SimBA: Simple Black-box Adversarial Attacks · SimBA: Simple Black-box Adversarial Attacks Chuan...

11

Transcript of SimBA: Simple Black-box Adversarial Attacks · SimBA: Simple Black-box Adversarial Attacks Chuan...

Page 1: SimBA: Simple Black-box Adversarial Attacks · SimBA: Simple Black-box Adversarial Attacks Chuan Guo, Jacob R. Gardner, Yurong You, Andrew Gordon Wilson, Kilian Q. Weinberger. Adversarial

June 12, 2019

SimBA: Simple Black-box Adversarial AttacksChuan Guo, Jacob R. Gardner, Yurong You, Andrew Gordon Wilson, Kilian Q. Weinberger

Page 2: SimBA: Simple Black-box Adversarial Attacks · SimBA: Simple Black-box Adversarial Attacks Chuan Guo, Jacob R. Gardner, Yurong You, Andrew Gordon Wilson, Kilian Q. Weinberger. Adversarial

Adversarial Perturbation

✤ Small (imperceptible) change in input that alters model decision

✤ Security implications for critical applications

97.75% Eel 99.99% Goldfish

+<latexit sha1_base64="aWOcHJrcbrsxJSLO3n80z068CGE=">AAAB6HicbVBNS8NAEJ3Ur1q/qh69LBZBEEoigh6LXjy2YD+gDWWznbRrN5uwuxFK6C/w4kERr/4kb/4bt20O2vpg4PHeDDPzgkRwbVz32ymsrW9sbhW3Szu7e/sH5cOjlo5TxbDJYhGrTkA1Ci6xabgR2EkU0igQ2A7GdzO//YRK81g+mEmCfkSHkoecUWOlxkW/XHGr7hxklXg5qUCOer/81RvELI1QGiao1l3PTYyfUWU4Ezgt9VKNCWVjOsSupZJGqP1sfuiUnFllQMJY2ZKGzNXfExmNtJ5Ege2MqBnpZW8m/ud1UxPe+BmXSWpQssWiMBXExGT2NRlwhcyIiSWUKW5vJWxEFWXGZlOyIXjLL6+S1mXVc6te46pSu83jKMIJnMI5eHANNbiHOjSBAcIzvMKb8+i8OO/Ox6K14OQzx/AHzucPcYWMrw==</latexit><latexit sha1_base64="aWOcHJrcbrsxJSLO3n80z068CGE=">AAAB6HicbVBNS8NAEJ3Ur1q/qh69LBZBEEoigh6LXjy2YD+gDWWznbRrN5uwuxFK6C/w4kERr/4kb/4bt20O2vpg4PHeDDPzgkRwbVz32ymsrW9sbhW3Szu7e/sH5cOjlo5TxbDJYhGrTkA1Ci6xabgR2EkU0igQ2A7GdzO//YRK81g+mEmCfkSHkoecUWOlxkW/XHGr7hxklXg5qUCOer/81RvELI1QGiao1l3PTYyfUWU4Ezgt9VKNCWVjOsSupZJGqP1sfuiUnFllQMJY2ZKGzNXfExmNtJ5Ege2MqBnpZW8m/ud1UxPe+BmXSWpQssWiMBXExGT2NRlwhcyIiSWUKW5vJWxEFWXGZlOyIXjLL6+S1mXVc6te46pSu83jKMIJnMI5eHANNbiHOjSBAcIzvMKb8+i8OO/Ox6K14OQzx/AHzucPcYWMrw==</latexit><latexit sha1_base64="aWOcHJrcbrsxJSLO3n80z068CGE=">AAAB6HicbVBNS8NAEJ3Ur1q/qh69LBZBEEoigh6LXjy2YD+gDWWznbRrN5uwuxFK6C/w4kERr/4kb/4bt20O2vpg4PHeDDPzgkRwbVz32ymsrW9sbhW3Szu7e/sH5cOjlo5TxbDJYhGrTkA1Ci6xabgR2EkU0igQ2A7GdzO//YRK81g+mEmCfkSHkoecUWOlxkW/XHGr7hxklXg5qUCOer/81RvELI1QGiao1l3PTYyfUWU4Ezgt9VKNCWVjOsSupZJGqP1sfuiUnFllQMJY2ZKGzNXfExmNtJ5Ege2MqBnpZW8m/ud1UxPe+BmXSWpQssWiMBXExGT2NRlwhcyIiSWUKW5vJWxEFWXGZlOyIXjLL6+S1mXVc6te46pSu83jKMIJnMI5eHANNbiHOjSBAcIzvMKb8+i8OO/Ox6K14OQzx/AHzucPcYWMrw==</latexit><latexit sha1_base64="aWOcHJrcbrsxJSLO3n80z068CGE=">AAAB6HicbVBNS8NAEJ3Ur1q/qh69LBZBEEoigh6LXjy2YD+gDWWznbRrN5uwuxFK6C/w4kERr/4kb/4bt20O2vpg4PHeDDPzgkRwbVz32ymsrW9sbhW3Szu7e/sH5cOjlo5TxbDJYhGrTkA1Ci6xabgR2EkU0igQ2A7GdzO//YRK81g+mEmCfkSHkoecUWOlxkW/XHGr7hxklXg5qUCOer/81RvELI1QGiao1l3PTYyfUWU4Ezgt9VKNCWVjOsSupZJGqP1sfuiUnFllQMJY2ZKGzNXfExmNtJ5Ege2MqBnpZW8m/ud1UxPe+BmXSWpQssWiMBXExGT2NRlwhcyIiSWUKW5vJWxEFWXGZlOyIXjLL6+S1mXVc6te46pSu83jKMIJnMI5eHANNbiHOjSBAcIzvMKb8+i8OO/Ox6K14OQzx/AHzucPcYWMrw==</latexit>

=<latexit sha1_base64="DmNMk2YXYyTv+zN0rWXYwO/YuLg=">AAAB6HicbVBNS8NAEJ3Ur1q/qh69LBbBU0lE0ItQ9OKxBfsBbSib7aRdu9mE3Y1QQn+BFw+KePUnefPfuG1z0NYHA4/3ZpiZFySCa+O6305hbX1jc6u4XdrZ3ds/KB8etXScKoZNFotYdQKqUXCJTcONwE6ikEaBwHYwvpv57SdUmsfywUwS9CM6lDzkjBorNW765Ypbdecgq8TLSQVy1Pvlr94gZmmE0jBBte56bmL8jCrDmcBpqZdqTCgb0yF2LZU0Qu1n80On5MwqAxLGypY0ZK7+nshopPUkCmxnRM1IL3sz8T+vm5rw2s+4TFKDki0WhakgJiazr8mAK2RGTCyhTHF7K2EjqigzNpuSDcFbfnmVtC6qnlv1GpeV2m0eRxFO4BTOwYMrqME91KEJDBCe4RXenEfnxXl3PhatBSefOYY/cD5/AIzNjME=</latexit><latexit sha1_base64="DmNMk2YXYyTv+zN0rWXYwO/YuLg=">AAAB6HicbVBNS8NAEJ3Ur1q/qh69LBbBU0lE0ItQ9OKxBfsBbSib7aRdu9mE3Y1QQn+BFw+KePUnefPfuG1z0NYHA4/3ZpiZFySCa+O6305hbX1jc6u4XdrZ3ds/KB8etXScKoZNFotYdQKqUXCJTcONwE6ikEaBwHYwvpv57SdUmsfywUwS9CM6lDzkjBorNW765Ypbdecgq8TLSQVy1Pvlr94gZmmE0jBBte56bmL8jCrDmcBpqZdqTCgb0yF2LZU0Qu1n80On5MwqAxLGypY0ZK7+nshopPUkCmxnRM1IL3sz8T+vm5rw2s+4TFKDki0WhakgJiazr8mAK2RGTCyhTHF7K2EjqigzNpuSDcFbfnmVtC6qnlv1GpeV2m0eRxFO4BTOwYMrqME91KEJDBCe4RXenEfnxXl3PhatBSefOYY/cD5/AIzNjME=</latexit><latexit sha1_base64="DmNMk2YXYyTv+zN0rWXYwO/YuLg=">AAAB6HicbVBNS8NAEJ3Ur1q/qh69LBbBU0lE0ItQ9OKxBfsBbSib7aRdu9mE3Y1QQn+BFw+KePUnefPfuG1z0NYHA4/3ZpiZFySCa+O6305hbX1jc6u4XdrZ3ds/KB8etXScKoZNFotYdQKqUXCJTcONwE6ikEaBwHYwvpv57SdUmsfywUwS9CM6lDzkjBorNW765Ypbdecgq8TLSQVy1Pvlr94gZmmE0jBBte56bmL8jCrDmcBpqZdqTCgb0yF2LZU0Qu1n80On5MwqAxLGypY0ZK7+nshopPUkCmxnRM1IL3sz8T+vm5rw2s+4TFKDki0WhakgJiazr8mAK2RGTCyhTHF7K2EjqigzNpuSDcFbfnmVtC6qnlv1GpeV2m0eRxFO4BTOwYMrqME91KEJDBCe4RXenEfnxXl3PhatBSefOYY/cD5/AIzNjME=</latexit><latexit sha1_base64="DmNMk2YXYyTv+zN0rWXYwO/YuLg=">AAAB6HicbVBNS8NAEJ3Ur1q/qh69LBbBU0lE0ItQ9OKxBfsBbSib7aRdu9mE3Y1QQn+BFw+KePUnefPfuG1z0NYHA4/3ZpiZFySCa+O6305hbX1jc6u4XdrZ3ds/KB8etXScKoZNFotYdQKqUXCJTcONwE6ikEaBwHYwvpv57SdUmsfywUwS9CM6lDzkjBorNW765Ypbdecgq8TLSQVy1Pvlr94gZmmE0jBBte56bmL8jCrDmcBpqZdqTCgb0yF2LZU0Qu1n80On5MwqAxLGypY0ZK7+nshopPUkCmxnRM1IL3sz8T+vm5rw2s+4TFKDki0WhakgJiazr8mAK2RGTCyhTHF7K2EjqigzNpuSDcFbfnmVtC6qnlv1GpeV2m0eRxFO4BTOwYMrqME91KEJDBCe4RXenEfnxXl3PhatBSefOYY/cD5/AIzNjME=</latexit>

