Boosting Ray Search Procedure of Hard-label Attacks with Transfer-based Priors

2025-07-23

AI Summary

To address the low query efficiency of ray-search-based black-box attacks under hard-label constraints, this paper proposes a prior-guided ray optimization framework. The method leverages a surrogate model to generate transferable priors, which are fused with random search directions to construct a direction-aware gradient estimator; theoretical analysis proves that such priors enhance the gradient direction projection gain, significantly improving estimation accuracy. Furthermore, a sign-assisted binary search strategy is integrated to transform discrete label queries into efficient continuous optimization. Evaluated on ImageNet and CIFAR-10 against 11 state-of-the-art baselines, the approach reduces average query counts by 52% and accelerates convergence by 2.3×. It is the first method to achieve high-precision, adaptive ray-direction optimization under hard-label constraints while effectively incorporating prior knowledge.

Technology Category

• Search and Optimization: Learning to Search
• Computer Vision: Adversarial Attacks & Robustness
• Constraint Satisfaction and Optimization: Search

Application Category

• Search and Retrieval-Augmented AI: Web learning to rank, online learning, and counterfactual learning for ranking
• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems
• Graph Algorithms and Modeling for the Web: Querying, indexing, and retrieval in Web-related graphs

Abstract

One of the most practical and challenging types of black-box adversarial attacks is the hard-label attack, where only the top-1 predicted label is available. One effective approach is to search for the optimal ray direction from the benign image that minimizes the $ell_p$-norm distance to the adversarial region. The unique advantage of this approach is that it transforms the hard-label attack into a continuous optimization problem. The objective function value is the ray's radius, which can be obtained via binary search at a high query cost. Existing methods use a "sign trick" in gradient estimation to reduce the number of queries. In this paper, we theoretically analyze the quality of this gradient estimation and propose a novel prior-guided approach to improve ray search efficiency both theoretically and empirically. Specifically, we utilize the transfer-based priors from surrogate models, and our gradient estimators appropriately integrate them by approximating the projection of the true gradient onto the subspace spanned by these priors and random directions, in a query-efficient manner. We theoretically derive the expected cosine similarities between the obtained gradient estimators and the true gradient, and demonstrate the improvement achieved by incorporating priors. Extensive experiments on the ImageNet and CIFAR-10 datasets show that our approach significantly outperforms 11 state-of-the-art methods in terms of query efficiency.

Problem

• Improving hard-label attack efficiency with transfer-based priors
• Reducing query cost in adversarial ray search optimization
• Enhancing gradient estimation quality using surrogate model priors

Innovation

• Transfer-based priors enhance ray search efficiency
• Gradient estimators integrate surrogate model priors
• Query-efficient binary search optimizes adversarial attacks