NATTACK: Learning the Distributions of Adversarial Examples for an Improved Black-Box Attack on Deep Neural Networks

Powerful adversarial attack methods are vital for understanding how to\nconstruct robust deep neural networks (DNNs) and for thoroughly testing defense\ntechniques. In this paper, we propose a black-box adversarial attack algorithm\nthat can defeat both vanilla DNNs and those generated by various defense\ntechniques developed recently. Instead of searching for an "optimal"\nadversarial example for a benign input to a targeted DNN, our algorithm finds a\nprobability density distribution over a small region centered around the input,\nsuch that a sample drawn from this distribution is likely an adversarial\nexample, without the need of accessing the DNN's internal layers or weights.\nOur approach is universal as it can successfully attack different neural\nnetworks by a single algorithm. It is also strong; according to the testing\nagainst 2 vanilla DNNs and 13 defended ones, it outperforms state-of-the-art\nblack-box or white-box attack methods for most test cases. Additionally, our\nresults reveal that adversarial training remains one of the best defense\ntechniques, and the adversarial examples are not as transferable across\ndefended DNNs as them across vanilla DNNs.\n