Demo Data from EDBT 2026 / reviewers in the wild / expert
Salman Asif
dblp:346/0874
· DBLP profile ↗
1ranked-venue papers
0as first author
1since 2021 · last 2022
—ORCID · none
Domains — the database's venue-derived domains; a paper can count in several
Artificial intelligence and machine learning · 1 · 1 since 2021
Expertise — from the expertise taxonomy: the topics of the expert's papers under the CCF categories. A weight counts papers with recency: 1 for a paper about the topic, 0.3 when the topic is its context, halved every five years.
| Network and information security
1 paper |
Security and privacy of machine learning · 100% |
Topics — the 4 heaviest of 4, each with the papers that count most for it
| Topic | Weight | Papers | Last | Evidence papers |
|---|---|---|---|---|
Security and privacy of machine learning
adversarial attack |
0.6 | 1 | 2022 | Blackbox Attacks via Surrogate Ensemble Search · NeurIPS 2022 |
Security and privacy of machine learning › adversarial attack
black-box attack |
0.6 | 1 | 2022 | Blackbox Attacks via Surrogate Ensemble Search · NeurIPS 2022 |
Security and privacy of machine learning › adversarial attack
query-efficient attack |
0.6 | 1 | 2022 | Blackbox Attacks via Surrogate Ensemble Search · NeurIPS 2022 |
Security and privacy of machine learning › adversarial attack
transferable adversarial attack |
0.6 | 1 | 2022 | Blackbox Attacks via Surrogate Ensemble Search · NeurIPS 2022 |
Methods — techniques the papers use, named apart from their topics
weighted loss search · 0.6surrogate ensemble · 0.6query-based optimization · 0.6
| Year | Publication | Venue | Position |
|---|---|---|---|
| 2022 | Blackbox Attacks via Surrogate Ensemble SearchabstractBlackbox adversarial attacks can be categorized into transfer- and query-based attacks. Transfer methods do not require any feedback from the victim model, but provide lower success rates compared to query-based methods. Query attacks often require a large number of queries for success. To achieve the best of both approaches, recent efforts have tried to combine them, but still require hundreds of queries to achieve high success rates (especially for targeted attacks). In this paper, we propose a novel method for Blackbox Attacks via Surrogate Ensemble Search (BASES) that can generate highly successful blackbox attacks using an extremely small number of queries. We first define a perturbation machine that generates a perturbed image by minimizing a weighted loss function over a fixed set of surrogate models. To generate an attack for a given victim model, we search over the weights in the loss function using queries generated by the perturbation machine. Since the dimension of the search space is small (same as the number of surrogate models), the search requires a small number of queries. We demonstrate that our proposed method achieves better success rate with at least $30\times$ fewer queries compared to state-of-the-art methods on different image classifiers trained with ImageNet (including VGG-19, DenseNet-121, and ResNext-50). In particular, our method requires as few as 3 queries per image (on average) to achieve more than a $90\%$ success rate for targeted attacks and 1--2 queries per image for over a $99\%$ success rate for untargeted attacks. Our method is also effective on Google Cloud Vision API and achieved a $91\%$ untargeted attack success rate with 2.9 queries per image. We also show that the perturbations generated by our proposed method are highly transferable and can be adopted for hard-label blackbox attacks. Furthermore, we argue that BASES can be used to create attacks for a variety of tasks and show its effectiveness for attacks on object detection models. Our code is available at https://github.com/CSIPlab/BASES. Zikui Cai, Chengyu Song, Srikanth V. Krishnamurthy, Amit K. Roy-Chowdhury, Salman Asif |
NeurIPS | 5 |