White-box setting

[le000043]

Hello,
I am still new to adversarial attack/defense. If I add Preprocessor to TensorFlowV2Classifier and conduct attacks using PGD, would that be considered a white-box setting in the threat model where the attacker knows about the model as well as the defense?
Thanks

[beat-buesser]

Hi @le000043 Yes, that would be considered a white-box scenario. You could further distinguish if your Preprocessor provides exact gradients or approximated with a Backward Pass Differentiable Approximation (BPDA).

[le000043]

@beat-buesser Thanks. Additionally, how does the attacker use the information about the preprocessor in the white-box scenario?

[beat-buesser]

@le000043 In a white-box scenario the attacker would analyse the preprocessor and try to calculate or approximate loss gradients as accurately as possible.

[le000043]

@beat-buesser thanks! Just to clarify, in this scenario, the attacker can calculate the loss gradients of the combined preprocessor-classifier as accurately as it does to the classifier alone right?

[beat-buesser]

Yes.

[le000043]

@beat-buesser Thanks. For the gray-box attack setting, the adversarial examples are generated against the classifier without any preprocessor, which is then purified by an image denoiser (e.g, JpegCompression). Thus, for the gray-box scenario, the attacker generates adversarial examples based solely on the loss gradient of the classifier alone. How does this differ from the white-box scenario you mentioned previously?

• Additionally, I notice that in your Preprocessor description, it was mentioned that BPDA is applied as default, does this mean that all ART's implemented Preprocessor's gradient can be estimated by default?