Research map / Adversarial robustness and security / Black-box and transfer attacks
Reinforcement Learning Platform for Adversarial Black-box Attacks with Custom Distortion Filters
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Presents RLAB, a Dueling DQN reinforcement learning platform for black-box untargeted and targeted adversarial attacks that uses pluggable ("bring your own filter") distortion filters and a dual add/remove action to reduce query counts.
Problem
Black-box adversarial attacks are query-inefficient and often rely on unnatural, hand-crafted distortions, limiting their applicability; robustness evaluation against natural distortions is also needed.
Approach
An RL agent (Dueling DQN) chooses at each step how many image patches to add distortion to and how many to remove distortion from, based on patch sensitivity of the ground-truth probability, with a reward of probability dilution change normalized by L2 change; users can plug in any distortion filter, including mixtures.
Key results
- On ImageNet ResNet-50 untargeted L2 attack, RLAB (Gaussian noise) achieves 178 average queries and 100% ASR, versus 401 for Square attack and 341 for Pixle, with average L2 of 2.48.
- Targeted attack on Inception-V3 ImageNet: RLAB averages 180 queries at 100% ASR, compared with 1112 for Square attack and 1115 for SignHunter.
- On CIFAR-10-C adversarial retraining, RLAB-retrained ResNet-50 has 6.0 degradation error versus 13 for AugMix (mean 8.83 vs 13.1 across three models).
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| use RLAB with Gaussian Noise instead of the strongest listed baseline | ResNet-50 · ImageNet, untargeted | AVG.Q: 270.5 -> 178 | Helped |
| use RLAB with Gaussian Noise instead of the strongest listed baseline | Inception-V3 · ImageNet, targeted | AVG.Q: 2447 -> 180 | Helped |
| use RLAB instead of CG-Attack | ResNet-50 · CIFAR-10 | AVG.Q: 81.6 -> 60 | Helped |
| use Brightness filter instead of Gaussian Noise (ablation) | RLAB on ResNet-50 · ImageNet | AVG.Q: 166 -> 266 | Hurt |
| use Gaussian Blur filter instead of Gaussian Noise (ablation) | RLAB on ResNet-50 · ImageNet | AVG.Q: 166 -> 201 | Hurt |
| use Dead Pixel filter instead of Gaussian Noise (ablation) | RLAB on ResNet-50 · ImageNet | AVG.Q: 166 -> 75 | Helped |
| use patch size 4x4 instead of 2x2 (ablation) | RLAB with Gaussian Noise · ImageNet, ResNet-50 | Average L2: 2.48 -> 11.29 | Hurt |
| use patch size 8x8 instead of 2x2 (ablation) | RLAB with Gaussian Noise · ImageNet, ResNet-50 | Average L2: 2.48 -> 17.52 | Hurt |
| use patch size 16x16 instead of 2x2 (ablation) | RLAB with Gaussian Noise · ImageNet, ResNet-50 | Average L2: 2.48 -> 32.16 | Hurt |
| use patch size 32x32 instead of 2x2 (ablation) | RLAB with Gaussian Noise · ImageNet, ResNet-50 | Average L2: 2.48 -> 63.45 | Hurt |
| increase Gaussian noise variance from 0.0005 to 0.005 (ablation) | RLAB · ImageNet, ResNet-50 | AVG.Q: 981 -> 178 | Helped |
| increase Gaussian noise variance from 0.0005 to 0.005 (ablation) | RLAB · ImageNet, ResNet-50 | Avg. L2: 4.42 -> 2.48 | Mixed |
Surprising findings
- Gaussian noise filter outperformed brightness, Gaussian blur and dead-pixel filters on query count and L2 in the ImageNet ablation.
- RLAB's maximum L2 (4.74) exceeds Linf-based budgets reported by competitors' Linf values, which the authors attribute to metric differences.
Limitations
- Max L2 and Linf values for RLAB are compared against competitors' reported values rather than reproduced under identical settings.
- Evaluation is limited to CNN image classifiers on ImageNet and CIFAR-10 with a 1000-sample test subset for some experiments.
Experimental setup
Datasets: ImageNet (ILSVRC2012) CIFAR-10 Caltech-101 CIFAR-10-C
Benchmarks: ImageNet CIFAR-10 CIFAR-10-C Caltech-101
Metrics: average queries (AVG.Q) average success rate (ASR) L2 norm Linf norm degradation error adversarial error
Baselines: NES MetaAttack SignHunter Square attack SimBA-DCT CG-Attack EigenBA Pixle LeBA AdvFlow Patch Attack Mixup
Builds on: Dueling DQN Patch Attack DeepFool SimBA Square Attack
Closest papers by meaning
- Natural Black-Box Adversarial Examples against Deep Reinforcement Learning (AAAI 2022 · similarity 0.88)
- Diffusion Guided Adversarial State Perturbations in Reinforcement Learning (NeurIPS 2025 · similarity 0.86)
- Representation-Based Robustness in Goal-Conditioned Reinforcement Learning (AAAI 2024 · similarity 0.85)
- Amnesia as a Catalyst for Enhancing Black Box Pixel Attacks in Image Classification and Object Detection (NeurIPS 2024 · similarity 0.85)
- Rethinking Adversarial Policies: A Generalized Attack Formulation and Provable Defense in RL (ICLR 2024 · similarity 0.85)
- Query-efficient Attack for Black-box Image Inpainting Forensics via Reinforcement Learning (AAAI 2025 · similarity 0.85)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.