{"type":"ScholarlyArticle","title":"Boosting Decision-Based Black-Box Adversarial Attack with Gradient Priors","authors":[{"name":"Han Liu","slug":"han-liu","given":"Han","family":"Liu","affiliation":"Dalian University of Technology , Dalian , China"},{"name":"Xingshuo Huang","slug":"xingshuo-huang","given":"Xingshuo","family":"Huang","affiliation":"Dalian University of Technology , Dalian , China"},{"name":"Xiaotong Zhang","slug":"xiaotong-zhang","given":"Xiaotong","family":"Zhang","affiliation":"Dalian University of Technology , Dalian , China"},{"name":"Qimai Li","slug":"qimai-li","given":"Qimai","family":"Li","affiliation":"The Hong Kong Polytechnic University , Hong Kong , China"},{"name":"Fenglong Ma","slug":"fenglong-ma","given":"Fenglong","family":"Ma","affiliation":"The Pennsylvania State University , Pennsylvania , USA"},{"name":"Wei Wang","slug":"wei-wang","given":"Wei","family":"Wang","affiliation":"Shenzhen MSU-BIT University , Shenzhen , China"},{"name":"Hongyang Chen","slug":"hongyang-chen","given":"Hongyang","family":"Chen","affiliation":"Zhejiang Lab , Hangzhou , China"},{"name":"Hong Yu","slug":"hong-yu","given":"Hong","family":"Yu","affiliation":"Dalian University of Technology , Dalian , China"},{"name":"Xianchao Zhang","slug":"xianchao-zhang","given":"Xianchao","family":"Zhang","affiliation":"Dalian University of Technology , Dalian , China"}],"abstract":"Decision-based methods have shown to be effective in black-box adversarial attacks, as they can obtain satisfactory performance and only require to access the final model prediction. Gradient estimation is a critical step in black-box adversarial attacks, as it will directly affect the query efficiency. Recent works have attempted to utilize gradient priors to facilitate score-based methods to obtain better results. However, these gradient priors still suffer from the edge gradient discrepancy issue and the successive iteration gradient direction issue, thus are difficult to simply extend to decision-based methods. In this paper, we propose a novel Decision-based Black-box Attack framework with Gradient Priors (DBA-GP), which seamlessly integrates the data-dependent gradient prior and time-dependent prior into the gradient estimation procedure. First, by leveraging the joint bilateral filter to deal with each random perturbation, DBA-GP can guarantee that the generated perturbations in edge locations are hardly smoothed, i.e., alleviating the edge gradient discrepancy, thus remaining the characteristics of the original image as much as possible. Second, by utilizing a new gradient updating strategy to automatically adjust the successive iteration gradient direction, DBA-GP can accelerate the convergence speed, thus improving the query efficiency. Extensive experiments have demonstrated that the proposed method outperforms other strong baselines significantly.","doi":"10.24963/ijcai.2023/133","url":"https://ijcai.org/proceedings/2023/133","pdf":"https://ijcai.org/proceedings/2023/0133.pdf","markdown":"https://ijcai.org/proceedings/2023/133.md","bibtex":"https://ijcai.org/proceedings/2023/bibtex/133","volume":{"slug":"2023","title":"Proceedings of the Thirty-Second International Joint Conference on Artificial Intelligence","short_title":"IJCAI 2023","url":"https://ijcai.org/proceedings/2023/","year":2023,"location":"Macao, SAR","dates":"19-25 August 2023","editors":"Edith Elkind","isbn":"978-1-956792-03-4","publisher":"International Joint Conferences on Artificial Intelligence Organization","doi_prefix":"10.24963/ijcai.2023"},"section":"Computer