mlsanityData to 14 Oct 2026

Progressive-Scale Boundary Blackbox Attack via Projective Gradient Estimation

arXiv 2106.06056 ↗First posted 10 Jun 2021cs.LG cs.CR cs.CVcited by 8

Not on the map. Why?

Abstract (arXiv)

Boundary based blackbox attack has been recognized as practical and effective, given that an attacker only needs to access the final model prediction. However, the query efficiency of it is in general high especially for high dimensional image data. In this paper, we show that such efficiency highly depends on the scale at which the attack is applied, and attacking at the optimal scale significantly improves the efficiency. In particular, we propose a theoretical framework to analyze and show three key characteristics to improve the query efficiency. We prove that there exists an optimal scale for projective gradient estimation. Our framework also explains the satisfactory performance achieved by existing boundary black-box attacks. Based on our theoretical framework, we propose Progressive-Scale enabled projective Boundary Attack (PSBA) to improve the query efficiency via progressive scaling techniques. In particular, we employ Progressive-GAN to optimize the scale of projections, which we call PSBA-PGAN. We evaluate our approach on both spatial and frequency scales. Extensive experiments on MNIST, CIFAR-10, CelebA, and ImageNet against different models including a real-world face recognition API show that PSBA-PGAN significantly outperforms existing baseline attacks in terms of query efficiency and attack success rate. We also observe relatively stable optimal scales for different models and datasets. The code is publicly available at https://github.com/AI-secure/PSBA.

Key facts. Cited by 8 papers in the map (data through 14 Oct 2026). Builds on 37 of its 51 references that are in the map. First posted on arXiv 10 Jun 2021.

Builds on

37 of 51 references.

References · 37

  1. 2017Attention Is All You Needcited by 60,361
  2. 2015Deep Residual Learning for Image Recognitioncited by 52,096
  3. 2014Very Deep Convolutional Networks for Large-Scale Image Recognitioncited by 15,364
  4. 2014Explaining and Harnessing Adversarial Examplescited by 7,364
  5. 2016Densely Connected Convolutional Networkscited by 6,720
  6. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,415
  7. 2013Intriguing properties of neural networkscited by 5,155
  8. 2016Feature Pyramid Networks for Object Detectioncited by 5,036
  9. 2014Going Deeper with Convolutionscited by 4,241
  10. 2014Deep Learning Face Attributes in the Wildcited by 3,693
  11. 2015Delving Deep into Rectifiers: Surpassing Human-Level Performance on ImageNet Classificationcited by 3,611
  12. 2016Wide Residual Networkscited by 3,070
25 more
  1. 2017Progressive Growing of GANs for Improved Quality, Stability, and Variationcited by 2,988
  2. 2016Aggregated Residual Transformations for Deep Neural Networkscited by 2,546
  3. 2016Adversarial examples in the physical worldcited by 1,769
  4. 2017ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Modelscited by 666
  5. 2018Black-box Adversarial Attacks with Limited Queries and Informationcited by 501
  6. 2017Decision-Based Adversarial Attacks: Reliable Attacks Against Black-Box Machine Learning Modelscited by 462
  7. 2016Transferability in Machine Learning: from Phenomena to Black-Box Attacks using Adversarial Samplescited by 446
  8. 2019HopSkipJumpAttack: A Query-Efficient Decision-Based Attackcited by 333
  9. 2019A Fourier Perspective on Model Robustness in Computer Visioncited by 288
  10. 2019Efficient Decision-based Black-box Adversarial Attacks on Face Recognitioncited by 175
  11. 2017The Space of Transferable Adversarial Examplescited by 158
  12. 2020Randomized Smoothing of All Shapes and Sizescited by 147
  13. 2018AutoZOOM: Autoencoder-based Zeroth Order Optimization Method for Attacking Black-box Neural Networkscited by 137
  14. 2019Improving Black-box Adversarial Attacks with a Transfer-based Priorcited by 121
  15. 2019Sign-OPT: A Query-Efficient Hard-label Adversarial Attackcited by 120
  16. 2020QEBA: Query-Efficient Boundary-Based Blackbox Attackcited by 104
  17. 2020RayS: A Ray Searching Method for Hard-label Adversarial Attackcited by 96
  18. 2016A Unified Multi-scale Deep Convolutional Neural Network for Fast Object Detectioncited by 83
  19. 2020Cascade EF-GAN: Progressive Facial Expression Editing with Local Focusescited by 43
  20. 2019Subspace Attack: Exploiting Promising Subspaces for Query-Efficient Black-box Attackscited by 35
  21. 2019Hybrid Batch Attacks: Finding Black-box Adversarial Examples with Limited Queriescited by 33
  22. 2020Controllable Orthogonalization in Training DNNscited by 30
  23. 2019MDFN: Multi-Scale Deep Feature Learning Network for Object Detectioncited by 19
  24. 2020Projection & Probability-Driven Black-Box Attackcited by 19
  25. 2019Progressive Augmentation of GANscited by 13

Built on by

Cited by year

Citing papers per year: 2022: 4; 2023: 2; 2024: 1; 2025: 1.

8 papers.

  1. 2022Fingerprinting Deep Neural Networks Globally via Universal Adversarial Perturbationscited by 61
  2. 2022Double Sampling Randomized Smoothingcited by 22
  3. 2022Query Efficient Decision Based Sparse Attacks Against Black-Box Deep Learning Modelscited by 13
  4. 2022TPC: Transformation-Specific Smoothing for Point Cloud Modelscited by 10
  5. 2023SoK: Pitfalls in Evaluating Black-Box Attackscited by 6
  6. 2025Beyond Vulnerabilities: A Survey of Adversarial Attacks as Both Threats and Defenses in Computer Vision Systemscited by 4
  7. 2024BadPart: Unified Black-box Adversarial Patch Attacks against Pixel-wise Regression Taskscited by 3
  8. 2023Boosting Decision-Based Black-Box Adversarial Attack with Gradient Priorscited by 1