Latent Geometric Chords for Query-Efficient Decision-Based Adversarial Attacks
This work improves the effectiveness and visual quality of decision-based adversarial attacks, posing a greater security threat to machine learning models, especially for those relying on image classification.
The paper addresses limitations in decision-based black-box adversarial attacks, specifically unnatural visual artifacts from pixel-wise attacks and limited search space/reconstruction flaws in latent-space frameworks. The proposed Latent Geometric Chords (LGC) method achieves state-of-the-art visual fidelity (SSIM > 0.99, LPIPS < 0.01 at 5000 queries) with minimal perturbation magnitudes and high attack success rates, even against robust models.
While decision-based black-box adversarial attacks present a severe security threat, current methodologies suffer from fundamental limitations. Pixel-wise attacks frequently introduce unnatural, high-frequency visual artifacts, while latent-space frameworks are confined by the limited search space of low-dimensional manifolds and inherent reconstruction flaws. To resolve these limitations, we propose Latent Geometric Chords (LGC) for Query-Efficient Decision-Based Adversarial Attacks alongside a variant, LGC-H. At its core, LGC navigates decision boundaries by executing a curvature-aware geometric search within a compressed semantic manifold. To guarantee high visual fidelity and circumvent dimensionality bottlenecks, we introduce a Residual-based Adversarial Generation (RAG) mechanism. RAG isolates semantic perturbations as geometric chords and superimposes them directly onto the original source image. RAG substantially resolves baseline reconstruction flaws and effectively doubles the permissible search space dimensions. Experimental results demonstrate that LGC achieves robust cross-dataset transferability and substantially outperforms state-of-the-art baselines. Notably, our method, LGC, minimizes perturbation magnitudes while achieving state-of-the-art visual fidelity--with a Structural Similarity Index Measure (SSIM) exceeding 0.99 and a Learned Perceptual Image Patch Similarity (LPIPS) below 0.01 at 5000 queries--and sustaining high attack success rates under stringent perceptual constraints, successfully compromising adversarially trained robust models. The source code is available at: https://github.com/eihmuekhine/Latent-Geometric-Chords.