Gaussian MRF Covariance Modeling for Efficient Black-Box Adversarial Attacks
We study the problem of generating adversarial examples in a black-box setting, where we only have access to a zeroth order oracle, providing us with loss function evaluations. We employ Markov Random Fields (MRF) to exploit the structure of input data to systematically model the covariance structure of the gradients. The MRF structure in addition to Bayesian inference for the gradients facilitates one-step attacks akin to Fast Gradient Sign Method (FGSM) albeit in the black-box setting. The resulting method uses fewer queries than the current state of the art to achieve comparable performance. In particular, in the regime of lower query budgets, we show that our method is particularly effective in terms of fewer average queries with high attack accuracy while employing one-step attacks.
In this paper, the authors propose a method for black box adversarial image generation. The idea is to learn a parameterization of a precision matrix so that gradients of a network*s loss are assumed to be drawn from a corresponding Gaussian. The parameters of this model are fit efficiently using the spectral theorem that their particular parameterization of the precision matrix allows them to use. Gradient estimation is then viewed as a Gaussian conditioning problem given observations (see last equation on page 5). Overall, I think the method is elegant -- particular in comparison to many existing approaches in the literature that rely on highly complex machinery like genetic algorithms and the like. My main source of questions is the experimental results section, which I currently view as somewhat weak and a little confusing -- I would be more than happy to increase my score if my concerns are sufficiently addressed. First, I*m not sure that the story told by Figure 3 and Table 1 is entirely clear. On the whole at a given sufficiently high success rate (say, 80%), it seems that the authors* approach consistently loses to the Parsimonious attack of Moon et al., 2019? The authors* method seems to perform strictly better than Bandits_{TD} and NES, but the gap between the Parsimonious attack and the authors* is quite substantial past 300 evaluations. This ultimately leaves me with the question of what to do with this paper. The learning framework used to estimate gradients is clever, but doesn*t seem to me to be methodologically groundbreaking to the point where it can stand on its own merits independent of its performance in comparison to other techniques. Particularly considering other papers have been published since the Ilyas et al., 2019 paper that outperform Bandits_{TD} and NES in terms of query efficiency, I worry that this paper simply presents a decent idea with middling results. I*d therefore like the authors to primarily comment on the broader impact they believe their paper will have. The conclusion primarily focuses on the introduction of the method: does it have substantial merits past its empirical performance?
You are a member of the scientific community tasked with peer review. Review the following paper title and abstract.
### Title + Abstract
Gaussian MRF Covariance Modeling for Efficient Black-Box Adversarial Attacks
We study the problem of generating adversarial examples in a black-box setting, where we only have access to a zeroth order oracle, providing us with loss function evaluations. We employ Markov Random Fields (MRF) to exploit the structure of input data to systematically model the covariance structure of the gradients. The MRF structure in addition to Bayesian inference for the gradients facilitates one-step attacks akin to Fast Gradient Sign Method (FGSM) albeit in the black-box setting. The resulting method uses fewer queries than the current state of the art to achieve comparable performance. In particular, in the regime of lower query budgets, we show that our method is particularly effective in terms of fewer average queries with high attack accuracy while employing one-step attacks.
user
<think>Okay, to do a decent peer review, I should start with summarizing what the work is about. This includes novelty, contributions, clarity, and impact. I might include suggestions to issues that I find critical to the usefulness of the work. Starting with novelty, there are different types of novelty. The first aspect of novelty is scope and scale. Is the work covering a broader perspective than previous works? The second aspect is methodology. Is the proposed methodology novel compared to previous methods? Do they provide any significant advantage over previous methodologies? The third aspect is results. Are the results different compared previous work? Does this lead to any novel theories or an extension of current theories? Next is clarity, I will be reading the work in depth and analyze if any sentences can be potentially ambiguous or misleading. If any sentences are ambiguous, I will state them and give a suggestion on how to rephrase such sentence or how to make more clear to the audience. Lastly, impact is important. I will attempt to predict how such work will impact the scientific community. This might include the applications of such work and how the work might transform the way we study a certain topic. Finally, I will might only mention issues that are critical. This is to keep the review as concise and helpful as possible.</think>



In this paper, the authors propose a method for black box adversarial image generation. The idea is to learn a parameterization of a precision matrix so that gradients of a network*s loss are assumed to be drawn from a corresponding Gaussian. The parameters of this model are fit efficiently using the spectral theorem that their particular parameterization of the precision matrix allows them to use. Gradient estimation is then viewed as a Gaussian conditioning problem given observations (see last equation on page 5). Overall, I think the method is elegant -- particular in comparison to many existing approaches in the literature that rely on highly complex machinery like genetic algorithms and the like. My main source of questions is the experimental results section, which I currently view as somewhat weak and a little confusing -- I would be more than happy to increase my score if my concerns are sufficiently addressed. First, I*m not sure that the story told by Figure 3 and Table 1 is entirely clear. On the whole at a given sufficiently high success rate (say, 80%), it seems that the authors* approach consistently loses to the Parsimonious attack of Moon et al., 2019? The authors* method seems to perform strictly better than Bandits_{TD} and NES, but the gap between the Parsimonious attack and the authors* is quite substantial past 300 evaluations. This ultimately leaves me with the question of what to do with this paper. The learning framework used to estimate gradients is clever, but doesn*t seem to me to be methodologically groundbreaking to the point where it can stand on its own merits independent of its performance in comparison to other techniques. Particularly considering other papers have been published since the Ilyas et al., 2019 paper that outperform Bandits_{TD} and NES in terms of query efficiency, I worry that this paper simply presents a decent idea with middling results. I*d therefore like the authors to primarily comment on the broader impact they believe their paper will have. The conclusion primarily focuses on the introduction of the method: does it have substantial merits past its empirical performance?
assistant
In this paper, the authors propose a method for black box adversarial image generation. The idea is to learn a parameterization of a precision matrix so that gradients of a network*s loss are assumed to be drawn from a corresponding Gaussian. The parameters of this model are fit efficiently using the spectral theorem that their particular parameterization of the precision matrix allows them to use. Gradient estimation is then viewed as a Gaussian conditioning problem given observations (see last equation on page 5). Overall, I think the method is elegant -- particular in comparison to many existing approaches in the literature that rely on highly complex machinery like genetic algorithms and the like. My main source of questions is the experimental results section, which I currently view as somewhat weak and a little confusing -- I would be more than happy to increase my score if my concerns are sufficiently addressed. First, I*m not sure that the story told by Figure 3 and Table 1 is entirely clear. On the whole at a given sufficiently high success rate (say, 80%), it seems that the authors* approach consistently loses to the Parsimonious attack of Moon et al., 2019? The authors* method seems to perform strictly better than Bandits_{TD} and NES, but the gap between the Parsimonious attack and the authors* is quite substantial past 300 evaluations. This ultimately leaves me with the question of what to do with this paper. The learning framework used to estimate gradients is clever, but doesn*t seem to me to be methodologically groundbreaking to the point where it can stand on its own merits independent of its performance in comparison to other techniques. Particularly considering other papers have been published since the Ilyas et al., 2019 paper that outperform Bandits_{TD} and NES in terms of query efficiency, I worry that this paper simply presents a decent idea with middling results. I*d therefore like the authors to primarily comment on the broader impact they believe their paper will have. The conclusion primarily focuses on the introduction of the method: does it have substantial merits past its empirical performance?