Practical No-box Adversarial Attacks with Training-free Hybrid Image Transformation

TL;DR

This work tackles practical adversarial attacks under a no-box setting by proposing a training-free Hybrid Image Transformation (HIT) that exploits high-frequency components (HFC) in deep networks. HIT constructs regionally homogeneous, repeating, and dense adversarial patches, combines their HFC with the low-frequency content (LFC) of the original image, and constrains perturbations within an $\ell_\infty$ budget using $\bm{x^{adv}} = \text{clip}_{\bm{x},\varepsilon}(\bm{x} * \bm{G} + \lambda (\bm{x^p} - \bm{x^p} * \bm{G}))$. Across ImageNet and fine-grained tasks, HIT achieves an average attack success rate of 98.13% on ten normally trained models, outperforming state-of-the-art no-box methods by 29.39% and rivaling transfer-based black-box attacks, while remaining perceptually less intrusive. The method demonstrates strong practical impact by successfully attacking real-world systems and demonstrating vulnerabilities even against certain defenses, highlighting the need for robust defenses that address training-free, frequency-domain perturbations. $\lambda$, patch density, and tile-size influence HIT’s effectiveness, with circle proto-patterns often most potent due to their impact on intermediate feature representations.

Abstract

In recent years, the adversarial vulnerability of deep neural networks (DNNs) has raised increasing attention. Among all the threat models, no-box attacks are the most practical but extremely challenging since they neither rely on any knowledge of the target model or similar substitute model, nor access the dataset for training a new substitute model. Although a recent method has attempted such an attack in a loose sense, its performance is not good enough and computational overhead of training is expensive. In this paper, we move a step forward and show the existence of a \textbf{training-free} adversarial perturbation under the no-box threat model, which can be successfully used to attack different DNNs in real-time. Motivated by our observation that high-frequency component (HFC) domains in low-level features and plays a crucial role in classification, we attack an image mainly by manipulating its frequency components. Specifically, the perturbation is manipulated by suppression of the original HFC and adding of noisy HFC. We empirically and experimentally analyze the requirements of effective noisy HFC and show that it should be regionally homogeneous, repeating and dense. Extensive experiments on the ImageNet dataset demonstrate the effectiveness of our proposed no-box method. It attacks ten well-known models with a success rate of \textbf{98.13\%} on average, which outperforms state-of-the-art no-box attacks by \textbf{29.39\%}. Furthermore, our method is even competitive to mainstream transfer-based black-box attacks.

Figures (17)

• Figure 1: The confidence of a raw image (left), its low-frequency component (middle) and high-frequency component (right) on Inc-v3 inc-v3.
• Figure 2: The visualization for the shallow layer ("activation 2”) feature maps of Inception-v3 inc-v3 w.r.t. the input (a) and its corresponding adversarial example crafted by our HIT.
• Figure 3: The average accuracy of HFC and LFC obtained by different Gaussian kernel.
• Figure 4: Three simple geometric patterns serve as proto-patterns.
• Figure 5: The average attack success rates (%) on normally trained models (for ImageNet) w.r.t. strength of semi-random noise $N_{sr}$ and random noise $N_{r}$ (left), tile-schemes (middle) and densities (right). "blur” denotes using Gaussian kernel to smooth the image (constrained by $\varepsilon=16$).