ABCAttack: A Gradient-Free Optimization Black-Box Attack for Fooling Deep Image Classifiers

Entropy

Prosanta Gope¹  Han Cao²  Yanxiao Liu²  Qindong Sun²  Chengxiang Si³  Shancang Li⁴ 

[1] Department of Computer Science, University of Sheffield, Sheffield S10 2TN, UK;Key Laboratory of Network Computing and Security, Xi’an University of Technology, Xi’an 710048, China;National Computer Network Emergency Response Technical Team/Coordination Center of China (CNCERT/CC), Beijing 100029, China;The Department of Computer Science and Creative Technology, University of the West of England, Bristol BS16 1QY, UK;

关键词: deep neural networks;    adversarial examples;    image classification;    information security;    black-box attack;   

DOI  :  10.3390/e24030412

来源: DOAJ

【 摘 要 】

The vulnerability of deep neural network (DNN)-based systems makes them susceptible to adversarial perturbation and may cause classification task failure. In this work, we propose an adversarial attack model using the Artificial Bee Colony (ABC) algorithm to generate adversarial samples without the need for a further gradient evaluation and training of the substitute model, which can further improve the chance of task failure caused by adversarial perturbation. In untargeted attacks, the proposed method obtained 100%, 98.6%, and 90.00% success rates on the MNIST, CIFAR-10 and ImageNet datasets, respectively. The experimental results show that the proposed ABCAttack can not only obtain a high attack success rate with fewer queries in the black-box setting, but also break some existing defenses to a large extent, and is not limited by model structure or size, which provides further research directions for deep learning evasion attacks and defenses.

【 授权许可】

Unknown