{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/progressive-scale-boundary-blackbox-attack","title":"Progressive-Scale Boundary Blackbox Attack via Projective Gradient Estimation","arxiv_id":"2106.06056","date":"2021-06-10","proceeding":null,"authors":["Jiawei Zhang","Linyi Li","Huichen Li","Xiaolu Zhang","Shuang Yang","Bo Li"],"abstract":"Boundary based blackbox attack has been recognized as practical and effective, given that an attacker only needs to access the final model prediction. However, the query efficiency of it is in general high especially for high dimensional image data. In this paper, we show that such efficiency highly depends on the scale at which the attack is applied, and attacking at the optimal scale significantly improves the efficiency. In particular, we propose a theoretical framework to analyze and show three key characteristics to improve the query efficiency. We prove that there exists an optimal scale for projective gradient estimation. Our framework also explains the satisfactory performance achieved by existing boundary black-box attacks. Based on our theoretical framework, we propose Progressive-Scale enabled projective Boundary Attack (PSBA) to improve the query efficiency via progressive scaling techniques. In particular, we employ Progressive-GAN to optimize the scale of projections, which we call PSBA-PGAN. We evaluate our approach on both spatial and frequency scales. Extensive experiments on MNIST, CIFAR-10, CelebA, and ImageNet against different models including a real-world face recognition API show that PSBA-PGAN significantly outperforms existing baseline attacks in terms of query efficiency and attack success rate. We also observe relatively stable optimal scales for different models and datasets. The code is publicly available at https://github.com/AI-secure/PSBA.","url_abs":"https://arxiv.org/abs/2106.06056v1","url_pdf":"https://arxiv.org/pdf/2106.06056v1.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"progressive-scale-boundary-blackbox-attack","repo_url":"https://github.com/AI-secure/PSBA","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":1,"framework":"pytorch","reach":null}],"tasks":[{"task_slug":"face-recognition","task_name":"Face Recognition"}],"methods":[],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"atlas_url":"https://app.syntology.ai/?focus=2106.06056","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2106.06056"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-24T18:15:14+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/AI-secure/PSBA","reach":null}],"summary":{"ran_honours":4,"ran_fixture":3,"ran_draft_wrong":1,"unverified":1},"by_repo_kind":{"official":{"samples":9,"ran":8,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":9,"samples":[{"code_sha256_prefix":"b3373b027f45777c","entry":"MSE","repo":"ai-secure/psba","repo_kind":"official","path":"src/main_pytorch_multi.py","file_url":"https://github.com/ai-secure/psba/blob/HEAD/src/main_pytorch_multi.py","link_basis":"first_harvest_node","language":"python","status":"ran_honours","verification_level":2,"contract_check":"HONOURS","metamorphic_tier":"invariant","behaviour_fingerprint":true,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"b3373b027f45777c"}},{"code_sha256_prefix":"32d626ea74126c1a","entry":"RGB_img_dct","repo":"AI-secure/PSBA","repo_kind":"official","path":"src/models/pgan_generator.py","file_url":"https://github.com/AI-secure/PSBA/blob/HEAD/src/models/pgan_generator.py","link_basis":"first_harvest_node","language":"python","status":"ran_fixture","verification_level":1,"contract_check":"RAISES","metamorphic_tier":null,"behaviour_fingerprint":true,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"32d626ea74126c1a"}},{"code_sha256_prefix":"cb8239520dd90350","entry":"RGB_signal_idct","repo":"AI-secure/PSBA","repo_kind":"official","path":"src/models/pgan_generator.py","file_url":"https://github.com/AI-secure/PSBA/blob/HEAD/src/models/pgan_generator.py","link_basis":"first_harvest_node","language":"python","status":"ran_fixture","verification_level":1,"contract_check":"RAISES","metamorphic_tier":null,"behaviour_fingerprint":true,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"cb8239520dd90350"}},{"code_sha256_prefix":"e74d4df2f9edad00","entry":"Upscale2d","repo":"AI-secure/PSBA","repo_kind":"official","path":"src/models/pgan_generator.py","file_url":"https://github.com/AI-secure/PSBA/blob/HEAD/src/models/pgan_generator.py","link_basis":"first_harvest_node","language":"python","status":"ran_fixture","verification_level":1,"contract_check":"RAISES","metamorphic_tier":null,"behaviour_fingerprint":true,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"e74d4df2f9edad00"}},{"code_sha256_prefix":"57608d126fb352b7","entry":"get_2d_dct","repo":"AI-secure/PSBA","repo_kind":"official","path":"src/models/pgan_generator.py","file_url":"https://github.com/AI-secure/PSBA/blob/HEAD/src/models/pgan_generator.py","link_basis":"first_harvest_node","language":"python","status":"ran_honours","verification_level":1,"contract_check":"HONOURS","metamorphic_tier":null,"behaviour_fingerprint":true,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"57608d126fb352b7"}},{"code_sha256_prefix":"32a3197e287f430f","entry":"get_2d_idct","repo":"AI-secure/PSBA","repo_kind":"official","path":"src/models/pgan_generator.py","file_url":"https://github.com/AI-secure/PSBA/blob/HEAD/src/models/pgan_generator.py","link_basis":"first_harvest_node","language":"python","status":"ran_honours","verification_level":1,"contract_check":"HONOURS","metamorphic_tier":null,"behaviour_fingerprint":true,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"32a3197e287f430f"}},{"code_sha256_prefix":"5f2019cf9c5ca9eb","entry":"load_img","repo":"ai-secure/psba","repo_kind":"official","path":"src/main_api_attack.py","file_url":"https://github.com/ai-secure/psba/blob/HEAD/src/main_api_attack.py","link_basis":"first_harvest_node","language":"python","status":"ran_honours","verification_level":1,"contract_check":"HONOURS","metamorphic_tier":"well_formed","behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"5f2019cf9c5ca9eb"}},{"code_sha256_prefix":"f9e64946b23edb51","entry":"num_flat_features","repo":"AI-secure/PSBA","repo_kind":"official","path":"src/models/pgan_generator.py","file_url":"https://github.com/AI-secure/PSBA/blob/HEAD/src/models/pgan_generator.py","link_basis":"first_harvest_node","language":"python","status":"ran_draft_wrong","verification_level":1,"contract_check":"MISDECLARED","metamorphic_tier":null,"behaviour_fingerprint":true,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"f9e64946b23edb51"}},{"code_sha256_prefix":"4f33a0750fbf46a9","entry":"PGenerator","repo":"AI-secure/PSBA","repo_kind":"official","path":"src/models/pgan_generator.py","file_url":"https://github.com/AI-secure/PSBA/blob/HEAD/src/models/pgan_generator.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"4f33a0750fbf46a9"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}