Adversarial Examples and Cloud Detectors: A Black-Box Empirical Study
Adversarial Examples Versus Cloud-based Detectors: A Black-box Empirical Study
Translation in progress — untranslated text is omitted.
The researchers proposed four types of black-box adversarial example attacks combined with semantic segmentation, with success rates approaching 100% at the highest on the image detection services of five cloud platforms. The four types of attacks are image processing, single pixel, subject-based local search and subject-based boundary attack; adversarial examples are generated only by querying the black-box API, some iterative attacks require only several thousand queries, and all experiments were completed using the platforms' free quotas. On AWS, Azure, Google Cloud, Baidu Cloud and Alibaba Cloud, the success rate of the image-processing-based attack reached about 100%, and the semantic-segmentation-based attacks exceeded 90% on the violence, politician and pornography detection services, with differences among platforms in detection strength for different content types. The authors also discussed potential defenses such as adversarial training, input detection, randomization and limiting the number of queries, and said they had reported the vulnerabilities to the relevant cloud platforms.
- The violence, politician, pornography and other image detection services provided by cloud platforms have more complex structures than classifiers and are exposed as black-box APIs; the authors believe their adversarial example risk has not been sufficiently studied.
- The authors propose four black-box attacks: the IP attack based on five image processing techniques, the SP attack combined with semantic segmentation, the subject-region-based local search SBLS attack, and the subject-region-based boundary SBB attack, requiring only the labels and probabilities/scores returned by the API.
- On the five cloud platforms AWS, Azure, Google, Baidu and Alibaba, the authors report that the IP attack success rate is about 100% and the semantic-segmentation-based attacks exceed 90% (Table 2); iterative attacks generate adversarial examples in at most fewer than 3000 queries (Table 9).
- The authors state that defenses such as adversarial training, input detection and randomization could not be tested because the models are hosted by third parties; Median Filter can defend against most Salt-and-Pepper, SP and SBLS attacks but reduces detection accuracy; the authors plan to improve the algorithms and study general attack methods.
The paper empirically tests four types of black-box attacks on five cloud platforms, compares the vulnerability of different image moderation services on pornographic, violent and political content, and can be used to assess the adversarial risk of cloud content moderation.