PaperlayerView exact revision on arXiv

Source-linked AI summary

AutoZOOM: Autoencoder-based Zeroth Order Optimization Method for Attacking Black-box Neural Networks

Chun-Chen Tu, Paishun Ting, Pin-Yu Chen, Sijia Liu, Huan Zhang, Jinfeng Yi, Cho-Jui Hsieh, Shin-Ming Cheng

arXiv:1805.11770v5cs.CVcs.CRstat.ML

TL;DR

Black-box attacks on deployed classifiers are hindered by excessive model queries. AutoZOOM combines adaptive random gradient estimation with dimension-reducing decoders, and applied to ZOO it reduces mean queries by at least 93% while maintaining similar success rates. Its scope assumes access to class prediction scores, and the authors identify practical trade-offs between the AE and BiLIN decoders.

  • Problem

    Existing black-box attacks can require excessive model queries because coordinate-wise gradient estimation and updates are not query-efficient.

  • Method

    AutoZOOM combines adaptive random full-gradient estimation with a decoder based on an offline-trained autoencoder or bilinear resizing for attack-dimension reduction.

  • Results

    At least 93% mean query reduction is achieved versus ZOO on MNIST, CIFAR-10, and ImageNet while maintaining a similar attack success rate.

  • Takeaways & Limitations

    AutoZOOM provides an efficient means for assessing the robustness of deployed machine-learning models, including attacks using substantially fewer degrees of freedom.

  • Takeaways & Limitations

    The threat model assumes that class prediction scores are known to the attacker, and AutoZOOM-AE may require additional training while AutoZOOM-BiLIN can be less effective.

Abstract

from arXiv · show

Recent studies have shown that adversarial examples in state-of-the-art image classifiers trained by deep neural networks (DNN) can be easily generated when the target model is transparent to an attacker, known as the white-box setting. However, when attacking a deployed machine learning service, one can only acquire the input-output correspondences of the target model; this is the so-called black-box attack setting. The major drawback of existing black-box attacks is the need for excessive model queries, which may give a false sense of model robustness due to inefficient query designs. To bridge this gap, we propose a generic framework for query-efficient black-box attacks. Our framework, AutoZOOM, which is short for Autoencoder-based Zeroth Order Optimization Method, has two novel building blocks towards efficient black-box attacks: (i) an adaptive random gradient estimation strategy to balance query counts and distortion, and (ii) an autoencoder that is either trained offline with unlabeled data or a bilinear resizing operation for attack acceleration. Experimental results suggest that, by applying AutoZOOM to a state-of-the-art black-box attack (ZOO), a significant reduction in model queries can be achieved without sacrificing the attack success rate and the visual quality of the resulting adversarial examples. In particular, when compared to the standard ZOO method, AutoZOOM can consistently reduce the mean query counts in finding successful adversarial examples (or reaching the same distortion level) by at least 93% on MNIST, CIFAR-10 and ImageNet datasets, leading to novel insights on adversarial robustness.

1 Introduction

AutoZOOM addresses excessive queries in black-box attacks by combining adaptive random gradient estimation with attack-dimension reduction. Applied to ZOO, it substantially reduces queries while preserving attack success and visual quality.

  • Machine-learning services expose powerful classifiers whose adversarial vulnerabilities create security concerns, especially when deployed products inherit those weaknesses.
  • Existing black-box attacks use coordinate-wise gradient estimation and updates, incurring excessive queries and potentially creating a false sense of robustness.
  • AutoZOOM combines adaptive random gradient estimation with an offline-trained autoencoder or bilinear resizer to balance query counts, distortion, and attack acceleration.
  • AutoZOOM uses zeroth-order convergence rates and gradient-estimation error analysis to characterize the trade-off between estimation error and query counts.
  • At least 93% fewer mean queries are required on MNIST, CIFAR-10, and ImageNet while maintaining a similar attack success rate.
  • AutoZOOM-BiLIN achieves noticeable query efficiency despite underperforming AutoZOOM-AE, while requiring no additional training.

2 Related Work

Prior black-box attacks include substitute-model transfer, zeroth-order optimization, natural evolution strategies, and decision-boundary random walks. AutoZOOM is positioned as a theory-driven dimension-reduction framework for gradient-estimation attacks.

