Research map / Adversarial robustness and security / Black-box and transfer attacks
BRUSLEATTACK: A QUERY-EFFICIENT SCORE- BASED BLACK-BOX SPARSE ADVERSARIAL ATTACK
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes BrusLeAttack, a Bayesian score-based black-box sparse (l0) adversarial attack that reformulates pixel selection over a binary mask with Dirichlet-categorical updates, outperforming Sparse-RS in query efficiency on CIFAR-10, STL-10 and ImageNet.
Problem
Generating minimum-pixel (l0-bounded) adversarial perturbations against image classifiers using only confidence-score outputs under a limited query budget; the problem is NP-hard and has a mixed discrete/continuous non-differentiable search space.
Approach
Reduce the search over pixel positions and colors to a binary mask over pixels with a synthetic random color image, then sample masks from a Dirichlet-conjugate categorical model whose posterior is updated from historical pixel manipulations that increase loss, plus a pixel-dissimilarity map to bias unselected-pixel sampling.
Key results
- On ImageNet targeted ResNet-50 at 1.0% sparsity and 4K queries, BrusLeAttack reaches 88.6% ASR vs 69.3% for Sparse-RS.
- On CIFAR-10 at 2.0% sparsity with 500 queries, BrusLeAttack achieves 90.24% ASR vs 89.21% for Sparse-RS.
- Against l_inf-AT ResNet-50 at 0.2% sparsity, BrusLeAttack lowers accuracy to 11.8% vs 12.2% for Sparse-RS; against RND it lowers accuracy to 42.6% vs 56.8%.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Bayesian pixel-selection search (BrusLeAttack) instead of Sparse-RS random search | sparse attack on ImageNet ResNet-50, ViT, ResNet-50 (SIN) · ImageNet targeted, 0.4-1.0% sparsity, up to 10K queries | ASR: e.g. +3.4 points at 1.0% sparsity, 10K queries on ResNet-50 | Helped |
| Bayesian pixel-selection search (BrusLeAttack) instead of Sparse-RS | untargeted sparse attack on ImageNet · ImageNet untargeted, 0.04% to 0.2% sparsity | ASR | Mixed |
| Bayesian search (BrusLeAttack) instead of Sparse-RS on defended models | adversarially trained and RND-defended ImageNet models · ImageNet, 5K queries, 0.04-0.2% sparsity | accuracy under attack (lower is stronger): e.g. RND at 0.2%: 42.6% vs 56.8% for Sparse-RS | Helped |
| Replace starting image from target class with random synthetic color image as initialization (ablation) | BrusLeAttack · CIFAR-10 targeted, 1.0% sparsity | ASR: 68.21% vs 62.68% | Helped |
| Replace starting image with synthetic color image at 2.0% sparsity (ablation) | BrusLeAttack · CIFAR-10 targeted, 2.0% sparsity | ASR: 90.24% vs 87.17% | Helped |
| Adapt SparseEvo with alternative score-based loss fitness instead of BrusLeAttack (ablation) | SparseEvo (score-based adaptation) · CIFAR-10 targeted, 1.0% to 3.9% sparsity, 500 queries | ASR: e.g. 68.75% vs 90.24% at 2.0% sparsity | Hurt |
| Use decision-based SparseEvo baseline instead of BrusLeAttack (score-based) | SparseEvo · CIFAR-10 targeted, 500 queries vs SparseEvo 2K queries | ASR | Hurt |
| Replace Sparse-RS with BrusLeAttack for score-based sparse attack | Google Cloud Vision demo · GCV targeted, 5K queries, 0.5% sparsity | attack success on example images: Sparse-RS fails on four images; BrusLeAttack succeeds on all | Helped |
Surprising findings
- ViT is markedly more robust than ResNet models under score-based sparse attacks on ImageNet.
- ResNet-50 (SIN) is as vulnerable to sparse attacks as standard ResNet-50 despite its corruption robustness.
Limitations
- Gains over Sparse-RS are often marginal at low sparsity levels and in untargeted settings.
- Attacking Google Cloud Vision required adapting the loss because its scores are neither probabilities nor logits.
Experimental setup
Datasets: CIFAR-10 STL-10 ImageNet
Benchmarks: CIFAR-10 STL-10 ImageNet
Metrics: attack success rate query efficiency robust accuracy under attack
Baselines: Sparse-RS SparseEvo Pointwise PGD_0
Builds on: Sparse-RS SparseEvo Pointwise PGD_0
Closest papers by meaning
- DifAttack: Query-Efficient Black-Box Adversarial Attack via Disentangled Feature Space (AAAI 2024 · similarity 0.88)
- Understanding the Robustness of Randomized Feature Defense Against Query-Based Adversarial Attacks (ICLR 2024 · similarity 0.88)
- Efficient Black-box Adversarial Attacks via Bayesian Optimization Guided by a Function Prior (ICML 2024 · similarity 0.88)
- Mind the Gap: Detecting Black-box Adversarial Attacks in the Making through Query Update Analysis (CVPR 2025 · similarity 0.88)
- Amnesia as a Catalyst for Enhancing Black Box Pixel Attacks in Image Classification and Object Detection (NeurIPS 2024 · similarity 0.87)
- Towards Efficient Training and Evaluation of Robust Models against $l_0$ Bounded Adversarial Perturbations (ICML 2024 · similarity 0.87)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.