Decision-based black-box attack by coarse-to-fine random search

Abstract

Research to complement the vulnerability of deep neural networks to adversarial attacks has received great attention in the field of machine learning. To evaluate the adversarial robustness, various adversarial attacks have been proposed. However, existing decision-based black-box attacks that rely on gradient estimation or decision boundary are not successful against adversarial defenses using gradient obfuscation. In this paper, we propose a novel gradient-free black-box adversarial attack using random search-based optimization. The proposed method only needs hard-label and is effective even against gradient obfuscation. Moreover, the proposed method generates fine-grained adversarial examples that are close to the clean examples.