Black-Box Optimization
Black-Box Optimization in AI security is like trying to guess the secret recipe of a dish by only tasting the final product, without ever seeing the kitchen or the chef. In Black-Box attacks, the adversary has black-box (i.e. [AI Model Inference API Access](/techniques/AML.T0040) via API access) access to the target model. With black-box attacks, the adversary may be testing the system repeatedly to figure out how it works, which is slower and less precise than having the actual recipe, but it allows them to probe the system without needing to break into the secure facility where it was built.
Black-Box Optimization refers to adversarial techniques used to refine inputs to trigger specific model behaviors when the internal architecture and weights are unknown. In Black-Box attacks, the adversary has black-box (i.e. [AI Model Inference API Access](/techniques/AML.T0040) via API access) access to the target model. With black-box attacks, the adversary may be using an API that the victim is monitoring, necessitating a balance between query efficiency and stealth. These methods are typically more resource-intensive and less effective than [White-Box Optimization](/techniques/AML.T0043.000) but are essential for evaluating models where internal parameters are inaccessible.
Black-Box Optimization is a gradient-free adversarial methodology employed to identify optimal perturbations or inputs by treating the target model as a functional mapping f(x) = y, where the internal parameters θ are hidden. In Black-Box attacks, the adversary has black-box (i.e. [AI Model Inference API Access](/techniques/AML.T0040) via API access) access to the target model. With black-box attacks, the adversary may be using an API that the victim is monitoring, often necessitating the use of zeroth-order optimization or surrogate model distillation. These attacks are generally less effective and require more inferences than [White-Box Optimization](/techniques/AML.T0043.000) attacks, but they require much less access, operating solely on the observation of output responses to specific input queries.