Cargando…

A Distributed Black-Box Adversarial Attack Based on Multi-Group Particle Swarm Optimization

Adversarial attack techniques in deep learning have been studied extensively due to its stealthiness to human eyes and potentially dangerous consequences when applied to real-life applications. However, current attack methods in black-box settings mainly employ a large number of queries for crafting...

Descripción completa

Detalles Bibliográficos
Autores principales: Suryanto, Naufal, Kang, Hyoeun, Kim, Yongsu, Yun, Youngyeo, Larasati, Harashta Tatimma, Kim, Howon
Formato: Online Artículo Texto
Lenguaje:English
Publicado: MDPI 2020
Materias:
Acceso en línea:https://www.ncbi.nlm.nih.gov/pmc/articles/PMC7765002/
https://www.ncbi.nlm.nih.gov/pubmed/33327453
http://dx.doi.org/10.3390/s20247158
_version_ 1783628389377114112
author Suryanto, Naufal
Kang, Hyoeun
Kim, Yongsu
Yun, Youngyeo
Larasati, Harashta Tatimma
Kim, Howon
author_facet Suryanto, Naufal
Kang, Hyoeun
Kim, Yongsu
Yun, Youngyeo
Larasati, Harashta Tatimma
Kim, Howon
author_sort Suryanto, Naufal
collection PubMed
description Adversarial attack techniques in deep learning have been studied extensively due to its stealthiness to human eyes and potentially dangerous consequences when applied to real-life applications. However, current attack methods in black-box settings mainly employ a large number of queries for crafting their adversarial examples, hence making them very likely to be detected and responded by the target system (e.g., artificial intelligence (AI) service provider) due to its high traffic volume. A recent proposal able to address the large query problem utilizes a gradient-free approach based on Particle Swarm Optimization (PSO) algorithm. Unfortunately, this original approach tends to have a low attack success rate, possibly due to the model’s difficulty of escaping local optima. This obstacle can be overcome by employing a multi-group approach for PSO algorithm, by which the PSO particles can be redistributed, preventing them from being trapped in local optima. In this paper, we present a black-box adversarial attack which can significantly increase the success rate of PSO-based attack while maintaining a low number of query by launching the attack in a distributed manner. Attacks are executed from multiple nodes, disseminating queries among the nodes, hence reducing the possibility of being recognized by the target system while also increasing scalability. Furthermore, we utilize Multi-Group PSO with Random Redistribution (MGRR-PSO) for perturbation generation, performing better than the original approach against local optima, thus achieving a higher success rate. Additionally, we propose to efficiently remove excessive perturbation (i.e, perturbation pruning) by utilizing again the MGRR-PSO rather than a standard iterative method as used in the original approach. We perform five different experiments: comparing our attack’s performance with existing algorithms, testing in high-dimensional space in ImageNet dataset, examining our hyperparameters (i.e., particle size, number of clients, search boundary), and testing on real digital attack to Google Cloud Vision. Our attack proves to obtain a 100% success rate on MNIST and CIFAR-10 datasets and able to successfully fool Google Cloud Vision as a proof of the real digital attack by maintaining a lower query and wide applicability.
format Online
Article
Text
id pubmed-7765002
institution National Center for Biotechnology Information
language English
publishDate 2020
publisher MDPI
record_format MEDLINE/PubMed
spelling pubmed-77650022020-12-27 A Distributed Black-Box Adversarial Attack Based on Multi-Group Particle Swarm Optimization Suryanto, Naufal Kang, Hyoeun Kim, Yongsu Yun, Youngyeo Larasati, Harashta Tatimma Kim, Howon Sensors (Basel) Article Adversarial attack techniques in deep learning have been studied extensively due to its stealthiness to human eyes and potentially dangerous consequences when applied to real-life applications. However, current attack methods in black-box settings mainly employ a large number of queries for crafting their adversarial examples, hence making them very likely to be detected and responded by the target system (e.g., artificial intelligence (AI) service provider) due to its high traffic