Efficient black-box attack with surrogate models and multiple universal adversarial perturbations.

Area of Science:

• Deep Learning
• Adversarial Machine Learning
• Computer Vision

Background:

• Deep learning models are susceptible to adversarial examples, especially in black-box scenarios.
• Existing black-box attacks struggle with effectiveness and efficiency, often requiring extensive queries.

Purpose of the Study:

• To develop an efficient and effective algorithm for generating adversarial examples in black-box settings.
• To address the limitations of current black-box attack methods regarding query budget and success rates.

Main Methods:

• Investigated the transferability of Multiple Universal Adversarial Perturbations (MUAPs).
• Proposed SMPack, a staged algorithm integrating MUAPs, surrogate models, and a Genetic Algorithm (GA).
• Evaluated SMPack against eight existing algorithms on four datasets (MNIST, SVHN, CIFAR-10, ImageNet).

Main Results:

• SMPack demonstrated superior attack success rate (ASR) and query efficiency compared to existing black-box methods.
• The algorithm achieved competitive performance against white-box attack methods.
• SMPack effectively overcomes black-box constraints and optimizes perturbation generation.

Conclusions:

• SMPack offers an efficient and effective solution for black-box adversarial example generation.
• The integration of MUAPs, surrogate schemes, and GA optimization significantly reduces query budget requirements.
• SMPack presents a robust alternative for generating adversarial perturbations in limited-knowledge scenarios.