Towards Lightweight Black-Box Attacks against Deep Neural Networks
Anonymous Author(s)
AffiliationAddress email
Abstract
Black-box attacks can generate adversarial examples without accessing the parameters of target model, largely exacerbating the threats of deployed deep neuralnetworks (DNNs).
However, previous works state that black-box attacks fail tomislead target models when their training data and outputs are inaccessible.
In thiswork, we argue that black-box attacks can pose practical attacks in this extremelyrestrictive scenario where only several test samples are available.
Specifically, wefind that attacking the shallow layers of DNNs trained on a few test samples can generate powerful adversarial examples.
As only a few samples are required, we referto these attacks as lightweight black-box attacks.
The main challenge to promotinglightweight attacks is to mitigate the adverse impact caused by the approximationerror of shallow layers.
As it is hard to mitigate the approximation error with fewavailable samples, we propose Error TransFormer (ETF) for lightweight attacks.
Namely, ETF transforms the approximation error in the parameter space into aperturbation in the feature space and alleviates the error by disturbing features.
In experiments, lightweight black-box attacks with the proposed ETF achievesurprising results.
For example, even if only 1 sample per category available, thesuccess attack rate in lightweight black-box attacks is only about 3% lower thanthat of the black-box attacks with complete training data.
Introduction
Black-box attacks [7, 36, 6] can mount successful attacks without accessing the parameters ofdeep neural networks (DNNs), posing great challenges to deep learning in safety-critical situations.
Existing black-box attack methods assume that the training data and/or the outputs of target modelsare available to adversaries.
For scenarios where training data are available, adversarial examples canbe generated by attacking surrogate models constructed for approximate target models.
Using thetarget models’ outputs for estimating gradients is another practical approach to crafting adversarialexamples.
In general, due to the low dependency on target model information, the black-box attacksraise realistic threats to real-world deep learning systems, including semantic segmentation [3, 22],object detection [9, 28, 27], and automatic driving [35].
However, these assumptions can be violated in many practical scenarios [4, 29], where both thetraining data and the outputs of target models are inaccessible.
This realistic attack scenario isintroduced in [4], generally termed as the no-box setting .
Under such a restrictive setting, Li et al.
[20]states that existing black-box attacks can fail to mislead target models, as the information previouslyconsidered essential in mounting black-box attacks is now inaccessible.
Therein, the failure ofexisting black-box attacks is not surprising.
The reason is that constructing reliable surrogate modelstypically relies on target models’ training data, which is inaccessible in such a restrictive setting withonly a few test samples available.
In this work, we aim to reveal the potential threats of black-box attacks in the no-box setting, asmounting black-box attacks with highly limited accessible information leaves many models exposedto attack.
Specifically, we challenge the previous believes by raising the following question: Canblack-box attacks success in the no-box setting?
The doubts about the potential threats of the blackbox attack are not groundless.
Specifically, the potential threats of black-box attacks stem from twofacts: (a) adversarial examples can be generated by perturbing representations at shallow layers of DNNs [18, 17, 14]; (b) regarding the representation of shallow layers, there do not exist criticaldifferences between those models learned from a few data and that of the whole training data.
Building upon the above facts, it is actually possible that an adversary can successfully mount attacksusing limited samples, as powerful adversarial examples can be generated by attacking the shallowlayers of DNNs trained on few samples.
Concretely, the adversary can leverage available samples toconstruct a surrogate model to approximate the shallow layers of target models within acceptableerrors.
Consequently, adversarial examples can be generated by perturbing the features obtained fromthe shallow layers of the constructed surrogate model.
As merely a few samples are required forattacking, we refer to black-box attacks in the no-box setting as lightweight black-box attacks .
Intuitively, the closer the surrogate model is to the target model, the higher the attack success ratethe crafted adversarial examples have [19].
If the approximation error of shallow layers is alleviated,the lightweight black-box attack can be as powerful as black-box attacks with complete trainingdata.
Hence, the main challenge to mounting a powerful lightweight attack is to mitigate the adverseimpact caused by the approximation error of shallow layers.
