论文标题
预处理器很重要！基于决策的机器学习系统的现实攻击
Preprocessors Matter! Realistic Decision-Based Attacks on Machine Learning Systems
论文作者
论文摘要
基于决策的攻击仅通过硬标签查询来构建针对机器学习（ML）模型的对抗性示例。这些攻击主要直接应用于独立的神经网络。但是，实际上，ML模型只是较大学习系统的组成部分。我们发现，通过在分类器面前添加单个预处理器，基于查询的最先进的攻击在攻击预测管道方面的效率高于7 $ \ times $，而不是仅攻击模型。我们通过大多数预处理器向输入空间介绍一些不变性概念来解释这一差异。因此，不知道这种不变的攻击不可避免地会浪费大量查询以重新发现或克服它。因此，我们开发了（i）反处理预处理器的技术，然后（ii）使用此提取的信息来攻击端到端系统。我们的预处理器提取方法仅需要几百个查询，而我们的预处理器感知攻击恢复了与单独攻击模型时相同的功效。该代码可以在https://github.com/google-research/preprocessor-aware-box-box-attack上找到。
Decision-based attacks construct adversarial examples against a machine learning (ML) model by making only hard-label queries. These attacks have mainly been applied directly to standalone neural networks. However, in practice, ML models are just one component of a larger learning system. We find that by adding a single preprocessor in front of a classifier, state-of-the-art query-based attacks are up to 7$\times$ less effective at attacking a prediction pipeline than at attacking the model alone. We explain this discrepancy by the fact that most preprocessors introduce some notion of invariance to the input space. Hence, attacks that are unaware of this invariance inevitably waste a large number of queries to re-discover or overcome it. We, therefore, develop techniques to (i) reverse-engineer the preprocessor and then (ii) use this extracted information to attack the end-to-end system. Our preprocessors extraction method requires only a few hundred queries, and our preprocessor-aware attacks recover the same efficacy as when attacking the model alone. The code can be found at https://github.com/google-research/preprocessor-aware-black-box-attack.
