Nonlinear Projection Based Gradient Estimation for Query Efficient Blackbox Attacks论文解读

Abstract

Gradient estimation以及vector space projection现在被作为两个独立的主题进行研究。我们希望bridge the gap between the
two by investigating how to efficiently estimate gradient based on a projected low-dimensional space. We first provide lower
and upper bounds for gradient estimation under both linear and nonlinear gradient projections, and outline checkable sufficient conditions under which one is better than the other. Moreover, we analyze the query complexity for the projection-based gradient estimation and present a sufficient condition for query-efficient estimators. Built upon our
theoretic analysis, we propose a novel queryefficient Nonlinear Gradient Projection-based
Boundary Blackbox Attack (NonLinearBA). We conduct extensive experiments on
four datasets: ImageNet, CelebA, CIFAR-10,
and MNIST, and show the superiority of the
proposed methods compared with the stateof-the-art baselines. In particular, we show
that the projection-based boundary blackbox attacks are able to achieve much smaller
magnitude of perturbations with 100% attack success rate based on efficient queries.
Both linear and nonlinear projections demonstrate their advantages under different conditions. We also evaluate NonLinear-BA against
the commercial online API MEGVII Face++,
and demonstrate the high blackbox attack
performance both quantitatively and qualitatively.

1 Introduction

Gradient estimation and vector space projection have
both been extensively studied in machine learning, but
largely for different purposes. Gradient estimation is
used when gradient-based optimization such as backpropagation is employed but the exact gradients are
not directly accessible, for example, in the case of blackbox adversarial attacks (Chen et al., 2020; Li et al.,
2020). Vector space projection, especially gradient projection (or sparsification), on the other hand, has been
used to speedup training, for instance, by reducing the
complexity of communication and/or storage when performing model update in distributed training (Wangni
et al., 2018). In this paper, we aim to bridge the gap
between the two and attempt to answer the following
questions: Can we estimate gradients from a projected
low-dimensional subspace? How do different projections
affect the gradient estimation quality?