In this paper, we study the problem of constrained robust (min-max)
optimization ina black-box setting, where the desired optimizer cannot access
the gradients of the objective function but may query its values. We present a
principled optimization framework, integrating a zeroth-order (ZO) gradient
estimator with an alternating projected stochastic gradient descent-ascent
method, where the former only requires a small number of function queries and
the later needs just one-step descent/ascent update. We show that the proposed
framework, referred to as ZO-Min-Max, has a sub-linear convergence rate under
mild conditions and scales gracefully with problem size. From an application
side, we explore a promising connection between black-box min-max optimization
and black-box evasion and poisoning attacks in adversarial machine learning
(ML). Our empirical evaluations on these use cases demonstrate the
effectiveness of our approach and its scalability to dimensions that prohibit
using recent black-box solvers.

本文研究了黑盒环境下有约束的鲁棒（最小 - 最大）优化问题，并采用了零阶梯度估计器与交替投影随机梯度下降 - 上升方法的优化框架，称为 ZO-Min-Max，旨在探索在对抗机器学习中的黑盒最小 - 最大优化与黑盒逃避和污染攻击之间的可能联系。实证评估表明了该方法的有效性和可扩展性。

无梯度的极小极大优化：收敛性和在对抗机器学习中的应用

Min-Max Optimization without Gradients: Convergence and Applications to  Adversarial ML

Solving for adversarial examples with projected gradient descent has been
demonstrated to be highly effective in fooling the neural network based
classifiers. However, in the black-box setting, the attacker is limited only to
the query access to the network and solving for a successful adversarial
example becomes much more difficult. To this end, recent methods aim at
estimating the true gradient signal based on the input queries but at the cost
of excessive queries. We propose an efficient discrete surrogate to the
optimization problem which does not require estimating the gradient and
consequently becomes free of the first order update hyperparameters to tune.
Our experiments on Cifar-10 and ImageNet show the state of the art black-box
attack performance with significant reduction in the required queries compared
to a number of recently proposed methods. The source code is available at
this https URL

本文提出了一种离散替代方法来解决黑匣子攻击的问题，该方法可以在不需要估计导数的情况下有效地攻击神经网络，降低了之前所提出方法所需的查询次数。