{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/guessing-smart-biased-sampling-for-efficient","title":"Guessing Smart: Biased Sampling for Efficient Black-Box Adversarial Attacks","arxiv_id":"1812.09803","date":"2018-12-24","proceeding":"ICCV 2019 10","authors":["Thomas Brunner","Frederik Diehl","Michael Truong Le","Alois Knoll"],"abstract":"We consider adversarial examples for image classification in the black-box decision-based setting. Here, an attacker cannot access confidence scores, but only the final label. Most attacks for this scenario are either unreliable or inefficient. Focusing on the latter, we show that a specific class of attacks, Boundary Attacks, can be reinterpreted as a biased sampling framework that gains efficiency from domain knowledge. We identify three such biases, image frequency, regional masks and surrogate gradients, and evaluate their performance against an ImageNet classifier. We show that the combination of these biases outperforms the state of the art by a wide margin. We also showcase an efficient way to attack the Google Cloud Vision API, where we craft convincing perturbations with just a few hundred queries. Finally, the methods we propose have also been found to work very well against strong defenses: Our targeted attack won second place in the NeurIPS 2018 Adversarial Vision Challenge.","url_abs":"https://arxiv.org/abs/1812.09803v3","url_pdf":"https://arxiv.org/pdf/1812.09803v3.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"guessing-smart-biased-sampling-for-efficient","repo_url":"https://github.com/ttbrunner/biased_boundary_attack","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":1,"framework":"tf","reach":{"status":"ok","spdx":"MIT"}},{"paper_slug":"guessing-smart-biased-sampling-for-efficient","repo_url":"https://github.com/ttbrunner/biased_boundary_attack_avc","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":1,"framework":"tf","reach":{"status":"ok","spdx":"MIT"}},{"paper_slug":"guessing-smart-biased-sampling-for-efficient","repo_url":"https://github.com/MatveyMor/substitute_boundary_attack","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"pytorch","reach":null}],"tasks":[{"task_slug":"image-classification","task_name":"Image Classification"},{"task_slug":"image-classification","task_name":"image-classification"}],"methods":[],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"syntology_url":"https://syntology.ai/paper/1812.09803","atlas_url":"https://app.syntology.ai/?focus=1812.09803","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"1812.09803"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-25T09:33:49+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/MatveyMor/substitute_boundary_attack","reach":null},{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/ttbrunner/biased_boundary_attack_avc","reach":{"status":"ok","spdx":"MIT"}},{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/ttbrunner/biased_boundary_attack","reach":{"status":"ok","spdx":"MIT"}}],"summary":{"ran_fixture":1,"unverified":9},"by_repo_kind":{"official":{"samples":10,"ran":1,"repositories":2}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":0,"samples":[{"code_sha256_prefix":"5756d6bfbcce2dfc","entry":"fixed_padding","repo":"ttbrunner/biased_boundary_attack_avc","repo_kind":"official","path":"models/resnet18_baseline/resnet_model.py","file_url":"https://github.com/ttbrunner/biased_boundary_attack_avc/blob/HEAD/models/resnet18_baseline/resnet_model.py","link_basis":"harvester_set","language":"python","status":"ran_fixture","verification_level":1,"contract_check":"RAISES","metamorphic_tier":"invariant","behaviour_fingerprint":true,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"5756d6bfbcce2dfc"}},{"code_sha256_prefix":"f4fba27e3fd641f2","entry":"batch_norm","repo":"ttbrunner/biased_boundary_attack_avc","repo_kind":"official","path":"models/resnet18_baseline/resnet_model.py","file_url":"https://github.com/ttbrunner/biased_boundary_attack_avc/blob/HEAD/models/resnet18_baseline/resnet_model.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"f4fba27e3fd641f2"}},{"code_sha256_prefix":"c756a6986ed2d1b8","entry":"conv2d_fixed_padding","repo":"ttbrunner/biased_boundary_attack_avc","repo_kind":"official","path":"models/resnet18_baseline/resnet_model.py","file_url":"https://github.com/ttbrunner/biased_boundary_attack_avc/blob/HEAD/models/resnet18_baseline/resnet_model.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"c756a6986ed2d1b8"}},{"code_sha256_prefix":"fb5ea6b124795904","entry":"find_closest_img","repo":"ttbrunner/biased_boundary_attack","repo_kind":"official","path":"utils/util.py","file_url":"https://github.com/ttbrunner/biased_boundary_attack/blob/HEAD/utils/util.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"fb5ea6b124795904"}},{"code_sha256_prefix":"3ac662a79b2c646a","entry":"label_to_name","repo":"ttbrunner/biased_boundary_attack","repo_kind":"official","path":"utils/imagenet_labels.py","file_url":"https://github.com/ttbrunner/biased_boundary_attack/blob/HEAD/utils/imagenet_labels.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"3ac662a79b2c646a"}},{"code_sha256_prefix":"bb9fbab9e6ad0e45","entry":"line_search_to_boundary","repo":"ttbrunner/biased_boundary_attack","repo_kind":"official","path":"utils/util.py","file_url":"https://github.com/ttbrunner/biased_boundary_attack/blob/HEAD/utils/util.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"bb9fbab9e6ad0e45"}},{"code_sha256_prefix":"5808c5dd79a489ef","entry":"name_to_label","repo":"ttbrunner/biased_boundary_attack","repo_kind":"official","path":"utils/imagenet_labels.py","file_url":"https://github.com/ttbrunner/biased_boundary_attack/blob/HEAD/utils/imagenet_labels.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"5808c5dd79a489ef"}},{"code_sha256_prefix":"8d6535e1a0fbad04","entry":"refine_jitter","repo":"ttbrunner/biased_boundary_attack_avc","repo_kind":"official","path":"attacks/methods/refinement_tricks.py","file_url":"https://github.com/ttbrunner/biased_boundary_attack_avc/blob/HEAD/attacks/methods/refinement_tricks.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"8d6535e1a0fbad04"}},{"code_sha256_prefix":"284410a741ab221f","entry":"refine_pixels","repo":"ttbrunner/biased_boundary_attack_avc","repo_kind":"official","path":"attacks/methods/refinement_tricks.py","file_url":"https://github.com/ttbrunner/biased_boundary_attack_avc/blob/HEAD/attacks/methods/refinement_tricks.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"284410a741ab221f"}},{"code_sha256_prefix":"2facf483973d66d6","entry":"sample_hypersphere","repo":"ttbrunner/biased_boundary_attack","repo_kind":"official","path":"utils/util.py","file_url":"https://github.com/ttbrunner/biased_boundary_attack/blob/HEAD/utils/util.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"2facf483973d66d6"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}