Page 3: SimBA: Simple Black-box Adversarial Attacks · SimBA: Simple Black-box Adversarial Attacks Chuan Guo, Jacob R. Gardner, Yurong You, Andrew Gordon Wilson, Kilian Q. Weinberger. Adversarial

White-box Attacks

✤ White-box attacks are simple and efficient due to access to gradients

+<latexit sha1_base64="aWOcHJrcbrsxJSLO3n80z068CGE=">AAAB6HicbVBNS8NAEJ3Ur1q/qh69LBZBEEoigh6LXjy2YD+gDWWznbRrN5uwuxFK6C/w4kERr/4kb/4bt20O2vpg4PHeDDPzgkRwbVz32ymsrW9sbhW3Szu7e/sH5cOjlo5TxbDJYhGrTkA1Ci6xabgR2EkU0igQ2A7GdzO//YRK81g+mEmCfkSHkoecUWOlxkW/XHGr7hxklXg5qUCOer/81RvELI1QGiao1l3PTYyfUWU4Ezgt9VKNCWVjOsSupZJGqP1sfuiUnFllQMJY2ZKGzNXfExmNtJ5Ege2MqBnpZW8m/ud1UxPe+BmXSWpQssWiMBXExGT2NRlwhcyIiSWUKW5vJWxEFWXGZlOyIXjLL6+S1mXVc6te46pSu83jKMIJnMI5eHANNbiHOjSBAcIzvMKb8+i8OO/Ox6K14OQzx/AHzucPcYWMrw==</latexit><latexit sha1_base64="aWOcHJrcbrsxJSLO3n80z068CGE=">AAAB6HicbVBNS8NAEJ3Ur1q/qh69LBZBEEoigh6LXjy2YD+gDWWznbRrN5uwuxFK6C/w4kERr/4kb/4bt20O2vpg4PHeDDPzgkRwbVz32ymsrW9sbhW3Szu7e/sH5cOjlo5TxbDJYhGrTkA1Ci6xabgR2EkU0igQ2A7GdzO//YRK81g+mEmCfkSHkoecUWOlxkW/XHGr7hxklXg5qUCOer/81RvELI1QGiao1l3PTYyfUWU4Ezgt9VKNCWVjOsSupZJGqP1sfuiUnFllQMJY2ZKGzNXfExmNtJ5Ege2MqBnpZW8m/ud1UxPe+BmXSWpQssWiMBXExGT2NRlwhcyIiSWUKW5vJWxEFWXGZlOyIXjLL6+S1mXVc6te46pSu83jKMIJnMI5eHANNbiHOjSBAcIzvMKb8+i8OO/Ox6K14OQzx/AHzucPcYWMrw==</latexit><latexit sha1_base64="aWOcHJrcbrsxJSLO3n80z068CGE=">AAAB6HicbVBNS8NAEJ3Ur1q/qh69LBZBEEoigh6LXjy2YD+gDWWznbRrN5uwuxFK6C/w4kERr/4kb/4bt20O2vpg4PHeDDPzgkRwbVz32ymsrW9sbhW3Szu7e/sH5cOjlo5TxbDJYhGrTkA1Ci6xabgR2EkU0igQ2A7GdzO//YRK81g+mEmCfkSHkoecUWOlxkW/XHGr7hxklXg5qUCOer/81RvELI1QGiao1l3PTYyfUWU4Ezgt9VKNCWVjOsSupZJGqP1sfuiUnFllQMJY2ZKGzNXfExmNtJ5Ege2MqBnpZW8m/ud1UxPe+BmXSWpQssWiMBXExGT2NRlwhcyIiSWUKW5vJWxEFWXGZlOyIXjLL6+S1mXVc6te46pSu83jKMIJnMI5eHANNbiHOjSBAcIzvMKb8+i8OO/Ox6K14OQzx/AHzucPcYWMrw==</latexit><latexit sha1_base64="aWOcHJrcbrsxJSLO3n80z068CGE=">AAAB6HicbVBNS8NAEJ3Ur1q/qh69LBZBEEoigh6LXjy2YD+gDWWznbRrN5uwuxFK6C/w4kERr/4kb/4bt20O2vpg4PHeDDPzgkRwbVz32ymsrW9sbhW3Szu7e/sH5cOjlo5TxbDJYhGrTkA1Ci6xabgR2EkU0igQ2A7GdzO//YRK81g+mEmCfkSHkoecUWOlxkW/XHGr7hxklXg5qUCOer/81RvELI1QGiao1l3PTYyfUWU4Ezgt9VKNCWVjOsSupZJGqP1sfuiUnFllQMJY2ZKGzNXfExmNtJ5Ege2MqBnpZW8m/ud1UxPe+BmXSWpQssWiMBXExGT2NRlwhcyIiSWUKW5vJWxEFWXGZlOyIXjLL6+S1mXVc6te46pSu83jKMIJnMI5eHANNbiHOjSBAcIzvMKb8+i8OO/Ox6K14OQzx/AHzucPcYWMrw==</latexit>

