Research map / Adversarial robustness and security / Black-box and transfer attacks
Attacking deep networks with surrogate-based adversarial black-box methods is easy
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's title only (no summary yet). Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use GFCS, transferring surrogate loss gradients first and coimage directions as fallback | ImageNet untargeted attacks with one surrogate · VGG-16, ResNet-50, and Inception-v3 | median queries: 6±0.3; 4±0.4; 18±1.1 | Helped |
| Use GFCS with four surrogates instead of the strongest listed query-count baseline | ImageNet untargeted attacks · VGG-16, ResNet-50, and Inception-v3 | median queries: 4±0.2 vs 16±2.3; 4±0.0 vs 14±0.5; 9±0.5 vs 29±1.4 | Helped |
| Add coimage sampling as a fallback when surrogate loss gradients fail (ablation) | GFCS · ImageNet untargeted attacks, one and four surrogates | success rate: 58.55% -> 99.90%; 75.90% -> 99.85%; 38.25% -> 98.60%; 98.65% -> 100%; 96.50% -> 99.95%; 80.20% -> 99.40% | Helped |
| Increase SimBA-ODS step length from its default ε=0.2 to ε=2 | SimBA-ODS · ImageNet untargeted attacks | median queries: 117±5.1 -> 15±0.7; 91.5±3.2 -> 11±0.4; 275±14 -> 36±1.9 | Helped |
| Use input-specific surrogate gradients rather than a fixed basis prior | GFCS and SimBA-style search · ImageNet untargeted attacks | query efficiency | Helped |
| Use adversarial-gradient PCA directions instead of the canonical pixel basis | SimBA-PCA-gradients · ImageNet untargeted attacks | query efficiency | Helped |
| Use principal image components instead of the canonical pixel basis | SimBA-PCA-images · ImageNet untargeted attacks | query efficiency | Helped |
| Use adversarial-gradient PCA rather than the DCT basis | SimBA-PCA-gradients · ImageNet untargeted attacks | query efficiency | No clear effect |
| Use a four-surrogate set instead of ResNet-152 alone | GFCS · ImageNet untargeted attacks | need for coimage queries | Helped |
| Use GFCS rather than SimBA-ODS alone | ImageNet targeted attacks with four surrogates · VGG-16 and ResNet-50 | query efficiency | Helped |
| Use GFCS on adversarially trained Inception-v3 rather than competing attack methods | ImageNet untargeted attacks with four surrogates · Adversarially trained Inception-v3 | query efficiency | Helped |
Closest papers by meaning
- Efficient Black-box Adversarial Attacks via Bayesian Optimization Guided by a Function Prior (ICML 2024 · similarity 0.89)
- LRS: Enhancing Adversarial Transferability through Lipschitz Regularized Surrogate (AAAI 2024 · similarity 0.88)
- Enhancing Adversarial Transferability with Checkpoints of a Single Model's Training (CVPR 2025 · similarity 0.88)
- Understanding the Robustness of Randomized Feature Defense Against Query-Based Adversarial Attacks (ICLR 2024 · similarity 0.87)
- PubDef: Defending Against Transfer Attacks From Public Models (ICLR 2024 · similarity 0.87)
- Enhancing Adversarial Transferability with Adversarial Weight Tuning (AAAI 2025 · similarity 0.86)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.