Towards Query-Efficient Black-Box Adversary with Zeroth-Order Natural Gradient Descent

Conference · Fri Apr 03 04:00:00 EDT 2020 · Proceedings of the AAAI Conference on Artificial Intelligence

DOI:https://doi.org/10.1609/aaai.v34i04.6173· OSTI ID:1958810

Zhao, Pu ^[1]; Chen, Pin-yu; Wang, Siyue; Lin, Xue

---

1. University of Nevada, Reno

Despite the great achievements of the modern deep neural networks (DNNs), the vulnerability/robustness of state-of-the-art DNNs raises security concerns in many application domains requiring high reliability. Various adversarial attacks are proposed to sabotage the learning performance of DNN models. Among those, the black-box adversarial attack methods have received special attentions owing to their practicality and simplicity. Black-box attacks usually prefer less queries in order to maintain stealthy and low costs. However, most of the current black-box attack methods adopt the first-order gradient descent method, which may come with certain deficiencies such as relatively slow convergence and high sensitivity to hyper-parameter settings. In this paper, we propose a zeroth-order natural gradient descent (ZO-NGD) method to design the adversarial attacks, which incorporates the zeroth-order gradient estimation technique catering to the black-box attack scenario and the second-order natural gradient descent to achieve higher query efficiency. The empirical evaluations on image classification datasets demonstrate that ZO-NGD can obtain significantly lower model query complexities compared with state-of-the-art attack methods.

• Research Organization: Nevada System of Higher Education
• Sponsoring Organization: USDOE Office of Electricity (OE)
• DOE Contract Number: OE0000911
• OSTI ID: 1958810
• Conference Information: Journal Name: Proceedings of the AAAI Conference on Artificial Intelligence Journal Issue: 04 Journal Volume: 34
• Country of Publication: United States
• Language: English