✏ ⇤<latexit sha1_base64="xsitgCBwSwViNYDFo7cUN35R94U=">AAAB9XicbVA9T8MwEL2Ur1K+CowsFg0SYqiSLjBWsDAWiX5Ibagc12mtOnZkO6Aq6v9gYQAhVv4LG/8Gt80ALU866em9O93dCxPOtPG8b6ewtr6xuVXcLu3s7u0flA+PWlqmitAmkVyqTog15UzQpmGG006iKI5DTtvh+Gbmtx+p0kyKezNJaBDjoWARI9hY6cHt0UQzLoWL3Au3X654VW8OtEr8nFQgR6Nf/uoNJEljKgzhWOuu7yUmyLAyjHA6LfVSTRNMxnhIu5YKHFMdZPOrp+jMKgMUSWVLGDRXf09kONZ6Eoe2M8ZmpJe9mfif101NdBVkTCSpoYIsFkUpR0aiWQRowBQlhk8swUQxeysiI6wwMTaokg3BX355lbRqVd+r+ne1Sv06j6MIJ3AK5+DDJdThFhrQBAIKnuEV3pwn58V5dz4WrQUnnzmGP3A+fwCIZZE0</latexit><latexit sha1_base64="xsitgCBwSwViNYDFo7cUN35R94U=">AAAB9XicbVA9T8MwEL2Ur1K+CowsFg0SYqiSLjBWsDAWiX5Ibagc12mtOnZkO6Aq6v9gYQAhVv4LG/8Gt80ALU866em9O93dCxPOtPG8b6ewtr6xuVXcLu3s7u0flA+PWlqmitAmkVyqTog15UzQpmGG006iKI5DTtvh+Gbmtx+p0kyKezNJaBDjoWARI9hY6cHt0UQzLoWL3Au3X654VW8OtEr8nFQgR6Nf/uoNJEljKgzhWOuu7yUmyLAyjHA6LfVSTRNMxnhIu5YKHFMdZPOrp+jMKgMUSWVLGDRXf09kONZ6Eoe2M8ZmpJe9mfif101NdBVkTCSpoYIsFkUpR0aiWQRowBQlhk8swUQxeysiI6wwMTaokg3BX355lbRqVd+r+ne1Sv06j6MIJ3AK5+DDJdThFhrQBAIKnuEV3pwn58V5dz4WrQUnnzmGP3A+fwCIZZE0</latexit><latexit sha1_base64="xsitgCBwSwViNYDFo7cUN35R94U=">AAAB9XicbVA9T8MwEL2Ur1K+CowsFg0SYqiSLjBWsDAWiX5Ibagc12mtOnZkO6Aq6v9gYQAhVv4LG/8Gt80ALU866em9O93dCxPOtPG8b6ewtr6xuVXcLu3s7u0flA+PWlqmitAmkVyqTog15UzQpmGG006iKI5DTtvh+Gbmtx+p0kyKezNJaBDjoWARI9hY6cHt0UQzLoWL3Au3X654VW8OtEr8nFQgR6Nf/uoNJEljKgzhWOuu7yUmyLAyjHA6LfVSTRNMxnhIu5YKHFMdZPOrp+jMKgMUSWVLGDRXf09kONZ6Eoe2M8ZmpJe9mfif101NdBVkTCSpoYIsFkUpR0aiWQRowBQlhk8swUQxeysiI6wwMTaokg3BX355lbRqVd+r+ne1Sv06j6MIJ3AK5+DDJdThFhrQBAIKnuEV3pwn58V5dz4WrQUnnzmGP3A+fwCIZZE0</latexit><latexit sha1_base64="xsitgCBwSwViNYDFo7cUN35R94U=">AAAB9XicbVA9T8MwEL2Ur1K+CowsFg0SYqiSLjBWsDAWiX5Ibagc12mtOnZkO6Aq6v9gYQAhVv4LG/8Gt80ALU866em9O93dCxPOtPG8b6ewtr6xuVXcLu3s7u0flA+PWlqmitAmkVyqTog15UzQpmGG006iKI5DTtvh+Gbmtx+p0kyKezNJaBDjoWARI9hY6cHt0UQzLoWL3Au3X654VW8OtEr8nFQgR6Nf/uoNJEljKgzhWOuu7yUmyLAyjHA6LfVSTRNMxnhIu5YKHFMdZPOrp+jMKgMUSWVLGDRXf09kONZ6Eoe2M8ZmpJe9mfif101NdBVkTCSpoYIsFkUpR0aiWQRowBQlhk8swUQxeysiI6wwMTaokg3BX355lbRqVd+r+ne1Sv06j6MIJ3AK5+DDJdThFhrQBAIKnuEV3pwn58V5dz4WrQUnnzmGP3A+fwCIZZE0</latexit>

p(x)<latexit sha1_base64="dYBDJ8oFvlSiPpezwBg3EuK3K68=">AAAB/3icbVDLSsNAFL2pr1pfUcGNm6FFqAglcaPLohuXFewDmlAm00k7dPJgZiKWmIV/Im5cKOLW33Dn3zhpK2jrgYHDOfdyzxwv5kwqy/oyCkvLK6trxfXSxubW9o65u9eSUSIIbZKIR6LjYUk5C2lTMcVpJxYUBx6nbW90mfvtWyoki8IbNY6pG+BByHxGsNJSzzxwAqyGnp/GWfWH3mXHPbNi1awJ0CKxZ6RSLzsnjwDQ6JmfTj8iSUBDRTiWsmtbsXJTLBQjnGYlJ5E0xmSEB7SraYgDKt10kj9DR1rpIz8S+oUKTdTfGykOpBwHnp7MI8p5Lxf/87qJ8s/dlIVxomhIpof8hCMVobwM1GeCEsXHmmAimM6KyBALTJSurKRLsOe/vEhapzXbqtnXdqV+AVMU4RDKUAUbzqAOV9CAJhC4hyd4gVfjwXg23oz36WjBmO3swx8YH99rPZfS</latexit><latexit sha1_base64="mYXlzk/yhR4LlvUtUKS0rDDD9RA=">AAAB/3icbVDLSsNAFJ34rPUVFdy4GVqEilASN7oMunFZwT6gCWUynbRDJ5MwMxFDzMJ/8AvcuFDErb/hrn/jpK2grQcGDufcyz1z/JhRqSxrbCwtr6yurZc2yptb2zu75t5+S0aJwKSJIxaJjo8kYZSTpqKKkU4sCAp9Rtr+6Krw23dESBrxW5XGxAvRgNOAYqS01DMP3RCpoR9kcV77off5Sc+sWnVrArhI7BmpOhX39GnspI2e+eX2I5yEhCvMkJRd24qVlyGhKGYkL7uJJDHCIzQgXU05Con0skn+HB5rpQ+DSOjHFZyovzcyFEqZhr6eLCLKea8Q//O6iQouvIzyOFGE4+mhIGFQRbAoA/apIFixVBOEBdVZIR4igbDSlZV1Cfb8lxdJ66xuW3X7xq46l2CKEjgCFVADNjgHDrgGDdAEGDyAZ/AK3oxH48V4Nz6mo0vGbOcA/IHx+Q10p5lY</latexit><latexit sha1_base64="mYXlzk/yhR4LlvUtUKS0rDDD9RA=">AAAB/3icbVDLSsNAFJ34rPUVFdy4GVqEilASN7oMunFZwT6gCWUynbRDJ5MwMxFDzMJ/8AvcuFDErb/hrn/jpK2grQcGDufcyz1z/JhRqSxrbCwtr6yurZc2yptb2zu75t5+S0aJwKSJIxaJjo8kYZSTpqKKkU4sCAp9Rtr+6Krw23dESBrxW5XGxAvRgNOAYqS01DMP3RCpoR9kcV77off5Sc+sWnVrArhI7BmpOhX39GnspI2e+eX2I5yEhCvMkJRd24qVlyGhKGYkL7uJJDHCIzQgXU05Con0skn+HB5rpQ+DSOjHFZyovzcyFEqZhr6eLCLKea8Q//O6iQouvIzyOFGE4+mhIGFQRbAoA/apIFixVBOEBdVZIR4igbDSlZV1Cfb8lxdJ66xuW3X7xq46l2CKEjgCFVADNjgHDrgGDdAEGDyAZ/AK3oxH48V4Nz6mo0vGbOcA/IHx+Q10p5lY</latexit><latexit sha1_base64="idLQEvvjjdcyUwTMQ6mco1HScWw=">AAAB/3icbVDLSsNAFL3xWesrKrhxM1iEuimJG10W3bisYB/QhjKZTtqhk0mYmYglZuGvuHGhiFt/w51/46SNoK0HBg7n3Ms9c/yYM6Ud58taWl5ZXVsvbZQ3t7Z3du29/ZaKEklok0Q8kh0fK8qZoE3NNKedWFIc+py2/fFV7rfvqFQsErd6ElMvxEPBAkawNlLfPuyFWI/8II2z6g+9z077dsWpOVOgReIWpAIFGn37szeISBJSoQnHSnVdJ9ZeiqVmhNOs3EsUjTEZ4yHtGipwSJWXTvNn6MQoAxRE0jyh0VT9vZHiUKlJ6JvJPKKa93LxP6+b6ODCS5mIE00FmR0KEo50hPIy0IBJSjSfGIKJZCYrIiMsMdGmsrIpwZ3/8iJpndVcp+beuJX6ZVFHCY7gGKrgwjnU4Roa0AQCD/AEL/BqPVrP1pv1PhtdsoqdA/gD6+MbWL6WSQ==</latexit>