However, it is challenging to mitigate the approximation error, especially when the number ofavailable samples is limited.
Fortunately, it is straightforward to identify which kind of perturbationsare preferred: if perturbations applied to a feature contribute to fooling the surrogate model, theperturbation is preferred.
Therefore, bridging the connection between the parameter space and thefeature space is the key to mitigating the approximation error.
Accordingly, we propose transformingthe approximation error in the parameter space as the perturbation in the feature space, dubbedas Error TransFormer (ETF).
Namely, ETF transforms the worst-case approximation error to theworst-case feature perturbation, leading to a min-max scheme that generates adversarial examplesunder the worst feature perturbations.
We verify the attack success rate of lightweight black-boxattacks 7 models trained on the ImageNet dataset [30], and find that existing attack methods are muchpowerful than previous claimed.
Moreover, the performance of lightweight black-box attacks canbe further promoted by the proposed ETF, i.e., the attack success rate is only 3% lower than thatachieved by black-box attacks having complete target model’s training data.
Related works2.1 Adversarial attack
According to the amount of accessible information, existing adversarial attacks can be roughly dividedinto two categories: white-box attacks and black-box attacks.
White-box attacks [10, 25, 24, 2]assume that the target model is transparent to adversaries, i.e., adversaries can access all informationabout the target model.
Nevertheless, the assumption that all information is available to adversariescan be violated in many practical scenarios [6].
Hence, black-box attacks [24, 25, 36, 7] are proposedand applied to the scenario where relatively limited information about the target model is accessible,i.e., only a certain number of model queries or the training data of target tasks are available.
Utilizingthe training data or queries, adversaries generate adversarial examples on the surrogate modelconstructed for approximate target models.
Among these black-box attacks, intermediate-level attacks [31, 18, 14] are widely explored to improvethe adversarial transferability.
The core idea of this attack is based on the empirical observation thatwell-trained models’ intermediate features are transferable [37].
Hence, Inkawhich et al.
[18] proposeto perturb the feature space of neural networks to create more transferable adversarial examples.
Besides, these attacks provides an interesting empirical conclusion that disturbing the shallow layersof DNNs can also generate adversarial examples.
Existing black-box attacks assume that the large-scale training data of target models and the feedbackfrom querying target models are accessible, but these assumptions can be violated in many scenarios,such as no-box setting [4].
Li et al.
[20] state that existing black-box attacks cannot be successfully mounted because existing DNNs require large-scale training data for generalization.
Given onlysmall-size data available, obtaining a surrogate model with strong generalization is challenging.
Hence, Li et al.
propose replacing black-box attacks with their proposed no-box attack [20], wherethey train a classical auto-encoder model instead of the supervised classification model due to theconstraint of a small-scale dataset.
Concretely, they train 20 auto-encoders for each category andgenerate adversarial examples by attacking these auto-encoders.
Instead of proposing a new attack,which is time- and computational-consuming.
2.2 Approximation of Shallow Networks
A recent study [38] confirms the intuition that shallow layers in DNNs can be seen as low-level featureextractors.
Motivated by this observation, Asano et al.
[1] design a method to explore the informationin every layer of DNNs.
Asano et al.
[1] train a supervision model on ImageNet LSVRC-12, and aself-supervision model on a small-scale dataset.
Then, they apply linear probes [40] to all intermediatelayers of networks, where a linear classifier is trained on the top of pre-trained and fixed featurerepresentations.
In this way, they evaluate the quality of the representation learned at different depthsof the networks.
The results show that, given heavily synthetic transformations, the shallow layersof DNNs learned from a few images can approximate that of DNNs trained on millions of images.
According to the intriguing empirical observation, it is possible to construct a surrogate model withlimited samples, where its shallow layers are similar to that of the target models.
Preliminaries
This section defines the no-box threat model and the lightweight black-box attack.
3.1 No-Box Threat Model
The no-box setting [4] denotes a threat model where available information about the target modelis extremely limited, making it challenging to generate adversarial examples.
According to thedescription in [4], the no-box threat model can be defined as follows.
