An empirical study of derivative-free-optimization algorithms for targeted black-box attacks in deep neural networks
We perform a comprehensive study on the performance of derivative free optimization (DFO) algorithms for the generation of targeted black-box adversarial attacks on Deep Neural Network (DNN) classifiers assuming the perturbation energy is bounded by an ℓ∞ constraint and the number of queries to the...
| Main Authors: | , , |
|---|---|
| פורמט: | Journal article |
| שפה: | English |
| יצא לאור: |
Springer
2021
|
| _version_ | 1826308531612024832 |
|---|---|
| author | Ughi, G Abrol, V Tanner, J |
| author_facet | Ughi, G Abrol, V Tanner, J |
| author_sort | Ughi, G |
| collection | OXFORD |
| description | We perform a comprehensive study on the performance of derivative free optimization (DFO) algorithms for the generation of targeted black-box adversarial attacks on Deep Neural Network (DNN) classifiers assuming the perturbation energy is bounded by an ℓ∞ constraint and the number of queries to the network is limited. This paper considers four pre-existing state-of-the-art DFO-based algorithms along with a further developed algorithm built on BOBYQA, a model-based DFO method. We compare these algorithms in a variety of settings according to the fraction of images that they successfully misclassify given a maximum number of queries to the DNN. The experiments disclose how the likelihood of finding an adversarial example depends on both the algorithm used and the setting of the attack; algorithms limiting the search of adversarial example to the vertices of the ℓ∞ constraint work particularly well without structural defenses, while the presented BOBYQA based algorithm works better for especially small perturbation energies. This variance in performance highlights the importance of new algorithms being compared to the state-of-the-art in a variety of settings, and the effectiveness of adversarial defenses being tested using as wide a range of algorithms as possible. |
| first_indexed | 2024-03-07T07:20:51Z |
| format | Journal article |
| id | oxford-uuid:164a7e43-aea2-48a3-98cc-14fb7202cb7a |
| institution | University of Oxford |
| language | English |
| last_indexed | 2024-03-07T07:20:51Z |
| publishDate | 2021 |
| publisher | Springer |
| record_format | dspace |
| spelling | oxford-uuid:164a7e43-aea2-48a3-98cc-14fb7202cb7a2022-10-07T09:32:26ZAn empirical study of derivative-free-optimization algorithms for targeted black-box attacks in deep neural networksJournal articlehttp://purl.org/coar/resource_type/c_dcae04bcuuid:164a7e43-aea2-48a3-98cc-14fb7202cb7aEnglishSymplectic ElementsSpringer2021Ughi, GAbrol, VTanner, JWe perform a comprehensive study on the performance of derivative free optimization (DFO) algorithms for the generation of targeted black-box adversarial attacks on Deep Neural Network (DNN) classifiers assuming the perturbation energy is bounded by an ℓ∞ constraint and the number of queries to the network is limited. This paper considers four pre-existing state-of-the-art DFO-based algorithms along with a further developed algorithm built on BOBYQA, a model-based DFO method. We compare these algorithms in a variety of settings according to the fraction of images that they successfully misclassify given a maximum number of queries to the DNN. The experiments disclose how the likelihood of finding an adversarial example depends on both the algorithm used and the setting of the attack; algorithms limiting the search of adversarial example to the vertices of the ℓ∞ constraint work particularly well without structural defenses, while the presented BOBYQA based algorithm works better for especially small perturbation energies. This variance in performance highlights the importance of new algorithms being compared to the state-of-the-art in a variety of settings, and the effectiveness of adversarial defenses being tested using as wide a range of algorithms as possible. |
| spellingShingle | Ughi, G Abrol, V Tanner, J An empirical study of derivative-free-optimization algorithms for targeted black-box attacks in deep neural networks |
| title | An empirical study of derivative-free-optimization algorithms for targeted black-box attacks in deep neural networks |
| title_full | An empirical study of derivative-free-optimization algorithms for targeted black-box attacks in deep neural networks |
| title_fullStr | An empirical study of derivative-free-optimization algorithms for targeted black-box attacks in deep neural networks |
| title_full_unstemmed | An empirical study of derivative-free-optimization algorithms for targeted black-box attacks in deep neural networks |
| title_short | An empirical study of derivative-free-optimization algorithms for targeted black-box attacks in deep neural networks |
| title_sort | empirical study of derivative free optimization algorithms for targeted black box attacks in deep neural networks |
| work_keys_str_mv | AT ughig anempiricalstudyofderivativefreeoptimizationalgorithmsfortargetedblackboxattacksindeepneuralnetworks AT abrolv anempiricalstudyofderivativefreeoptimizationalgorithmsfortargetedblackboxattacksindeepneuralnetworks AT tannerj anempiricalstudyofderivativefreeoptimizationalgorithmsfortargetedblackboxattacksindeepneuralnetworks AT ughig empiricalstudyofderivativefreeoptimizationalgorithmsfortargetedblackboxattacksindeepneuralnetworks AT abrolv empiricalstudyofderivativefreeoptimizationalgorithmsfortargetedblackboxattacksindeepneuralnetworks AT tannerj empiricalstudyofderivativefreeoptimizationalgorithmsfortargetedblackboxattacksindeepneuralnetworks |