Research map / Adversarial robustness and security / Black-box and transfer attacks
TtBA: Two-third Bridge Approach for Decision-Based Adversarial Attack
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes TtBA, a hard-label decision-based black-box attack that searches a bridge weight between the current perturbation direction and its estimated boundary normal, and uses 2/3 of the bridge weight to pick the next direction, with local-optimum detection and escape.
Problem
Hard-label (decision-based) black-box adversarial attacks need many queries to find minimal L2 perturbations that flip a classifier's top-1 label, and narrow high-curvature adversarial regions can trap perturbation optimization in local optima.
Approach
Combine the current unit perturbation direction with its estimated unit normal via a weight k; binary-search the bridge threshold k_bridge where the boundary matches the current direction, then set the next weight to 2/3 k_bridge (near-optimal empirically), and increase k when k_bridge is small to escape local optima.
Key results
- On MNIST-CNN non-targeted at 10,000 queries, TtBA reaches average l2 1.288 vs 1.366 for HSJA and 1.436 for CGBA.
- On ImageNet-ResNet50 non-targeted at 10,000 queries, TtBA reaches average l2 3.448 vs 5.838 for CGBA, a reduction of over 40%.
- TtBA achieves the best non-targeted results on 7 of 9 models in Table 1 and the best targeted results in nearly all tested scenarios.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use TtBA instead of HSJA for non-targeted attacks | MNIST-CNN · MNIST, 10,000 queries | average ℓ2 perturbation: 1.366 -> 1.288 | Helped |
| Use TtBA instead of TA for targeted attacks | MNIST-CNN · MNIST, 10,000 queries | average ℓ2 perturbation: 1.901 -> 1.884 | Helped |
| Use TtBA instead of TA for non-targeted attacks | FASHION-MNIST-CNN · FASHION-MNIST, 10,000 queries | average ℓ2 perturbation: 0.665 -> 0.603 | Helped |
| Use TtBA instead of TA for targeted attacks | FASHION-MNIST-CNN · FASHION-MNIST, 10,000 queries | average ℓ2 perturbation: 1.017 -> 1.050 | Hurt |
| Use TtBA instead of CGBA for non-targeted attacks | CIFAR10-CNN · CIFAR10, 10,000 queries | average ℓ2 perturbation: 0.181 -> 0.180 | Helped |
| Use TtBA instead of CGBA for targeted attacks | CIFAR10-CNN · CIFAR10, 10,000 queries | average ℓ2 perturbation: 0.317 -> 0.308 | Helped |
| Use TtBA instead of CGBA for non-targeted attacks | CIFAR100-ViT · CIFAR100, 10,000 queries | average ℓ2 perturbation: 0.744 -> 0.734 | Helped |
| Use TtBA instead of CGBA-H for targeted attacks | CIFAR100-ViT · CIFAR100, 10,000 queries | average ℓ2 perturbation: 4.327 -> 4.464 | Hurt |
| Use TtBA instead of CGBA for non-targeted attacks | ImageNet-ResNet50 · ImageNet, 10,000 queries | average ℓ2 perturbation: 5.838 -> 3.448 | Helped |
| Use TtBA instead of CGBA-H for targeted attacks | ImageNet-ResNet50 · ImageNet, 10,000 queries | average ℓ2 perturbation: 34.35 -> 27.83 | Helped |
Surprising findings
- CGBA-style baselines outperform TtBA at 2,000 queries on CIFAR10-CNN and CIFAR100-ViT non-targeted attacks, with TtBA winning only at larger budgets.
Limitations
- Hyperparameters (thresholds 0.1 and 0.2, coefficients 0.9 and 2/3) are fixed empirically and tuned via sensitivity analysis.
- Performance gains are not uniform; CGBA outperforms TtBA at low query budgets on some non-targeted settings.
Experimental setup
Datasets: MNIST FASHION-MNIST CIFAR10 CIFAR100 ImageNet Tiny-ImageNet
Benchmarks: MNIST FASHION-MNIST CIFAR10 CIFAR100 ImageNet Tiny-ImageNet
Metrics: average l2 perturbation norm median l2 perturbation norm
Baselines: HSJA TA CGBA CGBA-H
Builds on: HSJA CGBA Tangent Attack Boundary Attack
Closest papers by meaning
- ADBA: Approximation Decision Boundary Approach for Black-Box Adversarial Attacks (AAAI 2025 · similarity 0.88)
- Decision-Based Adversarial Attacks: Reliable Attacks Against Black-Box Machine Learning Models (ICLR 2018 · similarity 0.86)
- Sign-OPT: A Query-Efficient Hard-label Adversarial Attack (ICLR 2020 · similarity 0.86)
- Efficient Black-box Adversarial Attacks via Bayesian Optimization Guided by a Function Prior (ICML 2024 · similarity 0.85)
- Boosting Ray Search Procedure of Hard-label Attacks with Transfer-based Priors (ICLR 2025 · similarity 0.84)
- SuperDeepFool: a new fast and accurate minimal adversarial attack (NeurIPS 2024 · similarity 0.84)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.