When does gradient estimation improve black-box adversarial attacks? - Irisa
Communication Dans Un Congrès Année : 2024

When does gradient estimation improve black-box adversarial attacks?

Résumé

The recent black-box adversarial attack SurFree demonstrated its high effectiveness resorting to a purely geometric construction. The method drastically reduced the number of queries necessary to craft low-distortion adversarial examples compared to the preceding art which relied on costly gradient estimation. Recently, CGBA proposed to reintroduce gradient information to SurFree. Despite promising empirical results, no theoretical study of the method was provided. This paper fills this gap by providing a comprehensive analysis of the performance of SurFree and CGBA. Notably, we express conditions under which using the gradient information is guaranteed to improve upon SurFree performance. We also provide the theoretical distortion of each attack at a given iteration, demonstrating the convergence of CGBA to the optimal adversarial image. Finally, we study the optimal query allocation schedule for CGBA. The accompanying code is to be found at https://github.com/EnoalG/Use-of-gradientfor-black-box-attacks.
Fichier principal
Vignette du fichier
conference_latex_template_10_17_19.pdf (551.93 Ko) Télécharger le fichier
Origine Fichiers produits par l'(les) auteur(s)

Dates et versions

hal-04728275 , version 1 (09-10-2024)

Licence

Identifiants

  • HAL Id : hal-04728275 , version 1

Citer

Enoal Gesny, Eva Giboulot, Teddy Furon. When does gradient estimation improve black-box adversarial attacks?. WIFS 2024 -16th IEEE International Workshop on Information Forensics and Security, Dec 2024, Roma, Italy. pp.1-6. ⟨hal-04728275⟩
18 Consultations
26 Téléchargements

Partager

More