Attacker Capabilities & Knowledge Clause Samples

Attacker Capabilities & Knowledge for the majority of this chapter, we model all attackers who interact with StratDef in a gray-box setting with limited knowledge about the target model, like previous work [162, 118, 185, 28]. In our threat model, attackers have access to the same training data as the target model and knowledge of the feature representation. However, attackers have no knowledge of the parameters, configurations, or constituent models of StratDef nor any other evaluated defenses. Therefore, they must train substitute models using the training data and attack them, in the expectation that the generated adversarial examples will transfer to the target model [207, 118, 157]. This is based on the well-established idea that adversarial examples for different models can be used to evade the target model [207]. furthermore, we use different scenarios involving attacker capabilities and attack intensities with the goal of studying and evaluating the performance of StratDef under different threat levels, like in prior work [44, 46, 28, 203, 192, 168]. Attackers’ capabilities may differ in the behavior, the strength and intensity of their attacks, their ability to generate adversarial examples, and more. Later, in Section 3.4.4, we describe precisely how we model different profiles for representing attackers with different capabilities. Nonetheless, for deployment, in the absence of any information about the operating environment, StratDef assumes the highest threat level, consisting of the most adverse environment and the strongest attacker. However, if there is information about the operating environment and/or the attackers within it (e.g., through cyber- threat intelligence [197, 238] or situational awareness), StratDef can use it to provide a more targeted defensive approach. Therefore, in our evaluation (see Section 3.5 later), we show how St▇▇▇▇▇▇ ▇erforms against different attacker scenarios and intensities to show the whole range of its capabilities. Nonetheless, for the comparison with other defenses later, we focus on the strongest attacker, as this is the default scenario when no information is available about the attacker or environment. Additionally, we evaluate StratDef’s performance against a black-box attacker with zero knowledge, as featured in previous work [102, 162, 157, 181, 159, 36, 52, 68, 75, 128]. This attacker only has access to the predictions of StratDef and no other knowledge. The attacker therefore performs a transferability attack, in which they constr...