PaperlayerView exact revision on arXiv

Source-linked AI summary

Improving Black-box Adversarial Attacks with a Transfer-based Prior

Shuyu Cheng, Yinpeng Dong, Tianyu Pang, Hang Su, Jun Zhu

arXiv:1906.06919v3cs.LGcs.CRcs.CVstat.ML

TL;DR

Black-box attacks must estimate gradients without target-model access, and existing transfer- or query-based estimates face success-rate or query-efficiency limitations. P-RGF combines a surrogate-model transfer prior with target-model query information using a theoretically derived optimal coefficient. Experiments report higher success rates with fewer queries across black-box attacks.

  • Problem

    Existing black-box attacks struggle to estimate useful gradients in high-dimensional spaces, leading to low attack success rates or poor query efficiency.

  • Method

    P-RGF biases random target-model queries toward a surrogate white-box model’s transfer gradient and controls its strength with a theoretically derived optimal coefficient.

  • Results

    P-RGF consistently attacks black-box models with higher success rates and much fewer queries than alternative methods.

  • Takeaways & Limitations

    The method can combine transfer-based and other prior information within a query-efficient black-box gradient-estimation framework.

  • Takeaways & Limitations

    The approach assumes a nonzero target gradient and requires estimating the unknown coefficient controlling the prior’s contribution.

Abstract

from arXiv · show

We consider the black-box adversarial setting, where the adversary has to generate adversarial perturbations without access to the target models to compute gradients. Previous methods tried to approximate the gradient either by using a transfer gradient of a surrogate white-box model, or based on the query feedback. However, these methods often suffer from low attack success rates or poor query efficiency since it is non-trivial to estimate the gradient in a high-dimensional space with limited information. To address these problems, we propose a prior-guided random gradient-free (P-RGF) method to improve black-box adversarial attacks, which takes the advantage of a transfer-based prior and the query information simultaneously. The transfer-based prior given by the gradient of a surrogate model is appropriately integrated into our algorithm by an optimal coefficient derived by a theoretical analysis. Extensive experiments demonstrate that our method requires much fewer queries to attack black-box models with higher success rates compared with the alternative state-of-the-art methods.

1 Introduction

Black-box attacks address realistic settings where adversaries lack target-model gradients, but existing transfer-based and query-based approaches face success-rate or query-efficiency challenges. P-RGF combines a transfer-based prior with query information using an theoretically derived coefficient and improves both attack success rate and query efficiency.

  • Black-box attacks are more practical than white-box attacks because the adversary has no or limited knowledge of the target model.
  • Transfer-based attacks use surrogate-model gradients, but their attack success rate remains unsatisfactory because surrogate gradients may point toward non-adversarial target-model regions.
  • Query-based attacks generally achieve higher attack success rates than transfer-based methods but require tremendous numbers of queries.
  • P-RGF biases random target-model queries toward a surrogate transfer gradient and uses an optimal coefficient to control that gradient’s strength.
  • Experiments show that P-RGF significantly outperforms previous state-of-the-art methods in black-box attack success rate and query efficiency.

2 Background

Black-box adversarial attacks replace inaccessible target gradients with surrogate gradients or query-based estimates, while gradient estimation remains difficult in high-dimensional inputs. Prior work motivates random gradient-free estimation and combining informative priors, including transfer-based and data-dependent priors.

  • 2.1 Adversarial setup: Adversarial attacks seek misclassified inputs whose ℓp distance from the original input stays below a preset threshold ϵ.
  • 2.1 Adversarial setup: Projected gradient descent iteratively updates adversarial examples using a normalized gradient and projects them into an ℓp ball around the original input.The step size is denoted η.
  • 2.1 Adversarial setup: White-box gradient-based methods require direct access to the target-model gradient, which is unrealistic in many real-world applications.
  • 2.2 Black-box attacks: Coordinate-wise finite-difference estimation has query complexity proportional to input dimension, which is prohibitively large for high-dimensional inputs such as ImageNet with D ≈270,000.
  • 2.2 Black-box attacks: Random gradient-free methods estimate gradients from random directions and average q estimates to reduce variance, while informative priors can improve query efficiency.
  • 2.2 Black-box attacks: Black-box attack methods include substitute-model approaches that query labels and transfer adversarial examples from the substitute model.
  • 2.2 Black-box attacks: A related method uses surrogate gradients for hard-label attacks with a preset transfer-gradient strength, whereas this paper considers accessible loss values and derives the coefficient theoretically.

3 Methodology

The methodology formulates gradient estimation as minimizing direction-sensitive error, then develops P-RGF to bias random queries toward a transfer gradient using an analytically selected coefficient. It also estimates transfer-gradient alignment and supports data-dependent priors and subspace sampling.

