GuidedRay: Diversity-Guided Direction Discovery for Targeted Hard-Label Black-Box Attacks
GuidedRay finds targeted adversarial directions for hard-label black-box attacks using fewer queries than prior methods.
GuidedRay is a targeted hard-label black-box attack that first finds a direction into a chosen class, then refines the perturbation. It generates diverse candidates from one or more target-class references, screens their sign directions with a one-query Fast Test, and uses Ray Search to reduce the decision-boundary radius. On CIFAR-10, CIFAR-100, and ImageNet it outperformed five decision-based attacks at query budgets from 500 to 5,000. It also recorded the highest success rate at those budgets against models protected by adversarial training or TRADES, with the largest gains during direction discovery.
- Attacker sees only the top-1 label and must reach a chosen class.
- Diverse target-class directions are screened with a one-query Fast Test.
- Ray Search then reduces the discovered decision-boundary radius.
- It beat five decision-based attacks on CIFAR-10, CIFAR-100, and ImageNet.
- Gains held against adversarial training and TRADES at 500 to 5,000 queries.
Full article191 words · extracted from arxiv.org · click to collapse
Deep neural networks are vulnerable to adversarial attacks. Among black-box attacks, targeted decision-based attacks are particularly difficult: the attacker observes only the target model's top-1 label and aims to make it predict a prespecified target class under a bounded perturbation. Before perturbation refinement, the attacker must discover a direction that reaches the prescribed target region. This initialization step can incur substantial query cost. We propose GuidedRay, a targeted decision-based attack based on diversity-guided direction discovery. GuidedRay builds on two observations: target-class reference samples provide useful target-conditioned direction priors, and diverse candidates increase the probability of discovering a targeted adversarial direction. GuidedRay generates varied candidates from one or multiple target-class references and uses a one-query Fast Test to screen their induced sign directions. Once a feasible direction is found, GuidedRay applies Ray Search to reduce its decision-boundary radius. Experiments on CIFAR-10, CIFAR-100, and ImageNet demonstrate that GuidedRay consistently outperforms five state-of-the-art decision-based attacks at four evaluated query budgets from 500 to 5,000, with particularly pronounced gains in direction discovery during initialization. Against models protected by adversarial training or TRADES, it likewise achieves the highest attack success rate at all four query budgets.
Text extracted automatically; images, tables and formatting may be missing. Original: https://arxiv.org/abs/2609.25734