Source-linked AI summary
DaST: Data-free Substitute Training for Adversarial Attacks
Mingyi Zhou, Jing Wu, Yipeng Liu, Shuaicheng Liu, Ce Zhu
TL;DR
Black-box substitute attacks commonly require pre-trained models or real data, which can be difficult to obtain. DaST trains substitute models without real data using GAN-generated samples labeled by the attacked model and mechanisms for controlling their label distribution. The method achieves competitive substitute-model performance and causes an online Microsoft Azure model to misclassify 98.35% of crafted adversarial examples.
Problem
Current black-box substitute attacks require pre-trained models or real data, while pre-trained models can be hard to obtain in real-world tasks.
Method
DaST uses GAN-generated synthetic samples, labels them with the attacked model, and applies multi-branch generation with label control to address uneven sample distributions.
Results
98.35% of adversarial examples crafted by DaST were misclassified by the remote online model on Microsoft Azure, while experiments showed the method's effectiveness.
Takeaways & Limitations
DaST trains substitute models without real data, indicating that attackers can do so even when real input data is hard to collect.
Takeaways & Limitations
DaST cannot generate adversarial examples alone and must be used with other gradient-based attack methods.
Abstract
from arXiv · showhide
Machine learning models are vulnerable to adversarial examples. For the black-box setting, current substitute attacks need pre-trained models to generate adversarial examples. However, pre-trained models are hard to obtain in real-world tasks. In this paper, we propose a data-free substitute training method (DaST) to obtain substitute models for adversarial black-box attacks without the requirement of any real data. To achieve this, DaST utilizes specially designed generative adversarial networks (GANs) to train the substitute models. In particular, we design a multi-branch architecture and label-control loss for the generative model to deal with the uneven distribution of synthetic samples. The substitute model is then trained by the synthetic samples generated by the generative model, which are labeled by the attacked model subsequently. The experiments demonstrate the substitute models produced by DaST can achieve competitive performance compared with the baseline models which are trained by the same train set with attacked models. Additionally, to evaluate the practicability of the proposed method on the real-world task, we attack an online machine learning model on the Microsoft Azure platform. The remote model misclassifies 98.35% of the adversarial examples crafted by our method. To the best of our knowledge, we are the first to train a substitute model for adversarial attacks without any real data.
1. Introduction
Black-box attacks are practical but typically require either many queries or a pre-trained substitute model, which is difficult to obtain when real data is unavailable. DaST addresses this gap by training substitute models from GAN-generated, attacked-model-labeled samples, with architectural and loss designs to improve label coverage.
- Black-box attacks are more practical than white-box attacks, but query-based methods require numerous attacked-model queries for each adversarial example.
- Gradient-based black-box attacks use substitute models and adversarial-example transferability, commonly relying on pre-trained models or training data.
- DaST trains substitute models without any real data by generating synthetic samples with GANs and labeling them through the attacked model.
- Multi-branch generation and a label-control loss address uneven synthetic-sample distributions and help cover all categories.
- DaST is evaluated on local models and an online machine learning system, including probability-only and label-only attack scenarios.
- Different substitute-model architectures are tested to assess how model capacity influences attack success rate.
2. Related Works
Related work distinguishes white-box and black-box attacks and describes gradient-based, query-based, and defense methods. Black-box attacks are more practical for real tasks, but gradient-based approaches rely on substitute models and transferability, while query-based approaches directly probe attacked models.
- Black-box attacks restrict access to the attacked model and are described as more practical for real tasks than white-box attacks.
- Adversarial Attacks: Gradient-based attacks use a pre-trained substitute model to generate adversarial examples and transfer them to the attacked model.
- Adversarial Defenses: Adversarial defenses include adversarial training, input transformations, nonlinear transformations, and gradient masking methods.
3. Method
DaST trains a substitute model without real images by adversarially pairing a generator with a model that imitates the attacked model. A label-controllable, multi-branch generator addresses uneven synthetic-data coverage so the substitute can generate transferable adversarial examples in label-only and probability-only settings.
