Abstract:Recent work has shown how easily white-box adversarial attacks can be applied to state-of-the-art image classifiers. However, real-life scenarios resemble more the black-box adversarial conditions, lacking transparency and usually imposing natural, hard constraints on the query budget. We propose $\textbf{EvoBA}$, a black-box adversarial attack based on a surprisingly simple evolutionary search strategy. $\textbf{EvoBA}$ is query-efficient, minimizes $L_0$ adversarial perturbations, and does not require any form of training. $\textbf{EvoBA}$ shows efficiency and efficacy through results that are in line with much more complex state-of-the-art black-box attacks such as $\textbf{AutoZOOM}$. It is more query-efficient than $\textbf{SimBA}$, a simple and powerful baseline black-box attack, and has a similar level of complexity. Therefore, we propose it both as a new strong baseline for black-box adversarial attacks and as a fast and general tool for gaining empirical insight into how robust image classifiers are with respect to $L_0$ adversarial perturbations. There exist fast and reliable $L_2$ black-box attacks, such as $\textbf{SimBA}$, and $L_{\infty}$ black-box attacks, such as $\textbf{DeepSearch}$. We propose $\textbf{EvoBA}$ as a query-efficient $L_0$ black-box adversarial attack which, together with the aforementioned methods, can serve as a generic tool to assess the empirical robustness of image classifiers. The main advantages of such methods are that they run fast, are query-efficient, and can easily be integrated in image classifiers development pipelines. While our attack minimises the $L_0$ adversarial perturbation, we also report $L_2$, and notice that we compare favorably to the state-of-the-art $L_2$ black-box attack, $\textbf{AutoZOOM}$, and of the $L_2$ strong baseline, $\textbf{SimBA}$.

Imperceptible and Sparse Adversarial Attacks Via a Dual-Population-Based Constrained Evolutionary Algorithm

Sparse and Imperceivable Adversarial Attacks

Learning to Attack with Fewer Pixels: A Probabilistic Post-hoc Framework for Refining Arbitrary Dense Adversarial Attacks

An Adversarial Attack Based On Multi-Objective Optimization In The Black-Box Scenario: Moea-Apga Ii

EvoBA: An Evolution Strategy as a Strong Baseline forBlack-Box Adversarial Attacks

Perception Improvement for Free: Exploring Imperceptible Black-box Adversarial Attacks on Image Classification

An Evolutionary-Based Black-Box Attack to Deep Neural Network Classifiers.

An efficient general black-box adversarial attack approach based on multi-objective optimization for high dimensional images

Image Adversarial Example Generation Method Based on Adaptive Parameter Adjustable Differential Evolution

Evolution Attack On Neural Networks

Sparse Adversarial Attack via Perturbation Factorization

Sparse Adversarial Attack to Object Detection

Sparse Adversarial Video Attacks Via Superpixel-Based Jacobian Computation

AutoAdversary: A Pixel Pruning Method for Sparse Adversarial Attack

Gradient-free adversarial attack algorithm based on differential evolution

Adversarial Example Generation using Evolutionary Multi-objective Optimization

GSE: Group-wise Sparse and Explainable Adversarial Attacks

Adv-Diffusion: Imperceptible Adversarial Face Identity Attack via Latent Diffusion Model

GenAttack: Practical Black-box Attacks with Gradient-Free Optimization

Query Efficient Decision Based Sparse Attacks Against Black-Box Deep Learning Models

A Multi-objective Examples Generation Approach to Fool the Deep Neural Networks in the Black-Box Scenario