QuadAttack: A Quadratic Programming Approach to Ordered Top-K Attacks

• URL: http://arxiv.org/abs/2312.11510v1
• Date: Tue, 12 Dec 2023 05:08:45 GMT
• Title: QuadAttack: A Quadratic Programming Approach to Ordered Top-K Attacks
• Abstract summary: adversarial vulnerability of Deep Neural Networks (DNNs) has been well-known and widely concerned. This paper shows that the concern is much more serious by learning significantly more aggressive ordered top-$K$ attacks.
• Score: 8.826642352173035
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: The adversarial vulnerability of Deep Neural Networks (DNNs) has been well-known and widely concerned, often under the context of learning top-$1$ attacks (e.g., fooling a DNN to classify a cat image as dog). This paper shows that the concern is much more serious by learning significantly more aggressive ordered top-$K$ clear-box~\footnote{ This is often referred to as white/black-box attacks in the literature. We choose to adopt neutral terminology, clear/opaque-box attacks in this paper, and omit the prefix clear-box for simplicity.} targeted attacks proposed in Adversarial Distillation. We propose a novel and rigorous quadratic programming (QP) method of learning ordered top-$K$ attacks with low computing cost, dubbed as \textbf{QuadAttac$K$}. Our QuadAttac$K$ directly solves the QP to satisfy the attack constraint in the feature embedding space (i.e., the input space to the final linear classifier), which thus exploits the semantics of the feature embedding space (i.e., the principle of class coherence). With the optimized feature embedding vector perturbation, it then computes the adversarial perturbation in the data space via the vanilla one-step back-propagation. In experiments, the proposed QuadAttac$K$ is tested in the ImageNet-1k classification using ResNet-50, DenseNet-121, and Vision Transformers (ViT-B and DEiT-S). It successfully pushes the boundary of successful ordered top-$K$ attacks from $K=10$ up to $K=20$ at a cheap budget ($1\times 60$) and further improves attack success rates for $K=5$ for all tested models, while retaining the performance for $K=1$.