  • Substitute-model attacks train a queried surrogate and transfer white-box adversarial examples, but poor transferability can severely degrade performance.
  • NES improves query efficiency through vector-wise gradient estimation and natural evolution, but does not account for attack-dimension reduction.
  • Decision-boundary random-walk attacks operate when only the top-1 class is known and require additional queries because class scores are unavailable.

3 AutoZOOM: Background and Methods

AutoZOOM formulates black-box adversarial attacks as zeroth-order optimization using model scores, then improves query efficiency through random gradient estimation and attack-dimension reduction. Its analysis motivates adaptive query selection and decoder-based acceleration.

  • 3.1 Black-box Attack Formulation and Zeroth Order Optimization: Black-box attacks optimize adversarial examples using only model evaluations because input gradients are unavailable.The threat model assumes class prediction scores are known to the attacker.
  • 3.2 Random Vector based Gradient Estimation: Coordinate-wise gradient estimation becomes query-inefficient in high-dimensional inputs, including ImageNet images with approximately 270,000 dimensions.Each coordinate-wise estimation step requires many model queries.
  • 3.2 Random Vector based Gradient Estimation: AutoZOOM replaces coordinate-wise estimation with a scaled random full-gradient estimator whose parameters control bias, variance, and query efficiency.The estimator samples a random unit vector and uses a smoothing parameter β plus scaling parameter b.
  • 3.2 Random Vector based Gradient Estimation: Averaging estimates over q random directions reduces estimator variance, while the error analysis characterizes how b and q affect estimation error and query efficiency.The analysis assumes a differentiable objective with an L-Lipschitz gradient.
  • 3.2 Random Vector based Gradient Estimation: AutoZOOM sets b = q and adapts q from minimal-query rough estimates before success to more accurate estimates for post-success distortion refinement.The framework is designed as a general acceleration tool for gradient-estimation-based black-box attacks.
  • 3.3 Attack Dimension Reduction via Autoencoder: AutoZOOM uses dimension reduction because zeroth-order convergence has a dimension-dependent factor, and decodes low-dimensional perturbations into image-space adversarial perturbations.The decoder can be an offline-trained autoencoder or a training-free bilinear image resizer; both reduce the attack dimension.

4 Performance Evaluation

Experiments evaluate AutoZOOM as a query-efficient gradient-free framework applied to ZOO across MNIST, CIFAR-10, and ImageNet. The results show substantially fewer queries while preserving attack effectiveness, with adaptive refinement and dimension reduction improving the query–distortion trade-off.

  • Experimental setup: AutoZOOM applies a query-efficient gradient-free framework to the ZOO attack formulation and evaluates initial success and specified-distortion performance.The experiments use squared L2 distortion and compare AutoZOOM variants with ZOO-based baselines across benchmark datasets.
  • MNIST and CIFAR-10: AutoZOOM-AE achieves the highest attack success rates and mean query reduction ratios on CIFAR-10, while usually requiring fewer queries than AutoZOOM-BiLIN to reach the same L2 distortion.AutoZOOM-AE requires additional autoencoder training, and at λini = 10 it has higher TPR but slightly more queries than BiLIN at the same distortion.
  • ImageNet: On ImageNet, AutoZOOM-AE reduces queries versus ZOO by 99.39% for initial success and 99.35% at the same L2 distortion.The reduction corresponds to more than 2.2 million fewer model queries under the reported ImageNet setting.
  • ImageNet: Post-success averaging with q > 1 further decreases distortion, with refinement effects empirically saturating at q = 4.Increasing q trades additional model queries for lower converged-stage distortion.
  • Dimension reduction and query efficiency: Dimension reduction cuts query counts by roughly 35-40% on MNIST and CIFAR-10 and at least 95% on ImageNet versus operating in the original dimension.Without dimension reduction, the original-dimensional ImageNet attack cannot succeed within the Q = 200K query budget.
  • Additional remarks and discussion: AutoZOOM-BiLIN is easier to deploy because it requires no additional training, while AutoZOOM-AE’s gain over BiLIN can sometimes be marginal.The authors also identify room to improve AutoZOOM-AE through alternative autoencoder models.

5 Conclusion

AutoZOOM accelerates gradient-estimation-based black-box attacks through adaptive random full-gradient estimation and reduced attack dimensions. Compared with ZOO, it achieves at least 93% fewer mean queries while maintaining similar attack success and visual similarity.

