Research map / Adversarial robustness and security / Black-box and transfer attacks
Robustness and Visual Explanation for Black Box Image, Video, and ECG Signal Classification with Reinforcement Learning
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes an RL agent (RLAB) that crafts black-box adversarial attacks on 1D ECG, 2D image, and 3D video classifiers by adding or removing patch-wise distortions, and uses the resulting sensitivity maps as visual explanations.
Problem
Black-box adversarial attacks on DNN classifiers across signal (ECG), image, and video data are often inefficient and rely on hand-crafted heuristics; there is also a need for robustness metrics and interpretable sensitivity maps.
Approach
An RL agent takes two actions per step (add distortion to patches or remove distortion from patches), chosen from a bring-your-own-filter set of distortions, to minimally distort inputs until misclassification; the agent's learned distortion locations double as explanation localization maps, and the generated adversarial samples are used for adversarial fine-tuning.
Key results
- Reports the RL agent achieves a 100% average attack success rate in most cases with smaller query budgets than competitors across ECG, image, and video tasks (no specific numbers in the provided text).
- Localization masks evaluated with dice coefficient and IOU show the proposed method outperforms gradient and non-gradient explanation baselines.
- Retraining the model with adversarial samples significantly improved robustness on benchmark datasets.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use the RL-based RLAB attack strategy | Image, video, and ECG classification · ECG analysis, image classification, and video classification | average success rate | Helped |
| Use the RL-based RLAB attack strategy | Image, video, and ECG classification · ECG analysis, image classification, and video classification | number of queries | Helped |
| Retrain the model with adversarial samples | Victim model · Benchmark datasets | robustness | Helped |
Limitations
- Provided text lacks specific numerical results, dataset names, and victim model names.
- Framework is stated to be in the process of being evaluated for LLMs, so generality beyond the three modalities is unverified.
Experimental setup
Metrics: average success rate average number of queries L2 distance Linf distance dice coefficient IOU
Baselines: state-of-the-art black-box attacks (references 8, 10, 11, 16) gradient and non-gradient localization methods (references 20, 5, 7)
Builds on: Deep Tree Search
Closest papers by meaning
- ECG-R1: Protocol-Guided and Modality-Agnostic MLLM for Reliable ECG Interpretation (ICML 2026 · similarity 0.86)
- Boosting Masked ECG-Text Auto-Encoders as Discriminative Learners (ICML 2025 · similarity 0.85)
- Reinforcement Learning Platform for Adversarial Black-box Attacks with Custom Distortion Filters (AAAI 2025 · similarity 0.84)
- RL-SeqISP: Reinforcement Learning-Based Sequential Optimization for Image Signal Processing (AAAI 2024 · similarity 0.82)
- Guiding Masked Representation Learning to Capture Spatio-Temporal Relationship of Electrocardiogram (ICLR 2024 · similarity 0.82)
- GEM: Empowering MLLM for Grounded ECG Understanding with Time Series and Images (NeurIPS 2025 · similarity 0.82)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.