Query-efficient decision-based adversarial attack with low query budget
摘要
Today’s deep neural networks have excellent performance on a variety of tasks. However, the emergence of adversarial examples has raised concerns about the security of the models. Attacks on real-world models are difficult because real-world models only return the final decision. While the decision-based attacks can generate adversarial examples solely based on the model’s hard-label information, which makes it closest to real-world. However, existing decision-based attacks still require thousands of queries to generate good quality adversarial examples. Therefore, in order to generate high-quality adversarial examples with low query budget, we present a novel decision-based attack one plane one query attack (OPOQA). The main idea of the OPOQA is to generate more candidate examples in each iteration for random exploration of the decision boundary and select the most suitable adversarial example for the next iteration. In each iteration, we sample from the low-frequency discrete cosine transform (DCT) space and transform it back to the pixel space via inverse DCT (iDCT). This generates a set of random vectors in the pixel space which form a two-dimensional (2D) plane. Only one candidate sample is generated on this plane to reduce the number of queries. Non-target attacks on six mainstream models–Inception-v3, ResNet, VGG, Vit, and others–performed on the ImageNet validation set (200 randomly selected images) show that, with a query budget of 1000 and RMSE thresholds of 0.05 and 0.01(where RMSE