Aug 2026· Proceedings of the 32nd ACM SIGKDD Conference on Knowledge Discovery and Data Mining V.2· pp. 6116-6127· 0 citations· 9 references
TL;DR
Experiments show that BRP significantly reduces patch size and query cost compared to state-of-the-art decision-based attacks, offering a strong and practical approach for evaluating model vulnerability in adversarial settings.
Abstract
Adversarial patches pose a serious threat to deep neural networks, as small localized perturbations can decisively control model predictions. In real-world deployments, the decision-based black-box setting is the most realistic and challenging threat model, where attackers observe only the predicted labels. Designing adversarial patch attacks under this setting is of substantial real-world significance for rigorously testing model robustness under realistic black-box conditions. However, adversarial patch attacks in the decision-based setting remain largely underexplored. Existing methods often suffer from low query efficiency and require large patch areas, which significantly limit their practical applicability. We propose Block Revert Patch (BRP), a novel reverse construction method for query-efficient adversarial patch generation. Instead of adding perturbations, BRP formulates patch generation as a pixel-block reversion problem and employs a two-stage process to progressively refine the patch. Specifically, the single-block revert test stage uses a sliding window to temporarily revert individual blocks and collect those whose reversion maintains the adversarial effect. The global revert optimization stage then searches for an optimal combination of pixel-blocks from this set, further reducing the patch size. By iteratively alternating between these two stages, BRP progressively refines the patch in a coarse-to-fine manner. Experiments show that BRP significantly reduces patch size and query cost compared to state-of-the-art decision-based attacks, offering a strong and practical approach for evaluating model vulnerability in adversarial settings.
Machine learning models are increasingly adapted in various domains. However, adversarial examples pose a significant threat to the reliable deployment of these models. In recent years, some powerful adversarial example attacks have been proposed for the fast and query-efficient generation of adversarial examples, even in black-box scenarios, highlighting the need for scalable, low-cost, and powerful defenses. In this work, we present two contributions to the domain of black-box adversarial example attacks and defenses. First, we propose Random Logit Scaling (RLS), a randomization-based defense against black-box score-based adversarial example attacks. RLS is a plug-and-play, post-processing defense that can be implemented on top of any existing ML model with minimal effort. The idea behind RLS is to confuse an attacker by outputting falsified scores resulting from randomly scaled logits while maintaining the model accuracy. We show that RLS significantly reduces the success rate of state-of-the-art black-box score-based attacks while preserving the accuracy and minimizing confidence score distortion compared to state-of-the-art randomization-based defenses. Second, we introduce a novel adaptive attack against AAA, a SOTA non-randomized black-box defense against black-box score-based attacks that also modifies output logits to confuse attackers, demonstrating its vulnerability against adaptive attacks.
Hamid Dashtbani, Mehdi Dousti Gandomani, A. M. Sadeghzadeh· 0 citations
: Non-maximum suppression (NMS) is commonly used to filter redundant detection results in object detection models. Several white-box adversarial attacks to induce false positives by circumventing the NMS and increasing the number of false bounding boxes have been studied. However, since white-box attacks require internal parameters of the target model, actual viable environments are limited. This paper aims at an adversarial attack in a more feasible black-box environment threat model without internal parameters of the target model. Specifically, we propose a zero-query attack that exploits transferability such that we generate a universal adversarial perturbation (UAP) by the ensemble of multiple surrogate models that are white-box accessible and use the UAP to attack the target model in the black-box environment. We show that by increasing the number of surrogate models, we can achieve the false positive rate of the target model up to 84.4% in COCO2017 dataset and 82.9% in BDD100K dataset for targeting YOLOv8, and 87.2% in COCO2017 and 79.7% in BDD100K for targeting YOLOv9.
Kohei Kawasumi, Kazuki Yoneyama· Proceedings of the 23rd Inte...· 0 citations
Gradient-seeded Reinforcement Learning And Stealthy Pruning (GRASP), a three-stage framework that tackles challenges of adversarial attacks on machine learning-based malware detectors, and out-performs baselines, achieving higher attack success with fewer queries and smaller file-size inflation.
Yutong Liu, Jianting Ning, Qi Feng et al.· 0 citations
This work comprehensively investigates computation-efficient strategies to speed up latent adversarial training from two complementary perspectives, and reduces per-step adversarial-training FLOPs by 48.1% while requiring only 0.0118% trainable parameters.
Weiyi He, Yuping Lin, Jiliang Tang et al.· 0 citations
D3Adapter is presented, a threat-aware framework that unifies adversarial example detection (AED) and robust inference and scalability across datasets with varying numbers of classes is studied, showing that unified detection and robust inference can be achieved with predictable overhead proportional to the number of adapters.
Adversarial examples generated on a surrogate deep neural network (DNN) can often successfully fool other black-box DNN models. This cross-model transferability poses serious security threats to DNNs in practical applications. Input transformation techniques are widely used to enhance adversarial transferability by increasing the diversity of input images. However, existing methods primarily rely on local operations with limited degrees of freedom (DOF), such as block-wise shuffling and resizing, overlooking global perspective transformations that naturally arise from viewpoint changes. In this work, we propose a Perspective-Invariant Attack (PIA), which introduces a multi-DOF vertex sampling strategy that systematically covers the perspective transformation hierarchy from 2-DOF translation to 8-DOF projective mapping. By generating geometrically diverse input variations, PIA effectively reduces overfitting of adversarial perturbations to the surrogate model, thereby improving adversarial transferability. We further propose PIA-Mix, a generic extension that maintains a complementary transformation pool and efficiently combines our perspective transformation with auxiliary methods for improved transferability. Extensive experiments involving various DNN architectures, advanced defense mechanisms, and multimodal large language models (LLMs) demonstrate that PIA and PIA-Mix outperform state-of-the-art transfer-based attacks.
Kaisheng Liang, Yiming Cao, Bin Xiao· IEEE Transactions on Informa...· 0 citations