Improving Black-box Adversarial Attacks with a Transfer-based Prior

Understand

We consider the black-box adversarial setting, where the adversary has to generate adversarial perturbations without access to the target models to compute gradients.

• Previous methods tried to approximate the gradient either by using a transfer gradient of a surrogate white-box model, or based on the query feedback.
• However, these methods often suffer from low attack success rates or poor query efficiency since it is non-trivial to estimate the gradient in a high-dimensional space with limited information.
• To address these problems, we propose a prior-guided random gradient-free (P-RGF) method to improve black-box adversarial attacks, which takes the advantage of a transfer-based prior and the query information simultaneously.