{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/decision-based-adversarial-attacks-reliable","title":"Decision-Based Adversarial Attacks: Reliable Attacks Against Black-Box Machine Learning Models","arxiv_id":"1712.04248","date":"2017-12-12","proceeding":"ICLR 2018 1","authors":["Wieland Brendel","Jonas Rauber","Matthias Bethge"],"abstract":"Many machine learning algorithms are vulnerable to almost imperceptible\nperturbations of their inputs. So far it was unclear how much risk adversarial\nperturbations carry for the safety of real-world machine learning applications\nbecause most methods used to generate such perturbations rely either on\ndetailed model information (gradient-based attacks) or on confidence scores\nsuch as class probabilities (score-based attacks), neither of which are\navailable in most real-world scenarios. In many such cases one currently needs\nto retreat to transfer-based attacks which rely on cumbersome substitute\nmodels, need access to the training data and can be defended against. Here we\nemphasise the importance of attacks which solely rely on the final model\ndecision. Such decision-based attacks are (1) applicable to real-world\nblack-box models such as autonomous cars, (2) need less knowledge and are\neasier to apply than transfer-based attacks and (3) are more robust to simple\ndefences than gradient- or score-based attacks. Previous attacks in this\ncategory were limited to simple models or simple datasets. Here we introduce\nthe Boundary Attack, a decision-based attack that starts from a large\nadversarial perturbation and then seeks to reduce the perturbation while\nstaying adversarial. The attack is conceptually simple, requires close to no\nhyperparameter tuning, does not rely on substitute models and is competitive\nwith the best gradient-based attacks in standard computer vision tasks like\nImageNet. We apply the attack on two black-box algorithms from Clarifai.com.\nThe Boundary Attack in particular and the class of decision-based attacks in\ngeneral open new avenues to study the robustness of machine learning models and\nraise new questions regarding the safety of deployed machine learning systems.\nAn implementation of the attack is available as part of Foolbox at\nhttps://github.com/bethgelab/foolbox .","url_abs":"http://arxiv.org/abs/1712.04248v2","url_pdf":"http://arxiv.org/pdf/1712.04248v2.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"decision-based-adversarial-attacks-reliable","repo_url":"https://github.com/bethgelab/foolbox","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":0,"framework":"tf","reach":{"status":"ok","spdx":"MIT"}},{"paper_slug":"decision-based-adversarial-attacks-reliable","repo_url":"https://github.com/Cold-Winter/boundary_attack_foolbox","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"tf","reach":null},{"paper_slug":"decision-based-adversarial-attacks-reliable","repo_url":"https://github.com/MatveyMor/substitute_boundary_attack","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"pytorch","reach":null},{"paper_slug":"decision-based-adversarial-attacks-reliable","repo_url":"https://github.com/ermongroup/ODI","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"pytorch","reach":{"status":"ok"}},{"paper_slug":"decision-based-adversarial-attacks-reliable","repo_url":"https://github.com/ermongroup/ODS","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"pytorch","reach":null},{"paper_slug":"decision-based-adversarial-attacks-reliable","repo_url":"https://github.com/greentfrapp/boundary-attack","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"tf","reach":null}],"tasks":[{"task_slug":"machine-learning","task_name":"BIG-bench Machine Learning"}],"methods":[],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"atlas_url":"https://app.syntology.ai/?focus=1712.04248","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"1712.04248"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-24T18:15:14+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/bethgelab/foolbox","reach":{"status":"ok","spdx":"MIT"}},{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/MatveyMor/substitute_boundary_attack","reach":null},{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/ermongroup/ODS","reach":null},{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/ermongroup/ODI","reach":{"status":"ok"}},{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/Cold-Winter/boundary_attack_foolbox","reach":null},{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/greentfrapp/boundary-attack","reach":null}],"summary":{"ran_honours":1,"ran_fixture":2,"ran_draft_wrong":2,"unverified":1},"by_repo_kind":{"listed":{"samples":6,"ran":5,"repositories":3}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":6,"samples":[{"code_sha256_prefix":"229d236b9d27bf01","entry":"forward_perturbation","repo":"greentfrapp/boundary-attack","repo_kind":"listed","path":"boundary-attack-resnet.py","file_url":"https://github.com/greentfrapp/boundary-attack/blob/HEAD/boundary-attack-resnet.py","link_basis":"first_harvest_node","language":"python","status":"ran_honours","verification_level":1,"contract_check":"HONOURS","metamorphic_tier":"invariant","behaviour_fingerprint":true,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"229d236b9d27bf01"}},{"code_sha256_prefix":"5b5f785614979554","entry":"orthogonal_perturbation","repo":"Cold-Winter/boundary_attack_foolbox","repo_kind":"listed","path":"boundary-attack-resnet.py","file_url":"https://github.com/Cold-Winter/boundary_attack_foolbox/blob/HEAD/boundary-attack-resnet.py","link_basis":"first_harvest_node","language":"python","status":"ran_fixture","verification_level":1,"contract_check":"RAISES","metamorphic_tier":"invariant","behaviour_fingerprint":true,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"5b5f785614979554"}},{"code_sha256_prefix":"8b7605e7fe260fc9","entry":"orthogonal_perturbation","repo":"greentfrapp/boundary-attack","repo_kind":"listed","path":"boundary-attack-resnet.py","file_url":"https://github.com/greentfrapp/boundary-attack/blob/HEAD/boundary-attack-resnet.py","link_basis":"first_harvest_node","language":"python","status":"ran_fixture","verification_level":1,"contract_check":"RAISES","metamorphic_tier":"invariant","behaviour_fingerprint":true,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"8b7605e7fe260fc9"}},{"code_sha256_prefix":"596161374b2d3344","entry":"train","repo":"MatveyMor/substitute_boundary_attack","repo_kind":"listed","path":"attacks/boundary_attack.py","file_url":"https://github.com/MatveyMor/substitute_boundary_attack/blob/HEAD/attacks/boundary_attack.py","link_basis":"first_harvest_node","language":"python","status":"ran_draft_wrong","verification_level":1,"contract_check":"MISDECLARED","metamorphic_tier":"deterministic","behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"596161374b2d3344"}},{"code_sha256_prefix":"bd789455b0e05d14","entry":"train_epoch","repo":"MatveyMor/substitute_boundary_attack","repo_kind":"listed","path":"attacks/boundary_attack.py","file_url":"https://github.com/MatveyMor/substitute_boundary_attack/blob/HEAD/attacks/boundary_attack.py","link_basis":"first_harvest_node","language":"python","status":"ran_draft_wrong","verification_level":1,"contract_check":"MISDECLARED","metamorphic_tier":"deterministic","behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"bd789455b0e05d14"}},{"code_sha256_prefix":"3b1a7afc57b2cf5e","entry":"forward_perturbation","repo":"Cold-Winter/boundary_attack_foolbox","repo_kind":"listed","path":"boundary-attack-resnet.py","file_url":"https://github.com/Cold-Winter/boundary_attack_foolbox/blob/HEAD/boundary-attack-resnet.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"3b1a7afc57b2cf5e"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}