Diversity can be Transferred: Output Diversification for White- and Black-box Attacks
This addresses the problem of improving attack efficiency for adversarial machine learning practitioners, offering a transferable method that enhances both white-box and black-box attacks.
The paper tackles the sub-optimality of random perturbations in adversarial attacks by proposing Output Diversified Sampling (ODS), a gradient-based strategy that maximizes output diversity, which reduces the number of queries needed for state-of-the-art black-box attacks on ImageNet by a factor of two.
Adversarial attacks often involve random perturbations of the inputs drawn from uniform or Gaussian distributions, e.g., to initialize optimization-based white-box attacks or generate update directions in black-box attacks. These simple perturbations, however, could be sub-optimal as they are agnostic to the model being attacked. To improve the efficiency of these attacks, we propose Output Diversified Sampling (ODS), a novel sampling strategy that attempts to maximize diversity in the target model's outputs among the generated samples. While ODS is a gradient-based strategy, the diversity offered by ODS is transferable and can be helpful for both white-box and black-box attacks via surrogate models. Empirically, we demonstrate that ODS significantly improves the performance of existing white-box and black-box attacks. In particular, ODS reduces the number of queries needed for state-of-the-art black-box attacks on ImageNet by a factor of two.