【论文阅读】Learning Black-Box Attackers with Transferable Priors and Query Feedback（2020）

摘要

This paper addresses（解决） the challenging black-box adversarial attack problem（黑盒对抗攻击问题）, where only classification confidence（分类置信度） of a victim model（受害者模型） is available. Inspired by consistency（一致性） of visual saliency（视觉显著性） between different vision models（视觉模型）, a surrogate model（代理模型） is expected to improve the attack performance（攻击性能） via transferability（可转移性）. By combining（结合） transferability-based（基于可转移性） and query-based（基于查询） black-box attack, we propose a surprisingly simple baseline approach（基线方法） (named SimBA++) using the surrogate model（代理模型）, which significantly outperforms（明显优于） several state-of-the-art（最先进的） methods. Moreover（此外）, to efficiently utilize（有效利用） the query feedbac（查询反馈）, we update the surrogate model（代理模型） in a novel learning scheme（新的学习方案）, named High-Order Gradient Approximation (HOGA 高阶梯度近似). By constructing（构造） a high-order gradient computation graph（高阶梯度计算图）, we update the surrogate model to approximate（逼近） the victim model in both forward and backward pass（正向和反向传递）. The SimBA++ and HOGA result in Learnable Black-Box Attack（可学习的黑盒攻击） (LeBA), which surpasses（超过） previous state of the art by considerable margins: the proposed LeBA significantly reduces queries（减少了查询）, while keeping higher attack success rates（攻击成功率） close to（接近） 100% in extensive（广泛的） Ima-geNet experiments, including attacking vision benchmarks and defensive models（攻击视觉基准和防御模型）.

算法

论文链接

Learning black-box attackers with transferable priors and query feedback

笔记

在模型窃取攻击中，攻击者通过对受害者模型进行查询，并利用查询结果反向构建具有相似功能的替代模型。然后，攻击者可以利用替代模型发起进一步的对抗攻击。