rx`(p(x), y)<latexit sha1_base64="gOj7eYHG41bQUDF0l64oRf51sLE=">AAACGnicbVDLSsNAFJ3UV62vqEs3g0VoQUoigi6LblxWsA9oSphMJ+3QySTMTMQQ8h1u/BU3LhRxJ278GydtRG09MHDmnHu59x4vYlQqy/o0SkvLK6tr5fXKxubW9o65u9eRYSwwaeOQhaLnIUkY5aStqGKkFwmCAo+Rrje5zP3uLRGShvxGJREZBGjEqU8xUlpyTdvhyGPIdQKkxp6f3mXQIYzVvv9RVvux6scwqbtm1WpYU8BFYhekCgq0XPPdGYY4DghXmCEp+7YVqUGKhKKYkazixJJECE/QiPQ15SggcpBOT8vgkVaG0A+FflzBqfq7I0WBlEng6cp8TTnv5eJ/Xj9W/vkgpTyKFeF4NsiPGVQhzHOCQyoIVizRBGFB9a4Qj5FAWOk0KzoEe/7kRdI5adhWw74+rTYvijjK4AAcghqwwRlogivQAm2AwT14BM/gxXgwnoxX421WWjKKnn3wB8bHF4eboSA=</latexit><latexit sha1_base64="gOj7eYHG41bQUDF0l64oRf51sLE=">AAACGnicbVDLSsNAFJ3UV62vqEs3g0VoQUoigi6LblxWsA9oSphMJ+3QySTMTMQQ8h1u/BU3LhRxJ278GydtRG09MHDmnHu59x4vYlQqy/o0SkvLK6tr5fXKxubW9o65u9eRYSwwaeOQhaLnIUkY5aStqGKkFwmCAo+Rrje5zP3uLRGShvxGJREZBGjEqU8xUlpyTdvhyGPIdQKkxp6f3mXQIYzVvv9RVvux6scwqbtm1WpYU8BFYhekCgq0XPPdGYY4DghXmCEp+7YVqUGKhKKYkazixJJECE/QiPQ15SggcpBOT8vgkVaG0A+FflzBqfq7I0WBlEng6cp8TTnv5eJ/Xj9W/vkgpTyKFeF4NsiPGVQhzHOCQyoIVizRBGFB9a4Qj5FAWOk0KzoEe/7kRdI5adhWw74+rTYvijjK4AAcghqwwRlogivQAm2AwT14BM/gxXgwnoxX421WWjKKnn3wB8bHF4eboSA=</latexit><latexit sha1_base64="gOj7eYHG41bQUDF0l64oRf51sLE=">AAACGnicbVDLSsNAFJ3UV62vqEs3g0VoQUoigi6LblxWsA9oSphMJ+3QySTMTMQQ8h1u/BU3LhRxJ278GydtRG09MHDmnHu59x4vYlQqy/o0SkvLK6tr5fXKxubW9o65u9eRYSwwaeOQhaLnIUkY5aStqGKkFwmCAo+Rrje5zP3uLRGShvxGJREZBGjEqU8xUlpyTdvhyGPIdQKkxp6f3mXQIYzVvv9RVvux6scwqbtm1WpYU8BFYhekCgq0XPPdGYY4DghXmCEp+7YVqUGKhKKYkazixJJECE/QiPQ15SggcpBOT8vgkVaG0A+FflzBqfq7I0WBlEng6cp8TTnv5eJ/Xj9W/vkgpTyKFeF4NsiPGVQhzHOCQyoIVizRBGFB9a4Qj5FAWOk0KzoEe/7kRdI5adhWw74+rTYvijjK4AAcghqwwRlogivQAm2AwT14BM/gxXgwnoxX421WWjKKnn3wB8bHF4eboSA=</latexit><latexit sha1_base64="gOj7eYHG41bQUDF0l64oRf51sLE=">AAACGnicbVDLSsNAFJ3UV62vqEs3g0VoQUoigi6LblxWsA9oSphMJ+3QySTMTMQQ8h1u/BU3LhRxJ278GydtRG09MHDmnHu59x4vYlQqy/o0SkvLK6tr5fXKxubW9o65u9eRYSwwaeOQhaLnIUkY5aStqGKkFwmCAo+Rrje5zP3uLRGShvxGJREZBGjEqU8xUlpyTdvhyGPIdQKkxp6f3mXQIYzVvv9RVvux6scwqbtm1WpYU8BFYhekCgq0XPPdGYY4DghXmCEp+7YVqUGKhKKYkazixJJECE/QiPQ15SggcpBOT8vgkVaG0A+FflzBqfq7I0WBlEng6cp8TTnv5eJ/Xj9W/vkgpTyKFeF4NsiPGVQhzHOCQyoIVizRBGFB9a4Qj5FAWOk0KzoEe/7kRdI5adhWw74+rTYvijjK4AAcghqwwRlogivQAm2AwT14BM/gxXgwnoxX421WWjKKnn3wB8bHF4eboSA=</latexit>

=<latexit sha1_base64="DmNMk2YXYyTv+zN0rWXYwO/YuLg=">AAAB6HicbVBNS8NAEJ3Ur1q/qh69LBbBU0lE0ItQ9OKxBfsBbSib7aRdu9mE3Y1QQn+BFw+KePUnefPfuG1z0NYHA4/3ZpiZFySCa+O6305hbX1jc6u4XdrZ3ds/KB8etXScKoZNFotYdQKqUXCJTcONwE6ikEaBwHYwvpv57SdUmsfywUwS9CM6lDzkjBorNW765Ypbdecgq8TLSQVy1Pvlr94gZmmE0jBBte56bmL8jCrDmcBpqZdqTCgb0yF2LZU0Qu1n80On5MwqAxLGypY0ZK7+nshopPUkCmxnRM1IL3sz8T+vm5rw2s+4TFKDki0WhakgJiazr8mAK2RGTCyhTHF7K2EjqigzNpuSDcFbfnmVtC6qnlv1GpeV2m0eRxFO4BTOwYMrqME91KEJDBCe4RXenEfnxXl3PhatBSefOYY/cD5/AIzNjME=</latexit><latexit sha1_base64="DmNMk2YXYyTv+zN0rWXYwO/YuLg=">AAAB6HicbVBNS8NAEJ3Ur1q/qh69LBbBU0lE0ItQ9OKxBfsBbSib7aRdu9mE3Y1QQn+BFw+KePUnefPfuG1z0NYHA4/3ZpiZFySCa+O6305hbX1jc6u4XdrZ3ds/KB8etXScKoZNFotYdQKqUXCJTcONwE6ikEaBwHYwvpv57SdUmsfywUwS9CM6lDzkjBorNW765Ypbdecgq8TLSQVy1Pvlr94gZmmE0jBBte56bmL8jCrDmcBpqZdqTCgb0yF2LZU0Qu1n80On5MwqAxLGypY0ZK7+nshopPUkCmxnRM1IL3sz8T+vm5rw2s+4TFKDki0WhakgJiazr8mAK2RGTCyhTHF7K2EjqigzNpuSDcFbfnmVtC6qnlv1GpeV2m0eRxFO4BTOwYMrqME91KEJDBCe4RXenEfnxXl3PhatBSefOYY/cD5/AIzNjME=</latexit><latexit sha1_base64="DmNMk2YXYyTv+zN0rWXYwO/YuLg=">AAAB6HicbVBNS8NAEJ3Ur1q/qh69LBbBU0lE0ItQ9OKxBfsBbSib7aRdu9mE3Y1QQn+BFw+KePUnefPfuG1z0NYHA4/3ZpiZFySCa+O6305hbX1jc6u4XdrZ3ds/KB8etXScKoZNFotYdQKqUXCJTcONwE6ikEaBwHYwvpv57SdUmsfywUwS9CM6lDzkjBorNW765Ypbdecgq8TLSQVy1Pvlr94gZmmE0jBBte56bmL8jCrDmcBpqZdqTCgb0yF2LZU0Qu1n80On5MwqAxLGypY0ZK7+nshopPUkCmxnRM1IL3sz8T+vm5rw2s+4TFKDki0WhakgJiazr8mAK2RGTCyhTHF7K2EjqigzNpuSDcFbfnmVtC6qnlv1GpeV2m0eRxFO4BTOwYMrqME91KEJDBCe4RXenEfnxXl3PhatBSefOYY/cD5/AIzNjME=</latexit><latexit sha1_base64="DmNMk2YXYyTv+zN0rWXYwO/YuLg=">AAAB6HicbVBNS8NAEJ3Ur1q/qh69LBbBU0lE0ItQ9OKxBfsBbSib7aRdu9mE3Y1QQn+BFw+KePUnefPfuG1z0NYHA4/3ZpiZFySCa+O6305hbX1jc6u4XdrZ3ds/KB8etXScKoZNFotYdQKqUXCJTcONwE6ikEaBwHYwvpv57SdUmsfywUwS9CM6lDzkjBorNW765Ypbdecgq8TLSQVy1Pvlr94gZmmE0jBBte56bmL8jCrDmcBpqZdqTCgb0yF2LZU0Qu1n80On5MwqAxLGypY0ZK7+nshopPUkCmxnRM1IL3sz8T+vm5rw2s+4TFKDki0WhakgJiazr8mAK2RGTCyhTHF7K2EjqigzNpuSDcFbfnmVtC6qnlv1GpeV2m0eRxFO4BTOwYMrqME91KEJDBCe4RXenEfnxXl3PhatBSefOYY/cD5/AIzNjME=</latexit>

