Rethinking Image-Scaling Attacks: The Interplay Between Vulnerabilities in Machine Learning Systems
Yue Gaoa, Ilia Shumailovb, Kassem Fawaza
- aUniversity of Wisconsin-Madison, #TAB#
- bUniv. of Cambridge
Papers open inside SciRah from the original publisher or repository; SciRah never hosts them.
Abstract
As real-world images come in varying sizes, the machine learning model is part of a larger system that includes an upstream image scaling algorithm. In this paper, we investigate the interplay between vulnerabilities of the image scaling procedure and machine learning models in the decision-based black-box setting. We propose a novel sampling strategy to make a black-box attack exploit vulnerabilities in scaling algorithms, scaling defenses, and the final machine learning model in an end-to-end manner. Based on this scaling-aware attack, we reveal that most existing scaling defenses are ineffective under threat from downstream models. Moreover, we empirically observe that standard black-box attacks can significantly improve their performance by exploiting the vulnerable scaling procedure. We further demonstrate this problem on a commercial Image Analysis API with decision-based black-box attacks.
TL;DRThis paper proposes a novel sampling strategy to make a black-box attack exploit vulnerabilities in scaling algorithms, scaling defenses, and the machine learning model in an end-to-end manner and reveals that most existing scaling defenses are ineffective under threat from downstream models. (Semantic Scholar)