Related papers

• Ranked by Position: Order Sensitivity as an Exploitable Attack Surface in LLM Listwise Recommenders [10.604893155368702]
  Large language models (LLMs) used as listwise rerankers suffer from position bias when serializing candidate sets into prompts.<n>We show this order sensitivity creates an exploitable attack surface.<n>An attacker can promote a label-0 target into the top-$k$ solely by reordering candidates.
  arXiv  Detail & Related papers  (2026-07-26T22:32:12Z)
• Capability and Robustness Cannot Both Be Free: An Information-Theoretic Bound for Vision-Language-Action Models [0.0]
  Vision-Language-Action (VLA) models reach high success rates on clean inputs but collapse under small adversarial perturbations.<n>We prove that a $16/255$ PGD attack drops OpenVLA-7B's LIBERO success from $95%$ to under $5%$.<n>For any VLA policy, capability $I(Astar;Api)$ and robustness $I(Api;Atildepi)-I(Api;)$ sum to at most $H(Astar)+I(X;Xt
  arXiv  Detail & Related papers  (2026-05-25T14:16:57Z)
• The Cost of Compression: Tight Quadratic Black-Box Attacks on Sketches for $\ell_2$ Norm Estimation [27.82218389495089]
  Dimensionality reduction via linear sketching is a powerful and widely used technique, but it is known to be vulnerable to adversarial inputs.<n>We study the black-box adversarial setting, where a fixed, hidden sketching matrix A in $Rk X n$ maps high-dimensional vectors v $in Rn$ to lower-dimensional sketches A v in $Rk$.<n>We present a universal, nonadaptive attack that, using tilde(O)($k2$) queries, either causes a failure in norm estimation or constructs an adversarial input on which the optimal estimator for the query distribution fails
  arXiv  Detail & Related papers  (2025-07-22T08:25:05Z)
• GSBA$^K$: $top$-$K$ Geometric Score-based Black-box Attack [35.50056034977821]
  We propose a free score-based attack named b geometric b score-based b black-box b attack (GSBA$K$) for both untargeted and targeted attacks. GSBA$K$ can be used to attack against classifiers with $top$-$K$ multi-label learning.
  arXiv  Detail & Related papers  (2025-03-17T05:15:09Z)
• $σ$-zero: Gradient-based Optimization of $\ell_0$-norm Adversarial Examples [14.17412770504598]
  We show that $ell_infty$-norm constraints can be used to craft input perturbations. We propose a novel $ell_infty$-norm attack called $sigma$-norm. It outperforms all competing adversarial attacks in terms of success, size, and efficiency.
  arXiv  Detail & Related papers  (2024-02-02T20:08:11Z)
• DeltaBound Attack: Efficient decision-based attack in low queries regime [0.4061135251278187]
  Deep neural networks and other machine learning systems are vulnerable to adversarial attacks. We propose a novel, powerful attack in the hard-label setting with $ell$ norm bounded perturbations. We find that the DeltaBound attack performs as well and sometimes better than current state-of-the-art attacks.
  arXiv  Detail & Related papers  (2022-10-01T14:45:18Z)
• Adversarial Attacks on Gaussian Process Bandits [47.84198626686564]
  We propose various adversarial attack methods with differing assumptions on the attacker's strength and prior information. Our goal is to understand adversarial attacks on GP bandits from both a theoretical and practical perspective. We demonstrate that adversarial attacks on GP bandits can succeed in forcing the algorithm towards $mathcalR_rm target$ even with a low attack budget.
  arXiv  Detail & Related papers  (2021-10-16T02:39:10Z)
• EvoBA: An Evolution Strategy as a Strong Baseline forBlack-Box Adversarial Attacks [6.338178373376446]
  We propose a black-box adversarial attack based on a surprisingly simple evolutionary search strategy. $textbfEvoBA$ shows efficiency and efficacy through results that are in line with more complex state-of-the-art attacks.
  arXiv  Detail & Related papers  (2021-07-12T21:55:01Z)
• PDPGD: Primal-Dual Proximal Gradient Descent Adversarial Attack [92.94132883915876]
  State-of-the-art deep neural networks are sensitive to small input perturbations. Many defence methods have been proposed that attempt to improve robustness to adversarial noise. evaluating adversarial robustness has proven to be extremely challenging.
  arXiv  Detail & Related papers  (2021-06-03T01:45:48Z)
• Online Adversarial Attacks [57.448101834579624]
  We formalize the online adversarial attack problem, emphasizing two key elements found in real-world use-cases. We first rigorously analyze a deterministic variant of the online threat model. We then propose algoname, a simple yet practical algorithm yielding a provably better competitive ratio for $k=2$ over the current best single threshold algorithm.
  arXiv  Detail & Related papers  (2021-03-02T20:36:04Z)
• Composite Adversarial Attacks [57.293211764569996]
  Adversarial attack is a technique for deceiving Machine Learning (ML) models. In this paper, a new procedure called Composite Adrial Attack (CAA) is proposed for automatically searching the best combination of attack algorithms. CAA beats 10 top attackers on 11 diverse defenses with less elapsed time.
  arXiv  Detail & Related papers  (2020-12-10T03:21:16Z)
• Almost Tight L0-norm Certified Robustness of Top-k Predictions against Adversarial Perturbations [78.23408201652984]
  Top-k predictions are used in many real-world applications such as machine learning as a service, recommender systems, and web searches. Our work is based on randomized smoothing, which builds a provably robust classifier via randomizing an input. For instance, our method can build a classifier that achieves a certified top-3 accuracy of 69.2% on ImageNet when an attacker can arbitrarily perturb 5 pixels of a testing image.
  arXiv  Detail & Related papers  (2020-11-15T21:34:44Z)
• Simple and Efficient Hard Label Black-box Adversarial Attacks in Low Query Budget Regimes [80.9350052404617]
  We propose a simple and efficient Bayesian Optimization(BO) based approach for developing black-box adversarial attacks. Issues with BO's performance in high dimensions are avoided by searching for adversarial examples in a structured low-dimensional subspace. Our proposed approach consistently achieves 2x to 10x higher attack success rate while requiring 10x to 20x fewer queries.
  arXiv  Detail & Related papers  (2020-07-13T04:34:57Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.