White-Box Optimization - AI Security Technique
AI Security TechniqueIn White-Box Optimization, the adversary has full access to the target model and optimizes the adversarial example directly. Adversarial examples trained in this manner are most effective against the target model.
Overview
A source-backed snapshot of this AI security technique.
Technique details
Identifiers, maturity, and source taxonomy for this technique.
- ATLAS ID
- AML.T0043.000
- Maturity
- demonstrated
- Priority score
- 58
Attack flow
How to read the public records connected to this technique.
Impact
Why this technique may deserve attention in the current dataset.
- Evidence leveldemonstrated
- Mapped defenses6 ATLAS mitigation records
- Public examples2 linked case study records
- Research risks0 related MIT AI Risk records above the confidence threshold
- Vulnerabilities0 linked CVE records
Mitigations
Defenses that may help against this attack.
AML.M0017 - AI Model Distribution Methods
With full access to the model, an adversary could perform white-box attacks.
AML.M0015 - Adversarial Input Detection
Incorporate adversarial input detection to block malicious inputs at inference time.
AML.M0005 - Control Access to AI Models and Data at Rest
Access controls can reduce unnecessary access to AI models and prevent an adversary from achieving white-box access.
AML.M0010 - Input Restoration
Input restoration can help remediate adversarial inputs.
Showing 4 of 6
Case studies
Examples from public reports and exercises.
Face Identification System Evasion via Physical Countermeasures
MITRE's AI Red Team demonstrated a physical-domain evasion attack on a commercial face identification service with the intention of inducing a targeted misclassification. This operation had a combination of traditional MITRE ATT&CK techniques such as finding valid accounts and executing code via an API - all interleaved with adversarial ML specific attacks.
Microsoft Azure Service Disruption
The Microsoft AI Red Team performed a red team exercise on an internal Azure service with the intention of disrupting its service. This operation had a combination of traditional ATT&CK enterprise techniques such as finding valid account, and exfiltrating data -- all interleaved with adversarial ML specific steps such as offline and online evasion examples.
Source evidence
Original public records and references for this page.
Original source
Original source links
Open the public records and source datasets used for this page.