Definition 1 (No-Box Threat Model)
A threat model is called the no-box threat model if the adversary in this scenario is not allowed to access the target model’s training data and outputs, so it hasand only has some samples for attacking that can be correctly predicted with high probability by thetarget model.
The definition is consistent with the no-box setting introduced in [4], where the target model’straining data and outputs are inaccessible to the adversary.
Moreover, the available samples usedfor generating adversarial examples are expected to be limited.
This is because if the number ofsamples is similar to or even larger than the number of samples used for training target models, theadversary can leverage these samples to construct a surrogate model similar to target models, makingthe condition of inaccessible training data meaningless.
It is intuitive that target models can correctlypredict the labels of these available samples with high probability.
For example, it is meaningless toperform attacks using samples misclassified by the target model.
3.2 Lightweight Black-Box Attack
Definition 2 (Lightweight Black-Box Attack)
An attack is called the lightweight black-box attackif an adversary aims to perform an attack in the context of a no-box threat model.
The definition of the lightweight black-box attack shows that lightweight attack is a special kind ofblack-box attacks.
The extremely limited accessible information distinguishes it from other blackbox attacks.
For example, query-efficient black-box attacks require the feedback information oftarget models [15, 16], while lightweight attacks do not.
To our best knowledge, how to perform alightweight black-box attack is still lacking in the literature.
For example, Li et al.
[20] claim thatblack-box attacks fail to fool target models when their training data and outputs are inaccessible, i.e.,in the context of the no-box threat model.
Approach
Generating adversarial examples in the lightweight black-box attacks requires constructing surrogatemodels.
As the training procedure requires limited samples, we refer to these models as lightweightsurrogate models.
After constructing the surrogate model, we can generate adversarial examples byattacking the model in the feature space, i.e., feature space perturbation.
The reason is that usinglimited samples can merely approximate the shallow layers within acceptable errors.
To furtherpromote the performance of lightweight attacks, we propose the Error TransFormer (ETF) to alleviateto adverse impact caused by approximation error.
4.1 Lightweight Surrogate Model
Surrogate models are widely used in black-box attack, as adversarial examples are usually generatedby attack surrogate models when querying target models is forbidden.
Since the lightweight black-boxattack is a special kind of black-box attacks, performing attack requires constructing surrogate models.
We call surrogate models employed in lightweight black-box attacks lightweight surrogate models,considering that the number of samples are usually limited.
Similar to existing black-box attacks, we assume that the label information of samples used forgenerating adversarial examples are accessible.
In this scenario, the lightweight surrogate modelis trained for a classification task.
Specifically, the lightweight model is realized by training aclassification DNN equipped via conventional supervised learning, using cross-entropy loss ℓ ( · , · ) :
[Equation]
) where w stands for the parameters of surrogate models f , ( x, y ) sampled from the dataset
ˆ D denotesthe pair of natural sample and its label y .
In black-box attacks, adversary only leverages the shallow layers of DNNs, leading to a straightforward approach to constructing lightweight surrogate models.
Specifically, we can train the lightweightsurrogate model in a contrastive manner, where the supervised information is no longer necessary:
[Equation]
where σ is a specific similarity metric, e.g., cosine similarity, T denotes the data transformationoperation, and ˆ D \ x means that x is removed from the dataset ˆ D .
4.2 Feature Space Perturbation
Built upon the previous empirical observation, using limited samples can approximate the shallowlayers of DNNs within acceptable errors.
This suggests that layers other than shallow layers cancause large approximation error.
Accordingly, merely the shallow layers of the learned lightweightsurrogate models are used for generating adversarial examples, which is similar to the feature spaceattacks.
For brevity, we define the shallow layers as φ and denote the feature of x obtained by φ asφ ( x ; w ) .
In feature space attacks, guide images are usually required for generating adversarial examples.
Anatural image used for generating adversarial example x adv is usually called source image.
Given asource image x s , we generate an adversarial example x adv by perturbing x s such that its feature issimilar to that of a guide image x g , where the labels of these two images are different.
