R UN - TIME COMPARISON
We evaluate the efﬁciency of various algorithms based on the number of queries, it is commonly used in the papers of this area.
In this section we also include the run-time performance comparison of these methods.
{+We use one Nvidia GTX 
+}
Ti to conduct the experiments, but the run-time will reduce if we use multiple GPUs since our boosting algorithm can be easily parallelize (searches with different directions do not depend on each other)
[Table]
[Table]
G A TTACK S UCCESS R ATE UNDER DIFFERENT P ERTURBATION (cid:15)
In this section, we show the results of Sign-OPT and Boosted Sign-OPT attack on MNIST and
CIFAR-10 dataset.
We mainly show how Attack Success Rate (ASR) changes based on different perturbations.
[Figure]
H T IME C OMPLEXITY A NALYSIS
We brieﬂy analyse the number of queries our algorithm need regarding the parameters we mentioned in Algorithm 1.
Generally speaking, in ﬁrst several cutting intervals (we consistently set to 3 in the experiments), our boosting algorithm requires about k times more queries than single search.
This is because we resample new conﬁgurations while cutting unpromising one.
After this, we only cut and do not resample, and run until there is only one conﬁguration left and it converges.
As discussed in Algorithm 1, assume that the cutting interval is M , cutting rate is s , cutting interval increase rate is m and initial number of starting conﬁgurations is k .
In the cutting and resampling phase, since we only resample 3 times, we need:
[Equation]
) queries.
After that, we only cut the unpromising conﬁgurations, so we need:
[Equation]
11) queries.
We can see that the main differences between the original and our algorithm is the initial number of staring conﬁgurations k , and we also discuss how k inﬂuences the results in Section 4.2 and
Appendix B.