Vision","track":"Main Track","number":133,"pages":{"first":1195,"last":1203},"keywords":["Computer Vision: CV: Adversarial learning, adversarial attack and defense methods"],"videos":[],"references":[{"position":1,"raw":"[Brendel et al., 2018] Wieland Brendel, Jonas Rauber, and Matthias Bethge. Decision-based adversarial attacks: Re- liable attacks against black-box machine learning models. In ICLR, 2018.","title":"Decision-based adversarial attacks: Reliable attacks against black-box machine learning models","authors":"Wieland Brendel, Jonas Rauber, Matthias Bethge","year":"2018","venue":"ICLR","doi":null,"url":null,"internal_url":null},{"position":2,"raw":"[Brunner et al., 2019] Thomas Brunner, Frederik Diehl, Michael Truong-Le, and Alois C. Knoll. Guessing smart: Biased sampling for efficient black-box adversarial at- tacks. In ICCV, pages 4957-4965, 2019.","title":"Guessing smart: Biased sampling for efficient black-box adversarial attacks","authors":"Thomas Brunner, Frederik Diehl, Michael Truong-Le, Alois C Knoll","year":"2019","venue":"ICCV","doi":null,"url":null,"internal_url":null},{"position":3,"raw":"[Cao et al., 2021] Yulong Cao, Ningfei Wang, Chaowei Xiao, Dawei Yang, Jin Fang, Ruigang Yang, Qi Alfred Chen, Mingyan Liu, and Bo Li. Invisible for both camera and lidar: Security of multi-sensor fusion based percep- tion in autonomous driving under physical-world attacks. In IEEE Symposium on Security and Privacy (S&P), pages 176-194, 2021.","title":"Invisible for both camera and lidar: Security of multi-sensor fusion based perception in autonomous driving under physical-world attacks","authors":"Yulong Cao, Ningfei Wang, Chaowei Xiao, Dawei Yang, Jin Fang, Ruigang Yang, Qi Alfred Chen, Mingyan Liu, Bo Li","year":"2021","venue":"IEEE Symposium on Security and Privacy (S&P)","doi":null,"url":null,"internal_url":null},{"position":4,"raw":"[Carlini and Wagner, 2017] Nicholas Carlini and David A. Wagner. Towards evaluating the robustness of neural net- works. In IEEE Symposium on Security and Privacy (S&P), pages 39-57, 2017.","title":"Towards evaluating the robustness of neural networks","authors":"Nicholas Carlini, David A Wagner","year":"2017","venue":"IEEE Symposium on Security and Privacy (S&P)","doi":null,"url":null,"internal_url":null},{"position":5,"raw":"[Chen et al., 2020] Jianbo Chen, Michael I. Jordan, and Mar- tin J. Wainwright. Hopskipjumpattack: A query-efficient decision-based attack. In IEEE Symposium on Security and Privacy (S&P), pages 1277-1294, 2020.","title":"Hopskipjumpattack: A query-efficient decision-based attack","authors":"Jianbo Chen, Michael I Jordan, Martin J Wainwright","year":"2020","venue":"IEEE Symposium on Security and Privacy (S&P)","doi":null,"url":null,"internal_url":null},{"position":6,"raw":"[Cheng et al., 2020] Minhao Cheng, Simranjit Singh, Patrick H. Chen, Pin-Yu Chen, Sijia Liu, and Cho-Jui Hsieh. Sign-opt: A query-efficient hard-label adversarial attack. In ICLR, 2020.","title":"Sign-opt: A query-efficient hard-label adversarial attack","authors":"Minhao Cheng, Simranjit Singh, Patrick H Chen, Pin-Yu Chen, Sijia Liu, Cho-Jui Hsieh","year":"2020","venue":"ICLR","doi":null,"url":null,"internal_url":null},{"position":7,"raw":"[Chiu et al., 2018] Chung-Cheng Chiu, Tara N. Sainath, Yonghui Wu, Rohit Prabhavalkar, Patrick Nguyen, Zhifeng Chen, Anjuli Kannan, Ron J. Weiss, Kan- ishka Rao, Ekaterina Gonina, Navdeep Jaitly, Bo Li, Jan Chorowski, and Michiel Bacchiani. State-of-the-art speech recognition with sequence-to-sequence models. In ICASSP, pages 4774-4778, 