Substitute model generation for black-box adversarial attack based on knowledge distillation

Weiyu Cui; Xiaorui Li; Jiawei Huang; Wenyi Wang; Shuai Wang; Jianwen Chen

doi:10.1109/ICIP40778.2020.9191063

Substitute model generation for black-box adversarial attack based on knowledge distillation

Weiyu Cui, Xiaorui Li, Jiawei Huang, Wenyi Wang, Shuai Wang, Jianwen Chen

Research output: Chapter in Book / Conference Paper › Conference Paper › peer-review

17 Citations (Scopus)

Abstract

Although deep convolutional neural network (CNN) performs well in many computer vision tasks, its classification mechanism is very vulnerable when it is exposed to the perturbation of adversarial attacks. In this paper, we proposed a new algorithm to generate the substitute model of black-box CNN models by using knowledge distillation. The proposed algorithm distills multiple CNN teacher models to a compact student model as the substitution of other black-box CNN models to be attacked. The black-box adversarial samples can be consequently generated on this substitute model by using various white-box attacking methods. According to our experiments on ResNet18 and DenseNet121, our algorithm boosts the attacking success rate (ASR) by 20% by training the substitute model based on knowledge distillation.

Original language	English
Title of host publication	Proceedings of IEEE International Conference on Image Processing, September 25-28, 2020, Virtual Conference, Abu Dhabi, United Arab Emirates
Publisher	IEEE
Pages	648-652
Number of pages	5
ISBN (Print)	9781728163956
DOIs	https://doi.org/10.1109/ICIP40778.2020.9191063
Publication status	Published - Oct 2020
Event	International Conference on Image Processing - Duration: 25 Sept 2020 → …

Publication series

Name
ISSN (Print)	1522-4880

Conference

Conference	International Conference on Image Processing
Period	25/09/20 → …

Bibliographical note

Publisher Copyright:
© 2020 IEEE.

Access to Document

10.1109/ICIP40778.2020.9191063

Cite this

Cui, W., Li, X., Huang, J., Wang, W., Wang, S., & Chen, J. (2020). Substitute model generation for black-box adversarial attack based on knowledge distillation. In Proceedings of IEEE International Conference on Image Processing, September 25-28, 2020, Virtual Conference, Abu Dhabi, United Arab Emirates (pp. 648-652). Article 9191063 IEEE. https://doi.org/10.1109/ICIP40778.2020.9191063

@inproceedings{b89c02df5bd84ffd9c7fec45ed8d65a8,

title = "Substitute model generation for black-box adversarial attack based on knowledge distillation",

abstract = "Although deep convolutional neural network (CNN) performs well in many computer vision tasks, its classification mechanism is very vulnerable when it is exposed to the perturbation of adversarial attacks. In this paper, we proposed a new algorithm to generate the substitute model of black-box CNN models by using knowledge distillation. The proposed algorithm distills multiple CNN teacher models to a compact student model as the substitution of other black-box CNN models to be attacked. The black-box adversarial samples can be consequently generated on this substitute model by using various white-box attacking methods. According to our experiments on ResNet18 and DenseNet121, our algorithm boosts the attacking success rate (ASR) by 20% by training the substitute model based on knowledge distillation.",

author = "Weiyu Cui and Xiaorui Li and Jiawei Huang and Wenyi Wang and Shuai Wang and Jianwen Chen",

note = "Publisher Copyright: {\textcopyright} 2020 IEEE.; International Conference on Image Processing ; Conference date: 25-09-2020",

year = "2020",

month = oct,

doi = "10.1109/ICIP40778.2020.9191063",

language = "English",

isbn = "9781728163956",

publisher = "IEEE",

pages = "648--652",

booktitle = "Proceedings of IEEE International Conference on Image Processing, September 25-28, 2020, Virtual Conference, Abu Dhabi, United Arab Emirates",

}

Cui, W, Li, X, Huang, J, Wang, W, Wang, S & Chen, J 2020, Substitute model generation for black-box adversarial attack based on knowledge distillation. in Proceedings of IEEE International Conference on Image Processing, September 25-28, 2020, Virtual Conference, Abu Dhabi, United Arab Emirates., 9191063, IEEE, pp. 648-652, International Conference on Image Processing, 25/09/20. https://doi.org/10.1109/ICIP40778.2020.9191063

Substitute model generation for black-box adversarial attack based on knowledge distillation. / Cui, Weiyu; Li, Xiaorui; Huang, Jiawei et al.
Proceedings of IEEE International Conference on Image Processing, September 25-28, 2020, Virtual Conference, Abu Dhabi, United Arab Emirates. IEEE, 2020. p. 648-652 9191063.

Research output: Chapter in Book / Conference Paper › Conference Paper › peer-review

TY - GEN

T1 - Substitute model generation for black-box adversarial attack based on knowledge distillation

AU - Cui, Weiyu

AU - Li, Xiaorui

AU - Huang, Jiawei

AU - Wang, Wenyi

AU - Wang, Shuai

AU - Chen, Jianwen

PY - 2020/10

Y1 - 2020/10

N2 - Although deep convolutional neural network (CNN) performs well in many computer vision tasks, its classification mechanism is very vulnerable when it is exposed to the perturbation of adversarial attacks. In this paper, we proposed a new algorithm to generate the substitute model of black-box CNN models by using knowledge distillation. The proposed algorithm distills multiple CNN teacher models to a compact student model as the substitution of other black-box CNN models to be attacked. The black-box adversarial samples can be consequently generated on this substitute model by using various white-box attacking methods. According to our experiments on ResNet18 and DenseNet121, our algorithm boosts the attacking success rate (ASR) by 20% by training the substitute model based on knowledge distillation.

AB - Although deep convolutional neural network (CNN) performs well in many computer vision tasks, its classification mechanism is very vulnerable when it is exposed to the perturbation of adversarial attacks. In this paper, we proposed a new algorithm to generate the substitute model of black-box CNN models by using knowledge distillation. The proposed algorithm distills multiple CNN teacher models to a compact student model as the substitution of other black-box CNN models to be attacked. The black-box adversarial samples can be consequently generated on this substitute model by using various white-box attacking methods. According to our experiments on ResNet18 and DenseNet121, our algorithm boosts the attacking success rate (ASR) by 20% by training the substitute model based on knowledge distillation.

UR - https://hdl.handle.net/1959.7/uws:67257

U2 - 10.1109/ICIP40778.2020.9191063

DO - 10.1109/ICIP40778.2020.9191063

M3 - Conference Paper

SN - 9781728163956

SP - 648

EP - 652

BT - Proceedings of IEEE International Conference on Image Processing, September 25-28, 2020, Virtual Conference, Abu Dhabi, United Arab Emirates

PB - IEEE

T2 - International Conference on Image Processing

Y2 - 25 September 2020

ER -

Substitute model generation for black-box adversarial attack based on knowledge distillation

Abstract

Publication series

Conference

Bibliographical note

Access to Document

Other files and links

Fingerprint

Cite this