Research map / Adversarial robustness and security / Black-box and transfer attacks
Amnesia as a Catalyst for Enhancing Black Box Pixel Attacks in Image Classification and Object Detection
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes RFPAR, a one-step REINFORCE-based query-based black-box pixel attack with Remember and Forget processes, applied to ImageNet classification and first query-based pixel attack on object detection (YOLOv8, DDQ, Argoverse).
Problem
Query-based black-box pixel (L0) attacks are patch-dependent and random in image classification, and have not been explored for object detection; this paper targets both settings with limited pixel budgets.
Approach
An RL agent (one-step REINFORCE) perturbs individual pixels (position and max/zero brightness) with a Remember process that keeps the best-reward image in memory, and a Forget process that resets the agent and memory once rewards converge, reinitializing from the best image to escape local optima.
Key results
- On ImageNet-1K, RFPAR reaches 64.1% success on ViT-B with 211 L0 and 613 queries, versus Pixle 51.4%, and 95.3% on ResNeXt50 vs Pixle 89.1%.
- On MS-COCO with YOLO, RFPAR achieves mAP reduction 0.29 (tied with GARSDC) using about 1270 queries versus GARSDC's 2691.
- On Argoverse (1920x1200) with YOLOv8, RFPAR removes 94% of objects while attacking 0.10% of pixels, but mAP reduction is only 0.05.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use RFPAR instead of Pixle | Image classification attacks · ImageNet-1K, six victim models | success rate | Helped |
| Use RFPAR instead of GARSDC | YOLO object detection attack · MS-COCO | mAP reduction (RD): 0.29 vs 0.29 | No clear effect |
| Use RFPAR instead of GARSDC | YOLO object detection attack · MS-COCO | queries: 2691 -> 1270 | Helped |
| Increase pixel attack rate from α=0.01 to α=0.05 | RFPAR on YOLOv8 · MS-COCO | RM: 0.65 -> 0.91 | Helped |
| Increase pixel attack rate from α=0.01 to α=0.05 | RFPAR on YOLOv8 · MS-COCO | mAP: 0.218 -> 0.111 | Helped |
| Increase pixel attack rate from α=0.01 to α=0.05 | RFPAR on DDQ · MS-COCO | RM: 0.60 -> 0.83 | Helped |
| Increase pixel attack rate from α=0.01 to α=0.05 | RFPAR on DDQ · MS-COCO | mAP: 0.125 -> 0.054 | Helped |
| Add memory to the Remember process (ablation) | RFPAR · ImageNet-1K classification | attack success rate | Helped |
| Add initialization to the Forget process when memory is included (ablation) | RFPAR with memory · ImageNet-1K classification | attack success rate | Helped |
| Add initialization to the Forget process without memory (ablation) | RFPAR without memory · ImageNet-1K classification | attack success rate | No clear effect |
Surprising findings
- OnePixel achieves the lowest L0 (15) but a much lower success rate, and RFPAR's L0 is higher than ScratchThat and Pixle on some models.
- Without memory, the RL agent alone fails to generate meaningful adversarial attacks; initialization alone has negligible impact.
Limitations
- Pixel values are restricted to zero or one, which may be noticeable.
- The Forget process is simple and time complexity is higher than other pixel attacks.
- mAP reduction is limited on Argoverse where many objects belong to a single class.
Experimental setup
Datasets: ImageNet-1K MS-COCO 2017 Argoverse-1.1
Benchmarks: ImageNet-1K MS-COCO 2017 Argoverse-1.1
Metrics: attack success rate L0 norm queries RM mAP reduction ATA
Baselines: OnePixel ScratchThat Pixle PRFA GARSDC
Builds on: REINFORCE PatchAttack PIXLE OnePixel ScratchThat
Closest papers by meaning
- BRUSLEATTACK: A QUERY-EFFICIENT SCORE- BASED BLACK-BOX SPARSE ADVERSARIAL ATTACK (ICLR 2024 · similarity 0.87)
- Ask, Attend, Attack: An Effective Decision-Based Black-Box Targeted Attack for Image-to-Text Models (NeurIPS 2024 · similarity 0.85)
- Efficient Black-box Adversarial Attacks via Bayesian Optimization Guided by a Function Prior (ICML 2024 · similarity 0.85)
- Query-efficient Attack for Black-box Image Inpainting Forensics via Reinforcement Learning (AAAI 2025 · similarity 0.85)
- Reinforcement Learning Platform for Adversarial Black-box Attacks with Custom Distortion Filters (AAAI 2025 · similarity 0.85)
- Understanding the Robustness of Randomized Feature Defense Against Query-Based Adversarial Attacks (ICLR 2024 · similarity 0.85)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.