mlsanityData to 7 Oct 2026

Finding Optimal Tangent Points for Reducing Distortions of Hard-label Attacks

arXiv 2111.07492 ↗First posted 15 Nov 2021cs.CV cs.CRcited by 11

Not on the map. Why?

Abstract (arXiv)

One major problem in black-box adversarial attacks is the high query complexity in the hard-label attack setting, where only the top-1 predicted label is available. In this paper, we propose a novel geometric-based approach called Tangent Attack (TA), which identifies an optimal tangent point of a virtual hemisphere located on the decision boundary to reduce the distortion of the attack. Assuming the decision boundary is locally flat, we theoretically prove that the minimum ℓ2 distortion can be obtained by reaching the decision boundary along the tangent line passing through such tangent point in each iteration. To improve the robustness of our method, we further propose a generalized method which replaces the hemisphere with a semi-ellipsoid to adapt to curved decision boundaries. Our approach is free of pre-training. Extensive experiments conducted on the ImageNet and CIFAR-10 datasets demonstrate that our approach can consume only a small number of queries to achieve the low-magnitude distortion. The implementation source code is released online at https://github.com/machanic/TangentAttack.

Key facts. Cited by 11 papers in the map (data through 7 Oct 2026). Builds on 37 of its 51 references that are in the map. First posted on arXiv 15 Nov 2021.

Builds on

37 of 51 references.

References · 37

  1. 2015Deep Residual Learning for Image Recognitioncited by 51,809
  2. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  3. 2015Rethinking the Inception Architecture for Computer Visioncited by 5,451
  4. 2017Squeeze-and-Excitation Networkscited by 4,763
  5. 2016Wide Residual Networkscited by 3,057
  6. 2016Towards Evaluating the Robustness of Neural Networkscited by 2,976
  7. 2019Theoretically Principled Trade-off between Robustness and Accuracycited by 1,510
  8. 2016Inception-v4, Inception-ResNet and the Impact of Residual Connections on Learningcited by 1,509
  9. 2015DeepFool: a simple and accurate method to fool deep neural networkscited by 1,315
  10. 2017ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Modelscited by 656
  11. 2016Delving into Transferable Adversarial Examples and Black-box Attackscited by 530
  12. 2017Countering Adversarial Images using Input Transformationscited by 517
25 more
  1. 2018Black-box Adversarial Attacks with Limited Queries and Informationcited by 499
  2. 2017Decision-Based Adversarial Attacks: Reliable Attacks Against Black-Box Machine Learning Modelscited by 459
  3. 2019Searching for A Robust Neural Architecture in Four GPU Hourscited by 258
  4. 2020Geometry-aware Instance-reweighted Adversarial Trainingcited by 198
  5. 2019Efficient Decision-based Black-box Adversarial Attacks on Face Recognitioncited by 173
  6. 2020Skip Connections Matter: On the Transferability of Adversarial Examples Generated with ResNetscited by 165
  7. 2016Deep Pyramidal Residual Networkscited by 163
  8. 2018Prior Convictions: Black-Box Adversarial Attacks with Bandits and Priorscited by 145
  9. 2018Query-Efficient Hard-label Black-box Attack:An Optimization-based Approachcited by 130
  10. 2019Improving Black-box Adversarial Attacks with a Transfer-based Priorcited by 121
  11. 2019Sign-OPT: A Query-Efficient Hard-label Adversarial Attackcited by 118
  12. 2018ComDefend: An Efficient Image Compression Model to Defend Adversarial Examplescited by 104
  13. 2020QEBA: Query-Efficient Boundary-Based Blackbox Attackcited by 103
  14. 2018Feature Distillation: DNN-Oriented JPEG Compression Against Adversarial Examplescited by 98
  15. 2019Defense Against Adversarial Attacks Using Feature Scattering-based Adversarial Trainingcited by 95
  16. 2020RayS: A Ray Searching Method for Hard-label Adversarial Attackcited by 94
  17. 2016Robustness of classifiers: from adversarial to random noisecited by 87
  18. 2020A Unified Approach to Interpreting and Boosting Adversarial Transferabilitycited by 71
  19. 2020GeoDA: a geometric framework for black-box adversarial attackscited by 66
  20. 2020SurFree: a fast surrogate-free black-box attackcited by 59
  21. 2019Parsimonious Black-Box Adversarial Attacks via Efficient Combinatorial Optimizationcited by 49
  22. 2018Guessing Smart: Biased Sampling for Efficient Black-Box Adversarial Attackscited by 46
  23. 2018ShakeDrop Regularization for Deep Residual Learningcited by 40
  24. 2020Improving Query Efficiency of Black-box Adversarial Attackcited by 34
  25. 2019A geometry-inspired decision-based attackcited by 22

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2023: 4; 2024: 2; 2025: 4; 2026: 1.

11 papers.

  1. 2024Fight Back Against Jailbreaking via Prompt Adversarial Tuningcited by 63
  2. 2023CGBA: Curvature-aware Geometric Black-box Attackcited by 20
  3. 2023A Survey of Robustness and Safety of 2D and 3D Deep Learning Models Against Adversarial Attackscited by 19
  4. 2023Survey on Adversarial Attack and Defense for Medical Image Analysis: Methods and Challengescited by 16
  5. 2024Spectral regularization for adversarially-robust representation learningcited by 2
  6. 2025GSBAK: top-K Geometric Score-based Black-box Attackcited by 2
  7. 2025Accelerating Targeted Hard-Label Adversarial Attacks in Low-Query Black-Box Settingscited by 1
  8. 2025Boosting Ray Search Procedure of Hard-label Attacks with Transfer-based Priorscited by 1
  9. 2023DTA: Distribution Transform-based Attack for Query-Limited Scenariocited by 0
  10. 2025Improving the Convergence Rate of Ray Search Optimization for Query-Efficient Hard-Label Attackscited by 0
  11. 2026Low-Cost Hard-Label Adversarial Attack with Theoretical Foundationscited by 0