Specifically,the adversarial examples are generated as follows:
[Equation]
where d stands for a specific distance and ϵ controls the strength of adversarial perturbation.
4.3 Error Transformer
Although applying feature space attacks to lightweight surrogate models can generate transferableadversarial examples, the approximation error will cause adverse impact to the mounting attacks.
The reason is that large dissimilarity between the surrogate models and the target models reducesthe attack success rate.
Therefore, the main challenge to mounting a powerful lightweight attack isto mitigate the adverse impact caused by the approximation error.
However, available samples areusually limited in the no-box threat model, making it hard to alleviate the approximation error.
To address the challenge, we propose to transform the approximation error in the parameter space 181 as the perturbation in the feature space.
The inspiration is borrowed from the feature space attack.
Specifically, it is clear to identify the preferred feature perturbations, i.e., we prefer the perturbations 183 than can contribute to fooling the surrogate model.
Similarly, it is also straightforward to define the“bad” perturbations, which hinder the generation of adversarial examples.
Therefore, connecting 185 the parameter space and feature space makes it possible to mitigate the adverse impact caused byapproximation error.
To bridge the connection, we introduce the following key identity, which is also 187 used in [26]:
[Equation]
where w 1 stands for the first layer parameters of model φ , A is a transformation matrix used forperturbing w 1 , (cid:8) w 1 + w 1 A (cid:9) ∪ (cid:8) w \ w 1 (cid:9) means that the first layer’s parameters are perturbed andthe other layers’ parameters keep the same, and g is the function parameterized with w \ w 1 usedfor processing the first layer’s outputs.
According to Eq. 4.3, we can transform a perturbation inthe parameter space as the perturbation in the data space, i.e., φ ( x ; (cid:8) w 1 + w 1 A (cid:9) ∪ (cid:8) w \ w 1 (cid:9) )
=
φ ( x + Ax ; w ) .
Similarly, we can apply the transformation operation to the hidden layers, see
Appendix for more details.
Built upon the connection in Eq.
4.3, we can transform the first layer parameters’ discrepancy 196 between the target model and the surrogate model.
Taking the first layer as an example, let w t be theparameters of the target model and w 1 t be its first layer parameters, where the other parameters are 198 the same as the surrogate model.
Assume that there exists a transformation matrix A applied to thefirst layer parameters of the surrogate model such that w 1 t = w 1 + w 1 A , we have:
[Equation]
The identity in Eq.
5 shows that we can find a perturbation in the data space to alleviate the differencein the first layer parameters between these two models.
Built upon the transformation, we cantransform the worst approximation error to the worst perturbation in the data space.
Therefore, we canemploy a min-max strategy to mitigate the adverse impact of approximation error through generatingadversarial examples under the worst perturbation.
Thus, lightweight black-box attacks with ETFgenerate adversarial examples as follows (equation applying ETF to other layers can be found in Appendix):
[Equation]
where ∥·∥ p is the ℓ p -norm, ϵ and τ control the strength of perturbations, ∆ g and ∆ t are the data spaceperturbations for mitigating the approximation error in parameter space.
In this way, we reduce theerror in parameter space to approximate the target model.
Experiments
In this section, experimental setups and implementation details are introduced in Section 5.1.
In
Section 5.2, lightweight black-box attacks through ETF shows consistent effectiveness on bothnormally and adversarially trained models. Further analysis and ablation studies are provided in
{+Section 5.
+}
5.1 Experimental SetupModels Architectures.
All surrogate models are based on the ResNet- 18 [11].
Following theordinary settings in the black-box attack, the general surrogate models are trained through the wholetraining set of ImageNet [30].
On the contrary, the lightweight surrogate models adopt only 1 , 000images sampled from the validation set of ImageNet, considering that images in the training set areprobably inaccessible in practice [20]. In addition, the architecture of surrogate models is modified
[Table]
to avoid overfitting 1 .
Please refer to Table 5 in the Appendix A for the detailed information on thelightweight surrogate model and the general surrogate model.
