Fuzzing-based hard-label black-box attacks against machine learning models. Issue 117 (June 2022)

• Record Type: Journal Article
• Authors: Qin, Yi; Yue, Chuan
• Is Part Of: Computers & security. Issue 117(2022)
• Publication Date: 2022-06
• Subjects: Adversarial machine learning -- Adversarial example -- Neural network -- Black-box attack -- Fuzzing; Computer security -- Periodicals; Electronic data processing departments -- Security measures -- Periodicals; 005.805
• DOI: 10.1016/j.cose.2022.102694
• Languages: English
• ISSNs: 0167-4048

Abstract

Abstract: Machine learning models are vulnerable to adversarial examples. We study the most realistic hard-label black-box attacks in this paper. The main limitation of the existing attacks is that they need a large number of model queries, making them inefficient and even infeasible in practice. Inspired by the very successful fuzz testing approach in traditional software engineering and computer security domains, we propose fuzzing-based hard-label black-box attacks against machine learning models. We design an AdvFuzzer to explore multiple paths between a source image and a guidance image, and design a LocalFuzzer to explore the nearby space around a given input for identifying potential adversarial examples. We demonstrate that our fuzzing attacks are feasible and effective in generating successful adversarial examples with significantly reduced number of model queries and L 0 distance. More interestingly, given a successful example generated by either our or other attacks, LocalFuzzer can immediately generate more successful adversarial examples even with smaller L 2 distance from the source example.