We propose a simple and highly query-efficient black-box adversarial attack named SWITCH, which has a state-of-the-art performance in the score-based setting. SWITCH features a highly efficient and effective utilization of the gradient of a surrogate model $\hat{\mathbf{g}}$ w.r.t. the input image, i.e., the transferable gradient. In each iteration, SWITCH first tries to update the current sample along the direction of $\hat{\mathbf{g}}$, but considers switching to its opposite direction $-\hat{\mathbf{g}}$ if our algorithm detects that it does not increase the value of the attack objective function. We justify the choice of switching to the opposite direction by a local approximate linearity assumption. In SWITCH, only one or two queries are needed per iteration, but it is still effective due to the rich information provided by the transferable gradient, thereby resulting in unprecedented query efficiency. To improve the robustness of SWITCH, we further propose SWITCH$_\text{RGF}$ in which the update follows the direction of a random gradient-free (RGF) estimate when neither $\hat{\mathbf{g}}$ nor its opposite direction can increase the objective, while maintaining the advantage of SWITCH in terms of query efficiency. Experimental results conducted on CIFAR-10, CIFAR-100 and TinyImageNet show that compared with other methods, SWITCH achieves a satisfactory attack success rate using much fewer queries, and SWITCH$_\text{RGF}$ achieves the state-of-the-art attack success rate with fewer queries overall. Our approach can serve as a strong baseline for future black-box attacks because of its simplicity. The PyTorch source code is released on https://github.com/machanic/SWITCH.
翻译:我们提出一个简单和高度查询效率高的黑盒对抗性攻击,名为SWitchch, 但它在以分数为基础的环境下表现最先进。 SWitchch 将高度高效和有效地使用代用模型的梯度, 即可转移的梯度。 在每次迭代中, SWitch首先尝试按照 $\hat\ hathb{g_$的方向更新当前样本, 但是考虑转向相反的方向 $\ hhat_ hathbf{g_$。 如果我们的算法发现代用模型不会增加攻击目标功能的价值。 我们有理由选择用本地的近似线性假设转向相反的方向。 在 SWitchchitch 中, 只需要一次或两次查询, 但是由于可转移的梯度提供的丰富信息仍然有效, 从而导致前所未有的查询效率。 为了提高SWitchchtrcht的稳定性, 我们进一步提议SWitchchitrch$\h_mathrf{g{g} 向相反的方向转变方向转变方向, 而其直径rickrickrrrrrrrrrrrrr 则则则会以更快速的方式更新其方向。