Sparse-RS: a versatile framework for query-efficient sparse black-box adversarial attacks

Authors: Francesco Croce, Maksym Andriushchenko, Naman D. Singh, Nicolas Flammarion, Matthias Hein
Published: 2020-06-23 | Updated: 2022-02-08

Source: https://arxiv.org/abs/2006.12834

PDF: https://arxiv.org/pdf/2006.12834

Labels Predicted by AI

敵対的攻撃手法 クエリ生成手法 強化学習

Please note that these labels were automatically added by AI. Therefore, they may not be entirely accurate.
For more details, please see the About the Literature Database page.

Abstract

We propose a versatile framework based on random search, Sparse-RS, for score-based sparse targeted and untargeted attacks in the black-box setting. Sparse-RS does not rely on substitute models and achieves state-of-the-art success rate and query efficiency for multiple sparse attack models: l₀-bounded perturbations, adversarial patches, and adversarial frames. The l₀-version of untargeted Sparse-RS outperforms all black-box and even all white-box attacks for different models on MNIST, CIFAR-10, and ImageNet. Moreover, our untargeted Sparse-RS achieves very high success rates even for the challenging settings of 20 × 20 adversarial patches and 2-pixel wide adversarial frames for 224 × 224 images. Finally, we show that Sparse-RS can be applied to generate targeted universal adversarial patches where it significantly outperforms the existing approaches. The code of our framework is available at https://github.com/fra31/sparse-rs.