GuidedRay: Diversity-Guided Direction Discovery for Targeted Hard-Label Black-Box Attacks
GuidedRay finds targeted adversarial directions for hard-label black-box attacks using fewer queries than prior methods.
GuidedRay is a targeted hard-label black-box attack that first finds a direction into a chosen class, then refines the perturbation. It generates diverse candidates from one or more target-class references, screens their sign directions with a one-query Fast Test, and uses Ray Search to reduce the decision-boundary radius. On CIFAR-10, CIFAR-100, and ImageNet it outperformed five decision-based attacks at query budgets from 500 to 5,000. It also recorded the highest success rate at those budgets against models protected by adversarial training or TRADES, with the largest gains during direction discovery.
- Attacker sees only the top-1 label and must reach a chosen class.
- Diverse target-class directions are screened with a one-query Fast Test.
- Ray Search then reduces the discovered decision-boundary radius.
- It beat five decision-based attacks on CIFAR-10, CIFAR-100, and ImageNet.
- Gains held against adversarial training and TRADES at 500 to 5,000 queries.
From the original article
1 min read at arxiv.orgDeep neural networks are vulnerable to adversarial attacks. Among black-box attacks, targeted decision-based attacks are particularly difficult: the attacker observes only the target model's top-1 label and aims to make it predict a prespecified target class under a bounded perturbation. Before perturbation refinement, the attacker must discover a direction that reaches the prescribed target region.
By Fei Yuan · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.