text:   adversarial attacks",7,"['Check out our new paper on sparse black-box perturbations! New SOTA in query efficiency and success rate. For L0 attacks, changing *only 0.1% pixels* is sufficient to break the models. @maksym_andr \n\nPaper: <LINK>\nCode: <LINK>\n(1/n) <LINK>', 'Sparse perturbations are challenging for gradient-based methods because of the combinatorial constraints. To tackle this problem, we propose a flexible framework based on random search that naturally handles complicated constraints and leads to query-efficient attacks.\n(2/n) https://t.co/1bjL34J7uJ', 'Our framework leads to the first black-box patch and frame attacks that don’t rely on extra knowledge such as a surrogate model. Having access to a surrogate model is a very strong assumption and it can be very expensive to obtain.\n(3/n) https://t.co/xUDwvkXzpM', 'Moreover, although transfer attacks rely on surrogate models, they in general *do not perform well* and patches/frames are no exceptions. Sparse-RS outperforms transfer attacks (Tr-PGD) by a large margin in terms of the success rate.\n(4/n) https://t.co/z4Ijtk6mcM', 'The resulting adversarial patches are very different from the patches found with white-box PGD and some of them are quite interpretable (see the patch for class Peacock).\n(5/n) https://t.co/mWatfd4Ybc', 'We show the versatility of Sparse-RS framework by generating both image-specific and universal patches/frames + L0 perturbations for images and malware.  Sparse-RS outperforms other methods on all these threat models including **white-box** L0-PGD attack, see PGD_0 (wb).\n(6/n) https://t.co/X5bFdrWbT6', 'Takeaway message: don’t spend queries on estimating the gradient, do random search with a properly chosen sampling distribution! \nMore details are in the paper: https://t.co/8MvRlRrdr7\n(7/n)']",20,06,1654