Regarding the target models [Table] various model architectures are selected for full comparison, including, VGG- 19 [33], Inception v3 [34], ResNet- 152 [11], DenseNet [13], SENet [12], wide ResNet(WRN) [39] and MobileNet v2 [32].
All these target models are well-trained on the training set of ImageNet.
Implement Details.
The lightweight surrogate models are randomly initialized.
The batch sizeis 128 , the epoch is 500 , and the initial learning rate is 0 .
4 , linearly decreasing to 0 .
To betterapproximate the low-level feature of shallow layers, we refer to the self-supervision work [5] andapply various random augmentations to the data in each epoch for training.
For mounting attacks,classic methods, e.g., PGD [24], MI [6], DI [36] and TI [7], are applied to all surrogate models.
Unless otherwise specified, our attack is mounted on the first layer of ResNet-18 for lightweightsurrogate models.
The adversarial examples are generated by increasing the similarity between thesource images and the guide images regarding their output features maps of shallow layers. Followingprevious works on intermediate-level attacks, the mean square error is used as the similarity metric,and apply different attacking methods mentioned before are adopted.
The Top-1 prediction accuracyis adopted as the evaluation metric. The lower the classification accuracy, the better the attack successrate.
All the experiments are run for 5 individual trials with different random seeds.
Since the standarddeviation is lower than 1% , we report only their average accuracy.
5.2 Lightweight Black-box Attacks for ImageNet classification
Results on normally trained models.
The results of classification accuracy are shown in Table 1,which exhibits the evaluations for both lightweight and general surrogate models.
The last four rows show the ordinary results where the general surrogate models are trained through all data intraining set.
The black-box attacks are mounted based on the whole model, termed ”Deep/Deep ∗ ”,with average accuracies of around 10% .
As the size of the training data is reduced to 1 , 000 , thisconventional method obviously loses its aggressiveness.
In specific, the averaged accuracies of 2-5rows are among 40% - 50% , revealing limited attacking capability compared to 66 .
99% of the cleanaccuracy.
It demonstrates the necessity of large amount of data for classic black-box attacks.
Inthe 6-9 rows, shallow layers without ETF are used to generate adversarial examples.
The averagedaccuracies of around 25% illustrates the less dependence of shallow networks on the amount of data.
In the 10-13 rows, ETF is further combined based on shallow layers, and the averaged accuraciesdecrease to around 17% . The narrow gap between the proposed ETF, i.e., the lightweight surrogatemodel, and the general surrogate model indicates the potential capability of the black-box attack inthe no-box settings.
[Table]
= 8 /
[Table]
Results on Adversarially Trained Models.
Therein, models are trained throughadversarial training [24], which is morepersuasive to evaluate the effectivenessof attacking methods.
Following [24],the target models are trained on thewhole training set of ImageNet.
During adversarial training, the adversarial examples are generated under ϵ =0 , 4 / 255 , 8 / 255 , where ϵ means the constraint of L ∞ distance of the adversarialexamples used for adversarial trainingrelative to the original sample.
Table 2exhibits the attacking results mounted by ETF, Black-box attacks (general surrogate models withall training data avaliable), and No-box attacks.
For simplicity, only the results of PGD attacks arereported.
When ϵ = 0 / 255 , the target models are actually normal trained models.
As analysedabove, the black-box attacks shows the best attacking results, while ETF has a narrow gap with it.
However, when ϵ = 4 / 255 or 8 / 255 , ETF gradually exceeds the black-box attacks (29.13%26.14%vs.
It is interesting that black-box attacks are even worse than no-box attacks.
Sinceadversarial training is adopted, the pattern of adversarial noise have a large probability to be seenduring the training procedure. On the contrary, the ETF and no-box attacks generate the adversarialexamples in different perspectives, and the superiority of ETF further indicates the effectiveness ofthe proposed method. [Table]
5.3 Further Analysis and Ablation Study
Intermediate-level Perturbations.
Since the lightweight black-box attacks are implemented mainlyon intermediate features, two classic attacks mounted on intermediate features, i.e. ILA [14] and AA [18], are selected for experiments.
