# Adversarial Examples Versus Cloud-based Detectors: A Black-box Empirical Study

arXiv: https://arxiv.org/abs/1901.01223 · HTML: https://mlsanity.com/paper/1901.01223/

## Key facts

- Cited by 8 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 4 Jan 2019.

## Built on by (most cited first, 8 of 8)

- [Smart App Attack: Hacking Deep Learning Models in Android Apps](https://mlsanity.com/paper/2204.11075/) (2022)
- [Saliency Attack: Towards Imperceptible Black-box Adversarial Attack](https://mlsanity.com/paper/2206.01898/) (2022)
- [Transfer Attacks Revisited: A Large-Scale Empirical Study in Real Computer Vision Settings](https://mlsanity.com/paper/2204.04063/) (2022)
- [Local Black-box Adversarial Attacks: A Query Efficient Approach](https://mlsanity.com/paper/2101.01032/) (2021)
- [Effective and Imperceptible Adversarial Textual Attack via Multi-objectivization](https://mlsanity.com/paper/2111.01528/) (2021)
- [Substance or Style: What Does Your Image Embedding Know?](https://mlsanity.com/paper/2307.05610/) (2023)
- [Be Careful with Rotation: A Uniform Backdoor Pattern for 3D Shape](https://mlsanity.com/paper/2211.16192/) (2022)
- [Adversarial Examples Detection with Enhanced Image Difference Features based on Local Histogram Equalization](https://mlsanity.com/paper/2305.04436/) (2023)

## Abstract (arXiv)

Deep learning has been broadly leveraged by major cloud providers, such as Google, AWS and Baidu, to offer various computer vision related services including image classification, object identification, illegal image detection, etc. While recent works extensively demonstrated that deep learning classification models are vulnerable to adversarial examples, cloud-based image detection models, which are more complicated than classifiers, may also have similar security concern but not get enough attention yet. In this paper, we mainly focus on the security issues of real-world cloud-based image detectors. Specifically, (1) based on effective semantic segmentation, we propose four attacks to generate semantics-aware adversarial examples via only interacting with black-box APIs; and (2) we make the first attempt to conduct an extensive empirical study of black-box attacks against real-world cloud-based image detectors. Through the comprehensive evaluations on five major cloud platforms: AWS, Azure, Google Cloud, Baidu Cloud, and Alibaba Cloud, we demonstrate that our image processing based attacks can reach a success rate of approximately 100%, and the semantic segmentation based attacks have a success rate over 90% among different detection services, such as violence, politician, and pornography detection. We also proposed several possible defense strategies for these security challenges in the real-life situation.