Cargando…
A Distributed Black-Box Adversarial Attack Based on Multi-Group Particle Swarm Optimization
Adversarial attack techniques in deep learning have been studied extensively due to its stealthiness to human eyes and potentially dangerous consequences when applied to real-life applications. However, current attack methods in black-box settings mainly employ a large number of queries for crafting...
Autores principales: | , , , , , |
---|---|
Formato: | Online Artículo Texto |
Lenguaje: | English |
Publicado: |
MDPI
2020
|
Materias: | |
Acceso en línea: | https://www.ncbi.nlm.nih.gov/pmc/articles/PMC7765002/ https://www.ncbi.nlm.nih.gov/pubmed/33327453 http://dx.doi.org/10.3390/s20247158 |
_version_ | 1783628389377114112 |
---|---|
author | Suryanto, Naufal Kang, Hyoeun Kim, Yongsu Yun, Youngyeo Larasati, Harashta Tatimma Kim, Howon |
author_facet | Suryanto, Naufal Kang, Hyoeun Kim, Yongsu Yun, Youngyeo Larasati, Harashta Tatimma Kim, Howon |
author_sort | Suryanto, Naufal |
collection | PubMed |
description | Adversarial attack techniques in deep learning have been studied extensively due to its stealthiness to human eyes and potentially dangerous consequences when applied to real-life applications. However, current attack methods in black-box settings mainly employ a large number of queries for crafting their adversarial examples, hence making them very likely to be detected and responded by the target system (e.g., artificial intelligence (AI) service provider) due to its high traffic volume. A recent proposal able to address the large query problem utilizes a gradient-free approach based on Particle Swarm Optimization (PSO) algorithm. Unfortunately, this original approach tends to have a low attack success rate, possibly due to the model’s difficulty of escaping local optima. This obstacle can be overcome by employing a multi-group approach for PSO algorithm, by which the PSO particles can be redistributed, preventing them from being trapped in local optima. In this paper, we present a black-box adversarial attack which can significantly increase the success rate of PSO-based attack while maintaining a low number of query by launching the attack in a distributed manner. Attacks are executed from multiple nodes, disseminating queries among the nodes, hence reducing the possibility of being recognized by the target system while also increasing scalability. Furthermore, we utilize Multi-Group PSO with Random Redistribution (MGRR-PSO) for perturbation generation, performing better than the original approach against local optima, thus achieving a higher success rate. Additionally, we propose to efficiently remove excessive perturbation (i.e, perturbation pruning) by utilizing again the MGRR-PSO rather than a standard iterative method as used in the original approach. We perform five different experiments: comparing our attack’s performance with existing algorithms, testing in high-dimensional space in ImageNet dataset, examining our hyperparameters (i.e., particle size, number of clients, search boundary), and testing on real digital attack to Google Cloud Vision. Our attack proves to obtain a 100% success rate on MNIST and CIFAR-10 datasets and able to successfully fool Google Cloud Vision as a proof of the real digital attack by maintaining a lower query and wide applicability. |
format | Online Article Text |
id | pubmed-7765002 |
institution | National Center for Biotechnology Information |
language | English |
publishDate | 2020 |
publisher | MDPI |
record_format | MEDLINE/PubMed |
spelling | pubmed-77650022020-12-27 A Distributed Black-Box Adversarial Attack Based on Multi-Group Particle Swarm Optimization Suryanto, Naufal Kang, Hyoeun Kim, Yongsu Yun, Youngyeo Larasati, Harashta Tatimma Kim, Howon Sensors (Basel) Article Adversarial attack techniques in deep learning have been studied extensively due to its stealthiness to human eyes and potentially dangerous consequences when applied to real-life applications. However, current attack methods in black-box settings mainly employ a large number of queries for crafting their adversarial examples, hence making them very likely to be detected and responded by the target system (e.g., artificial intelligence (AI) service provider) due to its high traffic volume. A recent proposal able to address