Low-Rank Adaptation (LoRA) for adversarial perturbations

The researchers show theoretically and experimentally that adversarial perturbations have an intrinsic low-rank structure, and on this basis propose a more efficient black-box adversarial attack method. The paper validates the method across multiple attack methods, model architectures and datasets. The method has two steps: first, with the help of a reference model and auxiliary data, gradients are projected into a low-dimensional subspace; then the perturbation search of the black-box attack is restricted to this subspace, to alleviate the problem of excessive query overhead in black-box attacks. Evaluations across multiple attack methods, baseline models, datasets and threat models show that low-rank adversarial attacks achieve significant and consistent improvements over traditional methods.