Universal Distributional Decision-Based Black-Box Adversarial Attack with Reinforcement Learning

Research output: Contribution to book/Conference proceedings/Anthology/ReportConference contributionContributedpeer-review

Contributors

  • Yiran Huang - , Karlsruhe Institute of Technology (Author)
  • Yexu Zhou - , Karlsruhe Institute of Technology (Author)
  • Michael Hefenbrock - , Karlsruhe Institute of Technology (Author)
  • Till Riedel - , Karlsruhe Institute of Technology (Author)
  • Likun Fang - , Karlsruhe Institute of Technology (Author)
  • Michael Beigl - , Karlsruhe Institute of Technology (Author)

Abstract

The vulnerability of the high-performance machine learning models implies a security risk in applications with real-world consequences. Research on adversarial attacks is beneficial in guiding the development of machine learning models on the one hand and finding targeted defenses on the other. However, most of the adversarial attacks today leverage the gradient or logit information from the models to generate adversarial perturbation. Works in the more realistic domain: decision-based attacks, which generate adversarial perturbation solely based on observing the output label of the targeted model, are still relatively rare and mostly use gradient-estimation strategies. In this work, we propose a pixel-wise decision-based attack algorithm that finds a distribution of adversarial perturbation through a reinforcement learning algorithm. We call this method Decision-based Black-box Attack with Reinforcement learning (DBAR). Experiments show that the proposed approach outperforms state-of-the-art decision-based attacks with a higher attack success rate and greater transferability.

Details

Original languageEnglish
Title of host publicationNeural Information Processing
EditorsMohammad Tanveer, Sonali Agarwal, Seiichi Ozawa, Asif Ekbal, Adam Jatowt
PublisherSpringer, Cham
Pages206–215
Number of pages10
ISBN (electronic)978-3-031-30111-7
ISBN (print)978-3-031-30110-0
Publication statusPublished - 2023
Peer-reviewedYes
Externally publishedYes

Publication series

SeriesLecture Notes in Computer Science, Volume 13625
ISSN0302-9743

External IDs

Scopus 85161696199

Keywords

Keywords

  • Adversarial attack, Reinforcement Learning, Decision attack

Library keywords