Curvature Dynamic Black-box Attack: revisiting adversarial robustness via dynamic curvature estimation

TL;DR

This paper introduces a novel, query-efficient method called DCE for estimating decision boundary curvature in black-box models, revealing its link to robustness and enhancing attack performance.

Contribution

It proposes a new dynamic curvature estimation method and a curvature-based attack, providing insights into the relationship between boundary curvature and robustness.

Findings

Decision boundary curvature correlates with adversarial robustness.

CDBA outperforms existing black-box attack methods.

Dynamic curvature estimation is effective and query-efficient.

Abstract

Adversarial attack reveals the vulnerability of deep learning models. It is assumed that high curvature may give rise to rough decision boundary and thus result in less robust models. However, the most commonly used \textit{curvature} is the curvature of loss function, scores or other parameters from within the model as opposed to decision boundary curvature, since the former can be relatively easily formed using second order derivative. In this paper, we propose a new query-efficient method, dynamic curvature estimation (DCE), to estimate the decision boundary curvature in a black-box setting. Our approach is based on CGBA, a black-box adversarial attack. By performing DCE on a wide range of classifiers, we discovered, statistically, a connection between decision boundary curvature and adversarial robustness. We also propose a new attack method, curvature dynamic black-box attack (CDBA) with improved performance using the estimated curvature.