Page 4: SimBA: Simple Black-box Adversarial Attacks · SimBA: Simple Black-box Adversarial Attacks Chuan Guo, Jacob R. Gardner, Yurong You, Andrew Gordon Wilson, Kilian Q. Weinberger. Adversarial

Black-box Attacks

✤ Black-box attacks are costly and existing approaches are complicated

+<latexit sha1_base64="aWOcHJrcbrsxJSLO3n80z068CGE=">AAAB6HicbVBNS8NAEJ3Ur1q/qh69LBZBEEoigh6LXjy2YD+gDWWznbRrN5uwuxFK6C/w4kERr/4kb/4bt20O2vpg4PHeDDPzgkRwbVz32ymsrW9sbhW3Szu7e/sH5cOjlo5TxbDJYhGrTkA1Ci6xabgR2EkU0igQ2A7GdzO//YRK81g+mEmCfkSHkoecUWOlxkW/XHGr7hxklXg5qUCOer/81RvELI1QGiao1l3PTYyfUWU4Ezgt9VKNCWVjOsSupZJGqP1sfuiUnFllQMJY2ZKGzNXfExmNtJ5Ege2MqBnpZW8m/ud1UxPe+BmXSWpQssWiMBXExGT2NRlwhcyIiSWUKW5vJWxEFWXGZlOyIXjLL6+S1mXVc6te46pSu83jKMIJnMI5eHANNbiHOjSBAcIzvMKb8+i8OO/Ox6K14OQzx/AHzucPcYWMrw==</latexit><latexit sha1_base64="aWOcHJrcbrsxJSLO3n80z068CGE=">AAAB6HicbVBNS8NAEJ3Ur1q/qh69LBZBEEoigh6LXjy2YD+gDWWznbRrN5uwuxFK6C/w4kERr/4kb/4bt20O2vpg4PHeDDPzgkRwbVz32ymsrW9sbhW3Szu7e/sH5cOjlo5TxbDJYhGrTkA1Ci6xabgR2EkU0igQ2A7GdzO//YRK81g+mEmCfkSHkoecUWOlxkW/XHGr7hxklXg5qUCOer/81RvELI1QGiao1l3PTYyfUWU4Ezgt9VKNCWVjOsSupZJGqP1sfuiUnFllQMJY2ZKGzNXfExmNtJ5Ege2MqBnpZW8m/ud1UxPe+BmXSWpQssWiMBXExGT2NRlwhcyIiSWUKW5vJWxEFWXGZlOyIXjLL6+S1mXVc6te46pSu83jKMIJnMI5eHANNbiHOjSBAcIzvMKb8+i8OO/Ox6K14OQzx/AHzucPcYWMrw==</latexit><latexit sha1_base64="aWOcHJrcbrsxJSLO3n80z068CGE=">AAAB6HicbVBNS8NAEJ3Ur1q/qh69LBZBEEoigh6LXjy2YD+gDWWznbRrN5uwuxFK6C/w4kERr/4kb/4bt20O2vpg4PHeDDPzgkRwbVz32ymsrW9sbhW3Szu7e/sH5cOjlo5TxbDJYhGrTkA1Ci6xabgR2EkU0igQ2A7GdzO//YRK81g+mEmCfkSHkoecUWOlxkW/XHGr7hxklXg5qUCOer/81RvELI1QGiao1l3PTYyfUWU4Ezgt9VKNCWVjOsSupZJGqP1sfuiUnFllQMJY2ZKGzNXfExmNtJ5Ege2MqBnpZW8m/ud1UxPe+BmXSWpQssWiMBXExGT2NRlwhcyIiSWUKW5vJWxEFWXGZlOyIXjLL6+S1mXVc6te46pSu83jKMIJnMI5eHANNbiHOjSBAcIzvMKb8+i8OO/Ox6K14OQzx/AHzucPcYWMrw==</latexit><latexit sha1_base64="aWOcHJrcbrsxJSLO3n80z068CGE=">AAAB6HicbVBNS8NAEJ3Ur1q/qh69LBZBEEoigh6LXjy2YD+gDWWznbRrN5uwuxFK6C/w4kERr/4kb/4bt20O2vpg4PHeDDPzgkRwbVz32ymsrW9sbhW3Szu7e/sH5cOjlo5TxbDJYhGrTkA1Ci6xabgR2EkU0igQ2A7GdzO//YRK81g+mEmCfkSHkoecUWOlxkW/XHGr7hxklXg5qUCOer/81RvELI1QGiao1l3PTYyfUWU4Ezgt9VKNCWVjOsSupZJGqP1sfuiUnFllQMJY2ZKGzNXfExmNtJ5Ege2MqBnpZW8m/ud1UxPe+BmXSWpQssWiMBXExGT2NRlwhcyIiSWUKW5vJWxEFWXGZlOyIXjLL6+S1mXVc6te46pSu83jKMIJnMI5eHANNbiHOjSBAcIzvMKb8+i8OO/Ox6K14OQzx/AHzucPcYWMrw==</latexit>

