Multi-network Ensembling for GAN Training and Adversarial Attacks

Deep neural networks are fragile to attacks from adversarial examples. However, successfully fooling a target model with a limited query budget is challenging in black-box scenarios where none of the network architecture, parameters, or training data is available. An alternative solution is to employ a generative adversarial network (GAN) to generate synthetic data and train a substitute model of the target model, allowing us to perform the white-box attack, namely the transfer attack. We find that the current single network substitution suffers from a performance bottleneck. This article presents a multi-network ensembling to optimize GAN training and adversarial example generation, which includes a new multi-network substitute training strategy and an adaptive ensemble attack strategy. Extensive experiments on the MNIST and CIFAR-10 datasets show that our method outperforms the state-of-the-art in terms of query efficiency. Especially, when attacking the Microsoft Azure online model in both the label-only and probability-only scenarios, our method achieves a 100% attack success rate with a meager query budget. The code is available at https://github.com/GZHU-DVL/ZHENG.