2018.","title":"State-of-the-art speech recognition with sequence-to-sequence models","authors":"Chung-Cheng Chiu, Tara N Sainath, Yonghui Wu, Rohit Prabhavalkar, Patrick Nguyen, Zhifeng Chen, Anjuli Kannan, Ron J Weiss, Kanishka Rao, Ekaterina Gonina, Navdeep Jaitly, Bo Li, Jan Chorowski, Michiel Bacchiani","year":"2018","venue":"ICASSP","doi":null,"url":null,"internal_url":null},{"position":8,"raw":"[Cintas et al., 2020] Celia Cintas, Skyler Speakman, Victor Akinwande, William Ogallo, Komminist Weldemariam, Srihari Sridharan, and Edward McFowland. Detecting ad- versarial attacks via subset scanning of autoencoder acti- vations and reconstruction error. In IJCAI, pages 876-882, 2020.","title":"Detecting adversarial attacks via subset scanning of autoencoder activations and reconstruction error","authors":"Celia Cintas, Skyler Speakman, Victor Akinwande, William Ogallo, Komminist Weldemariam, Srihari Sridharan, Edward Mcfowland","year":"2020","venue":"IJCAI","doi":null,"url":null,"internal_url":"/proceedings/2020/122"},{"position":9,"raw":"[Deng et al., 2009] Jia Deng, Wei Dong, Richard Socher, Li- Jia Li, Kai Li, and Li Fei-Fei. Imagenet: A large-scale hierarchical image database. In CVPR, pages 248-255, 2009.","title":"Imagenet: A large-scale hierarchical image database","authors":"Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, Li Fei-Fei","year":"2009","venue":"CVPR","doi":null,"url":null,"internal_url":null},{"position":10,"raw":"[Dong et al., 2019] Yinpeng Dong, Hang Su, Baoyuan Wu, Zhifeng Li, Wei Liu, Tong Zhang, and Jun Zhu. Effi- cient decision-based black-box adversarial attacks on face recognition. In CVPR, pages 7714-7722, 2019.","title":"Efficient decision-based black-box adversarial attacks on face recognition","authors":"Dong","year":"2019","venue":"CVPR","doi":null,"url":null,"internal_url":null},{"position":11,"raw":"[Goodfellow et al., 2015] Ian J. Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. In ICLR, 2015.","title":"Explaining and harnessing adversarial examples","authors":"Ian J Goodfellow, Jonathon Shlens, Christian Szegedy","year":"2015","venue":"ICLR","doi":null,"url":null,"internal_url":null},{"position":12,"raw":"[Guo et al., 2019] Chuan Guo, Jacob R. Gardner, Yurong You, Andrew Gordon Wilson, and Kilian Q. Weinberger. Simple black-box adversarial attacks. In ICML, pages 2484-2493, 2019.","title":"Simple black-box adversarial attacks","authors":"Chuan Guo, Jacob R Gardner, Yurong You, Andrew Gordon Wilson, Kilian Q Weinberger","year":"2019","venue":"ICML","doi":null,"url":null,"internal_url":null},{"position":13,"raw":"[Guo et al., 2020] Yiwen Guo, Qizhang Li, and Hao Chen. Backpropagating linearly improves transferability of ad- versarial examples. In NeurIPS, 2020.","title":"Backpropagating linearly improves transferability of adversarial examples","authors":"Yiwen Guo, Qizhang Li, Hao Chen","year":"2020","venue":"NeurIPS","doi":null,"url":null,"internal_url":null},{"position":14,"raw":"[He et al., 2016] Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recog- nition. In CVPR, pages 770-778, 2016.","title":"Deep residual learning for image recognition","authors":"Kaiming He, Xiangyu Zhang, Shaoqing Ren, Jian Sun","year":"2016","venue":"CVPR","doi":null,"url":null,"internal_url":null},{"position":15,"raw":"[Ilyas et al., 2019] Andrew Ilyas, Logan Engstrom, and Aleksander Madry. Prior convictions: Black-box adver- sarial attacks with bandits and priors. In ICLR, 2019.","title":"Prior convictions: Black-box adversarial attacks with bandits and priors","authors":"Andrew Ilyas, Logan