the large query problem utilizes a gradient-free approach based on Particle Swarm Optimization (PSO) algorithm. Unfortunately, this original approach tends to have a low attack success rate, possibly due to the model’s difficulty of escaping local optima. This obstacle can be overcome by employing a multi-group approach for PSO algorithm, by which the PSO particles can be redistributed, preventing them from being trapped in local optima. In this paper, we present a black-box adversarial attack which can significantly increase the success rate of PSO-based attack while maintaining a low number of query by launching the attack in a distributed manner. Attacks are executed from multiple nodes, disseminating queries among the nodes, hence reducing the possibility of being recognized by the target system while also increasing scalability. Furthermore, we utilize Multi-Group PSO with Random Redistribution (MGRR-PSO) for perturbation generation, performing better than the original approach against local optima, thus achieving a higher success rate. Additionally, we propose to efficiently remove excessive perturbation (i.e, perturbation pruning) by utilizing again the MGRR-PSO rather than a standard iterative method as used in the original approach. We perform five different experiments: comparing our attack’s performance with existing algorithms, testing in high-dimensional space in ImageNet dataset, examining our hyperparameters (i.e., particle size, number of clients, search boundary), and testing on real digital attack to Google Cloud Vision. Our attack proves to obtain a 100% success rate on MNIST and CIFAR-10 datasets and able to successfully fool Google Cloud Vision as a proof of the real digital attack by maintaining a lower query and wide applicability. MDPI 2020-12-14 /pmc/articles/PMC7765002/ /pubmed/33327453 http://dx.doi.org/10.3390/s20247158 Text en © 2020 by the authors. Licensee MDPI, Basel, Switzerland. This article is an open access article distributed under the terms and conditions of the Creative Commons Attribution (CC BY) license (http://creativecommons.org/licenses/by/4.0/). |
spellingShingle | Article Suryanto, Naufal Kang, Hyoeun Kim, Yongsu Yun, Youngyeo Larasati, Harashta Tatimma Kim, Howon A Distributed Black-Box Adversarial Attack Based on Multi-Group Particle Swarm Optimization |
title | A Distributed Black-Box Adversarial Attack Based on Multi-Group Particle Swarm Optimization |
title_full | A Distributed Black-Box Adversarial Attack Based on Multi-Group Particle Swarm Optimization |
title_fullStr | A Distributed Black-Box Adversarial Attack Based on Multi-Group Particle Swarm Optimization |
title_full_unstemmed | A Distributed Black-Box Adversarial Attack Based on Multi-Group Particle Swarm Optimization |
title_short | A Distributed Black-Box Adversarial Attack Based on Multi-Group Particle Swarm Optimization |
title_sort | distributed black-box adversarial attack based on multi-group particle swarm optimization |
topic | Article |
url | https://www.ncbi.nlm.nih.gov/pmc/articles/PMC7765002/ https://www.ncbi.nlm.nih.gov/pubmed/33327453 http://dx.doi.org/10.3390/s20247158 |
work_keys_str_mv | AT suryantonaufal adistributedblackboxadversarialattackbasedonmultigroupparticleswarmoptimization AT kanghyoeun adistributedblackboxadversarialattackbasedonmultigroupparticleswarmoptimization AT kimyongsu adistributedblackboxadversarialattackbasedonmultigroupparticleswarmoptimization AT yunyoungyeo adistributedblackboxadversarialattackbasedonmultigroupparticleswarmoptimization AT larasatiharashtatatimma adistributedblackboxadversarialattackbasedonmultigroupparticleswarmoptimization AT kimhowon adistributedblackboxadversarialattackbasedonmultigroupparticleswarmoptimization AT suryantonaufal distributedblackboxadversarialattackbasedonmultigroupparticleswarmoptimization AT kanghyoeun distributedblackboxadversarialattackbasedonmultigroupparticleswarmoptimization AT kimyongsu distributedblackboxadversarialattackbasedonmultigroupparticleswarmoptimization AT yunyoungyeo distributedblackboxadversarialattackbasedonmultigroupparticleswarmoptimization AT larasatiharashtatatimma distributedblackboxadversarialattackbasedonmultigroupparticleswarmoptimization AT kimhowon distributedblackboxadversarialattackbasedonmultigroupparticleswarmoptimization |