Research map / Adversarial robustness and security / Black-box and transfer attacks
Boosting Ray Search Procedure of Hard-label Attacks with Transfer-based Priors
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes Prior-OPT and Prior-Sign-OPT, hard-label ray-search attacks that inject transfer-based surrogate priors into gradient estimation via subspace projection, with theoretical cosine-similarity analysis.
Problem
Hard-label (top-1 label only) black-box adversarial attacks are query-expensive; ray-search methods like OPT and Sign-OPT either need many binary-search queries or sacrifice gradient accuracy, and prior work combining transfer priors with hard-label attacks lacks principled prior weighting.
Approach
Treat the ray-search objective g(theta) as differentiable via a C&W-loss surrogate on surrogate models, then estimate the projection of the true gradient onto the span of transfer priors and random directions (Gram-Schmidt basis), using sign-based queries for random directions and finite differences for priors (Prior-OPT), with closed-form expected cosine similarities.
Key results
- On ImageNet untargeted l2 attack against Inception-v4, Prior-OPT (IncResV2&Xception) reaches mean distortion 3.119 at 10K queries versus 8.786 for Sign-OPT.
- Prior-OPT with ResNet50&ConViT on ViT achieves 3.609 at 10K queries untargeted, versus 4.572 for Sign-OPT.
- Using more priors consistently lowers distortion; on Swin Transformer untargeted, 5 priors give 2.577 vs 4.754 at 10K vs no-prior Sign-OPT at 9.899.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| use Prior-OPT with two surrogate-model priors instead of the strongest listed baseline | ImageNet Inception-v4 untargeted attack · ImageNet, Inception-v4 untargeted @10K queries | mean ℓ2 distortion: 7.115 -> 3.119 | Helped |
| use Prior-Sign-OPT with two surrogate-model priors instead of the strongest listed baseline | ImageNet Inception-v4 targeted attack · ImageNet, Inception-v4 targeted @10K queries | mean ℓ2 distortion: 30.221 -> 16.697 | Helped |
| use Prior-OPT with two surrogate-model priors instead of the strongest listed baseline | ImageNet ViT untargeted attack · ImageNet, ViT untargeted @10K queries | mean ℓ2 distortion: 4.452 -> 3.609 | Helped |
| use Prior-Sign-OPT with two surrogate-model priors instead of the strongest listed baseline | ImageNet ViT targeted attack · ImageNet, ViT targeted @10K queries | mean ℓ2 distortion: 16.046 -> 12.153 | Helped |
| increase the number of surrogate priors from 1 to 5 (ablation) | Prior-Sign-OPT · ImageNet, ResNet-101, Swin Transformer, and GC ViT untargeted @10K queries | mean ℓ2 distortion: 3.019 -> 1.951; 9.254 -> 3.467; 6.899 -> 2.893 | Helped |
| increase the number of surrogate priors from 1 to 5 (ablation) | Prior-OPT · ImageNet, Swin Transformer and GC ViT untargeted @10K queries | mean ℓ2 distortion: 9.625 -> 2.577; 5.948 -> 2.159 | Helped |
| increase the number of surrogate priors from 3 to 4 (ablation) | Prior-OPT · ImageNet, ResNet-101 untargeted @10K queries | mean ℓ2 distortion: 1.653 -> 1.596 | Helped |
| increase the number of surrogate priors from 4 to 5 (ablation) | Prior-OPT · ImageNet, ResNet-101 untargeted @10K queries | mean ℓ2 distortion: 1.596 -> 1.605 | Hurt |
| use more surrogate models as priors (ablation) | Prior-OPT and Prior-Sign-OPT · ImageNet attacks against undefended models | mean distortion | Helped |
| initialize the ray direction with surrogate-model PGD instead of random initialization (ablation) | Prior-OPT and Prior-Sign-OPT untargeted attacks · ImageNet untargeted attacks, early iterations | mean distortion | Helped |
| use Prior-OPT rather than Prior-Sign-OPT | ImageNet targeted attacks · ImageNet targeted attacks below 5K queries | mean distortion | Helped |
| use Prior-Sign-OPT rather than Prior-OPT | ImageNet targeted attacks · ImageNet targeted attacks with more queries | mean distortion | Helped |
Surprising findings
- Prior-Sign-OPT can underperform Sign-OPT when the prior's cosine similarity with the true gradient is large (|alpha| >= 0.612 in the paper's example), because sign-based multipliers are applied to the priors too.
- Prior-OPT is better at low query budgets while Prior-Sign-OPT wins at later stages in targeted attacks.
Limitations
- Priors from surrogate models require surrogate architectures that transfer; targeted attacks need extra care to set surrogate target class and lambda_0.
- Theoretical analysis assumes q much smaller than d and that finite differences reduce to signs of directional derivatives (small sigma, deterministic models).
Experimental setup
Datasets: ImageNet CIFAR-10
Benchmarks: ImageNet CIFAR-10
Metrics: mean l2 distortion attack success rate AUC of distortion vs queries
Baselines: Sign-OPT SVM-OPT HSJA Triangle Attack TA G-TA SurFree GeoDA Evolutionary BBA SQBA
Builds on: OPT Sign-OPT RayS PRGF HopSkipJumpAttack
Closest papers by meaning
- Improving the Convergence Rate of Ray Search Optimization for Query-Efficient Hard-Label Attacks (AAAI 2026 · similarity 0.95)
- Sign-OPT: A Query-Efficient Hard-label Adversarial Attack (ICLR 2020 · similarity 0.89)
- Improving Black-box Adversarial Attacks with a Transfer-based Prior (NeurIPS 2019 · similarity 0.87)
- Blackbox Attacks via Surrogate Ensemble Search (NeurIPS 2022 · similarity 0.87)
- Efficient Black-box Adversarial Attacks via Bayesian Optimization Guided by a Function Prior (ICML 2024 · similarity 0.87)
- BRUSLEATTACK: A QUERY-EFFICIENT SCORE- BASED BLACK-BOX SPARSE ADVERSARIAL ATTACK (ICLR 2024 · similarity 0.86)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.