ZOO: a black-box attack on deep neural networks based on zeroth-order optimization, requiring no training of a substitute model
ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Models
Translation in progress — untranslated text is omitted.
Researchers from the IBM T.J. Watson Research Center and UC Davis proposed the ZOO black-box attack at AISec'17. Using only the target model's input images and output confidence scores, it directly estimates gradients via zeroth-order randomized coordinate descent to generate adversarial examples, without training a substitute model, thereby avoiding the transfer loss of substitute-model attacks. The method combines attack-space dimensionality reduction, hierarchical attack, and importance sampling for acceleration. On MNIST and CIFAR10, the success rate is close to 100%, and the L2 distortion is comparable to the white-box C&W attack, significantly outperforming substitute-model-based black-box attacks; on Inception-v3 on ImageNet, untargeted attacks reach about 90% success rate in about 20 minutes per image, and it successfully changed an image originally classified as a bagel with 97% confidence to the target class grand piano, raising it to top-1. The experimental code has been open-sourced on GitHub.
- How to generate adversarial examples when a black-box attacker can only query the target DNN's inputs and outputs and cannot back-propagate. Existing approaches train a substitute model and then transfer the attack; the authors consider this limited by transfer loss and difficult to scale to ImageNet-level large models.
- Proposes ZOO: rewrites the loss of the C&W attack into a form that depends only on output confidence, estimates gradients (and the Hessian) using symmetric differences, directly optimizes the target model with zeroth-order gradient stochastic coordinate descent (ADAM or a Newton variant), and accelerates it with attack-space dimensionality reduction, hierarchical attack, and importance sampling.
- On MNIST/CIFAR10, ZOO-ADAM's success rate is close to white-box C&W (untargeted 100%, targeted 98.9%/96.8%), higher than substitute-model black-box attacks; on ImageNet Inception-v3, the untargeted attack success rate is 88.9% (Table 2), and one targeted attack completed within 20,000 iterations is reported.
- The authors note that ZOO requires more iterations than white-box attacks, and propose future directions including data-driven acceleration, using it for adversarial training, and extending to other data types such as speech (Conclusion and Future Work). The experiments cover only image classification models on MNIST, CIFAR10, and ImageNet.
The paper proposes ZOO, a black-box attack that requires no training of a substitute model and performs comparably to the white-box C&W attack; teams deploying image classification services can use it to assess the attack risk of query interfaces.
Related papers
- Semantic-aware Adversarial Fine-tuning for CLIPDefensesarXiv