Delving into Data: Effectively Substitute Training for Black-box Attack

Adaptive label normalized generator. To better learn from the target model, we need equally distributed data of all categories for substitute training, thus it is necessary to generate label-controlled data. To realize that, we take full advantage of the given label and random noise. Firstly, with the input of the random noise vector $\textbf{z}^{(i)}\in\mathbb{R}^{N}$ sampled from standard Gaussian distribution and label i, we calculate the label-embedded vector $\textbf{e}^{(i)}\in\mathbb{R}^{N}$ based on embedding layers [21]. Such label embedding process can encode a single discrete label to a continuous learnable vector, which has a wider distribution in the feature space and contains more representation information. Unlike GANs, we have no real images for supervision, such a label embedding process is crucial for data generation. Next, we extract the mean $\mu^{(i)}$ and variance $\sigma^{(i)}$ from the $N$-dimensional label-embedding vector $\textbf{e}^{(i)}$ by two full-connected layers. Then, the $\mu^{(i)}$ and $\sigma^{(i)}$ are involved in all deconvolution blocks to iteratively synthesize the image data with the condition of the specific category, which can be expressed as,

where there are total five de-convolution blocks, and $t$ represents the number of de-convolution block. After obtaining the final $\hat{\textbf{x}}^{(i)}$, the output generated data has been decorated with label-normalized information. Such an adaptive label normalized generator can better leverage the relations between input noise and label-embedding vectors to synthesize label-controlled data.

Noise/Label reconstruction. To further ensure the diversity of generated data $\hat{\textbf{x}}^{(i)}$, we introduce a reconstruction net $R$ to reconstruct the input noise and label embedding $\textbf{z}^{(i)}_{r},\textbf{e}^{(i)}_{r}=R(\hat{x}^{(i)})$. And the corresponding reconstruction loss can be calculated as,

Inter-class diversity. To further enhance the data diversity of different classes, we use a cosine-similarity matrix to maximize the inter-class distance, for all the synthetic images. Particularly, the generator produces one input synthetic data batch of $M_{B}\ll M$ different classes, and the model $S$ gives the output similarity matrix $O_{B}\in\mathbb{R}^{M_{B}\times M_{B}}$ of this batch. Note that we have the ground-truth similarity matrix $O_{B}^{gt}\in\left\{0,1\right\}^{M_{B}\times M_{B}}$ with all the elements to be $0$ except the diagonal elements are set to be $1$. Thus the diversity loss function $\mathcal{L}_{div}$ can be formulated as:

where $TRI(*)$ is defined as an operation to extract the upper triangle elements of similarity matrix except the diagonal elements. In this way, $\mathcal{L}_{div}$ will ensure the synthetic data owns the independent distribution for each class.

where $\mathcal{L}_{d}$ measures the distance between the output of $T$ and $S$, and $\mathcal{L}_{c}$ denotes the generation loss. $e^{-\mathcal{L}_{d}}$ implies a ‘min-max’ game with $\mathcal{L}_{d}$, $\mathrm{CE}(\cdot)$ indicates the cross entropy loss between the prediction of $S$ and input ground-truth label $i$. Thus by virtue of such an alternately minimization of these two loss functions, the substitute model $S$ can learn to mimic the outputs from the target model $T$. Further promoted by DDG and AST, with the generated data and adversarial examples, the unified substitute training loss $\mathcal{L}_{S}$ and generator loss $\mathcal{L}_{G}$ to train $S$ and $G$ are defined as,

Datasets and target model. 1) MNIST [17]: The attacked model is pre-trained on AlexNet [14], VGG-16 [27], and ResNet-18 [10]. The default substitute model is a network with 3 convolutional layers. 2) CIFAR-10 [13]: The attacked is pre-trained on AlexNet, VGG-16, and ResNet-18. The default substitute model is VGG-13. 3) CIFAR-100 [13]: The attacked is pre-trained on VGG-19 and ResNet-50. The default substitute model is ResNet-18. 4) Tiny Imagenet [25]: The attacked is pre-trained on ResNet-50. The substitute model is ResNet-34.

Competitors. To verify the efficacy of the proposed method, we compare our attacking results with data-free black-box attack, i.e., DaST [33], and several black-box attacks which require real data, such as PBBA [23] and Knockoff [22]. We also conduct substitute training using the original training data of the attacked model, and utilize ImageNet [25] to learn the substitute model.

Implementation details. We use Pytorch for Implementation. We utilize Adam to train our substitute model, generator, and reconstruction net from scratch, and all weights are randomly initialized using a truncated normal distribution with std of 0.02. The initial learning rates of all networks are set as 0.0001, they are gradually decreased to zero from the 80th epoch, and stopped after the 150th epoch. We set the mini-batch size as 500, the hyper-parameters $\beta_{1},\beta_{2}$, and $\beta_{3}$ are equally as 1. Our model is trained by one NVIDIA GeForce GTX 1080Ti GPU. We apply PGD [20] as the default method to generate adversarial images during the AST and evaluation. We also utilize FGSM [8], BIM [15] and C&W [2] to conduct attack for extensive experiments.

Evaluation metrics. Considering there exist two different scenarios as proposed in DaST [33], i.e., only get the output label from the target model and access the output probability well, and we name these two scenarios as Probability-based and Label-based. In the experiments, we report the attack success rates (ASRs) of the adversarial examples generated by the substitute model to attack the target black-box model. Following the setting in DaST [33], in the non-target attack setting, we only generate adversarial examples on the images classified correctly by the attacked model. For target attacks, we only generate adversarial examples on the images which are not classified to the specific wrong labels. For a fair comparison, during all the adversarial example generation, we restrict the perturbation $\epsilon=8$. We conduct five times over each testing, and report the average results.

Comparisons with the real data for substitute training. Here we study the substitute training for attacking with real images, as listed in Tab. 1 and Tab. 2, we directly use the original training data of the target model or ImageNet to apply substitute training instead of the synthesized. The results show that the real image can let the substitute model learn a little from the target and may higher accuracy on the classification, but weaker attack strength compared to the generated data. We believe that this problem is caused by the number and diversity limitation of the real images, which may lead to failure of the substitute model learning and mimicking from the target one. Thus, we propose a DDG strategy to synthesize large-scale and diversified data.

Comparisons with the state-of-the-art. As shown in Tab. 1 and Tab. 2, we compare our method with black-box attacks. For both non-target and target attacking settings, our method achieves the best ASRs over Probability-based and Label-based scenarios under all datasets. In addition, compared to similar generative DaST, our method significantly outperforms it with a large margin. The results verify the efficacy of proposed method to encourage the substitute model better approximate the target’s decision boundary and achieve high ASRs for data-free black-box attack.

Comparisons with competitors on Microsoft Azure. To better evaluate the attack method ability under the real-world applications, we conduct experiments for attacking the online model on Microsoft Azure. Target at attacking the example MNIST model of the machine learning tutorial on Azure, we compare the results between our methods and competitors. The results shown in Tab. 3, indicate our method can achieve the best ASRs over the online model, which further prove the efficacy of our method under the real scenario without prior knowledge of the attack one.