Improving the Convergence Rate of Ray Search Optimization for Query-Efficient Hard-Label Attacks

TL;DR

The paper addresses the challenge of query-intensive hard-label black-box attacks by introducing ARS-OPT, a momentum-based Accelerated Random Search method that uses a lookahead direction to accelerate optimization in the top-1 feedback setting. Building on this, PARS-OPT incorporates surrogate-model priors to further refine gradient estimates, achieving a provable $\mathcal{O}(1/T^2)$ convergence rate under standard smoothness/convexity assumptions. Empirical evaluation on ImageNet, CIFAR-10, and CLIP demonstrates that ARS-OPT and PARS-OPT surpass 13 state-of-the-art baselines in both untargeted and targeted scenarios, with superior query efficiency and robustness to defenses. Together, the methods offer a principled, scalable approach to vulnerability assessment and defense evaluation under realistic hard-label feedback constraints.

Abstract

In hard-label black-box adversarial attacks, where only the top-1 predicted label is accessible, the prohibitive query complexity poses a major obstacle to practical deployment. In this paper, we focus on optimizing a representative class of attacks that search for the optimal ray direction yielding the minimum $\ell_2$-norm perturbation required to move a benign image into the adversarial region. Inspired by Nesterov's Accelerated Gradient (NAG), we propose a momentum-based algorithm, ARS-OPT, which proactively estimates the gradient with respect to a future ray direction inferred from accumulated momentum. We provide a theoretical analysis of its convergence behavior, showing that ARS-OPT enables more accurate directional updates and achieves faster, more stable optimization. To further accelerate convergence, we incorporate surrogate-model priors into ARS-OPT's gradient estimation, resulting in PARS-OPT with enhanced performance. The superiority of our approach is supported by theoretical guarantees under standard assumptions. Extensive experiments on ImageNet and CIFAR-10 demonstrate that our method surpasses 13 state-of-the-art approaches in query efficiency.

Figures (4)

• Figure 1: Illustration of a three-step update: first, compute the perturbation direction $\tilde{\theta}_t = (1-\alpha_t)\theta_t + \alpha_t m_t$; then estimate gradients at $\tilde{\theta}_t$ using a biased $g_1(\tilde{\theta}_t)$ and an unbiased $g_2(\tilde{\theta}_t)$; finally, update $\theta_{t+1}$ and $m_{t+1}$ via a gradient descent step.
• Figure 2: Illustration of one iteration in PARS-OPT. We first form a lookahead point $\tilde{\theta}_t$ by linearly interpolating between the current direction $\theta_t$ and the momentum term $m_t$ (with $m_0 = \theta_0$). Next, we estimate $\mathbf{v}_t$ via a sign-based procedure over a set of randomly sampled orthonormal basis vectors. Finally, we use $\mathbf{v}_t$ to compute the biased gradient estimate $g_1(\tilde{\theta}_t)$ and the unbiased estimate $g_2(\tilde{\theta}_t)$, which are then used to update $\theta_t$ and $m_t$, yielding $\theta_{t+1}$ and $m_{t+1}$ for the next iteration.
• Figure 3: Mean distortions and attack success rates of untargeted attacks with $\ell_2$ norm constraint against defense models. The surrogate model of PARS-OPT and Prior-OPT is the adversarially trained ResNet-50 model (PGD, $\epsilon_{\ell_\infty}=4/255$).
• Figure 4: Experimental results of ablation studies.

Theorems & Definitions (2)

• Theorem 4.1
• Theorem 4.2