Engstrom, Aleksander Madry","year":"2019","venue":"ICLR","doi":null,"url":null,"internal_url":null},{"position":16,"raw":"[LeCun, 1998] Yann LeCun. The mnist database of hand- written digits. http://yann. lecun. com/exdb/mnist/, 1998.","title":"The mnist database of handwritten digits","authors":"Yann Lecun","year":null,"venue":null,"doi":null,"url":"http://yann.lecun.com/exdb/mnist/,1998","internal_url":null},{"position":17,"raw":"[Li and Chen, 2021] Nannan Li and Zhenzhong Chen. To- ward visual distortion in black-box attacks. IEEE Trans- actions on Image Processing, pages 6156-6167, 2021.","title":"Toward visual distortion in black-box attacks","authors":"Nannan Li, Zhenzhong Chen","year":"2021","venue":"IEEE Transactions on Image Processing","doi":null,"url":null,"internal_url":null},{"position":18,"raw":"[Li et al., 2020a] Huichen Li, Xiaojun Xu, Xiaolu Zhang, Shuang Yang, and Bo Li. QEBA: query-efficient boundary-based blackbox attack. In CVPR, pages 1218- 1227, 2020.","title":"QEBA: query-efficient boundary-based blackbox attack","authors":"Li","year":"2020","venue":"CVPR","doi":null,"url":null,"internal_url":null},{"position":19,"raw":"[Li et al., 2020b] Jie Li, Rongrong Ji, Hong Liu, Jianzhuang Liu, Bineng Zhong, Cheng Deng, and Qi Tian. Projection & probability-driven black-box attack. In CVPR, pages 359-368, 2020.","title":"Projection & probability-driven black-box attack","authors":"Li","year":"2020","venue":"CVPR","doi":null,"url":null,"internal_url":null},{"position":20,"raw":"[Li et al., 2021] Jie Li, Rongrong Ji, Peixian Chen, Baochang Zhang, Xiaopeng Hong, Ruixin Zhang, Shaoxin Li, Jilin Li, Feiyue Huang, and Yongjian Wu. Aha! adaptive history-driven attack for decision-based black-box models. In ICCV, pages 16148-16157, 2021.","title":"Aha! adaptive history-driven attack for decision-based black-box models","authors":"Jie Li, Rongrong Ji, Peixian Chen, Baochang Zhang, Xiaopeng Hong, Ruixin Zhang, Shaoxin Li, Jilin Li, Feiyue Huang, Yongjian Wu","year":"2021","venue":"ICCV","doi":null,"url":null,"internal_url":null},{"position":21,"raw":"[Liu et al., 2015] Ziwei Liu, Ping Luo, Xiaogang Wang, and Xiaoou Tang. Deep learning face attributes in the wild. In ICCV, pages 3730-3738, 2015.","title":"Deep learning face attributes in the wild","authors":"Ziwei Liu, Ping Luo, Xiaogang Wang, Xiaoou Tang","year":"2015","venue":"ICCV","doi":null,"url":null,"internal_url":null},{"position":22,"raw":"[Luo et al., 2021] Chenxu Luo, Xiaodong Yang, and Alan L. Yuille. Self-supervised pillar motion learning for au- tonomous driving. In CVPR, pages 3183-3192, 2021.","title":"Self-supervised pillar motion learning for autonomous driving","authors":"Chenxu Luo, Xiaodong Yang, Alan L Yuille","year":"2021","venue":"CVPR","doi":null,"url":null,"internal_url":null},{"position":23,"raw":"[Madry et al., 2018] Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. In ICLR, 2018.","title":"Towards deep learning models resistant to adversarial attacks","authors":"Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, Adrian Vladu","year":"2018","venue":"ICLR","doi":null,"url":null,"internal_url":null},{"position":24,"raw":"[Maho et al., 2021] Thibault Maho, Teddy Furon, and Er- wan Le Merrer. Surfree: A fast surrogate-free black-box attack. In CVPR, pages 10430-10439, 2021.","title":"Surfree: A fast surrogate-free black-box attack","authors":"Thibault Maho, Teddy Furon, Erwan Le Merrer","year":"2021","venue":"CVPR","doi":null,"url":null,"internal_url":null},{"position":25,"raw":"[Mooney, 1997] Christopher Z Mooney. Monte Carlo