Square Attack: a query-efficient black-box adversarial attack via random search

By Maksym Andriushchenko, Francesco Croce, Nicolas Flammarion, Matthias Hein. 2019

1,300 citations recorded by the source corpus.

We propose the Square Attack, a score-based black-box $l_2$- and $l_\infty$-adversarial attack that does not rely on local gradient information and thus is not affected by gradient masking. Square Attack is based on a randomized search scheme which selects localized square-shaped updates at random positions so that at each iteration the perturbation is situated approximately at the boundary of the feasible set. Our method is significantly more query efficient and achieves a higher success rate compared to the state-of-the-art methods, especially in the untargeted setting. In particular, on ImageNet we improve the average query efficiency in the untargeted setting for various deep networks by a factor of at least $1.8$ and up to $3$ compared to the recent state-of-the-art $l_\infty$-attack of Al-Dujaili & O'Reilly. Moreover, although our attack is black-box, it can also outperform gradient-based white-box attacks on the standard benchmarks achieving a new state-of-the-art in terms of the success rate. The code of our attack is available at this https URL.

Subfields: Artificial Intelligence, Computer Vision and Pattern Recognition, Safety, Robustness & Interpretability

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Vision and Pattern Recognition

In Safety, Robustness & Interpretability

Citations in the corpus

Do Wider Neural Networks Really Help Adversarial Robustness? (2020, methodology): “For completeness, we also report the results under four different attack methods and settings, including PGD [41], C&W [9], FAB [16], and Square [4].”
Jailbreaking Leading Safety-Aligned LLMs with Simple Adaptive Attacks (2024, neutral): “We opted for random search (1) due to its simplicity and efficiency, requiring only logprobs instead of gradients (thus also reducing the memory demands), and (2) motivated by its success in attacking vision models (Andriushchenko et al., 2020; Croce et al., 2022).”
Fixing Data Augmentation to Improve Adversarial Robustness (2021, methodology): “…• AUTOPGD-T, a targeted attack using PGD with an adaptive step on the difference of logits ratio (Croce & Hein, 2020b), • FAB-T, a targeted attack which minimizes the norm of adversarial perturbations (Croce & Hein, 2020a), • SQUARE, a query-efficient black-box attack (Andriushchenko et al., 2020).”
Adversarial Weight Perturbation Helps Robust Generalization (2020, methodology): “In addition, we test AWP against Auto Attack (AA) [9], which is a strong and reliable attack to verify the robustness via an ensemble of diverse parameter-free attacks including three white-box attacks (APGD-CE [9], APGD-DLR [9], and FAB [8]) and a black-box attack (Square Attack [1]).”
Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks (2020, methodology): “5, we combine our two new versions of PGD with FAB and Square Attack to form a parameter-free, computationally affordable and userindependent ensemble of complementary attacks to estimate adversarial robustness, named AutoAttack.”
Are Transformers More Robust Than CNNs? (2021, background): “…also contains: A) AutoAttack [8], which is an ensemble of diverse attacks ( i.e ., two variants of PGD attack, FAB attack [7] and Square Attack [1]) and is parameter-free; and B) Texture Patch Attack (TPA) [50], which uses a predeﬁned texture dictionary of patches to fool deep neural networks.”