- Data-free substitute training: DaST trains a substitute model without real images by generating synthetic samples and labeling them through queries to the attacked model.The substitute is trained on image-output pairs (bX, T(bX)), while the generator explores differences between the attacked and substitute models.
- Attack scenarios: In label-only attacks, the substitute and attacked model outputs are compared with cross entropy; in probability-only attacks, their output probabilities are compared directly.The attacked model supplies either hard labels or output probabilities, depending on the scenario.
- Adversarial training: The generator seeks samples where the substitute and attacked models differ, while the substitute minimizes their output distance to imitate the attacked model.At the ideal optimum, the substitute matches the attacked model on every generated sample.
- Generator limitation: Without constraining the generator, synthetic data may occupy only a small input-space range, preventing effective substitute training.DaST addresses this limitation with a label-controllable generator designed to control synthetic-data distribution and speed convergence.
- Label-controllable generation: The generator uses N category-specific upsampling branches plus a shared convolutional network, producing bX = G(z, n) from noise z and a label value n.The label-control loss encourages generated samples to follow the selected labels, while the substitute replaces the attacked model when gradients from the attacked model are unavailable.
- Optimization: Training alternates updates to the substitute and generator until substitute accuracy or attack success rate ceases to increase.The generator loss combines the imitation term e^−d(T,D) with a weighted label-control loss, whose weight is set to 0.2 in the experiments.
4. Experiments
Experiments evaluate DaST in label-only and probability-only black-box settings on MNIST and CIFAR-10, using varied substitute architectures and an online Microsoft Azure model. Results show competitive or superior attack performance without pretrained substitute models, including strong Azure attack success after query-based training.
- Experimental settings: Experiments cover MNIST and CIFAR-10 in label-only and probability-only attack scenarios, with attack success rate as the primary evaluation criterion.DaST-L denotes label-only access, while DaST-P denotes probability-only access.
- MNIST: DaST-P and DaST-L achieve 97.82% and 83.95% test accuracy, respectively, on MNIST.These substitute models are evaluated against a pretrained large-network baseline trained on the attacked model’s 60000-image training set.
- MNIST: On MNIST, DaST attack success rates exceed the pretrained baseline across the reported non-targeted and targeted FGSM, BIM, PGD, and C&W comparisons.Reported non-targeted improvements are 10.04%, 10.66%, 16.06%, and 4.01%; targeted improvements are 11.83%, 19.39%, 18.62%, and 13.48%, respectively.
- Architecture analysis: Substitute architecture affects attack performance: the large MNIST model is best on FGSM, BIM, and PGD, whereas the small model is best on C&W.On CIFAR-10, VGG-13 outperforms the other evaluated architectures in most reported attacks.
- CIFAR-10: On CIFAR-10, DaST-P and DaST-L achieve 25.15% and 20.35% test accuracy, while DaST-P outperforms the baseline in most reported probability-only attacks.DaST-L also outperforms the baseline on non-targeted C&W attacks.
- Microsoft Azure: On the Microsoft Azure model, DaST-L reaches 98.21%, 98.35%, and 96.97% attack success on FGSM, BIM, and PGD, respectively.DaST-L converges after 20,000,000 queries, while DaST-P converges after 2,000,000 queries; DaST uses queries during training rather than evaluation.
5. Conclusion
DaST trains substitute models without real data by generating synthetic samples, and experiments demonstrate its effectiveness while identifying a limitation in attack generation.
- DaST trains substitute models for adversarial attacks without requiring real data.The method uses GAN-generated synthetic samples to reduce the prerequisites of substitute attacks.
- The synthetic samples support visualized adversarial examples for both DaST-P and DaST-L, including Azure attacks.Figures 4 and 5 show synthetic samples and Azure adversarial examples for the two scenarios.
- The Azure experiments include attack success rates for BIM attacks during training.Figure 6 reports the attack success rate of BIM attacks generated by DaST in the Azure training stage.
- The experiments indicate that attackers can train substitute models even when real input data is difficult to collect.The conclusion connects DaST's effectiveness with risks to machine learning systems when real input data is hard to obtain.
- DaST cannot generate adversarial examples by itself and must be used with other gradient-based attack methods.The paper identifies direct attack generation as future work.