Ensemble adversarial black-box attacks against deep learning systems. (May 2020)

• Record Type: Journal Article
• Authors: Hang, Jie; Han, Keji; Chen, Hui; Li, Yun
• Is Part Of: Pattern recognition. Volume 101(2020:May)
• Publication Date: 2020-05
• Subjects: Black-box attack -- Vulnerability -- Ensemble adversarial attack -- Diversity -- Transferability; Pattern perception -- Periodicals; Perception des structures -- Périodiques; Patroonherkenning; 006.4
• DOI: 10.1016/j.patcog.2019.107184
• Languages: English
• ISSNs: 0031-3203

Abstract

Highlights: Deep learning models, e.g., state-of-the-art convolutional neural networks (CNNs), have been widely applied into security-sensitivity tasks, such as facial recognition, automated driving, etc. Then their vulnerability analysis is an emergent topic, especially for black-box attacks, where adversaries do not know the model internal architectures or training parameters. This paper fully investigates the black-box attack strategies, which always train a substitute model to craft adversarial examples, and these adversarial examples can be transferred to disorder target models due to the transferability. However, conventional single-substitute attack strategies are easily defended by existed defense mechanism, e.g., ensemble adversarial training technology, and achieve unsatisfactory attack performance in black-box attack scenario. In this paper, the authors attempt to ensemble multiple pre-trained substitute models to produce adversarial examples with more powerful transferability in the form of selective cascade ensemble and stack parallel ensemble. Moreover, potential factors that contribute to the high-efficiency attacks are presented from three perspectives: the transferability of substitutes, the diversity of substitutes and the number of substitutes. Two classical measurements, Success rate and Transfer rate are used to analyze the vulnerability of deep learning models in black-box attack scenario. Two common pairwise and non-pairwise diversity measures are adopted to explore the relationship between the diversity in substitutes ensembles and transferability of crafted adversarial examples. Abstract: Deep learning (DL) models, e.g., state-of-the-art convolutional neural networks (CNNs), have been widely applied into security sensitivity tasks, such as face payment, security monitoring, automated driving, etc. Then their vulnerability analysis is an emergent topic, especially for black-box attacks, where adversaries do not know the model internal architectures or training parameters. In this paper, two types of ensemble-based black-box attack strategies, selective cascade ensemble strategy (SCES) and stack parallel ensemble strategy (SPES), are proposed to explore the vulnerability of DL system and potential factors that contribute to the high-efficiency attacks are explored. SCES adopts a boosting structure of ensemble learning and SPES employs a bagging structure. Moreover, two pairwise and non-pairwise diversity measures are adopted to examine the relationship between the diversity in substitutes ensembles and transferability of generated adversarial examples. Experimental results show that proposed ensemble adversarial black-box attack strategies can successfully attack the DL system with some defense mechanism, such as adversarial training and ensemble adversarial training. The experimental results also show the greater the diversity in substitute ensembles enables stronger transferability.