Comparing the ILA and AA in Table 3 and ShallowMI/DI/TI/PGD in Table 1, there is little difference between their average accuracies.
It indicates thoseintermediate-level feature perturbation has little benefit to lightweight black-box attack.
Because, theintermediate-level attacks rely more on the low-level features extracted by the lightweight model to
[Figure]
ag
[Figure]
cc
[Figure]
y
Number of training images
Black-box
Nobox (a)       maxpooling layer layer layer layer
FC
A cc u r a c y
Layer index
VGG
Inception v3 RN
DenseNet SENet
WRN MobileNet
[Figure]
Comparison with No-box Attacks [20]. No-box attack is the first work to explore how to mountattacks in the no-box setting. Considering the black-box attacks do not work in this setting, they do notattempt to design a surrogate model that approximates the target model as we do. Instead, they designthe pretext task to train an auto-encoder per category to generate adversarial examples.
However, thedifference between the pretext tasks and the target tasks may significantly reduce the transferability ofthe crafted adversarial examples.
In contrast, the proposed method train the lightweight model for thetarget task, which avoids the impact of different tasks on adversarial transferability.
Hence, thoughone sample per category is available, we achieve better attack performance than no-box attacks, whichis shown in Table 3.
Training Samples
The key difference between the lightweight and general black-boxattacks mainly lies in the number of samples n used for training models.
Therefore, we furtherexplore how lightweight attack performance varies with n .
We conduct the experiment on randomlyselected n images from ImageNet validation.
The experimental results are shown in Figure 1 (a).
The average accuracy decreases as more samples are available, and the better attacking results isachieved.
More data provides the opportunity for lightweight black-box attack to approximate theshallow layers of the target model more accurately.
Especially when the number of samples equals10 , 000 , the lightweight black-box attacks achieve the same performance as general black-box attackswhich train the surrogate model on 1,200,000 images.
More interestingly, the proposed method canstill mount attacks even when only 2 or 10 images are available.
Different Layers of the Lightweight Surrogate Model As analyzed above, we utilize the firstfew layers of the lightweight model to approximate the shallow layers of the target model to mountattacks.
Hence, it is interesting to study how the layers selection for lightweight models impactsthe attack performance.
We adopt different layers of ResNet- 18 to generate adversarial examplesutilizing ETF and attack the different target models.
The results are summarized in Table 1 (b).
It canbe seen that low-level information in the first block of the model is sufficient for achieving effectiveattack results.
With more block information on the model, the performance of the attack does notimprove.
In particular, the transferability of adversarial examples significantly decreases when weattack the full connection layer, which verifies our analysis that the high-level layer of the lightweightmodel cannot approximate the target model well.
Discussion
Though the no-box setting provides a weak assumption that a few samples and their labels areavailable, the realistic scenarios may be more complex.
For example, adversaries have access to onlydata without supervision information due to security [21] or privacy [29] issues.
In more extreme [Table] case, e.g., autonomous vehicle [35], adversaries even have no access to the test samples from thedistribution over which the model is trained.
Instead, the adversaries have access to samples from asimilar (but not exact) distribution (because the attacker knows the deployment environment).
Hence,this section considers two more challenging attack scenarios in which we provide solutions to mountblack-box attacks.
Insufficient supervision information.
Adversaries have only a few unlabeled samples (e.g., 1 , 000unlabeled images).
Since the proposed method focuses on low-level representations, we may notrequire the high-level semantic information captured by categorical labels. Hence, it may be feasibleto train the unsupervised model on unlabeled data for attacks. We design an experiment for mountingattacks using 1 , 000 unlabeled samples randomly selected from the ImageNet validation set toexplore how the proposed ETF performs under more challenging circumstances with unlabeled data.
Specifically, we adopt contrastive learning [5] to train a lightweight surrogate model on the small-scaleunlabeled dataset and generate adversarial examples by attacking the trained lightweight surrogatemodel.
The performance is shown in Table 4. We can see that without supervision information ETFstill achieves similar performance as that under supervision.
Consideration of Out-of-distribution.