  • Gradient estimation framework: The framework minimizes expected squared ℓ2 error after scaling the estimator, emphasizing gradient direction rather than magnitude for normalized attacks.The scaling factor removes the effect of estimator magnitude from the loss.
  • Prior-guided random gradient-free method: P-RGF samples unit random directions biased toward the normalized transfer gradient, whose strength is controlled by λ.The transfer gradient comes from a surrogate white-box model and is combined with query-based loss values.
  • Algorithm: The algorithm estimates transfer-gradient cosine similarity α, computes λ* from α, q, and D, and averages q query-based random-gradient estimates unless λ* = 1.The procedure uses the normalized transfer gradient, sampling variance σ, query count q, and input dimension D.
  • Prior-guided random gradient-free method: The optimal coefficient λ* is derived by minimizing the estimator loss and increases with transfer-gradient alignment while decreasing with query count when alignment exceeds a random-vector baseline.When λ* = 1, the algorithm returns the transfer gradient directly and avoids additional queries.
  • Estimation of gradient norm: Gradient-norm estimation uses S independently sampled unit directions and a homogeneous function of directional derivatives to estimate the norm.The construction exploits the directional derivatives' scale relationship to the gradient norm.
  • Incorporating the data-dependent prior: P-RGF can incorporate data-dependent priors by reducing input-space dimension through subspace sampling without sacrificing much estimation accuracy.The method can combine a transfer-based prior with a data-dependent prior, and its framework applies when perturbations lie in a linear subspace.

4 Experiments

Experiments evaluate P-RGF for gradient estimation and black-box attacks on normal and defensive models. Across these settings, P-RGF improves gradient alignment, attack success, and query efficiency.

  • Experimental setup: Experiments use ImageNet untargeted ℓ2 attacks on 1,000 validation images, with ℓ∞ results reported in Appendix D.The experiments use ResNet-152 as the surrogate model; both norms produce consistent results.
  • Gradient estimation: P-RGF with the derived λ∗ produces better gradient estimates than uniform RGF, the transfer gradient, and any fixed λ.The comparison uses cosine similarity between estimated and true gradients.
  • Gradient estimation: The adaptive λ∗ decreases during attack iterations because the transfer gradient becomes less useful while the estimated gradient retains higher cosine similarity.These trends support adapting the coefficient across iterations.
  • Normal models: P-RGF generally achieves higher attack success rates and fewer queries than baseline and state-of-the-art methods on Inception-v3, VGG-16, and ResNet-50.Evaluated methods include RGF, fixed-λ P-RGF, NES, Bandits, and AutoZoom, with at most 10,000 queries per image.
  • Defensive models: On JPEG compression, randomization, and guided denoiser defenses, P-RGF improves success rates by 20%–40% in many cases while reducing query complexity.These experiments use a smoothed transfer gradient as the prior.

5 Conclusion

The conclusion presents P-RGF as a transfer-prior method for improving black-box adversarial attacks. It integrates a surrogate gradient using a theoretically derived optimal coefficient and reports higher success with fewer queries.

  • P-RGF integrates the transfer gradient of a surrogate white-box model using a derived optimal coefficient.
  • Experiments consistently show that P-RGF attacks black-box models with higher success rates and fewer queries.
  • The method uses transfer-based prior information to improve black-box adversarial attacks.

A Proofs

This appendix section states that the paper provides proofs for its theoretical results.

  • The section provides the proofs for the paper’s theoretical results.
  • The proofs are presented in the appendix.
  • The section serves as the proof portion of the paper’s theoretical analysis.

A.1 Proof of Theorem 1

The appendix proves properties of the RGF estimator under differentiability, using a locally linear approximation and convergence as the sampling scale σ approaches zero.

  • The theorem analyzes the loss of the RGF estimator when f is differentiable at x.
  • The proof uses the locally linear case, where a single estimate equals u⊤∇f(x)·u, with u sampled uniformly from the unit hypersphere.
  • The argument derives the estimator’s moments and combines them to complete the theorem proof.
  • As σ→0, the finite-difference estimator’s expectation and norm converge to those of the local linear approximation.

A.2 Proof of Eq. (11)

This proof constructs a random vector whose second-moment matrix combines a transfer-prior direction with isotropic variation in its orthogonal complement. It establishes the needed expectation identities using orthonormal-basis decompositions and symmetry.

  • Construction: The construction decomposes a random vector into a component along v and a residual component orthogonal to v.The residual is formed from r ≜ (I − vv⊤)ξ, with ξ uniformly sampled from the unit hypersphere.
  • Expectation identities: Symmetry gives zero mean for the residual, so E[vr⊤] = E[rv⊤] = 0.The residual coefficients are uniformly distributed on the orthogonal unit hypersphere.
  • Expectation identities: For a uniformly sampled unit-hypersphere vector, symmetry makes diagonal second moments equal and off-diagonal moments vanish.The resulting second-moment matrix is proportional to the identity on the relevant orthogonal subspace.
  • Conclusion: The resulting construction satisfies E[uu⊤] = λvv⊤ + (1 − λ)/(D − 1)(I − vv⊤).The proof combines the v component, the residual second moment, and the vanishing cross terms.

