White-to-Black: Efficient Distillation of Black-Box Adversarial Attacks

Proceedings of NAACL-HLT 2019, pages 1373–1379 Minneapolis, Minnesota, June 2 - June 7, 2019. c⃝2019 Association for Computational Linguistics 1373 White-to-Black: Efficient Distillation of Black-Box Adversarial Attacks Yotam Gil1∗and Yoav Chai2∗and Or Gorodissky1∗and Jonathan Berant2,3 1School of Electrical Engineering, Tel-Aviv University 2School of Computer Science, Tel-Aviv University 3Allen Institute for Artificial Intelligence {yotamgil@mail, yoavchai1@mail, orarieg@mail, joberant@cs}.tau.ac.il Abstract Adversarial examples are important for under- standing the behavior of neural models, and can improve their robustness through adver- sarial training. Recent work in natural lan- guage processing generated adversarial exam- ples by assuming white-box access to the at- tacked model, and optimizing the input di- rectly against it (Ebrahimi et al., 2018). In this work, we show that the knowledge implicit in the optimization procedure can be distilled into another more efficient neural network. We train a model to emulate the behavior of a white-box attack and show that it generalizes well across examples. Moreover, it reduces adversarial example generation time by 19x- 39x. We also show that our approach trans- fers to a black-box setting, by attacking The Google Perspective API and exposing its vul- nerability. Our attack flips the API-predicted label in 42% of the generated examples, while humans maintain high-accuracy in predicting the gold label. 1 Introduction Adversarial examples (Goodfellow et al., 2014) have gained tremendous attention recently, as they elucidate model limitations, and expose vulnerabili- ties in deployed systems. Work in natural language processing (NLP) either (a) used simple heuristics for generating adversarial examples (Jia and Liang, 2017; Belinkov and Bisk, 2017; Iyyer et al., 2018), or (b) assumed white-box access, where the at- tacker has access to gradients of the model with re- spect to the input (Feng et al., 2018; Ebrahimi et al., 2018). In this approach, adversarial examples are constructed through an optimization process that uses gradient descent to search for input examples that maximally change the predictions of a model. However, developing attacks with only black-box access to a model (no access to gradients) is still under-explored in NLP. ∗ Equal contribution Figure 1: (A) Using a white-box attack we generate adversarial examples for a source toxicity model S(·). We train our black-box attacker, DISTFLIP, to emulate the white-box attack. (B) We use DISTFLIP to attack a black-box model. Inspired by work in computer vision (Papernot et al., 2016; Liu et al., 2017), we show in this work that a neural network can learn to emulate the op- timization process of a white-box attack and gen- eralize well to new examples. Figure 1 gives a high-level overview of our approach. We assume a text classification model and a white-box attack that flips characters in the input to modify the model prediction (Ebrahimi et al., 2018). We generate output adversarial examples using the white-box attack and train a neural network from these input- output examples to imitate the white-box attack. This results in a much more efficient attack whose run-time is independent of the optimization process. Moreover, assuming adversarial examples transfer between different models, our …

Content truncated to 500 words