Research map / Adversarial robustness and security / Black-box and transfer attacks

DifAttack: Query-Efficient Black-Box Adversarial Attack via Disentangled Feature Space

AAAI 2024 · Adversarial robustness and security › Black-box and transfer attacks · approach: Query-efficient black-box attacks · 22 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes DifAttack, a score-based black-box attack that disentangles image latent features into adversarial and visual parts via an autoencoder trained on clean/adversarial pairs, then optimizes only the adversarial feature with natural evolution strategies using victim query feedback.

Problem

Score-based black-box adversarial attacks suffer from low attack success rate and high query counts, especially for targeted attacks and open-set settings where the victim's training data is unknown and surrogate gradients are unreliable.

Approach

Disentangle an image's latent feature into an adversarial feature (controls adversarial capability) and a visual feature (controls appearance) using a DF module trained with surrogate-model adversarial losses; then search only over the adversarial feature via NES while keeping the visual feature fixed, avoiding surrogate gradients at query time.

Key results

• Targeted attacks on ImageNet (ResNet victim): DifAttack reaches 100% ASR with 1,901 average queries versus 3,274 for the next-best GFCS.
• Against the real-world Imagga API, DifAttack achieves 90% ASR (untargeted, Avg.Q 90.8) and 70% ASR (targeted, Avg.Q 183.5).
• Open-set CIFAR-100 attacks using CIFAR-10-trained surrogates: DifAttack lowers Avg.Q for GoogleNet untargeted attacks from 327 to 146 while keeping ASR at 100%.

Measured effects reported in the paper

Surprising findings

• Using a random split of the latent feature instead of the DF module raised ImageNet reconstruction l2 loss from ~50 to ~10 with DF, and its ablation showed DF is the main driver of improved attack efficiency.
• The choice of white-box attack used to generate training AEs (PGD vs. MIFGSM) had negligible effect on DifAttack performance, which the authors attribute to disentanglement depending on classifiers rather than AE distribution.

Limitations

• Targeted attack under defenses was omitted due to poor performance; ASR against Imagga targeted attack is 70%.
• Relies on availability of pre-trained white-box surrogate models and white-box PGD adversarial examples to train the autoencoder.
• Perturbations are not optimized for minimal distortion or visual fidelity; authors note CGA-like grid artifacts are avoided but perturbations are not minimal.

Experimental setup

Datasets: ImageNet-1k CIFAR-10 CIFAR-100

Benchmarks: ImageNet-1k CIFAR-10 CIFAR-100 Imagga API

Metrics: attack success rate average number of queries l2 distortion

Baselines: Signhunter NES NAttack SimBA BASES P-RGF Subspace GFCS CGA TREMBA AdvFlow

Builds on: NATTACK PGD TREMBA CGA P-RGF

Closest papers by meaning

• Simple Black-box Adversarial Attacks (ICML 2019 · similarity 0.89)
• BRUSLEATTACK: A QUERY-EFFICIENT SCORE- BASED BLACK-BOX SPARSE ADVERSARIAL ATTACK (ICLR 2024 · similarity 0.88)
• A General Framework for Black-Box Attacks Under Cost Asymmetry (ICLR 2026 · similarity 0.87)
• Black-Box Adversarial Attack with Transferable Model-based Embedding (ICLR 2020 · similarity 0.87)
• Understanding the Robustness of Randomized Feature Defense Against Query-Based Adversarial Attacks (ICLR 2024 · similarity 0.86)
• Efficient Black-box Adversarial Attacks via Bayesian Optimization Guided by a Function Prior (ICML 2024 · similarity 0.85)