A.3 Proof of Eq. (12)

The proof determines the optimal coefficient λ by minimizing the gradient-estimation objective over the closed interval [0, 1]. The solution depends on the transfer gradient's alignment with the true gradient, the query count, and the dimension, and is monotonic in key parameters.

  • Optimization: The optimization evaluates the endpoints λ = 0 and λ = 1 together with stationary points of F(λ).At most two stationary solutions arise, and λ2 is outside (0, 1), leaving λ1 as the interior candidate.
  • Endpoint and stationary cases: The interior solution λ1 lies in (0, 1) only when α2 lies between 1/(D + 2q − 2) and (2q − 1)/(D + 2q − 2).Outside this range, the optimum is determined by endpoint comparisons.
  • Monotonicity: λ∗ increases monotonically with α2 and decreases monotonically with q when α2 > 1/D.The proof establishes the query-count monotonicity in the regime where the transfer alignment exceeds 1/D.
  • Data-dependent prior: With a data-dependent prior, the corresponding optimization uses the transfer alignment α, subspace alignment A2, dimension d, and query count q.The construction must account for non-orthogonality between the transfer direction and the data-dependent subspace; an orthogonalized alternative is computationally expensive.

B Gradient averaging method

The gradient averaging method combines a normalized transfer gradient with a normalized ordinary RGF estimate using an analytically chosen weight. It can return the transfer gradient directly when averaging would provide only marginal improvement, thereby saving queries.

  • Algorithm: The algorithm estimates α and E[β], computes µ∗, and returns either v or µ∗v + (1 − µ∗)ˆgU depending on threshold c.When µ∗ ≥ c, it returns v to avoid queries that would provide only marginal improvement.
  • Method: Gradient averaging forms ˆg = µv + (1 − µ)ˆgU, where µ weights the normalized transfer gradient against the ordinary RGF estimator.The ordinary RGF estimator is used rather than P-RGF to avoid making the estimate too similar to the transfer direction.
  • Analysis: The analysis assumes α = v⊤∇f(x) ≥ 0 and uses local linearity to derive the estimator loss and its limiting behavior for differentiable f.For non-locally-linear f, the loss approaches the locally linear case as σ becomes sufficiently small.
  • Optimal weighting: The approximately optimal weight is µ∗ ≈ α/(E[β] + α), matching the ratio of expected alignments with the true gradient.Here α measures transfer-gradient alignment and E[β] characterizes the RGF estimator.
  • Estimator statistics: E[β] is independent of the gradient norm and direction, and depends on the input dimension D and query count q.The paper estimates this quantity through numerical simulation or a closed-form approximation.

B.1 Incorporating the data-dependent prior

The method also combines the transfer gradient with an ordinary subspace RGF estimate to exploit a data-dependent prior. Its analysis uses the gradient projection into the subspace and shows that the approximate averaging weight matches the case without that prior.

  • Method: The data-dependent variant first obtains an ordinary subspace RGF estimate, normalizes it, and averages it with the normalized transfer gradient.The ordinary subspace estimator uses samples confined to the data-dependent subspace.
  • Analysis: The analysis represents the subspace contribution through the projected gradient ∇f(x)T and its squared norm A2.It also defines α1 as the transfer gradient's inner product with the projected gradient.
  • Estimator statistics: The subspace RGF estimator is symmetric around the projected-gradient direction, yielding an expected estimator proportional to that projection.This provides the expectation needed for the averaging analysis.
  • Optimal weighting: The approximate solution for the averaging weight is the same as without the data-dependent prior and does not depend on α1.The corresponding subspace RGF objective uses F(0) = A2q/(d + q − 1).
  • Estimating subspace quantities: The method estimates the subspace gradient norm and its projection using random samples drawn uniformly from the subspace hypersphere.These samples support estimates of the projection-related quantity A.

D Additional experiments

The additional experiments evaluate P-RGF under both ℓ2 and ℓ∞ norms, covering normal and defensive black-box models. Results report attack success rate and average queries, with better ℓ∞ results consistent with the ℓ2 findings.

  • Gradient averaging: The gradient-averaging experiments compare fixed µ values of 0.5 and 0.05 with the theoretically optimal µ∗.The optimal coefficient is taken from Eq. (B.4), or Eq. (B.7) for the data-dependent prior.
  • ℓ2-norm experiments: The ℓ2 experiments report attack success rate and average queries for normal models and defensive models.Tables 3 and 4 cover standard classifiers and defenses, respectively.
  • ℓ∞-norm experiments: The ℓ∞ experiments use ϵ = 0.05 and η = 0.005 for PGD, evaluating normal and defensive models.The reported results show better performance consistent with the ℓ2-norm experiments.
Loading 1906.06919v3…