Simu- lation. SAGE, 1997.","title":"Monte Carlo Simulation","authors":"Z Christopher, Mooney","year":"1997","venue":null,"doi":null,"url":null,"internal_url":null},{"position":26,"raw":"[Moosavi-Dezfooli et al., 2016] Seyed-Mohsen Moosavi- Dezfooli, Alhussein Fawzi, and Pascal Frossard. Deep- fool: A simple and accurate method to fool deep neural networks. In CVPR, pages 2574-2582, 2016.","title":"Deepfool: A simple and accurate method to fool deep neural networks","authors":"Seyed-Mohsen Moosavi-Dezfooli, Alhussein Fawzi, Pascal Frossard","year":"2016","venue":"CVPR","doi":null,"url":null,"internal_url":null},{"position":27,"raw":"[Muhammad et al., 2021] Khan Muhammad, Amin Ullah, Jaime Lloret, Javier Del Ser, and Victor Hugo C. de Albu- querque. Deep learning for safe autonomous driving: Cur- rent challenges and future directions. IEEE Transactions on Intelligent Transportation Systems, 22(7):4316-4336, 2021.","title":"Deep learning for safe autonomous driving: Current challenges and future directions","authors":"Khan Muhammad, Amin Ullah, Jaime Lloret, Javier Del Ser, Victor Hugo, C De Albuquerque","year":"2021","venue":"IEEE Transactions on Intelligent Transportation Systems","doi":null,"url":null,"internal_url":null},{"position":28,"raw":"[Park et al., 2019] Daniel S. Park, William Chan, Yu Zhang, Chung-Cheng Chiu, Barret Zoph, Ekin D. Cubuk, and Quoc V. Le. Specaugment: A simple data augmenta- tion method for automatic speech recognition. In INTER- SPEECH, pages 2613-2617, 2019.","title":"Specaugment: A simple data augmentation method for automatic speech recognition","authors":"Daniel S Park, William Chan, Yu Zhang, Chung-Cheng Chiu, Barret Zoph, Ekin D Cubuk, V Quoc, Le","year":"2019","venue":"INTER-SPEECH","doi":null,"url":null,"internal_url":null},{"position":29,"raw":"[Petschnigg et al., 2004] Georg Petschnigg, Richard Szeliski, Maneesh Agrawala, Michael F. Cohen, Hugues Hoppe, and Kentaro Toyama. Digital photography with flash and no-flash image pairs. ACM Transactions on Graphics, pages 664-672, 2004.","title":"Digital photography with flash and no-flash image pairs","authors":"Georg Petschnigg, Richard Szeliski, Maneesh Agrawala, Michael F Cohen, Hugues Hoppe, Kentaro Toyama","year":"2004","venue":"ACM Transactions on Graphics","doi":null,"url":null,"internal_url":null},{"position":30,"raw":"[Pham et al., 2021] Hieu Pham, Zihang Dai, Qizhe Xie, and Quoc V. Le. Meta pseudo labels. In CVPR, pages 11557- 11568, 2021.","title":"Meta pseudo labels","authors":"Hieu Pham, Zihang Dai, Qizhe Xie, V Quoc, Le","year":"2021","venue":"CVPR","doi":null,"url":null,"internal_url":null},{"position":31,"raw":"[Qin et al., 2022] Zeyu Qin, Yanbo Fan, Yi Liu, Li Shen, Yong Zhang, Jue Wang, and Baoyuan Wu. Boosting the transferability of adversarial attacks with reverse adversar- ial perturbation. In NeurIPS, 2022.","title":"Boosting the transferability of adversarial attacks with reverse adversarial perturbation","authors":"Yanbo Zeyu Qin, Yi Fan, Li Liu, Yong Shen, Jue Zhang, Baoyuan Wang, Wu","year":"2022","venue":"NeurIPS","doi":null,"url":null,"internal_url":null},{"position":32,"raw":"[Rauber et al., 2017] Jonas Rauber, Wieland Brendel, and Matthias Bethge. Foolbox: A python toolbox to bench- mark the robustness of machine learning models. In ICML workshop, 2017.","title":"Foolbox: A python toolbox to benchmark the robustness of machine learning models","authors":"Rauber","year":"2017","venue":"ICML workshop","doi":null,"url":null,"internal_url":null},{"position":33,"raw":"[Rauber et al., 2020] Jonas Rauber, Roland