Decision-based Black-box Attack Against Vision Transformers via Patch-wise Adversarial Removal
Authors: Yucheng Shi, Yahong Han, Yu-an Tan, Xiaohui Kuang
NeurIPS 2022 | Conference PDF | Archive PDF | Plain Text | LLM Run Details
| Reproducibility Variable | Result | LLM Response |
|---|---|---|
| Research Type | Experimental | Extensive experiments on three datasets demonstrate that PAR achieves a much lower noise magnitude with the same number of queries. |
| Researcher Affiliation | Academia | Yucheng Shi, Yahong Han College of Intelligence and Computing, and Tianjin Key Lab of Machine Learning Tianjin University, Tianjin, China Engineering Research Center of City Intelligence and Digital Governance Ministry of Education of the People s Republic of China {yucheng, yahong}@tju.edu.cn Yu-an Tan School of Cyberspace Science and Technology Beijing Institute of Technology, Beijing, China tan2008@bit.edu.cn Xiaohui Kuang National Key Laboratory of Science and Technology on Information System Security, Beijing, China xiaohui_kuang@163.com |
| Pseudocode | Yes | Algorithm 1 Patch-wise Adversarial Removal |
| Open Source Code | No | The paper's main text does not contain a specific URL for the source code or an explicit statement indicating its public release or inclusion in supplementary materials. |
| Open Datasets | Yes | We conduct experiments on three image classification datasets: Image Net-21k [26], ILSVRC-2012 [27], and Tiny-Imagenet [28]. |
| Dataset Splits | No | We pick 10000 images from the validation sets of Image Net-21k and ILSVRC-2012 that can be correctly classified by all target models for test. As for Tiny-Imagenet with 200 image categories, we choose 2000 images, 10 images for each category. |
| Hardware Specification | Yes | 4 RTX 3090 GPU cards are used for calculation. |
| Software Dependencies | No | The paper mentions "Pytorch image models" with a GitHub link, but does not provide specific version numbers for PyTorch or other software dependencies used in the experiments. |
| Experiment Setup | Yes | Stepsizes of spherical direction and source direction are δ0 = 0.1, ε0 = 0.003 for Boundary, BBA, Evo and CAB. Noise magnitude limit τ = [0, 255]. The initial and minimum patch size for Image Net-21k and ILSVRC-2012 is set to 56 and 7, respectively. For Tiny-Imagenet, we set the initial and minimum patch size as 16 and 2, respectively. |