Recent work has shown how easily white-box adversarial attacks can be applied to state-of-the-art image classifiers. However, real-life scenarios resemble more the black-box adversarial conditions, lacking transparency and usually imposing natural, hard constraints on the query budget. We propose $\textbf{EvoBA}$, a black-box adversarial attack based on a surprisingly simple evolutionary search strategy. $\textbf{EvoBA}$ is query-efficient, minimizes $L_0$ adversarial perturbations, and does not require any form of training. $\textbf{EvoBA}$ shows efficiency and efficacy through results that are in line with much more complex state-of-the-art black-box attacks such as $\textbf{AutoZOOM}$. It is more query-efficient than $\textbf{SimBA}$, a simple and powerful baseline black-box attack, and has a similar level of complexity. Therefore, we propose it both as a new strong baseline for black-box adversarial attacks and as a fast and general tool for gaining empirical insight into how robust image classifiers are with respect to $L_0$ adversarial perturbations. There exist fast and reliable $L_2$ black-box attacks, such as $\textbf{SimBA}$, and $L_{\infty}$ black-box attacks, such as $\textbf{DeepSearch}$. We propose $\textbf{EvoBA}$ as a query-efficient $L_0$ black-box adversarial attack which, together with the aforementioned methods, can serve as a generic tool to assess the empirical robustness of image classifiers. The main advantages of such methods are that they run fast, are query-efficient, and can easily be integrated in image classifiers development pipelines. While our attack minimises the $L_0$ adversarial perturbation, we also report $L_2$, and notice that we compare favorably to the state-of-the-art $L_2$ black-box attack, $\textbf{AutoZOOM}$, and of the $L_2$ strong baseline, $\textbf{SimBA}$.
翻译:最近的工作表明,白箱对抗性攻击可以很容易地适用于最先进的图像分类 {白箱对抗性攻击可以很容易地适用于最先进的图像分类。然而,真实生活情景更像黑箱对抗性条件,缺乏透明度,通常会给查询预算施加自然的硬性约束。我们提议美元(textbf{EvoBA}$),黑箱对抗性攻击以惊人的简单进化搜索战略为基础。$(textbf{EvoBA}$),一个简单有力的基线黑箱攻击,尽量减少对立的干扰,而不需要任何形式的培训。$(textb}黑箱对价美元;OBO}美元现实生活情景更像黑箱对抗性竞争条件,缺乏透明度,通常会给电箱攻击带来效益和效率。