text: 450,46,1276250079356170240,1133088397273313282,francesco croce,"Check out our new paper on sparse black-box perturbations! New SOTA in query efficiency and success rate. For L0 attacks, changing *only 0.1% pixels* is sufficient to break the models. @maksym_andr  Paper: <LINK> Code: <LINK> (1/n) <LINK> Sparse perturbations are challenging for gradient-based methods because of the combinatorial constraints. To tackle this problem, we propose a flexible framework based on random search that naturally handles complicated constraints and leads to query-efficient attacks. (2/n) <LINK> Our framework leads to the first black-box patch and frame attacks that don’t rely on extra knowledge such as a surrogate model. Having access to a surrogate model is a very strong assumption and it can be very expensive to obtain. (3/n) <LINK> Moreover, although transfer attacks rely on surrogate models, they in general *do not perform well* and patches/frames are no exceptions. Sparse-RS outperforms transfer attacks (Tr-PGD) by a large margin in terms of the success rate. (4/n) <LINK> The resulting adversarial patches are very different from the patches found with white-box PGD and some of them are quite interpretable (see the patch for class Peacock). (5/n) <LINK> We show the versatility of Sparse-RS framework by generating both image-specific and universal patches/frames + L0 perturbations for images and malware. Sparse-RS outperforms other methods on all these threat models including **white-box** L0-PGD attack, see PGD_0 (wb). (6/n) <LINK> Takeaway message: don’t spend queries on estimating the gradient, do random search with a properly chosen sampling distribution! More details are in the paper: <LINK> (7/n)",https://arxiv.org/abs/2006.12834,"We propose a versatile framework based on random search, Sparse-RS, for score-based sparse targeted and untargeted attacks in the black-box setting. Sparse-RS does not rely on substitute models and achieves state-of-the-art success rate and query efficiency for multiple sparse attack models: $l_0$-bounded perturbations, adversarial patches, and adversarial frames. The $l_0$-version of untargeted Sparse-RS outperforms all black-box and even all white-box attacks for different models on MNIST, CIFAR-10, and ImageNet. Moreover, our untargeted Sparse-RS achieves very high success rates even for the challenging settings of $20\times20$ adversarial patches and $2$-pixel wide adversarial frames for $224\times224$ images. Finally, we show that Sparse-RS can be applied to generate targeted universal adversarial patches where it significantly outperforms the existing approaches. The code of our framework is available at this https URL ","Sparse-RS: a versatile framework for query-efficient sparse black-box