p(x)<latexit sha1_base64="dYBDJ8oFvlSiPpezwBg3EuK3K68=">AAAB/3icbVDLSsNAFL2pr1pfUcGNm6FFqAglcaPLohuXFewDmlAm00k7dPJgZiKWmIV/Im5cKOLW33Dn3zhpK2jrgYHDOfdyzxwv5kwqy/oyCkvLK6trxfXSxubW9o65u9eSUSIIbZKIR6LjYUk5C2lTMcVpJxYUBx6nbW90mfvtWyoki8IbNY6pG+BByHxGsNJSzzxwAqyGnp/GWfWH3mXHPbNi1awJ0CKxZ6RSLzsnjwDQ6JmfTj8iSUBDRTiWsmtbsXJTLBQjnGYlJ5E0xmSEB7SraYgDKt10kj9DR1rpIz8S+oUKTdTfGykOpBwHnp7MI8p5Lxf/87qJ8s/dlIVxomhIpof8hCMVobwM1GeCEsXHmmAimM6KyBALTJSurKRLsOe/vEhapzXbqtnXdqV+AVMU4RDKUAUbzqAOV9CAJhC4hyd4gVfjwXg23oz36WjBmO3swx8YH99rPZfS</latexit><latexit sha1_base64="mYXlzk/yhR4LlvUtUKS0rDDD9RA=">AAAB/3icbVDLSsNAFJ34rPUVFdy4GVqEilASN7oMunFZwT6gCWUynbRDJ5MwMxFDzMJ/8AvcuFDErb/hrn/jpK2grQcGDufcyz1z/JhRqSxrbCwtr6yurZc2yptb2zu75t5+S0aJwKSJIxaJjo8kYZSTpqKKkU4sCAp9Rtr+6Krw23dESBrxW5XGxAvRgNOAYqS01DMP3RCpoR9kcV77off5Sc+sWnVrArhI7BmpOhX39GnspI2e+eX2I5yEhCvMkJRd24qVlyGhKGYkL7uJJDHCIzQgXU05Con0skn+HB5rpQ+DSOjHFZyovzcyFEqZhr6eLCLKea8Q//O6iQouvIzyOFGE4+mhIGFQRbAoA/apIFixVBOEBdVZIR4igbDSlZV1Cfb8lxdJ66xuW3X7xq46l2CKEjgCFVADNjgHDrgGDdAEGDyAZ/AK3oxH48V4Nz6mo0vGbOcA/IHx+Q10p5lY</latexit><latexit sha1_base64="mYXlzk/yhR4LlvUtUKS0rDDD9RA=">AAAB/3icbVDLSsNAFJ34rPUVFdy4GVqEilASN7oMunFZwT6gCWUynbRDJ5MwMxFDzMJ/8AvcuFDErb/hrn/jpK2grQcGDufcyz1z/JhRqSxrbCwtr6yurZc2yptb2zu75t5+S0aJwKSJIxaJjo8kYZSTpqKKkU4sCAp9Rtr+6Krw23dESBrxW5XGxAvRgNOAYqS01DMP3RCpoR9kcV77off5Sc+sWnVrArhI7BmpOhX39GnspI2e+eX2I5yEhCvMkJRd24qVlyGhKGYkL7uJJDHCIzQgXU05Con0skn+HB5rpQ+DSOjHFZyovzcyFEqZhr6eLCLKea8Q//O6iQouvIzyOFGE4+mhIGFQRbAoA/apIFixVBOEBdVZIR4igbDSlZV1Cfb8lxdJ66xuW3X7xq46l2CKEjgCFVADNjgHDrgGDdAEGDyAZ/AK3oxH48V4Nz6mo0vGbOcA/IHx+Q10p5lY</latexit><latexit sha1_base64="idLQEvvjjdcyUwTMQ6mco1HScWw=">AAAB/3icbVDLSsNAFL3xWesrKrhxM1iEuimJG10W3bisYB/QhjKZTtqhk0mYmYglZuGvuHGhiFt/w51/46SNoK0HBg7n3Ms9c/yYM6Ud58taWl5ZXVsvbZQ3t7Z3du29/ZaKEklok0Q8kh0fK8qZoE3NNKedWFIc+py2/fFV7rfvqFQsErd6ElMvxEPBAkawNlLfPuyFWI/8II2z6g+9z077dsWpOVOgReIWpAIFGn37szeISBJSoQnHSnVdJ9ZeiqVmhNOs3EsUjTEZ4yHtGipwSJWXTvNn6MQoAxRE0jyh0VT9vZHiUKlJ6JvJPKKa93LxP6+b6ODCS5mIE00FmR0KEo50hPIy0IBJSjSfGIKJZCYrIiMsMdGmsrIpwZ3/8iJpndVcp+beuJX6ZVFHCY7gGKrgwjnU4Roa0AQCD/AEL/BqPVrP1pv1PhtdsoqdA/gD6+MbWL6WSQ==</latexit>

