# POBA-GA: Perturbation Optimized Black-Box Adversarial Attacks via Genetic Algorithm

arXiv: https://arxiv.org/abs/1906.03181 · HTML: https://mlsanity.com/paper/1906.03181/

## Key facts

- Cited by 14 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 1 May 2019.

## Built on by (most cited first, 14 of 14)

- [SAFARI: Versatile and Efficient Evaluations for Robustness of Interpretability](https://mlsanity.com/paper/2208.09418/) (2022)
- [Black-box adversarial attacks using Evolution Strategies](https://mlsanity.com/paper/2104.15064/) (2021)
- [SoK: Pitfalls in Evaluating Black-Box Attacks](https://mlsanity.com/paper/2310.17534/) (2023)
- [On the Adversarial Risk of Test Time Adaptation: An Investigation into Realistic Test-Time Data Poisoning](https://mlsanity.com/paper/2410.04682/) (2024)
- [Attention-Guided Black-box Adversarial Attacks with Large-Scale Multiobjective Evolutionary Optimization](https://mlsanity.com/paper/2101.07512/) (2021)
- [A Red Teaming Framework for Securing AI in Maritime Autonomous Systems](https://mlsanity.com/paper/2312.11500/) (2023)
- [Simple black-box universal adversarial attacks on medical image classification based on deep neural networks](https://mlsanity.com/paper/2108.04979/) (2021)
- [Semantic Preserving Adversarial Attack Generation with Autoencoder and Genetic Algorithm](https://mlsanity.com/paper/2208.12230/) (2022)
- [Physics-Guided Adversarial Machine Learning for Aircraft Systems Simulation](https://mlsanity.com/paper/2209.03431/) (2022)
- [Maestro: A Gamified Platform for Teaching AI Robustness](https://mlsanity.com/paper/2306.08238/) (2023)
- [MoCo-EA: Exploiting Adversarial Mode Connectivity for Efficient Evolutionary Attacks](https://mlsanity.com/paper/2605.18919/) (2026)
- [Salient Feature Extractor for Adversarial Defense on Deep Neural Networks](https://mlsanity.com/paper/2105.06807/) (2021)
- [Decision-BADGE: Decision-based Adversarial Batch Attack with Directional Gradient Estimation](https://mlsanity.com/paper/2303.04980/) (2023)
- [Breaking the Illusion of Security via Interpretation: Interpretable Vision Transformer Systems under Attack](https://mlsanity.com/paper/2507.14248/) (2025)

## Abstract (arXiv)

Most deep learning models are easily vulnerable to adversarial attacks. Various adversarial attacks are designed to evaluate the robustness of models and develop defense model. Currently, adversarial attacks are brought up to attack their own target model with their own evaluation metrics. And most of the black-box adversarial attack algorithms cannot achieve the expected success rate compared with white-box attacks. In this paper, comprehensive evaluation metrics are brought up for different adversarial attack methods. A novel perturbation optimized black-box adversarial attack based on genetic algorithm (POBA-GA) is proposed for achieving white-box comparable attack performances. Approximate optimal adversarial examples are evolved through evolutionary operations including initialization, selection, crossover and mutation. Fitness function is specifically designed to evaluate the example individual in both aspects of attack ability and perturbation control. Population diversity strategy is brought up in evolutionary process to promise the approximate optimal perturbations obtained. Comprehensive experiments are carried out to testify POBA-GA's performances. Both simulation and application results prove that our method is better than current state-of-art black-box attack methods in aspects of attack capability and perturbation control.