EvoBA: An Evolution Strategy as a Strong Baseline forBlack-Box Adversarial Attacks
Andrei Ilie, Marius Popescu, Alin Stefanescu

TL;DR
EvoBA introduces a simple, query-efficient evolutionary strategy for black-box $L_0$ adversarial attacks, serving as a strong baseline and tool for evaluating the robustness of image classifiers against sparse perturbations.
Contribution
The paper presents EvoBA, a novel evolutionary search-based black-box attack that is simple, fast, and effective for $L_0$ perturbations, outperforming or matching complex state-of-the-art methods.
Findings
EvoBA is more query-efficient than SimBA.
EvoBA achieves results comparable to AutoZOOM in $L_2$ attacks.
EvoBA is a fast, general tool for robustness assessment.
Abstract
Recent work has shown how easily white-box adversarial attacks can be applied to state-of-the-art image classifiers. However, real-life scenarios resemble more the black-box adversarial conditions, lacking transparency and usually imposing natural, hard constraints on the query budget. We propose , a black-box adversarial attack based on a surprisingly simple evolutionary search strategy. is query-efficient, minimizes adversarial perturbations, and does not require any form of training. shows efficiency and efficacy through results that are in line with much more complex state-of-the-art black-box attacks such as . It is more query-efficient than , a simple and powerful baseline black-box attack, and has a similar level of complexity. Therefore, we propose it both as a new strong baseline for…
Peer Reviews
No public reviews on file for this paper yet. If you reviewed it on a platform where reviews are public (OpenReview, ICLR, NeurIPS, ICML), you can paste yours below so the community can read it here.
Code & Models
Videos
No videos yet. Explain this paper in a talk, walkthrough, or lecture? Add one.
Taxonomy
TopicsAdversarial Robustness in Machine Learning · Domain Adaptation and Few-Shot Learning · Advanced Neural Network Applications
