TL;DR
SurFree introduces a geometric, surrogate-free black-box attack method that significantly reduces query counts while maintaining effectiveness, especially in decision-based attack scenarios.
Contribution
The paper presents SurFree, a novel geometric approach that eliminates the need for costly surrogate models in black-box decision-based attacks, reducing query complexity.
Findings
SurFree achieves faster distortion decay with fewer queries.
It outperforms previous methods in low-query scenarios.
Maintains competitive performance at higher query budgets.
Abstract
Machine learning classifiers are critically prone to evasion attacks. Adversarial examples are slightly modified inputs that are then misclassified, while remaining perceptively close to their originals. Last couple of years have witnessed a striking decrease in the amount of queries a black box attack submits to the target classifier, in order to forge adversarials. This particularly concerns the black-box score-based setup, where the attacker has access to top predicted probabilites: the amount of queries went from to millions of to less than a thousand. This paper presents SurFree, a geometrical approach that achieves a similar drastic reduction in the amount of queries in the hardest setup: black box decision-based attacks (only the top-1 label is available). We first highlight that the most recent attacks in that setup, HSJA, QEBA and GeoDA all perform costly gradient surrogate…
Peer Reviews
No public reviews on file for this paper yet. If you reviewed it on a platform where reviews are public (OpenReview, ICLR, NeurIPS, ICML), you can paste yours below so the community can read it here.
Code & Models
Videos
No videos yet. Explain this paper in a talk, walkthrough, or lecture? Add one.
