# The LogBarrier adversarial attack: making effective use of decision boundary information

arXiv: https://arxiv.org/abs/1903.10396 · HTML: https://mlsanity.com/paper/1903.10396/

## Key facts

- Cited by 7 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 25 Mar 2019.

## Built on by (most cited first, 7 of 7)

- [UPAM: Unified Prompt Attack in Text-to-Image Generation Models Against Both Textual Filters and Visual Checkers](https://mlsanity.com/paper/2405.11336/) (2024)
- [Selection of Source Images Heavily Influences the Effectiveness of Adversarial Attacks](https://mlsanity.com/paper/2106.07141/) (2021)
- [Unified Prompt Attack Against Text-to-Image Generation Models](https://mlsanity.com/paper/2502.16423/) (2025)
- [Adversarial Attacks and Defenses in Multivariate Time-Series Forecasting for Smart and Connected Infrastructures](https://mlsanity.com/paper/2408.14875/) (2024)
- [Learning Accurate Performance Predictors for Ultrafast Automated Model Compression](https://mlsanity.com/paper/2304.06393/) (2023)
- [Vulnerability Disclosure through Adaptive Black-Box Adversarial Attacks on NIDS](https://mlsanity.com/paper/2506.20576/) (2025)
- [Behavior-Aware and Generalizable Defense Against Black-Box Adversarial Attacks for ML-Based IDS](https://mlsanity.com/paper/2512.13501/) (2025)

## Abstract (arXiv)

Adversarial attacks for image classification are small perturbations to images that are designed to cause misclassification by a model. Adversarial attacks formally correspond to an optimization problem: find a minimum norm image perturbation, constrained to cause misclassification. A number of effective attacks have been developed. However, to date, no gradient-based attacks have used best practices from the optimization literature to solve this constrained minimization problem. We design a new untargeted attack, based on these best practices, using the established logarithmic barrier method. On average, our attack distance is similar or better than all state-of-the-art attacks on benchmark datasets (MNIST, CIFAR10, ImageNet-1K). In addition, our method performs significantly better on the most challenging images, those which normally require larger perturbations for misclassification. We employ the LogBarrier attack on several adversarially defended models, and show that it adversarially perturbs all images more efficiently than other attacks: the distance needed to perturb all images is significantly smaller with the LogBarrier attack than with other state-of-the-art attacks.