Consensus-based optimization for closed-box adversarial attacks and a connection to evolution strategies
This work addresses the challenge of fooling classifiers without gradient access, but it is incremental as it builds on existing optimization schemes.
The paper tackled the problem of closed-box adversarial attacks by connecting consensus-based optimization (CBO) to natural evolution strategies (NES) and gradient-based methods, showing that CBO can outperform NES and other evolutionary strategies in some scenarios.
Consensus-based optimization (CBO) has established itself as an efficient gradient-free optimization scheme, with attractive mathematical properties, such as mean-field convergence results for non-convex loss functions. In this work, we study CBO in the context of closed-box adversarial attacks, which are imperceptible input perturbations that aim to fool a classifier, without accessing its gradient. Our contribution is to establish a connection between the so-called consensus hopping as introduced by Riedl et al. and natural evolution strategies (NES) commonly applied in the context of adversarial attacks and to rigorously relate both methods to gradient-based optimization schemes. Beyond that, we provide a comprehensive experimental study that shows that despite the conceptual similarities, CBO can outperform NES and other evolutionary strategies in certain scenarios.