arXiv research

LAZO reduces query complexity and variance in ZO methods.

New methods improve black-box adversarial attacks with fewer queries.

We provide a new theoretical analysis framework to investigate online gradient descent in the dynamic environment. Comparing with the previous work, the new framework recovers the state-of-the-art dynamic regret, but does not require extra gradient queries for every iteration. Specifically, when functions are $α$ stron…

New tool for parallel and private stochastic convex optimization reduces query complexity.

Paper proposes ZO-NGD for more efficient black-box attacks.

We consider the black-box adversarial setting, where the adversary has to generate adversarial perturbations without access to the target models to compute gradients. Previous methods tried to approximate the gradient either by using a transfer gradient of a surrogate white-box model, or based on the query feedback. Ho…

Proposes efficient FOBO algorithms for global maxima of expensive functions.

We lower bound the complexity of finding $ε$-stationary points (with gradient norm at most $ε$) using stochastic first-order methods. In a well-studied model where algorithms access smooth, potentially non-convex functions through queries to an unbiased stochastic gradient oracle with bounded variance, we prove that (i…

New bounds show complex neural networks need many queries to learn.

Gradient flow on softmax attention minimizes nuclear norm of weight matrices.

Solving for adversarial examples with projected gradient descent has been demonstrated to be highly effective in fooling the neural network based classifiers. However, in the black-box setting, the attacker is limited only to the query access to the network and solving for a successful adversarial example becomes much …

Gradient descent fails to learn simple neural networks efficiently.

We show through theory and experiment that gradient-based explanations of a model quickly reveal the model itself. Our results speak to a tension between the desire to keep a proprietary model secret and the ability to offer model explanations. On the theoretical side, we give an algorithm that provably learns a two-la…

Improved sampling from high-dimensional Gaussians using smoothed scores.

Proposes a query-efficient blackbox attack method.

We study the most practical problem setup for evaluating adversarial robustness of a machine learning system with limited access: the hard-label black-box attack setting for generating adversarial examples, where limited model queries are allowed and only the decision is provided to a queried data input. Several algori…

This paper tackles the computational complexity of finding approximate stationary points in non-convex optimization.

New algorithm reduces dimensionality in stochastic optimization.

New algorithm tackles dynamic query routing to multiple embedding models.

Lower bounds show many sampling algorithms need many gradient queries.

The study examines how many samples are needed to minimize a noisy convex function with inaccurate gradient estimates.

Meta-learning framework improves model performance on few-shot classification tasks.

Gradient descent is efficient for solving feasibility problems with minimal memory and queries.

Paper reconstructs training data from a single gradient query.

The paper tackles machine unlearning by designing efficient algorithms for adaptive query classes.

HMC improves Gaussian sampling efficiency with long, random steps.

A quantum reinforcement learning algorithm reduces sample complexity.

Paper solves k-sparse parity problem with sign SGD, matching SQ lower bound.

This paper explores the non-convex composition optimization in the form including inner and outer finite-sum functions with a large number of component functions. This problem arises in some important applications such as nonlinear embedding and reinforcement learning. Although existing approaches such as stochastic gr…

A new one-point feedback scheme improves ZO algorithms for black-box optimization.

Effective techniques for eliciting user preferences have taken on added importance as recommender systems (RSs) become increasingly interactive and conversational. A common and conceptually appealing Bayesian criterion for selecting queries is expected value of information (EVOI). Unfortunately, it is computationally p…

New algorithm guarantees performance on noisy data.

We propose the Square Attack, a score-based black-box $l_2$- and $l_\infty$-adversarial attack that does not rely on local gradient information and thus is not affected by gradient masking. Square Attack is based on a randomized search scheme which selects localized square-shaped updates at random positions so that at …

Online minimization of an unknown convex function over the interval $[0,1]$ is considered under first-order stochastic bandit feedback, which returns a random realization of the gradient of the function at each query point. Without knowing the distribution of the random gradients, a learning algorithm sequentially choo…

Optimizes state monitoring in Markovian systems with cost constraints.

In this paper, we study the problem of constrained robust (min-max) optimization ina black-box setting, where the desired optimizer cannot access the gradients of the objective function but may query its values. We present a principled optimization framework, integrating a zeroth-order (ZO) gradient estimator with an a…

Note that this paper is superceded by "Black-Box Adversarial Attacks with Limited Queries and Information." Current neural network-based image classifiers are susceptible to adversarial examples, even in the black-box setting, where the attacker is limited to query access without access to gradients. Previous methods -…

New framework limits SGD for multi-index models, addressing SQ framework shortcomings.

The goal of a decision-based adversarial attack on a trained model is to generate adversarial examples based solely on observing output labels returned by the targeted model. We develop HopSkipJumpAttack, a family of algorithms based on a novel estimate of the gradient direction using binary information at the decision…

The paper addresses learner privacy in convex optimization with feedback.

Studying a softmax-attention model, we show that the learned query converges to the latent signal subspace spanned by the informative direction.

P-BO reduces black-box adversarial attacks by 10x with Bayesian optimization and function prior.

sGPO optimizes RLVR training by balancing inference FLOPs and training efficiency.

A new method for optimizing functions without gradients, improving efficiency and convergence.

Solving sequential decision prediction problems, including those in imitation learning settings, requires mitigating the problem of covariate shift. The standard approach, DAgger, relies on capturing expert behaviour in all states that the agent reaches. In real-world settings, querying an expert is costly. We propose …

We study the problem of attacking a machine learning model in the hard-label black-box setting, where no model information is revealed except that the attacker can make queries to probe the corresponding hard-label decisions. This is a very challenging problem since the direct extension of state-of-the-art white-box at…

New analysis shows how cross-entropy training shapes attention in transformers.

Neural networks struggle with learning fixed parities.