Research map / Adversarial robustness and security / Black-box and transfer attacks
GSBA$^K$: $top$-$K$ Geometric Score-based Black-box Attack
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes GSBA^K, a surrogate-free geometric score-based black-box attack that crafts top-K untargeted and targeted adversarial examples for both single-label and top-K multi-label classifiers, using DCT-subspace gradient estimates both to find an initial boundary point and to refine along the boundary.
Problem
Score-based black-box attacks have been designed almost exclusively for top-1 single-label classification and perform poorly under small perturbation budgets; attacks on top-K predictions and on multi-label classifiers are largely unstudied in the black-box setting.
Approach
Gradient estimators built from DCT low-frequency noise and probability changes of the target classes (weighted by how many target classes each query improves) are used to find a good initial boundary point, and then a semicircular boundary search (CGBA-style) refines the perturbation, extending geometric attacks to the score-based top-K setting.
Key results
- On ResNet-50 ImageNet, GSBA^1 untargeted ASR at r_th=1 reaches 29.2% vs 26.5% for SA^1 at Q=1000, rising to 87.9% vs 76.1% at Q=30000.
- For top-3 targeted attacks at r_th=4 with Q=30000 on ResNet-50, GSBA^3 achieves 71.2% ASR versus 27.0% for SA^3.
- On PASCAL VOC with Inception-V3 top-2 worst-case targeted attacks, SA^2 fails to converge while GSBA^2 reaches 67% ASR at r_th=6 with Q=40000.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use GSBA^1 instead of SA^1 | ResNet-50 · ImageNet, top-1 untargeted, r_th=1, Q=30000 | ASR (%): 76.1 -> 87.9 | Helped |
| Use GSBA^2 instead of SA^2 | ResNet-50 · ImageNet, top-2 untargeted, r_th=2, Q=30000 | ASR (%): 85.0 -> 97.2 | Helped |
| Use GSBA^1 instead of SA^1 | ResNet-50 · ImageNet, top-1 targeted, r_th=4, Q=40000 | ASR (%): 79.6 -> 98.6 | Helped |
| Use GSBA^4 instead of SA^4 | ResNet-50 · ImageNet, top-4 targeted, r_th=4, Q=40000 | ASR (%): 19.7 -> 63.4 | Helped |
| Use GSBA^2 instead of SA^2 | Inception-V3 · PASCAL VOC 2012, top-2 targeted, random targets, r_th=4, Q=40000 | ASR (%): 15.0 -> 53.0 | Helped |
| Combine target-class count and confidence-change weights rather than using only minimum target-class probability change (ablation) | GSBA initial-boundary estimator · ImageNet, ResNet-50, top-2 targeted initial-boundary estimation | median l2 perturbation: 12.17 -> 12.12 | Helped |
| Combine target-class count and confidence-change weights rather than using only minimum target-class probability change (ablation) | GSBA initial-boundary estimator · ImageNet, ResNet-50, top-3 targeted initial-boundary estimation | median query count: 4258.00 -> 3896.00 | Helped |
| Include non-adversarial queries in boundary gradient estimation rather than using adversarial queries only (ablation) | GSBA^1 · ImageNet, ResNet-50, top-1 untargeted and targeted | ASR and median l2 perturbation | Helped |
| Use gradient-based initialization rather than random-direction or source-to-target initialization (ablation) | GSBA^1 · ImageNet, ResNet-50, top-1 untargeted and targeted | median l2 perturbation | Helped |
| Use Method-2, the CW-objective estimator, for initial-boundary search (ablation) | GSBA targeted initial-boundary search · ImageNet, ResNet-50, aggressive top-K targeted attacks | initial-boundary search success | Hurt |
| Use the aggregated target-probability-change estimator (Approach 2) as K increases (ablation) | GSBA boundary gradient estimation · ImageNet, ResNet-50, targeted top-K attacks | perturbation | Hurt |
| Use the minimum target-class probability-change estimator (Approach 3) as K increases (ablation) | GSBA boundary gradient estimation · ImageNet, ResNet-50, targeted top-K attacks | perturbation | Hurt |
Surprising findings
- The top-K adapted Square Attack baseline fails to converge to the desired perturbation for worst-case target labels on VOC within the query budgets, while GSBA^K maintains much higher ASR.
- Gradient-based initial boundary search gives a substantial median l2 improvement over random or binary-search initialization.
Limitations
- ASR decreases as K increases, indicating the top-K setting remains harder.
- Baselines were adapted (SA^K, and modified SimBA-DCT/PPBA parameters) by the authors, so comparisons depend on those choices.
Experimental setup
Datasets: ImageNet PASCAL VOC 2012
Benchmarks: ImageNet PASCAL VOC 2012
Metrics: attack success rate (ASR) median l2 perturbation query count
Baselines: Square Attack (top-K adapted, SA^K) SimBA-DCT PPBA CGBA
Builds on: CGBA Square Attack SimBA Carlini-Wagner attack
Closest papers by meaning
- BRUSLEATTACK: A QUERY-EFFICIENT SCORE- BASED BLACK-BOX SPARSE ADVERSARIAL ATTACK (ICLR 2024 · similarity 0.86)
- ADBA: Approximation Decision Boundary Approach for Black-Box Adversarial Attacks (AAAI 2025 · similarity 0.85)
- Adversarial Perturbations Are Formed by Iteratively Learning Linear Combinations of the Right Singular Vectors of the Adversarial Jacobian (ICML 2025 · similarity 0.85)
- DifAttack: Query-Efficient Black-Box Adversarial Attack via Disentangled Feature Space (AAAI 2024 · similarity 0.84)
- Understanding the Robustness of Randomized Feature Defense Against Query-Based Adversarial Attacks (ICLR 2024 · similarity 0.84)
- TtBA: Two-third Bridge Approach for Decision-Based Adversarial Attack (ICML 2025 · similarity 0.84)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.