text: 160,95,1201853727059132416,987061319378587649,Maksym Andriushchenko 🇺🇦,"Excited to share our new black-box attack based on simple *random search*! Despite its simplicity it outperforms the recent SOTA by several times in terms of query efficiency. There are some interesting ideas behind Paper: <LINK> Code: <LINK> 1/n <LINK> We use the simplest form of random search from 1960s. The only thing we modify is the sampling distribution. We select it in a way so that each iterate always stays at the boundary of the feasible set. This simple idea significantly improves query efficiency. 2/n <LINK> As a result, the Square Attack outperforms all existing methods by a large margin with a simple random search scheme. The attack achieves both best query efficiency (*2x - 7x better*, depending on the model) and success rate (also in the low-query regime) on ImageNet. 3/n <LINK> Square Attack is also useful for robustness evaluation of new defenses. There are cases (post-averaging, CLP, LSQ models) where it can significantly outperform even white-box PGD attack *with random restarts*. Thus, we recommend to use it to prevent false robustness claims. 4/n <LINK>",https://arxiv.org/abs/1912.00049,"We propose the Square Attack, a score-based black-box $l_2$- and $l_\infty$-adversarial attack that does not rely on local gradient information and thus is not affected by gradient masking. Square Attack is based on a randomized search scheme which selects localized square-shaped updates at random positions so that at each iteration the perturbation is situated approximately at the boundary of the feasible set. Our method is significantly more query efficient and achieves a higher success rate compared to the state-of-the-art methods, especially in the untargeted setting. In particular, on ImageNet we improve the average query efficiency in the untargeted setting for various deep networks by a factor of at least $1.8$ and up to $3$ compared to the recent state-of-the-art $l_\infty$-attack of Al-Dujaili & O'Reilly. Moreover, although our attack is black-box, it can also outperform gradient-based white-box attacks on the standard benchmarks achieving a new state-of-the-art in terms of the success rate. The code of our attack is available at this https URL ","Square Attack: a query-efficient black-box adversarial attack via random