  • AutoZOOM is compatible with gradient-estimation-based black-box attacks and uses adaptive random full-gradient estimation with an AE or BiLIN decoder.
  • At least 93% query reduction is achieved on MNIST, CIFAR-10, and ImageNet while maintaining a similar attack success rate.The reduction concerns finding initial successful adversarial examples or reaching the same distortion.
  • AutoZOOM can fine-tune image distortion after success to maintain high visual similarity to the original image.

A More Background on Adversarial Attacks and Defenses

Black-box attacks address threats to deployed DNN services where model parameters are hidden, but query-intensive gradient estimation remains a central bottleneck. AutoZOOM focuses on query-efficient gradient-based attacks using reduced attack dimensions and known class prediction scores.

  • Black-box attackers observe input-output correspondences while target model parameters remain hidden, preventing direct use of input gradients.
  • Coordinate-wise gradient estimation and value updates require excessive model evaluations, even with acceleration techniques such as importance sampling and bilinear scaling.
  • AutoZOOM targets gradient-estimation and gradient-descent-based black-box attacks when class prediction scores are available to the attacker.
  • AutoZOOM distinguishes itself by using reduced attack dimensions through autoencoders trained on unlabeled natural data for black-box attack acceleration.
  • The paper focuses on attacking black-box undefended DNNs, while adversarial defenses have been weakened by follow-up attacks.

B Proof of Theorem 1

The proof analyzes the averaged random gradient estimator under a differentiability and Lipschitz-gradient assumption, then bounds its mean squared estimation error. The surrounding method uses zeroth-order optimization and autoencoder architectures for dimension reduction.

  • B Proof of Theorem 1: The analysis assumes a d-dimensional input, differentiable f, and an L-Lipschitz gradient before considering a smoothed version of f.
  • B Proof of Theorem 1: The proof derives relations for the averaged random gradient estimator using independent samples and the equality E[gi] = E[g1] = v.
  • B Proof of Theorem 1: The derivation concludes by bounding the mean squared estimation error of the gradient estimator.
  • C Architectures of Convolutional Autoencoders in AutoZOOM: AutoZOOM’s autoencoder designs include CIFAR-10 and ImageNet configurations with reduced feature-map dimensions and convolutional encoder-decoder components.

C Architectures of Convolutional Autoencoders in AutoZOOM

AutoZOOM trains convolutional autoencoders on unlabeled images for MNIST, CIFAR-10, and ImageNet, with ImageNet additionally using bilinear scaling for internal processing. Reported normalized reconstruction errors remain within a reasonable compression-loss range.

  • The MNIST autoencoder uses 50,000 randomly selected MNIST8M digits, while the CIFAR-10 autoencoder uses 9,900 images from its test dataset.
  • For ImageNet, the autoencoder is trained on about 9,000 images from 10 randomly selected classes used for attacked images and candidate targets.
  • ImageNet autoencoders use bilinear scaling between 299 × 299 × Dep and 128 × 128 × Dep to simplify processing in convolutional layers.
  • The normalized mean squared errors are 0.0027 for MNIST, 0.0049 for CIFAR-10, and 0.0151 for ImageNet, described as reasonable compression loss.

D More Adversarial Examples of Attacking Inception-v3 in the Black-box Setting

Figure S1 presents additional adversarial examples generated against Inception-v3 in the black-box targeted attack setting.

  • Figure S1 shows additional adversarial examples for the Inception-v3 model.
  • The examples come from a black-box attack setting.
  • The attack is targeted rather than untargeted.

E Performance Evaluation of Black-box Untargeted Attacks

Table S3 evaluates black-box untargeted attacks using ZOO and AutoZOOM-BiLIN on MNIST, CIFAR-10, and ImageNet under specified per-pixel L2 distortion thresholds.

  • Table S3 compares ZOO and AutoZOOM-BiLIN for black-box untargeted attacks on MNIST, CIFAR-10, and ImageNet.
  • Untargeted attacks require adversarial images to avoid the natural image's top-1 class rather than reach a specific target class.Here, t0 denotes the top-1 prediction label of the natural image x0.
  • The per-pixel L2 distortion thresholds are 0.004 for MNIST, 0.0015 for CIFAR-10, and 5 × 10−5 for ImageNet.
Loading 1805.11770v5…