# Perceptual Quality-preserving Black-Box Attack against Deep Learning Image Classifiers

arXiv: https://arxiv.org/abs/1902.07776 · HTML: https://mlsanity.com/paper/1902.07776/

## Key facts

- Cited by 8 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 20 Feb 2019.

## Built on by (most cited first, 8 of 8)

- [Sparse Adversarial Video Attacks with Spatial Transformations](https://mlsanity.com/paper/2111.05468/) (2021)
- [fakeWeather: Adversarial Attacks for Deep Neural Networks Emulating Weather Conditions on the Camera Lens of Autonomous Systems](https://mlsanity.com/paper/2205.13807/) (2022)
- [Perceptually Constrained Adversarial Attacks](https://mlsanity.com/paper/2102.07140/) (2021)
- [Investigating the significance of adversarial attacks and their relation to interpretability for radar-based human activity recognition systems](https://mlsanity.com/paper/2101.10562/) (2021)
- [Adaptive Feature Alignment for Adversarial Training](https://mlsanity.com/paper/2105.15157/) (2021)
- [Effective and Robust Adversarial Training against Data and Label Corruptions](https://mlsanity.com/paper/2405.04191/) (2024)
- [One-Index Vector Quantization Based Adversarial Attack on Image Classification](https://mlsanity.com/paper/2409.01282/) (2024)
- [Adapting to Evolving Adversaries with Regularized Continual Robust Training](https://mlsanity.com/paper/2502.04248/) (2025)

## Abstract (arXiv)

Deep neural networks provide unprecedented performance in all image classification problems, taking advantage of huge amounts of data available for training. Recent studies, however, have shown their vulnerability to adversarial attacks, spawning an intense research effort in this field. With the aim of building better systems, new countermeasures and stronger attacks are proposed by the day. On the attacker's side, there is growing interest for the realistic black-box scenario, in which the user has no access to the neural network parameters. The problem is to design efficient attacks which mislead the neural network without compromising image quality. In this work, we propose to perform the black-box attack along a low-distortion path, so as to improve both the attack efficiency and the perceptual quality of the adversarial image. Numerical experiments on real-world systems prove the effectiveness of the proposed approach, both in benchmark classification tasks and in key applications in biometrics and forensics.