提升硬标签攻击的收敛速度，显著降低查询次数。
Improving the Convergence Rate of Ray Search Optimization for Query-Efficient Hard-Label Attacks
- 基于动量思想预估未来方向，更精准更新搜索路径。
- 在ImageNet和CIFAR-10上，查询次数低于13种先进方法。
- 适合对查询成本敏感的黑盒攻击场景。
在仅能获取最高置信度标签的硬标签黑盒攻击中，高昂的查询代价严重制约实际应用。本文聚焦于一类代表性攻击：通过搜索最优射线方向，以最小的ℓ₂范数扰动将正常图像转入对抗区域。受Nesterov加速梯度启发，提出动量型算法ARS-OPT，通过累积动量预估未来射线方向的梯度，实现更准确的方向更新。理论分析表明，该方法收敛更快且更稳定。为进一步加速，引入代理模型先验优化梯度估计，得到性能更强的PARS-OPT。在标准假设下，理论保证了方法优越性。大量实验在ImageNet和CIFAR-10上验证，所提方法在查询效率上优于13种当前最先进方法。
原文摘要 · Abstract (English)
In hard-label black-box adversarial attacks, where only the top-1 predicted label is accessible, the prohibitive query complexity poses a major obstacle to practical deployment. In this paper, we focus on optimizing a representative class of attacks that search for the optimal ray direction yielding the minimum $\ell_2$-norm perturbation required to move a benign image into the adversarial region. Inspired by Nesterov's Accelerated Gradient (NAG), we propose a momentum-based algorithm, ARS-OPT, which proactively estimates the gradient with respect to a future ray direction inferred from accumulated momentum. We provide a theoretical analysis of its convergence behavior, showing that ARS-OPT enables more accurate directional updates and achieves faster, more stable optimization. To further accelerate convergence, we incorporate surrogate-model priors into ARS-OPT's gradient estimation, resulting in PARS-OPT with enhanced performance. The superiority of our approach is supported by theoretical guarantees under standard assumptions. Extensive experiments on ImageNet and CIFAR-10 demonstrate that our method surpasses 13 state-of-the-art approaches in query efficiency.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。