提出新攻击框架,低查询下高效突破硬标签防御。
Low-Cost Hard-Label Adversarial Attack with Theoretical Foundations
- 基于梯度符号逼近原理,设计零查询初始化与模式驱动优化
- 在低查询预算下成功率超现有方法,对齐真实梯度方向
- 适用于图像、医学影像及分割任务,可绕过黑光防御
硬标签黑盒攻击仅依赖顶层分类结果,是极具挑战且现实威胁的攻击模型。现有方法存在两大局限:忽视初始化关键作用,过度依赖经验启发式策略而缺乏理论保障。本文建立统一理论框架,揭示已有符号翻转攻击本质上近似真实梯度符号。基于此,提出新型攻击框架,包含零查询初始化策略和模式驱动优化(PDO)算法。理论证明该初始化比随机基线具有更高余弦相似性;PDO模块显著降低查询复杂度。在CIFAR-10、ImageNet和ObjectNet上测试,涵盖标准与对抗训练模型、商业API及CLIP模型,本方法在成功率达95%以上且查询数低于100时表现最优。在受损数据(ImageNet-C)、病理图像(PathMNIST)及分割任务中展现强泛化能力。尤其能绕过状态防御Blacklight,检测率为0%。
原文摘要 · Abstract (English)
Hard-label black-box attacks, relying solely on top-1 predictions, represent one of the most challenging yet practically threat models. Despite recent progress, existing approaches face two key limitations: (1) they overlook the critical role of initialization, focusing primarily on optimization strategies; and (2) they rely heavily on empirical heuristics without theoretical guarantees. To bridge this gap, we establish a unified theoretical framework showing that existing sign-flipping hard-label attacks can be understood as approximating the true gradient sign. Guided by this principled analysis, we propose a novel attack framework featuring a zero-query initialization strategy and a Pattern-Driven Optimization (PDO) algorithm. We provide theoretical guarantees that our initialization yields higher cosine similarity to the true gradient sign than random baselines, and our PDO module achieves significantly lower query complexity than baseline search methods. Extensive experiments across CIFAR-10, ImageNet, and ObjectNet-covering standard and adversarially trained models, commercial APIs, and CLIP models-demonstrate that our method consistently outperforms SOTA hard-label attacks in both success rate and efficiency, particularly under low query budgets. Furthermore, our method demonstrates robust generalization across corrupted data (ImageNet-C), biomedical images (PathMNIST), and dense prediction tasks such as segmentation. Notably, it bypasses the stateful defense Blacklight, achieving a 0% detection rate.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。