We propose the Square Attack, a score-based black-box $l_2$- and
$l_\infty$-adversarial attack that does not rely on local gradient information
and thus is not affected by gradient masking. Square Attack is based on a
randomized search scheme which selects localized square-shaped updates at
random positions so that at each iteration the perturbation is situated
approximately at the boundary of the feasible set. Our method is significantly
more query efficient and achieves a higher success rate compared to the
state-of-the-art methods, especially in the untargeted setting. In particular,
on ImageNet we improve the average query efficiency in the untargeted setting
for various deep networks by a factor of at least $1.8$ and up to $3$ compared
to the recent state-of-the-art $l_\infty$-attack of Al-Dujaili & O'Reilly.
Moreover, although our attack is black-box, it can also outperform
gradient-based white-box attacks on the standard benchmarks achieving a new
state-of-the-art in terms of the success rate. The code of our attack is
available at this https URL

《Square Attack》提出了一种基于分数的黑盒 l2 和 l - 无穷攻击，该攻击不依赖于局部梯度信息，因此不受梯度掩盖影响。Square Attack 基于随机搜索方案，它选择位于随机位置的局部方形更新，以便在每次迭代中扰动约在可行集的边界处。我们的方法在查询效率方面显着提高了攻击成功率，特别是在非针对性环境下，在 ImageNet 上，相对于 Al-Dujaili＆O'Reilly 最近的高阶 L - 无穷攻击，我们提高了各种深度网络的非针对性设置的平均查询效率，至少提高了 1.8 倍，最多提高了 3 倍。此外，虽然我们的攻击是黑盒的，但它在标准基准测试中也可以胜过基于梯度的白盒攻击，取得了新的成功率创纪录。