Research map / Adversarial robustness and security / Black-box and transfer attacks
Sparse-RS: A Versatile Framework for Query-Efficient Sparse Black-Box Adversarial Attacks
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's title only (no summary yet). Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use random search with sparse, task-specific sampling for pixel-space l0 attacks | ImageNet classifiers · ImageNet untargeted pixel-space l0, k=50 and k=150 | success rate: 49.1% -> 97.6%; 68.1% -> 100% (VGG) | Helped |
| Use random search with sparse, task-specific sampling for pixel-space l0 attacks | ImageNet classifiers · ImageNet targeted pixel-space l0, k=150 | success rate: 62.8% -> 98.2% (VGG); 67.8% -> 95.6% (ResNet) | Helped |
| Use l0-RS for feature-space l0 attacks | ImageNet classifiers · ImageNet untargeted feature-space l0, k=50 | robust test error: 89.6% -> 92.8% (VGG); 87.2% -> 88.8% (ResNet) | Helped |
| Use l0-RS for pixel-space l0 attacks | CIFAR-10 adversarially trained ResNet · CIFAR-10 pixel-space l0, k=24 | robust test error: 68.7% -> 85.7%; 72.7% -> 81.0% | Helped |
| Use l0-RS for feature-space l0 attacks | CIFAR-10 adversarially trained ResNet · CIFAR-10 feature-space l0, k=24 | robust test error: 52.9% -> 63.4%; 28.2% -> 38.3% | Helped |
| Use l0-RS instead of the strongest listed baseline | MNIST ABS classifiers · MNIST l0 attacks, k=12 | robust test error: 31% -> 55% (ABS); 28% -> 51% (Binary ABS) | Helped |
| Use Patch-RS, with its patch-specific initialization and updates | ImageNet image-specific patches · Untargeted 20x20 patches | success rate: 85.6% ± 1.1 -> 87.8% ± 0.7 (VGG); 78.5% ± 1.0 -> 79.5% ± 1.4 (ResNet) | Helped |
| Use Patch-RS rather than Sparse-RS + SA | ImageNet image-specific patches · Targeted 40x40 patches | success rate: 70.9% ± 1.2 -> 72.7% ± 0.9 (VGG); 53.7% ± 0.9 -> 55.6% ± 1.5 (ResNet) | Helped |
| Use Sparse-RS + SA for universal patch generation | VGG · Targeted universal 50x50 patches | success rate: 45.8% -> 72.9% ± 3.6 | Helped |
| Use l0-RS for targeted feature-space attacks | ImageNet classifiers · ImageNet targeted feature-space l0, k=150 | success rate: 92.8% -> 90.8% (VGG); 94.2% -> 80.0% (ResNet) | Mixed |
| Replace the square-attack patch sampling with Patch-RS sampling | Sparse-RS patch attacks · ImageNet image-specific patches | success rate: 85.6% ± 1.1 -> 87.8% ± 0.7 (VGG); 78.5% ± 1.0 -> 79.5% ± 1.4 (ResNet) | Helped |
Closest papers by meaning
- BRUSLEATTACK: A QUERY-EFFICIENT SCORE- BASED BLACK-BOX SPARSE ADVERSARIAL ATTACK (ICLR 2024 · similarity 0.92)
- Towards Efficient Training and Evaluation of Robust Models against $l_0$ Bounded Adversarial Perturbations (ICML 2024 · similarity 0.90)
- GSE: Group-wise Sparse and Explainable Adversarial Attacks (ICLR 2025 · similarity 0.87)
- $\sigma$-zero: Gradient-based Optimization of $\ell_0$-norm Adversarial Examples (ICLR 2025 · similarity 0.87)
- Understanding the Robustness of Randomized Feature Defense Against Query-Based Adversarial Attacks (ICLR 2024 · similarity 0.86)
- Transferable Structural Sparse Adversarial Attack Via Exact Group Sparsity Training (CVPR 2024 · similarity 0.86)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.