Simple and Efficient Hard Label Black-box Adversarial Attacks in Low Query Budget Regimes

TL;DR

This paper introduces a Bayesian Optimization-based method for black-box adversarial attacks that operates efficiently within low query budgets by searching in a low-dimensional subspace, significantly improving success rates and reducing queries.

Contribution

The paper presents a novel BO-based attack in a low-dimensional subspace, enhancing efficiency and success rate in hard label black-box adversarial attacks.

Findings

Achieves 2x to 10x higher attack success rates

Requires 10x to 20x fewer queries

Effective on MNIST, CIFAR-10, and ImageNet datasets

Abstract

We focus on the problem of black-box adversarial attacks, where the aim is to generate adversarial examples for deep learning models solely based on information limited to output label~(hard label) to a queried data input. We propose a simple and efficient Bayesian Optimization~(BO) based approach for developing black-box adversarial attacks. Issues with BO's performance in high dimensions are avoided by searching for adversarial examples in a structured low-dimensional subspace. We demonstrate the efficacy of our proposed attack method by evaluating both $\ell_\infty$ and $\ell_2$ norm constrained untargeted and targeted hard label black-box attacks on three standard datasets - MNIST, CIFAR-10 and ImageNet. Our proposed approach consistently achieves 2x to 10x higher attack success rate while requiring 10x to 20x fewer queries compared to the current state-of-the-art black-box adversarial attacks.