论文标题
一种用于在深网中生成对抗实例的进化，无梯度，有效的黑盒算法
An Evolutionary, Gradient-Free, Query-Efficient, Black-Box Algorithm for Generating Adversarial Instances in Deep Networks
论文作者
论文摘要
深度神经网络（DNNS）在各种方案中对对抗数据敏感，包括黑框方案，在该方案中，只允许攻击者查询训练有素的模型并接收输出。现有的黑框方法用于创建对抗性实例的方法是昂贵的，通常使用梯度估计或培训替换网络。本文介绍了\ textbf {qu} ery-效率\ textbf {e} volutiona \ textbf {ry} \ textbf {textbf {textbf {textIt {query Attack}，一个未靶向的，基于得分的，基于分数的，黑色盒子攻击。查询攻击基于一个新的目标函数，该目标函数可用于无梯度优化问题。攻击仅需要访问分类器的输出逻辑，因此不受梯度掩蔽的影响。不需要其他信息，使我们的方法更适合现实生活中的情况。我们使用三个基准数据集（MNIST，CIFAR10和Imagenet）使用三种不同的最先进模型（Inception-V3，Resnet-50和VGG-16-BN）测试其性能。此外，我们评估了查询攻击在非不同的变换防御和最先进的强大模型上的性能。我们的结果证明了查询攻击的出色性能，无论是准确的得分还是查询效率。
Deep neural networks (DNNs) are sensitive to adversarial data in a variety of scenarios, including the black-box scenario, where the attacker is only allowed to query the trained model and receive an output. Existing black-box methods for creating adversarial instances are costly, often using gradient estimation or training a replacement network. This paper introduces \textbf{Qu}ery-Efficient \textbf{E}volutiona\textbf{ry} \textbf{Attack}, \textit{QuEry Attack}, an untargeted, score-based, black-box attack. QuEry Attack is based on a novel objective function that can be used in gradient-free optimization problems. The attack only requires access to the output logits of the classifier and is thus not affected by gradient masking. No additional information is needed, rendering our method more suitable to real-life situations. We test its performance with three different state-of-the-art models -- Inception-v3, ResNet-50, and VGG-16-BN -- against three benchmark datasets: MNIST, CIFAR10 and ImageNet. Furthermore, we evaluate QuEry Attack's performance on non-differential transformation defenses and state-of-the-art robust models. Our results demonstrate the superior performance of QuEry Attack, both in terms of accuracy score and query efficiency.
