Towards Black-Box Adversarial Attacks on Interpretable Deep Learning Systems

Yike Zhan; Baolin Zheng; Qian Wang; Ningping Mou; Binqing Guo; Qi Li; Chao Shen; Cong Wang

doi:10.1109/ICME52920.2022.9859856

Towards Black-Box Adversarial Attacks on Interpretable Deep Learning Systems

Yike Zhan, Baolin Zheng, Qian Wang^*, Ningping Mou, Binqing Guo, Qi Li, Chao Shen, Cong Wang

^*Corresponding author for this work

Department of Computer Science

Research output: Chapters, Conference Papers, Creative and Literary Works › RGC 32 - Refereed conference paper (with host publication) › peer-review

8 Citations (Scopus)

Abstract

Recent works have empirically shown that neural network interpretability is susceptible to malicious manipulations. However, existing attacks against Interpretable Deep Learning Systems (IDLSes) all focus on the white-box setting, which is obviously unpractical in real-world scenarios. In this paper, we make the first attempt to attack IDLSes in the decision-based black-box setting. We propose a new framework called Dual Black-box Adversarial Attack (DBAA) which can generate adversarial examples that are misclassified as the target class, yet have very similar interpretations to their benign cases. We conduct comprehensive experiments on different combinations of classifiers and interpreters to illustrate the effectiveness of DBAA. Empirical results show that in all the cases, DBAA achieves high attack success rates and Intersection over Union (IoU) scores.

Original language	English
Title of host publication	IEEE ICME - IEEE INTERNATIONAL CONFERENCE ON MULTIMEDIA AND EXPO 2022
Subtitle of host publication	ICME 2022 - CONFERENCE PROCEEDINGS
Publisher	IEEE Computer Society
Number of pages	6
ISBN (Electronic)	9781665485630
ISBN (Print)	9781665485647
DOIs	https://doi.org/10.1109/ICME52920.2022.9859856
Publication status	Published - 2022
Event	2022 IEEE International Conference on Multimedia and Expo (ICME 2022) - Hybrid, Taipei, Taiwan, China Duration: 18 Jul 2022 → 22 Jul 2022 https://2022.ieeeicme.org/

Publication series

Name	Proceedings - IEEE International Conference on Multimedia and Expo
Volume	2022-July
ISSN (Print)	1945-7871
ISSN (Electronic)	1945-788X

Conference

Conference	2022 IEEE International Conference on Multimedia and Expo (ICME 2022)
Abbreviated title	IEEE ICME 2022
Place	Taiwan, China
City	Taipei
Period	18/07/22 → 22/07/22
Internet address	https://2022.ieeeicme.org/

Funding

This work was supported in part by the National Key R&D Program of China (2020AAA0107701), NSFC under Grants U20B2049, U21B2018, 62161160337 and 62132011, Shaanxi Province Key Industry Innovation Program under Grant 2021ZDLGY01-02, Research Grants Council of Hong Kong under Grants N CityU139/21 and R6021-20F, and in part by BNRist under Grant BNR2020RC01013.

Research Keywords

adversarial examples
black-box attacks
Interpretable deep learning systems

RGC Funding Information

RGC-funded

Access Output

10.1109/ICME52920.2022.9859856

Other Access Options

Check CityUHK Library

Permanent Link

Right click to copy link

Cite this

Zhan, Y., Zheng, B., Wang, Q., Mou, N., Guo, B., Li, Q., Shen, C., & Wang, C. (2022). Towards Black-Box Adversarial Attacks on Interpretable Deep Learning Systems. In IEEE ICME - IEEE INTERNATIONAL CONFERENCE ON MULTIMEDIA AND EXPO 2022: ICME 2022 - CONFERENCE PROCEEDINGS (Proceedings - IEEE International Conference on Multimedia and Expo; Vol. 2022-July). IEEE Computer Society. https://doi.org/10.1109/ICME52920.2022.9859856

@inproceedings{3a37aa37ca764977a836ee67bd9076ca,

title = "Towards Black-Box Adversarial Attacks on Interpretable Deep Learning Systems",

abstract = "Recent works have empirically shown that neural network interpretability is susceptible to malicious manipulations. However, existing attacks against Interpretable Deep Learning Systems (IDLSes) all focus on the white-box setting, which is obviously unpractical in real-world scenarios. In this paper, we make the first attempt to attack IDLSes in the decision-based black-box setting. We propose a new framework called Dual Black-box Adversarial Attack (DBAA) which can generate adversarial examples that are misclassified as the target class, yet have very similar interpretations to their benign cases. We conduct comprehensive experiments on different combinations of classifiers and interpreters to illustrate the effectiveness of DBAA. Empirical results show that in all the cases, DBAA achieves high attack success rates and Intersection over Union (IoU) scores.",

keywords = "adversarial examples, black-box attacks, Interpretable deep learning systems",

author = "Yike Zhan and Baolin Zheng and Qian Wang and Ningping Mou and Binqing Guo and Qi Li and Chao Shen and Cong Wang",

year = "2022",

doi = "10.1109/ICME52920.2022.9859856",

language = "English",

isbn = "9781665485647",

series = "Proceedings - IEEE International Conference on Multimedia and Expo",

publisher = "IEEE Computer Society",

booktitle = "IEEE ICME - IEEE INTERNATIONAL CONFERENCE ON MULTIMEDIA AND EXPO 2022",

address = "United States",

note = "2022 IEEE International Conference on Multimedia and Expo (ICME 2022), IEEE ICME 2022 ; Conference date: 18-07-2022 Through 22-07-2022",

url = "https://2022.ieeeicme.org/",

}

Zhan, Y, Zheng, B, Wang, Q, Mou, N, Guo, B, Li, Q, Shen, C & Wang, C 2022, Towards Black-Box Adversarial Attacks on Interpretable Deep Learning Systems. in IEEE ICME - IEEE INTERNATIONAL CONFERENCE ON MULTIMEDIA AND EXPO 2022: ICME 2022 - CONFERENCE PROCEEDINGS. Proceedings - IEEE International Conference on Multimedia and Expo, vol. 2022-July, IEEE Computer Society, 2022 IEEE International Conference on Multimedia and Expo (ICME 2022), Taipei, Taiwan, China, 18/07/22. https://doi.org/10.1109/ICME52920.2022.9859856

