DST: Dynamic Substitute Training for Data-free Black-box Attack

TL;DR

This paper introduces a dynamic substitute training method for data-free black-box attacks on neural networks, adaptively optimizing the substitute model structure and enhancing data quality to improve attack success rates.

Contribution

It proposes a novel dynamic structure learning strategy and a graph-based data quality constraint, advancing the effectiveness of data-free black-box adversarial attacks.

Findings

Outperforms state-of-the-art methods on multiple datasets

Achieves higher attack success rates

Demonstrates adaptability to various models and tasks

Abstract

With the wide applications of deep neural network models in various computer vision tasks, more and more works study the model vulnerability to adversarial examples. For data-free black box attack scenario, existing methods are inspired by the knowledge distillation, and thus usually train a substitute model to learn knowledge from the target model using generated data as input. However, the substitute model always has a static network structure, which limits the attack ability for various target models and tasks. In this paper, we propose a novel dynamic substitute training attack method to encourage substitute model to learn better and faster from the target model. Specifically, a dynamic substitute structure learning strategy is proposed to adaptively generate optimal substitute model structure via a dynamic gate according to different target models and tasks. Moreover, we introduce a task-driven graph-based structure information learning constrain to improve the quality of generated training data, and facilitate the substitute model learning structural relationships from the target model multiple outputs. Extensive experiments have been conducted to verify the efficacy of the proposed attack method, which can achieve better performance compared with the state-of-the-art competitors on several datasets.