论文标题
对抗攻击的查询复杂性
Query complexity of adversarial attacks
论文作者
论文摘要
对抗性鲁棒性文献中考虑了两个主要的攻击模型：Black-Box和White-Box。我们将这些威胁模型视为细粒频谱的两个端，并由对手可以提出的查询数量索引。使用此角度，我们研究了对手需要进行多少查询，以设计与白盒模型中最佳攻击相当的攻击。我们根据分类器决策边界的熵给出了该数量的查询数量。使用此结果，我们分析了两个合成任务的两种经典学习算法，我们证明了有意义的安全保证。获得的界限表明，某些学习算法本质上比其他学习对手比其他人更强大。
There are two main attack models considered in the adversarial robustness literature: black-box and white-box. We consider these threat models as two ends of a fine-grained spectrum, indexed by the number of queries the adversary can ask. Using this point of view we investigate how many queries the adversary needs to make to design an attack that is comparable to the best possible attack in the white-box model. We give a lower bound on that number of queries in terms of entropy of decision boundaries of the classifier. Using this result we analyze two classical learning algorithms on two synthetic tasks for which we prove meaningful security guarantees. The obtained bounds suggest that some learning algorithms are inherently more robust against query-bounded adversaries than others.
