{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/preprocessors-matter-realistic-decision-based","title":"Preprocessors Matter! Realistic Decision-Based Attacks on Machine Learning Systems","arxiv_id":"2210.03297","date":"2022-10-07","proceeding":null,"authors":["Chawin Sitawarin","Florian Tramèr","Nicholas Carlini"],"abstract":"Decision-based attacks construct adversarial examples against a machine learning (ML) model by making only hard-label queries. These attacks have mainly been applied directly to standalone neural networks. However, in practice, ML models are just one component of a larger learning system. We find that by adding a single preprocessor in front of a classifier, state-of-the-art query-based attacks are up to 7$\\times$ less effective at attacking a prediction pipeline than at attacking the model alone. We explain this discrepancy by the fact that most preprocessors introduce some notion of invariance to the input space. Hence, attacks that are unaware of this invariance inevitably waste a large number of queries to re-discover or overcome it. We, therefore, develop techniques to (i) reverse-engineer the preprocessor and then (ii) use this extracted information to attack the end-to-end system. Our preprocessors extraction method requires only a few hundred queries, and our preprocessor-aware attacks recover the same efficacy as when attacking the model alone. The code can be found at https://github.com/google-research/preprocessor-aware-black-box-attack.","url_abs":"https://arxiv.org/abs/2210.03297v2","url_pdf":"https://arxiv.org/pdf/2210.03297v2.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"preprocessors-matter-realistic-decision-based","repo_url":"https://github.com/google-research/preprocessor-aware-black-box-attack","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":0,"framework":"pytorch","reach":null}],"tasks":[],"methods":[],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"atlas_url":"https://app.syntology.ai/?focus=2210.03297","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2210.03297"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-24T18:15:14+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/google-research/preprocessor-aware-black-box-attack","reach":null}],"summary":{"ran":2,"ran_fixture":1,"unverified":3},"by_repo_kind":{"official":{"samples":6,"ran":3,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":0,"samples":[{"code_sha256_prefix":"6a9bb728e1e68bb8","entry":"PytorchModel","repo":"google-research/preprocessor-aware-black-box-attack","repo_kind":"official","path":"attack_prep/attack/opt.py","file_url":"https://github.com/google-research/preprocessor-aware-black-box-attack/blob/HEAD/attack_prep/attack/opt.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":true,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"6a9bb728e1e68bb8"}},{"code_sha256_prefix":"8399509cbd9bd67c","entry":"fine_grained_binary_search","repo":"google-research/preprocessor-aware-black-box-attack","repo_kind":"official","path":"attack_prep/attack/opt.py","file_url":"https://github.com/google-research/preprocessor-aware-black-box-attack/blob/HEAD/attack_prep/attack/opt.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"8399509cbd9bd67c"}},{"code_sha256_prefix":"667b1399bf0e16ad","entry":"normalize","repo":"google-research/preprocessor-aware-black-box-attack","repo_kind":"official","path":"attack_prep/attack/opt.py","file_url":"https://github.com/google-research/preprocessor-aware-black-box-attack/blob/HEAD/attack_prep/attack/opt.py","link_basis":"first_harvest_node","language":"python","status":"ran_fixture","verification_level":1,"contract_check":"RAISES","metamorphic_tier":null,"behaviour_fingerprint":true,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"667b1399bf0e16ad"}},{"code_sha256_prefix":"d9d87c3e7fb8c45f","entry":"Attack","repo":"google-research/preprocessor-aware-black-box-attack","repo_kind":"official","path":"attack_prep/attack/opt.py","file_url":"https://github.com/google-research/preprocessor-aware-black-box-attack/blob/HEAD/attack_prep/attack/opt.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"d9d87c3e7fb8c45f"}},{"code_sha256_prefix":"12293d4864d30be8","entry":"OptAttack","repo":"google-research/preprocessor-aware-black-box-attack","repo_kind":"official","path":"attack_prep/attack/opt.py","file_url":"https://github.com/google-research/preprocessor-aware-black-box-attack/blob/HEAD/attack_prep/attack/opt.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"12293d4864d30be8"}},{"code_sha256_prefix":"f6b866392a8aa1ce","entry":"fine_grained_binary_search_local","repo":"google-research/preprocessor-aware-black-box-attack","repo_kind":"official","path":"attack_prep/attack/opt.py","file_url":"https://github.com/google-research/preprocessor-aware-black-box-attack/blob/HEAD/attack_prep/attack/opt.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"f6b866392a8aa1ce"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}