=<latexit sha1_base64="DmNMk2YXYyTv+zN0rWXYwO/YuLg=">AAAB6HicbVBNS8NAEJ3Ur1q/qh69LBbBU0lE0ItQ9OKxBfsBbSib7aRdu9mE3Y1QQn+BFw+KePUnefPfuG1z0NYHA4/3ZpiZFySCa+O6305hbX1jc6u4XdrZ3ds/KB8etXScKoZNFotYdQKqUXCJTcONwE6ikEaBwHYwvpv57SdUmsfywUwS9CM6lDzkjBorNW765Ypbdecgq8TLSQVy1Pvlr94gZmmE0jBBte56bmL8jCrDmcBpqZdqTCgb0yF2LZU0Qu1n80On5MwqAxLGypY0ZK7+nshopPUkCmxnRM1IL3sz8T+vm5rw2s+4TFKDki0WhakgJiazr8mAK2RGTCyhTHF7K2EjqigzNpuSDcFbfnmVtC6qnlv1GpeV2m0eRxFO4BTOwYMrqME91KEJDBCe4RXenEfnxXl3PhatBSefOYY/cD5/AIzNjME=</latexit><latexit sha1_base64="DmNMk2YXYyTv+zN0rWXYwO/YuLg=">AAAB6HicbVBNS8NAEJ3Ur1q/qh69LBbBU0lE0ItQ9OKxBfsBbSib7aRdu9mE3Y1QQn+BFw+KePUnefPfuG1z0NYHA4/3ZpiZFySCa+O6305hbX1jc6u4XdrZ3ds/KB8etXScKoZNFotYdQKqUXCJTcONwE6ikEaBwHYwvpv57SdUmsfywUwS9CM6lDzkjBorNW765Ypbdecgq8TLSQVy1Pvlr94gZmmE0jBBte56bmL8jCrDmcBpqZdqTCgb0yF2LZU0Qu1n80On5MwqAxLGypY0ZK7+nshopPUkCmxnRM1IL3sz8T+vm5rw2s+4TFKDki0WhakgJiazr8mAK2RGTCyhTHF7K2EjqigzNpuSDcFbfnmVtC6qnlv1GpeV2m0eRxFO4BTOwYMrqME91KEJDBCe4RXenEfnxXl3PhatBSefOYY/cD5/AIzNjME=</latexit><latexit sha1_base64="DmNMk2YXYyTv+zN0rWXYwO/YuLg=">AAAB6HicbVBNS8NAEJ3Ur1q/qh69LBbBU0lE0ItQ9OKxBfsBbSib7aRdu9mE3Y1QQn+BFw+KePUnefPfuG1z0NYHA4/3ZpiZFySCa+O6305hbX1jc6u4XdrZ3ds/KB8etXScKoZNFotYdQKqUXCJTcONwE6ikEaBwHYwvpv57SdUmsfywUwS9CM6lDzkjBorNW765Ypbdecgq8TLSQVy1Pvlr94gZmmE0jBBte56bmL8jCrDmcBpqZdqTCgb0yF2LZU0Qu1n80On5MwqAxLGypY0ZK7+nshopPUkCmxnRM1IL3sz8T+vm5rw2s+4TFKDki0WhakgJiazr8mAK2RGTCyhTHF7K2EjqigzNpuSDcFbfnmVtC6qnlv1GpeV2m0eRxFO4BTOwYMrqME91KEJDBCe4RXenEfnxXl3PhatBSefOYY/cD5/AIzNjME=</latexit><latexit sha1_base64="DmNMk2YXYyTv+zN0rWXYwO/YuLg=">AAAB6HicbVBNS8NAEJ3Ur1q/qh69LBbBU0lE0ItQ9OKxBfsBbSib7aRdu9mE3Y1QQn+BFw+KePUnefPfuG1z0NYHA4/3ZpiZFySCa+O6305hbX1jc6u4XdrZ3ds/KB8etXScKoZNFotYdQKqUXCJTcONwE6ikEaBwHYwvpv57SdUmsfywUwS9CM6lDzkjBorNW765Ypbdecgq8TLSQVy1Pvlr94gZmmE0jBBte56bmL8jCrDmcBpqZdqTCgb0yF2LZU0Qu1n80On5MwqAxLGypY0ZK7+nshopPUkCmxnRM1IL3sz8T+vm5rw2s+4TFKDki0WhakgJiazr8mAK2RGTCyhTHF7K2EjqigzNpuSDcFbfnmVtC6qnlv1GpeV2m0eRxFO4BTOwYMrqME91KEJDBCe4RXenEfnxXl3PhatBSefOYY/cD5/AIzNjME=</latexit>+<latexit sha1_base64="aWOcHJrcbrsxJSLO3n80z068CGE=">AAAB6HicbVBNS8NAEJ3Ur1q/qh69LBZBEEoigh6LXjy2YD+gDWWznbRrN5uwuxFK6C/w4kERr/4kb/4bt20O2vpg4PHeDDPzgkRwbVz32ymsrW9sbhW3Szu7e/sH5cOjlo5TxbDJYhGrTkA1Ci6xabgR2EkU0igQ2A7GdzO//YRK81g+mEmCfkSHkoecUWOlxkW/XHGr7hxklXg5qUCOer/81RvELI1QGiao1l3PTYyfUWU4Ezgt9VKNCWVjOsSupZJGqP1sfuiUnFllQMJY2ZKGzNXfExmNtJ5Ege2MqBnpZW8m/ud1UxPe+BmXSWpQssWiMBXExGT2NRlwhcyIiSWUKW5vJWxEFWXGZlOyIXjLL6+S1mXVc6te46pSu83jKMIJnMI5eHANNbiHOjSBAcIzvMKb8+i8OO/Ox6K14OQzx/AHzucPcYWMrw==</latexit><latexit sha1_base64="aWOcHJrcbrsxJSLO3n80z068CGE=">AAAB6HicbVBNS8NAEJ3Ur1q/qh69LBZBEEoigh6LXjy2YD+gDWWznbRrN5uwuxFK6C/w4kERr/4kb/4bt20O2vpg4PHeDDPzgkRwbVz32ymsrW9sbhW3Szu7e/sH5cOjlo5TxbDJYhGrTkA1Ci6xabgR2EkU0igQ2A7GdzO//YRK81g+mEmCfkSHkoecUWOlxkW/XHGr7hxklXg5qUCOer/81RvELI1QGiao1l3PTYyfUWU4Ezgt9VKNCWVjOsSupZJGqP1sfuiUnFllQMJY2ZKGzNXfExmNtJ5Ege2MqBnpZW8m/ud1UxPe+BmXSWpQssWiMBXExGT2NRlwhcyIiSWUKW5vJWxEFWXGZlOyIXjLL6+S1mXVc6te46pSu83jKMIJnMI5eHANNbiHOjSBAcIzvMKb8+i8OO/Ox6K14OQzx/AHzucPcYWMrw==</latexit><latexit sha1_base64="aWOcHJrcbrsxJSLO3n80z068CGE=">AAAB6HicbVBNS8NAEJ3Ur1q/qh69LBZBEEoigh6LXjy2YD+gDWWznbRrN5uwuxFK6C/w4kERr/4kb/4bt20O2vpg4PHeDDPzgkRwbVz32ymsrW9sbhW3Szu7e/sH5cOjlo5TxbDJYhGrTkA1Ci6xabgR2EkU0igQ2A7GdzO//YRK81g+mEmCfkSHkoecUWOlxkW/XHGr7hxklXg5qUCOer/81RvELI1QGiao1l3PTYyfUWU4Ezgt9VKNCWVjOsSupZJGqP1sfuiUnFllQMJY2ZKGzNXfExmNtJ5Ege2MqBnpZW8m/ud1UxPe+BmXSWpQssWiMBXExGT2NRlwhcyIiSWUKW5vJWxEFWXGZlOyIXjLL6+S1mXVc6te46pSu83jKMIJnMI5eHANNbiHOjSBAcIzvMKb8+i8OO/Ox6K14OQzx/AHzucPcYWMrw==</latexit><latexit sha1_base64="aWOcHJrcbrsxJSLO3n80z068CGE=">AAAB6HicbVBNS8NAEJ3Ur1q/qh69LBZBEEoigh6LXjy2YD+gDWWznbRrN5uwuxFK6C/w4kERr/4kb/4bt20O2vpg4PHeDDPzgkRwbVz32ymsrW9sbhW3Szu7e/sH5cOjlo5TxbDJYhGrTkA1Ci6xabgR2EkU0igQ2A7GdzO//YRK81g+mEmCfkSHkoecUWOlxkW/XHGr7hxklXg5qUCOer/81RvELI1QGiao1l3PTYyfUWU4Ezgt9VKNCWVjOsSupZJGqP1sfuiUnFllQMJY2ZKGzNXfExmNtJ5Ege2MqBnpZW8m/ud1UxPe+BmXSWpQssWiMBXExGT2NRlwhcyIiSWUKW5vJWxEFWXGZlOyIXjLL6+S1mXVc6te46pSu83jKMIJnMI5eHANNbiHOjSBAcIzvMKb8+i8OO/Ox6K14OQzx/AHzucPcYWMrw==</latexit>

Page 5: SimBA: Simple Black-box Adversarial Attacks · SimBA: Simple Black-box Adversarial Attacks Chuan Guo, Jacob R. Gardner, Yurong You, Andrew Gordon Wilson, Kilian Q. Weinberger. Adversarial

Black-box Attacks

✤ Black-box attacks are costly and existing approaches are complicated

Brendel et al., 2018

Cheng et al., 2018

Guo et al., 2019

Ilyas et al., 2018

Ilyas et al., 2019

Page 6: SimBA: Simple Black-box Adversarial Attacks · SimBA: Simple Black-box Adversarial Attacks Chuan Guo, Jacob R. Gardner, Yurong You, Andrew Gordon Wilson, Kilian Q. Weinberger. Adversarial

Simple Black-box Attack (SimBA)

x<latexit sha1_base64="P/78WoKPqTPMAmrnJ7K8sbyWLsQ=">AAAB8XicbVBNS8NAFHypX7V+VT16WSyCp5KIoMeiF48VbCu2oWy2m3bpZhN2X8QS+i+8eFDEq//Gm//GTZuDtg4sDDPvsfMmSKQw6LrfTmlldW19o7xZ2dre2d2r7h+0TZxqxlsslrG+D6jhUijeQoGS3yea0yiQvBOMr3O/88i1EbG6w0nC/YgOlQgFo2ilh15EcRSE2dO0X625dXcGsky8gtSgQLNf/eoNYpZGXCGT1Jiu5yboZ1SjYJJPK73U8ISyMR3yrqWKRtz42SzxlJxYZUDCWNunkMzU3xsZjYyZRIGdzBOaRS8X//O6KYaXfiZUkiJXbP5RmEqCMcnPJwOhOUM5sYQyLWxWwkZUU4a2pIotwVs8eZm0z+qeW/duz2uNq6KOMhzBMZyCBxfQgBtoQgsYKHiGV3hzjPPivDsf89GSU+wcwh84nz/9OZEc</latexit><latexit sha1_base64="P/78WoKPqTPMAmrnJ7K8sbyWLsQ=">AAAB8XicbVBNS8NAFHypX7V+VT16WSyCp5KIoMeiF48VbCu2oWy2m3bpZhN2X8QS+i+8eFDEq//Gm//GTZuDtg4sDDPvsfMmSKQw6LrfTmlldW19o7xZ2dre2d2r7h+0TZxqxlsslrG+D6jhUijeQoGS3yea0yiQvBOMr3O/88i1EbG6w0nC/YgOlQgFo2ilh15EcRSE2dO0X625dXcGsky8gtSgQLNf/eoNYpZGXCGT1Jiu5yboZ1SjYJJPK73U8ISyMR3yrqWKRtz42SzxlJxYZUDCWNunkMzU3xsZjYyZRIGdzBOaRS8X//O6KYaXfiZUkiJXbP5RmEqCMcnPJwOhOUM5sYQyLWxWwkZUU4a2pIotwVs8eZm0z+qeW/duz2uNq6KOMhzBMZyCBxfQgBtoQgsYKHiGV3hzjPPivDsf89GSU+wcwh84nz/9OZEc</latexit><latexit sha1_base64="P/78WoKPqTPMAmrnJ7K8sbyWLsQ=">AAAB8XicbVBNS8NAFHypX7V+VT16WSyCp5KIoMeiF48VbCu2oWy2m3bpZhN2X8QS+i+8eFDEq//Gm//GTZuDtg4sDDPvsfMmSKQw6LrfTmlldW19o7xZ2dre2d2r7h+0TZxqxlsslrG+D6jhUijeQoGS3yea0yiQvBOMr3O/88i1EbG6w0nC/YgOlQgFo2ilh15EcRSE2dO0X625dXcGsky8gtSgQLNf/eoNYpZGXCGT1Jiu5yboZ1SjYJJPK73U8ISyMR3yrqWKRtz42SzxlJxYZUDCWNunkMzU3xsZjYyZRIGdzBOaRS8X//O6KYaXfiZUkiJXbP5RmEqCMcnPJwOhOUM5sYQyLWxWwkZUU4a2pIotwVs8eZm0z+qeW/duz2uNq6KOMhzBMZyCBxfQgBtoQgsYKHiGV3hzjPPivDsf89GSU+wcwh84nz/9OZEc</latexit><latexit sha1_base64="P/78WoKPqTPMAmrnJ7K8sbyWLsQ=">AAAB8XicbVBNS8NAFHypX7V+VT16WSyCp5KIoMeiF48VbCu2oWy2m3bpZhN2X8QS+i+8eFDEq//Gm//GTZuDtg4sDDPvsfMmSKQw6LrfTmlldW19o7xZ2dre2d2r7h+0TZxqxlsslrG+D6jhUijeQoGS3yea0yiQvBOMr3O/88i1EbG6w0nC/YgOlQgFo2ilh15EcRSE2dO0X625dXcGsky8gtSgQLNf/eoNYpZGXCGT1Jiu5yboZ1SjYJJPK73U8ISyMR3yrqWKRtz42SzxlJxYZUDCWNunkMzU3xsZjYyZRIGdzBOaRS8X//O6KYaXfiZUkiJXbP5RmEqCMcnPJwOhOUM5sYQyLWxWwkZUU4a2pIotwVs8eZm0z+qeW/duz2uNq6KOMhzBMZyCBxfQgBtoQgsYKHiGV3hzjPPivDsf89GSU+wcwh84nz/9OZEc</latexit>

