Boosting Black-Box Adversarial Attacks with Meta Learning

TL;DR

This paper introduces a hybrid black-box adversarial attack method using meta adversarial perturbations trained on surrogate models, significantly improving success rates and reducing query counts in attacking deep neural networks.

Contribution

It proposes a novel meta adversarial perturbation approach that enhances existing black-box attack methods through transferability and universality, boosting efficiency and effectiveness.

Findings

Increases attack success rates significantly.

Reduces the number of queries needed for successful attacks.

Enhances transferability of adversarial perturbations.

Abstract

Deep neural networks (DNNs) have achieved remarkable success in diverse fields. However, it has been demonstrated that DNNs are very vulnerable to adversarial examples even in black-box settings. A large number of black-box attack methods have been proposed to in the literature. However, those methods usually suffer from low success rates and large query counts, which cannot fully satisfy practical purposes. In this paper, we propose a hybrid attack method which trains meta adversarial perturbations (MAPs) on surrogate models and performs black-box attacks by estimating gradients of the models. Our method uses the meta adversarial perturbation as an initialization and subsequently trains any black-box attack method for several epochs. Furthermore, the MAPs enjoy favorable transferability and universality, in the sense that they can be employed to boost performance of other black-box adversarial attack methods. Extensive experiments demonstrate that our method can not only improve the attack success rates, but also reduces the number of queries compared to other methods.