Bayesian Optimization for Query-Efficient Black-Box Adversarial Attacks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current black-box adversarial attack methods are inefficient when limited by a small query budget, as they struggle to achieve high attack accuracy without sufficient information about the neural network model, particularly in real-world scenarios where extensive querying is unrealistic.
Innovation Solution
The method employs Bayesian optimization using a Gaussian process to optimize an acquisition function and combines it with dimensionality reduction techniques like nearest-neighbor upsampling to find perturbations that effectively misclassify neural network inputs with minimal queries, allowing for successful adversarial attacks even under tight query constraints.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional black-box adversarial attack methods are used, then attack capability is achieved, but query efficiency is poor and attack accuracy is low when query budget is limited
Solution Approach 1:
The patent introduces an acquisition function as an intermediary between the adversarial attack objective and the query process. This acquisition function guides the search for adversarial perturbations by evaluating promising directions without requiring extensive model queries, thereby improving attack accuracy while reducing query consumption.
Solution Approach 2:
The patent performs preliminary optimization of the acquisition function before executing the main adversarial attack. By pre-computing and optimizing the acquisition function to identify promising perturbation directions, the system reduces the number of queries needed during the actual attack phase, thus improving query efficiency and attack accuracy under limited query budgets.
2Measurement precision
If extensive querying is performed to improve attack accuracy, then measurement precision improves, but productivity decreases due to high query consumption
Solution Approach 1:
The acquisition function serves as a mediator that translates the complex task of finding adversarial perturbations into a guided search process. It evaluates potential perturbation directions and prioritizes those most likely to succeed, reducing the need for exhaustive querying while maintaining high attack accuracy.
Solution Approach 2:
The patent optimizes parameters of the acquisition function to balance exploration and exploitation in the search for adversarial perturbations. By adjusting these parameters, the system achieves high attack accuracy with fewer queries, improving query efficiency without sacrificing measurement precision.
3Reliability
If gradient-based methods are used for black-box attacks, then attack effectiveness improves, but information requirements increase making it impractical for partial information settings
Solution Approach 1:
The acquisition function acts as an intermediary that enables gradient-free optimization for adversarial attacks. It guides the search for effective perturbations using only the information available from model queries, eliminating the need for gradient information while maintaining attack effectiveness in partial information and label-only settings.
Data Source
AI summary
Performing an adversarial attack on a neural network classifier is described. A dataset of input-output pairs is constructed, each input element of the input-output pairs randomly chosen from a search space, each output element of the input-output pairs indicating a prediction output of the neural network classifier for the corresponding input element. A Gaussian process is utilized on the dataset of input-output pairs to optimize an acquisition function to find a best perturbation input element from the dataset. The best perturbation input element is upsampled to generate an upsampled best input element. The upsampled best input element is added to an original input to generate a candidate input. The neural network classifier is queried to determine a classifier prediction for the candidate input. A score for the classifier prediction is computed. The candidate input is accepted as a successful adversarial attack responsive to the classifier prediction being incorrect.