Deep neural networks (DNNs) are sensitive to adversarial data in a variety of scenarios, including the black-box scenario, where the attacker is only allowed to query the trained model and receive an output. Existing black-box methods for creating adversarial instances are costly, often using gradient estimation or training a replacement network. This paper introduces \textbf{Qu}ery-Efficient \textbf{E}volutiona\textbf{ry} \textbf{Attack}, \textit{QuEry Attack}, an untargeted, score-based, black-box attack. QuEry Attack is based on a novel objective function that can be used in gradient-free optimization problems. The attack only requires access to the output logits of the classifier and is thus not affected by gradient masking. No additional information is needed, rendering our method more suitable to real-life situations. We test its performance with three different state-of-the-art models -- Inception-v3, ResNet-50, and VGG-16-BN -- against three benchmark datasets: MNIST, CIFAR10 and ImageNet. Furthermore, we evaluate QuEry Attack's performance on non-differential transformation defenses and state-of-the-art robust models. Our results demonstrate the superior performance of QuEry Attack, both in terms of accuracy score and query efficiency.
翻译:深神经网络(DNNS) 在各种情景中,包括黑盒情景中,攻击者只被允许查询经过训练的模型并接收输出。 现有的创建对抗实例的黑盒方法成本高昂, 通常使用梯度估计或培训替换网络。 本文引入了\ textbf ⁇ u / effifict {E} 革命a\ textb{{}\ textb{Attack},\ textit ⁇ uEry attack}, 攻击者只被允许查询经过训练的模型并接收输出。 QuEry Attack基于一个新的目标功能, 可用于解决无梯度优化问题。 攻击只需要访问分类器的输出日志, 不受梯度掩码影响。 不需要更多信息, 使我们的方法更适合现实生活状况。 我们用三种不同的状态模型测试其性能 -- Incion- v3, ResNet- 50 和 VGG-16-BN - 用来测试三个基准目标目标目标功能功能, 用于升级优化优化优化的图像测试: CIMISIMFS- 和EAR Stroupal Provical press 10。