Zimmermann, Matthias Bethge, and Wieland Brendel. Foolbox native: Fast adversarial attacks to benchmark the robustness of machine learning models in pytorch, tensorflow, and JAX. Journal of Open Source Software, page 2607, 2020.","title":"Foolbox native: Fast adversarial attacks to benchmark the robustness of machine learning models in pytorch, tensorflow, and JAX","authors":"Rauber","year":"2020","venue":"Journal of Open Source Software","doi":null,"url":null,"internal_url":null},{"position":34,"raw":"[Simonyan and Zisserman, 2015] Karen Simonyan and An- drew Zisserman. Very deep convolutional networks for large-scale image recognition. In ICLR, 2015.","title":"Very deep convolutional networks for large-scale image recognition","authors":"Karen Simonyan, Andrew Zisserman","year":"2015","venue":"ICLR","doi":null,"url":null,"internal_url":null},{"position":35,"raw":"[Wang et al., 2021] Jianfeng Wang, Lin Song, Zeming Li, Hongbin Sun, Jian Sun, and Nanning Zheng. End-to- end object detection with fully convolutional network. In CVPR, pages 15849-15858, 2021.","title":"End-toend object detection with fully convolutional network","authors":"Jianfeng Wang, Lin Song, Zeming Li, Hongbin Sun, Jian Sun, Nanning Zheng","year":"2021","venue":"CVPR","doi":null,"url":null,"internal_url":null},{"position":36,"raw":"[Wang et al., 2022] Chien-Yao Wang, Alexey Bochkovskiy, and Hong-Yuan Mark Liao. Yolov7: Trainable bag-of- freebies sets new state-of-the-art for real-time object de- tectors. CoRR, abs/2207.02696, 2022.","title":"Yolov7: Trainable bag-offreebies sets new state-of-the-art for real-time object detectors","authors":"Chien-Yao Wang, Alexey Bochkovskiy, Hong-Yuan Mark Liao","year":"2022","venue":null,"doi":null,"url":null,"internal_url":null},{"position":37,"raw":"[Wu et al., 2017] Tingmin Wu, Shigang Liu, Jun Zhang, and Yang Xiang. Twitter spam detection based on deep learn- ing. In ACSW, pages 3:1-3:8, 2017.","title":"Twitter spam detection based on deep learning","authors":"Wu","year":"2017","venue":"ACSW","doi":null,"url":null,"internal_url":null},{"position":38,"raw":"[Wu et al., 2020] Dongxian Wu, Yisen Wang, Shu-Tao Xia, James Bailey, and Xingjun Ma. Skip connections matter: On the transferability of adversarial examples generated with resnets. In ICLR, 2020.","title":"Skip connections matter: On the transferability of adversarial examples generated with resnets","authors":"Wu","year":"2020","venue":"ICLR","doi":null,"url":null,"internal_url":null},{"position":39,"raw":"[Zhang et al., 2021] Jiawei Zhang, Linyi Li, Huichen Li, Xi- aolu Zhang, Shuang Yang, and Bo Li. Progressive-scale boundary blackbox attack via projective gradient estima- tion. In ICML, pages 12479-12490, 2021.","title":"Progressive-scale boundary blackbox attack via projective gradient estimation","authors":"Jiawei Zhang, Linyi Li, Huichen Li, Xiaolu Zhang, Shuang Yang, Bo Li","year":"2021","venue":"ICML","doi":null,"url":null,"internal_url":null},{"position":40,"raw":"[Zhong et al., 2022] Yiqi Zhong, Xianming Liu, Deming Zhai, Junjun Jiang, and Xiangyang Ji. Shadows can be dangerous: Stealthy and effective physical-world adver- sarial attack by natural phenomenon. In CVPR, pages 15324-15333, 2022.","title":"Shadows can be dangerous: Stealthy and effective physical-world adversarial attack by natural phenomenon","authors":"Yiqi Zhong, Xianming Liu, Deming Zhai, Junjun Jiang, Xiangyang Ji","year":"2022","venue":"CVPR","doi":null,"url":null,"internal_url":null}],"license_note":"Copyright International Joint Conferences on Artificial Intelligence."}