Simple and Efficient Hard Label Black-box Adversarial Attacks in Low Query Budget Regimes
This work addresses the challenge of efficient adversarial attacks in low query budget regimes, which is crucial for security testing of AI systems, but it is incremental as it builds on existing Bayesian Optimization techniques.
The paper tackles the problem of generating adversarial examples for deep learning models using only hard label outputs in black-box settings, proposing a Bayesian Optimization-based method that searches in a low-dimensional subspace to achieve 2x to 10x higher attack success rates with 10x to 20x fewer queries compared to state-of-the-art attacks.
We focus on the problem of black-box adversarial attacks, where the aim is to generate adversarial examples for deep learning models solely based on information limited to output label~(hard label) to a queried data input. We propose a simple and efficient Bayesian Optimization~(BO) based approach for developing black-box adversarial attacks. Issues with BO's performance in high dimensions are avoided by searching for adversarial examples in a structured low-dimensional subspace. We demonstrate the efficacy of our proposed attack method by evaluating both $\ell_\infty$ and $\ell_2$ norm constrained untargeted and targeted hard label black-box attacks on three standard datasets - MNIST, CIFAR-10 and ImageNet. Our proposed approach consistently achieves 2x to 10x higher attack success rate while requiring 10x to 20x fewer queries compared to the current state-of-the-art black-box adversarial attacks.