volume. A recent proposal able to address the large query problem utilizes a gradient-free approach based on Particle Swarm Optimization (PSO) algorithm. Unfortunately, this original approach tends to have a low attack success rate, possibly due to the model’s difficulty of escaping local optima. This obstacle can be overcome by employing a multi-group approach for PSO algorithm, by which the PSO particles can be redistributed, preventing them from being trapped in local optima. In this paper, we present a black-box adversarial attack which can significantly increase the success rate of PSO-based attack while maintaining a low number of query by launching the attack in a distributed manner. Attacks are executed from multiple nodes, disseminating queries among the nodes, hence reducing the possibility of being recognized by the target system while also increasing scalability. Furthermore, we utilize Multi-Group PSO with Random Redistribution (MGRR-PSO) for perturbation generation, performing better than the original approach against local optima, thus achieving a higher success rate. Additionally, we propose to efficiently remove excessive perturbation (i.e, perturbation pruning) by utilizing again the MGRR-PSO rather than a standard iterative method as used in the original approach. We perform five different experiments: comparing our attack’s performance with existing algorithms, testing in high-dimensional space in ImageNet dataset, examining our hyperparameters (i.e., particle size, number of clients, search boundary), and testing on real digital attack to Google Cloud Vision. Our attack proves to obtain a 100% success rate on MNIST and CIFAR-10 datasets and able to successfully fool Google Cloud Vision as a proof of the real digital attack by maintaining a lower query and wide applicability. MDPI 2020-12-14 /pmc/articles/PMC7765002/ /pubmed/33327453 http://dx.doi.org/10.3390/s20247158 Text en © 2020 by the authors. Licensee MDPI, Basel, Switzerland. This article is an open access article distributed under the terms and conditions of the Creative Commons Attribution (CC BY) license (http://creativecommons.org/licenses/by/4.0/).
spellingShingle Article
Suryanto, Naufal
Kang, Hyoeun
Kim, Yongsu
Yun, Youngyeo
Larasati, Harashta Tatimma
Kim, Howon
A Distributed Black-Box Adversarial Attack Based on Multi-Group Particle Swarm Optimization
title A Distributed Black-Box Adversarial Attack Based on Multi-Group Particle Swarm Optimization
title_full A Distributed Black-Box Adversarial Attack Based on Multi-Group Particle Swarm Optimization
title_fullStr A Distributed Black-Box Adversarial Attack Based on Multi-Group Particle Swarm Optimization
title_full_unstemmed A Distributed Black-Box Adversarial Attack Based on Multi-Group Particle Swarm Optimization
title_short A Distributed Black-Box Adversarial Attack Based on Multi-Group Particle Swarm Optimization
title_sort distributed black-box adversarial attack based on multi-group particle swarm optimization
topic Article
url https://www.ncbi.nlm.nih.gov/pmc/articles/PMC7765002/
https://www.ncbi.nlm.nih.gov/pubmed/33327453
http://dx.doi.org/10.3390/s20247158
work_keys_str_mv AT suryantonaufal adistributedblackboxadversarialattackbasedonmultigroupparticleswarmoptimization
AT kanghyoeun adistributedblackboxadversarialattackbasedonmultigroupparticleswarmoptimization
AT kimyongsu adistributedblackboxadversarialattackbasedonmultigroupparticleswarmoptimization
AT yunyoungyeo adistributedblackboxadversarialattackbasedonmultigroupparticleswarmoptimization
AT larasatiharashtatatimma adistributedblackboxadversarialattackbasedonmultigroupparticleswarmoptimization
AT kimhowon adistributedblackboxadversarialattackbasedonmultigroupparticleswarmoptimization
AT suryantonaufal distributedblackboxadversarialattackbasedonmultigroupparticleswarmoptimization
AT kanghyoeun distributedblackboxadversarialattackbasedonmultigroupparticleswarmoptimization
AT kimyongsu distributedblackboxadversarialattackbasedonmultigroupparticleswarmoptimization
AT yunyoungyeo distributedblackboxadversarialattackbasedonmultigroupparticleswarmoptimization
AT larasatiharashtatatimma distributedblackboxadversarialattackbasedonmultigroupparticleswarmoptimization
AT kimhowon distributedblackboxadversarialattackbasedonmultigroupparticleswarmoptimization