Hands-On Artificial Intelligence for Cybersecurity

Substitute model training

As we said previously, the model-substitution-based adversarial attack methodology is aimed at training a substitute model that resembles the original target NN in order to find viable vulnerabilities on the target NN.

The training phase of the substitute model is therefore characterized by a number of important peculiarities, which involves the following:

• Selecting an architecture for the substitute model without knowledge of the targeted model
• Limiting the number of queries made to the targeted model in order to ensure that the approach is tractable

In order to address these difficult tasks, the proposed attack strategy is based on the generation of synthetic data (using the technique known as Jacobian-based ...