# Curls & Whey: Boosting Black-Box Adversarial Attacks

arXiv: https://arxiv.org/abs/1904.01160 · HTML: https://mlsanity.com/paper/1904.01160/

## Key facts

- Cited by 37 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 2 Apr 2019.

## Built on by (most cited first, 30 of 37)

- [Advances in adversarial attacks and defenses in computer vision: A survey](https://mlsanity.com/paper/2108.00401/) (2021)
- [Adversarial Robustness Comparison of Vision Transformer and MLP-Mixer to CNNs](https://mlsanity.com/paper/2110.02797/) (2021)
- [Beyond ImageNet Attack: Towards Crafting Adversarial Examples for Black-box Domains](https://mlsanity.com/paper/2201.11528/) (2022)
- [Evading DeepFake Detectors via Adversarial Statistical Consistency](https://mlsanity.com/paper/2304.11670/) (2023)
- [Delving into Data: Effectively Substitute Training for Black-box Attack](https://mlsanity.com/paper/2104.12378/) (2021)
- [QAIR: Practical Query-efficient Black-Box Attacks for Image Retrieval](https://mlsanity.com/paper/2103.02927/) (2021)
- [Attacking deep networks with surrogate-based adversarial black-box methods is easy](https://mlsanity.com/paper/2203.08725/) (2022)
- [Attack to Fool and Explain Deep Networks](https://mlsanity.com/paper/2106.10606/) (2021)
- [Staircase Sign Method for Boosting Adversarial Attacks](https://mlsanity.com/paper/2104.09722/) (2021)
- [XAI-Based Detection of Adversarial Attacks on Deepfake Detectors](https://mlsanity.com/paper/2403.02955/) (2024)
- [Adversarial Attack and Defense in Deep Ranking](https://mlsanity.com/paper/2106.03614/) (2021)
- [SoK: Pitfalls in Evaluating Black-Box Attacks](https://mlsanity.com/paper/2310.17534/) (2023)
- [Minimum Topology Attacks for Graph Neural Networks](https://mlsanity.com/paper/2403.02723/) (2024)
- [All You Need is RAW: Defending Against Adversarial Attacks with Camera Image Pipelines](https://mlsanity.com/paper/2112.09219/) (2021)
- [Certifiable Black-Box Attacks with Randomized Adversarial Examples: Breaking Defenses with Provable Confidence](https://mlsanity.com/paper/2304.04343/) (2023)
- [AdvGPS: Adversarial GPS for Multi-Agent Perception Attack](https://mlsanity.com/paper/2401.17499/) (2024)
- [SoK: A Modularized Approach to Study the Security of Automatic Speech Recognition Systems](https://mlsanity.com/paper/2103.10651/) (2021)
- [Moir'e Attack (MA): A New Potential Risk of Screen Photos](https://mlsanity.com/paper/2110.10444/) (2021)
- [General Adversarial Defense Against Black-box Attacks via Pixel Level and Feature Level Distribution Alignments](https://mlsanity.com/paper/2212.05387/) (2022)
- [Attention-Guided Black-box Adversarial Attacks with Large-Scale Multiobjective Evolutionary Optimization](https://mlsanity.com/paper/2101.07512/) (2021)
- [Wavelet Regularization Benefits Adversarial Training](https://mlsanity.com/paper/2206.03727/) (2022)
- [Improving Adversarial Transferability with Scheduled Step Size and Dual Example](https://mlsanity.com/paper/2301.12968/) (2023)
- [ReFace: Real-time Adversarial Attacks on Face Recognition Systems](https://mlsanity.com/paper/2206.04783/) (2022)
- [FoolSDEdit: Deceptively Steering Your Edits Towards Targeted Attribute-aware Distribution](https://mlsanity.com/paper/2402.03705/) (2024)
- [Towards a Novel Perspective on Adversarial Examples Driven by Frequency](https://mlsanity.com/paper/2404.10202/) (2024)
- [Amnesia as a Catalyst for Enhancing Black Box Pixel Attacks in Image Classification and Object Detection](https://mlsanity.com/paper/2502.07821/) (2025)
- [PICA: A Pixel Correlation-based Attentional Black-box Adversarial Attack](https://mlsanity.com/paper/2101.07538/) (2021)
- [Finding Deviated Behaviors of the Compressed DNN Models for Image Classifications](https://mlsanity.com/paper/2112.02819/) (2021)
- [Ares: A System-Oriented Wargame Framework for Adversarial ML](https://mlsanity.com/paper/2210.12952/) (2022)
- [Boosting Adversarial Attacks by Leveraging Decision Boundary Information](https://mlsanity.com/paper/2303.05719/) (2023)

## Abstract (arXiv)

Image classifiers based on deep neural networks suffer from harassment caused by adversarial examples. Two defects exist in black-box iterative attacks that generate adversarial examples by incrementally adjusting the noise-adding direction for each step. On the one hand, existing iterative attacks add noises monotonically along the direction of gradient ascent, resulting in a lack of diversity and adaptability of the generated iterative trajectories. On the other hand, it is trivial to perform adversarial attack by adding excessive noises, but currently there is no refinement mechanism to squeeze redundant noises. In this work, we propose Curls & Whey black-box attack to fix the above two defects. During Curls iteration, by combining gradient ascent and descent, we `curl' up iterative trajectories to integrate more diversity and transferability into adversarial examples. Curls iteration also alleviates the diminishing marginal effect in existing iterative attacks. The Whey optimization further squeezes the `whey' of noises by exploiting the robustness of adversarial perturbation. Extensive experiments on Imagenet and Tiny-Imagenet demonstrate that our approach achieves impressive decrease on noise magnitude in l2 norm. Curls & Whey attack also shows promising transferability against ensemble models as well as adversarially trained models. In addition, we extend our attack to the targeted misclassification, effectively reducing the difficulty of targeted attacks under black-box condition.