DST: Dynamic Substitute Training for Data-free Black-box Attack
This addresses the vulnerability of deep neural networks in computer vision for security applications, representing an incremental improvement over existing knowledge distillation-based methods.
The paper tackles the problem of limited attack ability in data-free black-box adversarial attacks by proposing a dynamic substitute training method that adaptively generates optimal substitute model structures and improves generated training data quality, achieving better performance than state-of-the-art methods on several datasets.
With the wide applications of deep neural network models in various computer vision tasks, more and more works study the model vulnerability to adversarial examples. For data-free black box attack scenario, existing methods are inspired by the knowledge distillation, and thus usually train a substitute model to learn knowledge from the target model using generated data as input. However, the substitute model always has a static network structure, which limits the attack ability for various target models and tasks. In this paper, we propose a novel dynamic substitute training attack method to encourage substitute model to learn better and faster from the target model. Specifically, a dynamic substitute structure learning strategy is proposed to adaptively generate optimal substitute model structure via a dynamic gate according to different target models and tasks. Moreover, we introduce a task-driven graph-based structure information learning constrain to improve the quality of generated training data, and facilitate the substitute model learning structural relationships from the target model multiple outputs. Extensive experiments have been conducted to verify the efficacy of the proposed attack method, which can achieve better performance compared with the state-of-the-art competitors on several datasets.