As shown in Section 5.3, when only two samples areavailable, the crafted adversarial examples have weak transferability to mount attacks. This is becausetoo little low-level information is available for lightweight models to approximate the target modelwell, even at shallow layers. However, adversaries can only get some samples from out-of-distributiondata in real scenarios.
Hence, we consider utilizing the model pre-trained on OOD samples to mountlightweight black-box attacks.
The rationality lies in that only low-level information is required tomount lightweight black-box attacks and the acquisition of low-level information does not requirethe corresponding high-level category information.
We load pre-trained ResNet- 50 on STL- 10 [23]dataset as the surrogate model.
Without further fine-tuning, we experiment with two samples again,and the results are recorded in Table 4, named OOD.
Interestingly, attacks mounted in the modeltrained on OOD achieve a higher attack success rate than those mounted in the lightweight surrogatemodel trained on 1 , 000 samples. Plenty of data from STL- 10 provide various low-level information,which is the main reason why OOD can also mount powerful attacks.
Conclusion
This paper proposes to perturb the shallow layers of a lightweight surrogate model to enable blackbox attacks in the no-box setting.
We demonstrate that black-box attacks can work well in theno-box setting by leveraging the lightweight model, even if it is trained with a few samples.
Theproposal is based on the empirical observations that the model trained with limited samples canapproximate the shallow layers of the target models within acceptable errors.
Therefore, to achievebetter attack performance, this work proposes error transformer for lightweight attacks to decreasethe approximation error between the lightweight surrogate model and the target model.
Specifically,
ETF transforms the approximation error in the parameter space into a perturbation in the featurespace. We reduce approximation error by applying the worst feature perturbation.
The experimentresults show that the proposed ETF achieves a comparative attack success rate with only one imageper category, which is only 3% lower than black-box attacks with complete training data of targetmodel.
Checklist
For all authors...
[Table] (a) Do the main claims made in the abstract and introduction accurately reflect the paper’s [Table]
contributions and scope?
[Yes]
(b) Did you describe the limitations of your work?
[Yes]
[Table]
(c) Did you discuss any potential negative societal impacts of your work?
[Yes]
[Table]
(d) Have you read the ethics review guidelines and ensured that your paper conforms tothem?
[Yes]
[Table]
If you are including theoretical results...
(a) Did you state the full set of assumptions of all theoretical results?
[Yes]
(b) Did you include complete proofs of all theoretical results?
[Yes]
[Table]
If you ran experiments...
[Table] (a) Did you include the code, data, and instructions needed to reproduce the main experi- [Table]
mental results (either in the supplemental material or as a URL)?
[No] We will providea private link when rebuttal.
[Table] (b) Did you specify all the training details (e.g., data splits, hyperparameters, how theywere chosen)?
[Yes]
[Table] (c) Did you report error bars (e.g., with respect to the random seed after running experiments multiple times)?
[No] All the experiments are run for 5 individual trials withdifferent random seeds.
Since the standard deviation is lower 1% , we report only theiraverage accuracy.
(d) Did you include the total amount of compute and the type of resources used (e.g., typeof GPUs, internal cluster, or cloud provider)?
[Yes]
If you are using existing assets (e.g., code, data, models) or curating/releasing new assets...
(a) If your work uses existing assets, did you cite the creators?
[Yes]
(b) Did you mention the license of the assets?
[No](c) Did you include any new assets either in the supplemental material or as a URL?
[No](d) Did you discuss whether and how consent was obtained from people whose data you’re
using/curating?
[No] We use public datasets and give references.
(e) Did you discuss whether the data you are using/curating contains personally identifiable
information or offensive content?
[No] We do not utilize such data.
If you used crowdsourcing or conducted research with human subjects...
(a) Did you include the full text of instructions given to participants and screenshots, if
applicable?
[N/A]
(b) Did you describe any potential participant risks, with links to Institutional Review
Board (IRB) approvals, if applicable?
[N/A]
(c) Did you include the estimated hourly wage paid to participants and the total amount
spent on participant compensation?
[N/A]