Adversarial Robustness Testing via Zeroth-Order ADMM Gradient Estimation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for adversarial robustness testing of black-box AI and ML models are inefficient, particularly in black-box settings where internal system information is not accessible, leading to high computational intensity and limited effectiveness in generating imperceptible adversarial examples.
Innovation Solution
A computer-implemented adversarial robustness testing method using an accelerator that employs efficient gradient estimation via random directional estimates and averaging, dimension reduction, and problem splitting through the Zeroth-Order ADMM (ZO-ADMM) framework to generate adversarial examples with minimal distortion and imperceptibility.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If gradient estimation via zeroth-order optimization (ZOO) is used for black-box attacks, then adversarial examples can be generated without internal system access, but the computational intensity becomes very high due to requiring a large number of queries per iteration
Solution Approach 1:
The patent segments the gradient estimation process into multiple independent random directional estimates that are averaged together. Instead of using a single complex gradient estimation requiring many queries, the method divides the problem into multiple simpler directional estimates (e.g., 2-10 random directions) that can be computed independently and then averaged to obtain the final gradient approximation, significantly reducing the number of queries needed per iteration.
Solution Approach 2:
The patent performs preliminary action by pre-computing and caching gradient estimates at each iteration before the main optimization step. The method calculates random directional gradient estimates in advance, averages them to obtain a preliminary gradient approximation, and then uses this pre-computed gradient for the parameter update, rather than computing gradients on-demand during the optimization process.
2Productivity
If greedy local search is used to estimate output gradient via perturbing only a subset of input components, then computational efficiency is improved, but the crafted noises appear more visible and do not explicitly minimize distortion between original and perturbed inputs
Solution Approach 1:
The patent applies parameter changes by modifying the optimization objective to explicitly minimize the L2 norm (distortion) between original and perturbed inputs. The method incorporates an L2 regularization term in the loss function that penalizes large perturbations, forcing the adversarial example generation to find solutions with minimal distortion. This parameter adjustment ensures that the crafted noises remain imperceptible while still achieving the attack objective.
3Adaptability or versatility
If conventional black-box attack methods are used, then attack generation is possible without internal system knowledge, but the number of queries required per iteration is very large leading to slow convergence
Solution Approach 1:
The patent implements feedback by using the averaged random directional gradient estimates to guide the iterative optimization process. The method computes gradient information from query responses, averages multiple directional estimates to reduce variance, and uses this feedback to update the adversarial example in the direction that maximizes misclassification while minimizing distortion. This feedback loop enables efficient convergence with fewer queries per iteration.
Data Source
AI summary
An adversarial robustness testing method, system, and computer program product include testing, via an accelerator, a robustness of a black-box system under different access settings, where the testing includes tearing down the robustness testing to a subtask of a predetermined size.