Towards Black-Box Adversarial Attacks on Interpretable Deep Learning Systems. / Zhan, Yike; Zheng, Baolin; Wang, Qian et al.
IEEE ICME - IEEE INTERNATIONAL CONFERENCE ON MULTIMEDIA AND EXPO 2022: ICME 2022 - CONFERENCE PROCEEDINGS. IEEE Computer Society, 2022. (Proceedings - IEEE International Conference on Multimedia and Expo; Vol. 2022-July).

Research output: Chapters, Conference Papers, Creative and Literary Works › RGC 32 - Refereed conference paper (with host publication) › peer-review

TY - GEN

T1 - Towards Black-Box Adversarial Attacks on Interpretable Deep Learning Systems

AU - Zhan, Yike

AU - Zheng, Baolin

AU - Wang, Qian

AU - Mou, Ningping

AU - Guo, Binqing

AU - Li, Qi

AU - Shen, Chao

AU - Wang, Cong

PY - 2022

Y1 - 2022

N2 - Recent works have empirically shown that neural network interpretability is susceptible to malicious manipulations. However, existing attacks against Interpretable Deep Learning Systems (IDLSes) all focus on the white-box setting, which is obviously unpractical in real-world scenarios. In this paper, we make the first attempt to attack IDLSes in the decision-based black-box setting. We propose a new framework called Dual Black-box Adversarial Attack (DBAA) which can generate adversarial examples that are misclassified as the target class, yet have very similar interpretations to their benign cases. We conduct comprehensive experiments on different combinations of classifiers and interpreters to illustrate the effectiveness of DBAA. Empirical results show that in all the cases, DBAA achieves high attack success rates and Intersection over Union (IoU) scores.

AB - Recent works have empirically shown that neural network interpretability is susceptible to malicious manipulations. However, existing attacks against Interpretable Deep Learning Systems (IDLSes) all focus on the white-box setting, which is obviously unpractical in real-world scenarios. In this paper, we make the first attempt to attack IDLSes in the decision-based black-box setting. We propose a new framework called Dual Black-box Adversarial Attack (DBAA) which can generate adversarial examples that are misclassified as the target class, yet have very similar interpretations to their benign cases. We conduct comprehensive experiments on different combinations of classifiers and interpreters to illustrate the effectiveness of DBAA. Empirical results show that in all the cases, DBAA achieves high attack success rates and Intersection over Union (IoU) scores.

KW - adversarial examples

KW - black-box attacks

KW - Interpretable deep learning systems

UR - http://www.scopus.com/inward/record.url?scp=85137700941&partnerID=8YFLogxK

UR - https://www.scopus.com/record/pubmetrics.uri?eid=2-s2.0-85137700941&origin=recordpage

U2 - 10.1109/ICME52920.2022.9859856

DO - 10.1109/ICME52920.2022.9859856

M3 - RGC 32 - Refereed conference paper (with host publication)

SN - 9781665485647

T3 - Proceedings - IEEE International Conference on Multimedia and Expo

BT - IEEE ICME - IEEE INTERNATIONAL CONFERENCE ON MULTIMEDIA AND EXPO 2022

PB - IEEE Computer Society

T2 - 2022 IEEE International Conference on Multimedia and Expo (ICME 2022)

Y2 - 18 July 2022 through 22 July 2022

ER -

Zhan Y, Zheng B, Wang Q, Mou N, Guo B, Li Q et al. Towards Black-Box Adversarial Attacks on Interpretable Deep Learning Systems. In IEEE ICME - IEEE INTERNATIONAL CONFERENCE ON MULTIMEDIA AND EXPO 2022: ICME 2022 - CONFERENCE PROCEEDINGS. IEEE Computer Society. 2022. (Proceedings - IEEE International Conference on Multimedia and Expo). Epub 2022 Aug 26. doi: 10.1109/ICME52920.2022.9859856

Towards Black-Box Adversarial Attacks on Interpretable Deep Learning Systems

Abstract

Publication series

Conference

Funding

Research Keywords

RGC Funding Information

Access Output

Other Access Options

Permanent Link

Other Files and Links

Fingerprint

RIF-ExtU-Lead: Enabling Secure and Efficient Cross-Silo Federated Learning at Scale

NSFC: Towards Secure and Privacy-enhanced Machine Learning as a Service

Cite this

Towards Black-Box Adversarial Attacks on Interpretable Deep Learning Systems

Abstract

Publication series

Conference

Funding

Research Keywords

RGC Funding Information

Access Output

Other Access Options

Permanent Link

Other Files and Links

Fingerprint

Projects

RIF-ExtU-Lead: Enabling Secure and Efficient Cross-Silo Federated Learning at Scale

NSFC: Towards Secure and Privacy-enhanced Machine Learning as a Service

Cite this