BASES: A black-box adversarial attack method based on surrogate model ensemble search

The authors propose BASES, a black-box adversarial attack method that searches the loss weights of an ensemble of surrogate models to achieve high-success-rate attacks with very few queries. The method first defines a perturbation generator that minimizes a weighted loss over a fixed set of surrogate models, then searches the loss weights via queries; because the search space dimension equals the number of surrogate models, few queries are required. On multiple image classifiers trained on ImageNet, the method achieves higher success rates with at least 30 times fewer queries than state-of-the-art methods; targeted attacks exceed 90% success rate with as few as 3 queries per image on average, and untargeted attacks exceed 99% success rate with 1-2 queries per image. On the Google Cloud Vision API, the method achieves a 91% untargeted attack success rate with 2.9 queries per image. The authors also state that the generated perturbations have high transferability, can be used for hard-label black-box attacks, and demonstrate the effectiveness of BASES in attacks on hidden object detectors.