Adversarial Attack Surrogate Model Gradient Perturbation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for finding successful adversarial attacks on perception components, particularly in black-box settings, require a large number of queries to the victim model, making them inefficient.
Innovation Solution
The method employs a surrogate model to iteratively perturb inputs based on the gradient of an attack loss function, using a primary attack process and a backup process to reduce the number of queries required to find a successful attack.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a large number of queries are used to find successful adversarial attacks on the victim model, then the attack reliability is improved, but the query efficiency deteriorates
Solution Approach 1:
The patent uses a surrogate model that copies the essential characteristics of the victim model to generate attack directions. The surrogate model is trained to match the victim model's behavior on attack loss functions, allowing the attacker to query the surrogate instead of the victim for gradient information. This copying approach enables reliable attacks with fewer queries since the surrogate can provide continuous gradient guidance without requiring extensive querying of the victim model.
Solution Approach 2:
The surrogate model acts as an intermediary between the attacker and the victim model. It mediates the attack process by providing gradient information and attack direction guidance without requiring direct, frequent queries to the victim. The intermediary surrogate model is queried much less frequently than the victim, reducing the overall query count while maintaining attack effectiveness through its ability to approximate the victim's behavior.
2Productivity
If a surrogate model is used to compute gradients for attack directions, then the query efficiency is improved, but the device complexity increases
Solution Approach 1:
The surrogate model is a simplified copy of the victim model that replicates only the necessary behavior for attack generation. It copies the input-output relationship and loss function computation but does not require full access to the victim's architecture or parameters. This selective copying reduces the complexity burden on the attacker while maintaining the ability to compute accurate attack gradients efficiently.
Solution Approach 2:
The surrogate model is pre-trained before the actual attack process, performing the preliminary action of learning the victim model's behavior patterns and attack loss landscape. This preliminary training allows the surrogate to provide immediate gradient guidance during the attack without requiring complex real-time analysis of the victim model, simplifying the overall attack procedure while improving query efficiency.
Data Source
AI summary
A computer-implemented method of generating black-box adversarial inputs to a perception component using a surrogate model of the perception component comprises receiving an initial input to the perception component and repeatedly perturbing the initial input until an adversarial input is found that satisfies an attack objective by: performing a primary attack process by perturbing the initial input based on a computed gradient of a surrogate attack loss function of the surrogate model that encodes the attack objective; wherein, if the primary attack process terminates without finding any perturbed input satisfying the promising attack condition, a backup attack process is performed to perform a randomized search of the input space of the perception component, guided by the surrogate model, until a perturbed input satisfying the promising attack condition is found; wherein the primary attack process is repeated based on the perturbed input found by the primary attack process or backup process.