Efficient black box adversarial attacks exploiting input data structure

1. A method for performing a single-step adversarial attack on a neural network classifier, comprising:

identifying Markov random field parameters to use for covariance modeling of correlation between gradient terms of a loss function of the classifier;

sampling a subset of images, from a dataset of images, according to a normal distribution to estimate the gradient terms;

using black-box gradient estimation to infer values of the parameters of the Markov random field according to the sampling;

generating Fourier basis vectors from the inferred values;

perturbing an original image using the Fourier basis vectors to obtain loss function values;

obtaining an estimate of a gradient from the loss function values;

creating an image perturbation using the estimated gradient;

adding the image perturbation to an original input to generate a candidate adversarial input that maximizes loss in identifying the image by the classifier;

querying the neural network classifier to determine a classifier prediction for the candidate adversarial input;

computing a score for the classifier prediction; and

accepting the candidate adversarial input as a successful adversarial attack responsive to the classifier prediction being incorrect.

2. The method of claim 1 , further comprising adding the image perturbation to the original input using a fast gradient sign method.

3. The method of claim 2 , wherein the fast gradient sign method utilizes a pre-specified L ∞ perturbation bound to adding the image perturbation to the original input.

4. The method of claim 1 , wherein the Markov random field parameters include a first parameter that governs diagonal terms, and a second parameter that governs adjacent pixels corresponding to indices that are neighboring in an image.

5. The method of claim 1 , wherein the values of the parameters are inferred using Newton's method.

6. The method of claim 1 , wherein a predefined maximum number of queries of the classifier are utilized to estimate the gradients.

7. The method of claim 1 , wherein the images include video image data.

8. The method of claim 1 , wherein the images include still image data.

9. A computational system for performing a single-step adversarial attack on a neural network classifier, the system comprising:

a memory storing instructions of black box adversarial attack algorithms of a software program; and

a processor programmed to execute the instructions to perform operations including to

identify Markov random field parameters to use for covariance modeling of correlation between gradient terms of a loss function of the classifier;

sample a subset of images, from a dataset of images, according to a normal distribution to estimate the gradient terms;

use black-box gradient estimation to infer values of the parameters of the Markov random field according to the sampling;

generate Fourier basis vectors from the inferred values;

perturb an original image using the Fourier basis vectors to obtain loss function values;

obtain an estimate of a gradient from the loss function values;

create an image perturbation using the estimated gradient;

add the image perturbation to an original input to generate a candidate adversarial input that maximizes loss in identifying the image by the classifier;

query the neural network classifier to determine a classifier prediction for the candidate adversarial input;

compute a score for the classifier prediction;

accept the candidate adversarial input as a successful adversarial attack responsive to the classifier prediction being incorrect; and

reject the candidate adversarial input responsive to the classifier prediction being correct.

10. The computational system of claim 9 , wherein the processor is further programmed to add the image perturbation to the original input using a fast gradient sign method.

11. The computational system of claim 10 , wherein the fast gradient sign method utilizes a pre-specified L ∞ perturbation bound to adding the image perturbation to the original input.

12. The computational system of claim 9 , wherein the Markov random field parameters include a first parameter that governs diagonal terms, and a second parameter that governs adjacent pixels corresponding to indices that are neighboring in an image.

13. The computational system of claim 9 , wherein the values of the parameters are inferred using Newton's method.

14. The computational system of claim 9 , wherein a predefined maximum number of queries of the classifier are utilized to estimate the gradients.

15. A non-transitory computer-readable medium comprising instructions for performing a single-step adversarial attack on a neural network classifier that, when executed by a processor, cause the processor to:

identify Markov random field parameters to use for covariance modeling of correlation between gradient terms of a loss function of the classifier;

sample a subset of images, from a dataset of images, according to a normal distribution to estimate the gradient terms;

use black-box gradient estimation to infer values of the parameters of the Markov random field according to the sampling;

generate Fourier basis vectors from the inferred values;

perturb an original image using the Fourier basis vectors to obtain loss function values;

obtain an estimate of a gradient from the loss function values;

create an image perturbation using the estimated gradient;

add the image perturbation to an original input to generate a candidate adversarial input that maximizes loss in identifying the image by the classifier;

query the neural network classifier to determine a classifier prediction for the candidate adversarial input;

compute a score for the classifier prediction;

accept the candidate adversarial input as a successful adversarial attack responsive to the classifier prediction being incorrect; and

reject the candidate adversarial input responsive to the classifier prediction being correct.

16. The medium of claim 15 , further comprising instructions that, when executed by the processor, cause the processor to add the image perturbation to the original input using a fast gradient sign method.

17. The medium of claim 16 , wherein the fast gradient sign method utilizes a pre-specified L ∞ perturbation bound to adding the image perturbation to the original input.

18. The medium of claim 15 , wherein the Markov random field parameters include a first parameter that governs diagonal terms, and a second parameter that governs adjacent pixels corresponding to indices that are neighboring in an image.

19. The medium of claim 15 , wherein the values of the parameters are inferred using Newton's method.

20. The medium of claim 15 , wherein a predefined maximum number of queries of the classifier are utilized to estimate the gradients.