Research map / Adversarial robustness and security / Black-box and transfer attacks
Projection & Probability-Driven Black-Box Attack
Check your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's title only (no summary yet). Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| use PPBA instead of SimBA-DCT | ImageNet attacks with ResNet50, VGG-16, and Inception V3 (l2 norm) · ImageNet | queries and AUC: ResNet50: 604/779 -> 430/668 queries, 1214.3 -> 1331.3 AUC; VGG-16: 563/722 -> 392/548 queries, 1271.5 -> 1451.5 AUC; In | Mixed |
| use PPBA instead of SimBA-DCT | ImageNet attacks with ResNet50, VGG-16, and Inception V3 (l2 norm) · ImageNet | ASR: 87.0% -> 84.8%; 88.5% -> 90.3%; 61.2% -> 65.3% | Mixed |
| use PPBA instead of SimBA-DCT | ImageNet attacks with ResNet50, VGG-16, and Inception V3 (l∞ norm) · ImageNet | ASR: 88.4% -> 96.6%; 91.9% -> 98.2%; 64.2% -> 67.9% | Mixed |
| use PPBA instead of PRBA, adding probability-driven step selection (ablation) | ResNet50 l2 attack · ImageNet | ASR: 82.9% -> 84.8% | Helped |
| use PPBA instead of PRBA, adding probability-driven step selection (ablation) | ResNet50 l2 attack · ImageNet | queries (success/all): 540/790 -> 430/668 | Helped |
| add a low-frequency sensing matrix to NES (ablation) | NES · ImageNet, VGG-16 | ASR: 60.7% -> 78.3% | Helped |
| add a low-frequency sensing matrix to NES (ablation) | NES · ImageNet, VGG-16 | queries (success/all): 1013/1402 -> 873/1117 | Helped |
| replace the low-frequency sensing matrix with a random Gaussian matrix (ablation) | NES · ImageNet, ResNet50 | ASR: 52.0% -> 50.7% | Hurt |
| constrain BIM perturbations with sensing matrix A (ablation) | BIM · ImageNet, VGG-16 | average L2 norm: 3.90 -> 1.70 | Helped |
| constrain BIM perturbations with sensing matrix A (ablation) | BIM · ImageNet, VGG-16 | ASR: 100% -> 100% | No clear effect |
| use a low-frequency constrained sensing matrix rather than the original NES search space (ablation) | NES · ImageNet, ResNet50 | ASR: 52.0% -> 79.2% | Helped |
| use a low-frequency constrained sensing matrix rather than the original Bandits_T search space (ablation) | Bandits_T · ImageNet, ResNet50 | ASR: 54.1% -> 78.3% | Helped |
Closest papers by meaning
- Efficient Black-box Adversarial Attacks via Bayesian Optimization Guided by a Function Prior (ICML 2024 · similarity 0.90)
- Improving Black-box Adversarial Attacks with a Transfer-based Prior (NeurIPS 2019 · similarity 0.89)
- Simple Black-box Adversarial Attacks (ICML 2019 · similarity 0.89)
- BayesOpt Adversarial Attack (ICLR 2020 · similarity 0.89)
- Understanding the Robustness of Randomized Feature Defense Against Query-Based Adversarial Attacks (ICLR 2024 · similarity 0.89)
- BRUSLEATTACK: A QUERY-EFFICIENT SCORE- BASED BLACK-BOX SPARSE ADVERSARIAL ATTACK (ICLR 2024 · similarity 0.88)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.