Evading Classifiers by Morphing in the Dark

Understand

Learning-based systems have been shown to be vulnerable to evasion through adversarial data manipulation.

• These attacks have been studied under assumptions that the adversary has certain knowledge of either the target model internals, its training dataset or at least classification scores it assigns to input samples.
• In this paper, we investigate a much more constrained and realistic attack scenario wherein the target classifier is minimally exposed to the adversary, revealing on its final classification decision (e.g., reject or accept an input sample).
• Moreover, the adversary can only manipulate malicious samples using a blackbox morpher.