Efficient black box adversarial attacks exploiting input data structure

A computational system for performing a single-step adversarial attack on a neural network classifier, the system comprising:

• a memory storing instructions of black box adversarial attack algorithms of a software program;
• and
• a processor programmed to execute the instructions to perform operations including to
• identify Markov random field parameters to use for covariance modeling of correlation between gradient terms of a loss function of the classifier;
• sample a subset of images, from a dataset of images, according to a normal distribution to estimate the gradient terms;
• use black-box gradient estimation to infer values of the parameters of the Markov random field according to the sampling;
• generate Fourier basis vectors from the inferred values;
• perturb an original image using the Fourier basis vectors to obtain loss function values;
• obtain an estimate of a gradient from the loss function values;
• create an image perturbation using the estimated gradient;
• add the image perturbation to an original input to generate a candidate adversarial input that maximizes loss in identifying the image by the classifier;
• query the neural network classifier to determine a classifier prediction for the candidate adversarial input;
• compute a score for the classifier prediction;
• accept the candidate adversarial input as a successful adversarial attack responsive to the classifier prediction being incorrect;
• and
• reject the candidate adversarial input responsive to the classifier prediction being correct.

A non-transitory computer-readable medium comprising instructions for performing a single-step adversarial attack on a neural network classifier that, when executed by a processor, cause the processor to:

• identify Markov random field parameters to use for covariance modeling of correlation between gradient terms of a loss function of the classifier;
• sample a subset of images, from a dataset of images, according to a normal distribution to estimate the gradient terms;
• use black-box gradient estimation to infer values of the parameters of the Markov random field according to the sampling;
• generate Fourier basis vectors from the inferred values;
• perturb an original image using the Fourier basis vectors to obtain loss function values;
• obtain an estimate of a gradient from the loss function values;
• create an image perturbation using the estimated gradient;
• add the image perturbation to an original input to generate a candidate adversarial input that maximizes loss in identifying the image by the classifier;
• query the neural network classifier to determine a classifier prediction for the candidate adversarial input;
• compute a score for the classifier prediction;
• accept the candidate adversarial input as a successful adversarial attack responsive to the classifier prediction being incorrect;
• and
• reject the candidate adversarial input responsive to the classifier prediction being correct.