Research map / Adversarial robustness and security / Black-box and transfer attacks
Sign-OPT: A Query-Efficient Hard-label Adversarial Attack
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's title only (no summary yet). Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use Sign-OPT instead of hard-label baselines | Untargeted L2 attacks · MNIST | average L2 distortion at matched query budgets: 1.54 vs 1.74; 1.18 vs 1.69; 1.09 vs 1.68 | Helped |
| Use Sign-OPT instead of hard-label baselines | Untargeted L2 attacks · CIFAR-10 | average L2 distortion at matched query budgets: 0.26 vs 0.29; 0.16 vs 0.25; 0.13 vs 0.24 | Helped |
| Use Sign-OPT instead of Guessing Smart | Untargeted L2 attacks · ImageNet (ResNet-50) | average L2 distortion: 23.19 vs 16.69; 2.99 vs 13.27; 1.21 vs 12.88 | Mixed |
| Use Sign-OPT instead of OPT attack | Untargeted L2 attacks · ImageNet (ResNet-50) | average L2 distortion: 2.99 vs 16.77 | Helped |
| Use the single-query sign oracle (ablation) | Hard-label optimization using ZO-SignSGD · Hard-label adversarial attack | query efficiency | Helped |
| Preserve the scale of each random direction instead of taking the sign of the whole gradient estimate (ablation) | Sign-OPT versus ZO-SignSGD with single-query oracle · Hard-label adversarial attack | convergence | Helped |
| Vary the number of queries Q per gradient estimate (ablation) | Sign-OPT · Untargeted attack experiments | convergence point | No clear effect |
| Use small Q for each gradient estimate (ablation) | Sign-OPT · Untargeted attack experiments | convergence speed | Hurt |
| Use large Q for each gradient estimate (ablation) | Sign-OPT · Untargeted attack experiments | queries per gradient estimate | Hurt |
| Replace Sign-OPT with SVM-OPT (ablation) | Hard-label attacks · MNIST and CIFAR-10, L2, targeted and untargeted | median distortion at a given query count | No clear effect |
| Use a one-point gradient estimate instead of Sign-OPT's two-point estimate (ablation) | HopSkipJumpAttack comparison · CIFAR-10 and MNIST | distortion | Mixed |
Closest papers by meaning
- Boosting Ray Search Procedure of Hard-label Attacks with Transfer-based Priors (ICLR 2025 · similarity 0.89)
- LimeAttack: Local Explainable Method for Textual Hard-Label Adversarial Attack (AAAI 2024 · similarity 0.87)
- Adversarial Training for Defense Against Label Poisoning Attacks (ICLR 2025 · similarity 0.86)
- BRUSLEATTACK: A QUERY-EFFICIENT SCORE- BASED BLACK-BOX SPARSE ADVERSARIAL ATTACK (ICLR 2024 · similarity 0.86)
- Improved Generation of Adversarial Examples Against Safety-aligned LLMs (NeurIPS 2024 · similarity 0.86)
- TtBA: Two-third Bridge Approach for Decision-Based Adversarial Attack (ICML 2025 · similarity 0.86)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.