# Towards Visual Distortion in Black-Box Attacks

arXiv: https://arxiv.org/abs/2007.10593 · HTML: https://mlsanity.com/paper/2007.10593/

## Key facts

- Cited by 6 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 21 Jul 2020.

## Built on by (most cited first, 6 of 6)

- [Saliency Attack: Towards Imperceptible Black-box Adversarial Attack](https://mlsanity.com/paper/2206.01898/) (2022)
- [Defending Person Detection Against Adversarial Patch Attack by using Universal Defensive Frame](https://mlsanity.com/paper/2204.13004/) (2022)
- [Query Attack by Multi-Identity Surrogates](https://mlsanity.com/paper/2105.15010/) (2021)
- [Robust and Accurate Object Detection via Self-Knowledge Distillation](https://mlsanity.com/paper/2111.07239/) (2021)
- [Boosting Decision-Based Black-Box Adversarial Attack with Gradient Priors](https://mlsanity.com/paper/2310.19038/) (2023)
- [Object-fabrication Targeted Attack for Object Detection](https://mlsanity.com/paper/2212.06431/) (2022)

## Abstract (arXiv)

Constructing adversarial examples in a black-box threat model injures the original images by introducing visual distortion. In this paper, we propose a novel black-box attack approach that can directly minimize the induced distortion by learning the noise distribution of the adversarial example, assuming only loss-oracle access to the black-box network. The quantified visual distortion, which measures the perceptual distance between the adversarial example and the original image, is introduced in our loss whilst the gradient of the corresponding non-differentiable loss function is approximated by sampling noise from the learned noise distribution. We validate the effectiveness of our attack on ImageNet. Our attack results in much lower distortion when compared to the state-of-the-art black-box attacks and achieves 100% success rate on InceptionV3, ResNet50 and VGG16bn. The code is available at https://github.com/Alina-1997/visual-distortion-in-attack.