Research map / Adversarial robustness and security / Black-box and transfer attacks
Efficient Black-box Adversarial Attacks via Bayesian Optimization Guided by a Function Prior
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes P-BO, a Bayesian optimization black-box attack whose GP mean is initialized by a white-box surrogate's loss, with an adaptive coefficient on the prior chosen by maximum likelihood, reducing queries and raising attack success rates on classifiers and VLMs.
Problem
Query-efficient black-box adversarial attacks: existing query-based methods need hundreds to thousands of queries, and surrogate-gradient priors are local and weakly informative.
Approach
Use the surrogate white-box model's loss as a global function prior for the mean of a Gaussian process in Bayesian optimization, and scale the prior by a coefficient lambda that is learned by maximizing the GP marginal likelihood, guarding against a bad prior.
Key results
- On CIFAR-10 (ResNet-50), P-BO (lambda*) reaches 100.0% ASR with 15 average queries versus 99.6% and 83 for vanilla BO and 98.4% and 55 for P-RGF.
- On ImageNet (Inception-v3), P-BO with dimensionality reduction (lambda*) reaches 94.4% ASR with 81 average queries versus 94.1% and 104 for BO-D.
- With fixed lambda=1 on ImageNet, P-BO underperforms vanilla BO (e.g., 60.8% vs 89.2% ASR on Inception-v3), while adaptive lambda* recovers performance (91.4%).
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use the surrogate model loss as a function prior with adaptive coefficient λ* instead of zero-mean BO | P-BO · CIFAR-10 | ASR: 99.6% -> 100.0%; 99.7% -> 100.0%; 99.7% -> 100.0% | Helped |
| Use the surrogate model loss as a function prior with adaptive coefficient λ* instead of zero-mean BO | P-BO_D · ImageNet | average queries: 104 -> 81; 102 -> 94; 170 -> 148 | Helped |
| Use the surrogate model loss as a function prior with adaptive coefficient λ* instead of zero-mean BO | P-BO_D · MS-COCO | ASR: 68.3% -> 95.8%; 79.2% -> 90.8%; 45.8% -> 96.7% | Helped |
| Replace fixed λ=1 with adaptive λ* (ablation) | P-BO · CIFAR-10, ResNet-50 | ASR: 99.9% -> 100.0% | Helped |
| Replace fixed λ=1 with adaptive λ* (ablation) | P-BO · ImageNet, Inception-v3 | ASR: 60.8% -> 91.4% | Helped |
| Replace fixed λ=1 with adaptive λ* (ablation) | P-BO_D · MS-COCO, mPLUG-Owl | ASR: 83.3% -> 90.8% | Helped |
| Replace fixed λ=1 with adaptive λ* (ablation) | P-BO_D · MS-COCO, InstructBLIP | ASR: 95.8% -> 95.8% | No clear effect |
| Use fixed λ=1 rather than zero-mean BO (ablation) | P-BO · ImageNet, Inception-v3 | ASR: 89.2% -> 60.8% | Hurt |
| Use fixed λ=1 rather than zero-mean BO (ablation) | P-BO · ImageNet, ViT-B/16 | ASR: 77.5% -> 43.9% | Hurt |
Surprising findings
- A fixed full-strength function prior (lambda=1) can hurt Bayesian optimization below the zero-mean baseline when surrogate and target models are dissimilar, as on ImageNet.
- The learned coefficient lambda* is substantially lower on ImageNet (about 0.4) than on CIFAR-10 (about 0.8), reflecting lower inter-model similarity.
Limitations
- Theoretical regret bound assumes f and f' lie in the RKHS; the lambda selection is a heuristic approximation via marginal likelihood.
- Performance depends on surrogate choice; adversarially trained surrogates (TRADES) give weaker priors.
- Evaluation on VLMs uses only 120 image-caption pairs and relies on CLIP-score based success criteria.
Experimental setup
Datasets: CIFAR-10 ImageNet MS-COCO
Benchmarks: CIFAR-10 ImageNet MS-COCO
Metrics: attack success rate average queries median queries
Baselines: NES Bandits NATTACK SignHunter Square attack NPAttack RGF P-RGF BO
Builds on: Bayesian optimization (GP-UCB) P-RGF Bandits with priors PGD Carlini-Wagner loss
Closest papers by meaning
- Improving Black-box Adversarial Attacks with a Transfer-based Prior (NeurIPS 2019 · similarity 0.93)
- BayesOpt Adversarial Attack (ICLR 2020 · similarity 0.93)
- Query-Efficient and Scalable Black-Box Adversarial Attacks on Discrete Sequential Data via Bayesian Optimization (ICML 2022 · similarity 0.91)
- Understanding the Robustness of Randomized Feature Defense Against Query-Based Adversarial Attacks (ICLR 2024 · similarity 0.89)
- BRUSLEATTACK: A QUERY-EFFICIENT SCORE- BASED BLACK-BOX SPARSE ADVERSARIAL ATTACK (ICLR 2024 · similarity 0.88)
- Boosting Ray Search Procedure of Hard-label Attacks with Transfer-based Priors (ICLR 2025 · similarity 0.87)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.