GreedyPixel: Fine-Grained Black-Box Adversarial Attack Via Greedy Algorithm

TL;DR

GreedyPixel is a novel black-box adversarial attack method that uses a greedy, pixel-wise optimization approach to generate highly precise, sparse, and imperceptible perturbations, achieving state-of-the-art success rates.

Contribution

It introduces a brute-force, per-pixel greedy optimization technique guided by a surrogate model, improving the precision and effectiveness of black-box attacks.

Findings

Achieved state-of-the-art success rates on CIFAR-10 and ImageNet.

Produced visually imperceptible, pixel-wise sparse perturbations.

Bridged the gap between black-box practicality and white-box performance.

Abstract

Deep neural networks are highly vulnerable to adversarial examples, which are inputs with small, carefully crafted perturbations that cause misclassification -- making adversarial attacks a critical tool for evaluating robustness. Existing black-box methods typically entail a trade-off between precision and flexibility: pixel-sparse attacks (e.g., single- or few-pixel attacks) provide fine-grained control but lack adaptability, whereas patch- or frequency-based attacks improve efficiency or transferability, but at the cost of producing larger and less precise perturbations. We present GreedyPixel, a fine-grained black-box attack method that performs brute-force-style, per-pixel greedy optimization guided by a surrogate-derived priority map and refined by means of query feedback. It evaluates each coordinate directly without any gradient information, guaranteeing monotonic loss reduction and convergence to a coordinate-wise optimum, while also yielding near white-box-level precision and pixel-wise sparsity and perceptual quality. On the CIFAR-10 and ImageNet datasets, spanning convolutional neural networks (CNNs) and Transformer models, GreedyPixel achieved state-of-the-art success rates with visually imperceptible perturbations, effectively bridging the gap between black-box practicality and white-box performance. The implementation is available at https://github.com/azrealwang/greedypixel.