Cross-domain Cross-architecture Black-box Attacks on Fine-tuned Models with Transferred Evolutionary Strategies

TL;DR

This paper introduces novel black-box attack methods on fine-tuned models across different domains and architectures, utilizing transferred evolutionary strategies to generate adversarial examples efficiently.

Contribution

It proposes two new BAFT settings and a method using an adversarial generator and latent space search guided by surrogate gradients.

Findings

Effective attack on fine-tuned models across domains

Efficient attack method with low-dimensional search

Demonstrated success on various architectures

Abstract

Fine-tuning can be vulnerable to adversarial attacks. Existing works about black-box attacks on fine-tuned models (BAFT) are limited by strong assumptions. To fill the gap, we propose two novel BAFT settings, cross-domain and cross-domain cross-architecture BAFT, which only assume that (1) the target model for attacking is a fine-tuned model, and (2) the source domain data is known and accessible. To successfully attack fine-tuned models under both settings, we propose to first train an adversarial generator against the source model, which adopts an encoder-decoder architecture and maps a clean input to an adversarial example. Then we search in the low-dimensional latent space produced by the encoder of the adversarial generator. The search is conducted under the guidance of the surrogate gradient obtained from the source model. Experimental results on different domains and different network architectures demonstrate that the proposed attack method can effectively and efficiently attack the fine-tuned models.