Boosting Black-Box Attack with Partially Transferred Conditional Adversarial Distribution
This work addresses the challenge of improving black-box attack efficiency for security researchers, though it is incremental as it builds on existing transferability approaches.
The paper tackles the problem of black-box adversarial attacks on deep neural networks by proposing a method that transfers partial parameters of conditional adversarial distributions from surrogate models to the target model, achieving superior attack performance as demonstrated in experiments on benchmark datasets and real-world APIs.
This work studies black-box adversarial attacks against deep neural networks (DNNs), where the attacker can only access the query feedback returned by the attacked DNN model, while other information such as model parameters or the training datasets are unknown. One promising approach to improve attack performance is utilizing the adversarial transferability between some white-box surrogate models and the target model (i.e., the attacked model). However, due to the possible differences on model architectures and training datasets between surrogate and target models, dubbed "surrogate biases", the contribution of adversarial transferability to improving the attack performance may be weakened. To tackle this issue, we innovatively propose a black-box attack method by developing a novel mechanism of adversarial transferability, which is robust to the surrogate biases. The general idea is transferring partial parameters of the conditional adversarial distribution (CAD) of surrogate models, while learning the untransferred parameters based on queries to the target model, to keep the flexibility to adjust the CAD of the target model on any new benign sample. Extensive experiments on benchmark datasets and attacking against real-world API demonstrate the superior attack performance of the proposed method.