Distributed Black-box Attack: Do Not Overestimate Black-box Attacks

TL;DR

This paper investigates the practical threat of black-box adversarial attacks on cloud-based image classification APIs, showing that prior high-efficiency claims often rely on offline/local-model evaluation and information unavailable to cloud services. By conducting online attacks using realistic pipelines and introducing open-source tools (DeepAPI and Black-box Adversarial Toolbox) along with horizontal and vertical distribution strategies, it demonstrates significantly lower attack success under $L_{\infty}$ constraints with budgeted perturbations $\epsilon$ compared to local-model scenarios. The work emphasizes the need for realistic evaluation of cloud APIs and provides concrete methods to study practical attacks, ultimately suggesting cloud services are more robust in practice. These findings have implications for API providers and researchers, guiding more credible threat assessments and defense-oriented research.

Abstract

As cloud computing becomes pervasive, deep learning models are deployed on cloud servers and then provided as APIs to end users. However, black-box adversarial attacks can fool image classification models without access to model structure and weights. Recent studies have reported attack success rates of over 95% with fewer than 1,000 queries. Then the question arises: whether black-box attacks have become a real threat against cloud APIs? To shed some light on this, our research indicates that black-box attacks are not as effective against cloud APIs as proposed in research papers due to several common mistakes that overestimate the efficiency of black-box attacks. To avoid similar mistakes, we conduct black-box attacks directly on cloud APIs rather than local models.

Figures (6)

• Figure 1: Most prior research tests black-box attacks on local models, where the adversarial perturbation is applied after pre-processing and just before the input is fed into deep learning models, assuming access to the input of a black-box model.
• Figure 2: We initiate black-box attacks directly against cloud APIs, applying the adversarial perturbation before image encoding and pre-processing. This approach assumes no access to the internal workflow of cloud-based black-box models.
• Figure 3: The attack success rate of attacking local models and cloud APIs.
• Figure 4: The average number of queries of attacking local models and cloud APIs.
• Figure 5: DeepAPI provides both web interface and APIs for research on black-box attacks.