Prior Convictions: Black-Box Adversarial Attacks with Bandits and Priors

Understand

We study the problem of generating adversarial examples in a black-box setting in which only loss-oracle access to a model is available.

• We introduce a framework that conceptually unifies much of the existing work on black-box attacks, and we demonstrate that the current state-of-the-art methods are optimal in a natural sense.
• Despite this optimality, we show how to improve black-box attacks by bringing a new element into the problem: gradient priors.
• We give a bandit optimization-based algorithm that allows us to seamlessly integrate any such priors, and we explicitly identify and incorporate two examples.