+✏<latexit sha1_base64="bw4LelN1w3VUQih3C5XrU9toAkI=">AAACAXicbVBNSwMxEJ2tX7V+Vb0IXoJFEISyK4Iei148VrC10F1KNp22odnskmSFstSLf8WLB0W8+i+8+W9M2z1o64OBx3szmcwLE8G1cd1vp7C0vLK6VlwvbWxube+Ud/eaOk4VwwaLRaxaIdUouMSG4UZgK1FIo1DgfTi8nvj3D6g0j+WdGSUYRLQveY8zaqzUKR/40zeyvkKUY3JKfEw0FxOr4lbdKcgi8XJSgRz1TvnL78YsjVAaJqjWbc9NTJBRZTgTOC75qcaEsiHtY9tSSSPUQTbdPibHVumSXqxsSUOm6u+JjEZaj6LQdkbUDPS8NxH/89qp6V0GGZdJalCy2aJeKoiJySQO0uUKmREjSyhT3P6VsAFVlBkbWsmG4M2fvEiaZ1XPrXq355XaVR5HEQ7hCE7AgwuowQ3UoQEMHuEZXuHNeXJenHfnY9ZacPKZffgD5/MHdWmW4A==</latexit><latexit sha1_base64="bw4LelN1w3VUQih3C5XrU9toAkI=">AAACAXicbVBNSwMxEJ2tX7V+Vb0IXoJFEISyK4Iei148VrC10F1KNp22odnskmSFstSLf8WLB0W8+i+8+W9M2z1o64OBx3szmcwLE8G1cd1vp7C0vLK6VlwvbWxube+Ud/eaOk4VwwaLRaxaIdUouMSG4UZgK1FIo1DgfTi8nvj3D6g0j+WdGSUYRLQveY8zaqzUKR/40zeyvkKUY3JKfEw0FxOr4lbdKcgi8XJSgRz1TvnL78YsjVAaJqjWbc9NTJBRZTgTOC75qcaEsiHtY9tSSSPUQTbdPibHVumSXqxsSUOm6u+JjEZaj6LQdkbUDPS8NxH/89qp6V0GGZdJalCy2aJeKoiJySQO0uUKmREjSyhT3P6VsAFVlBkbWsmG4M2fvEiaZ1XPrXq355XaVR5HEQ7hCE7AgwuowQ3UoQEMHuEZXuHNeXJenHfnY9ZacPKZffgD5/MHdWmW4A==</latexit><latexit sha1_base64="bw4LelN1w3VUQih3C5XrU9toAkI=">AAACAXicbVBNSwMxEJ2tX7V+Vb0IXoJFEISyK4Iei148VrC10F1KNp22odnskmSFstSLf8WLB0W8+i+8+W9M2z1o64OBx3szmcwLE8G1cd1vp7C0vLK6VlwvbWxube+Ud/eaOk4VwwaLRaxaIdUouMSG4UZgK1FIo1DgfTi8nvj3D6g0j+WdGSUYRLQveY8zaqzUKR/40zeyvkKUY3JKfEw0FxOr4lbdKcgi8XJSgRz1TvnL78YsjVAaJqjWbc9NTJBRZTgTOC75qcaEsiHtY9tSSSPUQTbdPibHVumSXqxsSUOm6u+JjEZaj6LQdkbUDPS8NxH/89qp6V0GGZdJalCy2aJeKoiJySQO0uUKmREjSyhT3P6VsAFVlBkbWsmG4M2fvEiaZ1XPrXq355XaVR5HEQ7hCE7AgwuowQ3UoQEMHuEZXuHNeXJenHfnY9ZacPKZffgD5/MHdWmW4A==</latexit><latexit sha1_base64="bw4LelN1w3VUQih3C5XrU9toAkI=">AAACAXicbVBNSwMxEJ2tX7V+Vb0IXoJFEISyK4Iei148VrC10F1KNp22odnskmSFstSLf8WLB0W8+i+8+W9M2z1o64OBx3szmcwLE8G1cd1vp7C0vLK6VlwvbWxube+Ud/eaOk4VwwaLRaxaIdUouMSG4UZgK1FIo1DgfTi8nvj3D6g0j+WdGSUYRLQveY8zaqzUKR/40zeyvkKUY3JKfEw0FxOr4lbdKcgi8XJSgRz1TvnL78YsjVAaJqjWbc9NTJBRZTgTOC75qcaEsiHtY9tSSSPUQTbdPibHVumSXqxsSUOm6u+JjEZaj6LQdkbUDPS8NxH/89qp6V0GGZdJalCy2aJeKoiJySQO0uUKmREjSyhT3P6VsAFVlBkbWsmG4M2fvEiaZ1XPrXq355XaVR5HEQ7hCE7AgwuowQ3UoQEMHuEZXuHNeXJenHfnY9ZacPKZffgD5/MHdWmW4A==</latexit>

�✏<latexit sha1_base64="itdpNiRN4ATA+sSNHWPhxin61qI=">AAACAHicbVDLSsNAFJ3UV62vqgsXbgaL4MaSiKDLohuXFewDmlAm05t26GQSZiZCCdn4K25cKOLWz3Dn3zhJs9DWAxcO59w7d+7xY86Utu1vq7Kyura+Ud2sbW3v7O7V9w+6KkokhQ6NeCT7PlHAmYCOZppDP5ZAQp9Dz5/e5n7vEaRikXjQsxi8kIwFCxgl2kjD+pFbvJH6PIEMn2MXYsV47jTspl0ALxOnJA1Uoj2sf7mjiCYhCE05UWrg2LH2UiI1oxyympsoiAmdkjEMDBUkBOWlxfIMnxplhINImhIaF+rviZSESs1C33SGRE/UopeL/3mDRAfXXspEnGgQdL4oSDjWEc7TwCMmgWo+M4RQycxfMZ0QSag2mdVMCM7iycuke9F07KZzf9lo3ZRxVNExOkFnyEFXqIXuUBt1EEUZekav6M16sl6sd+tj3lqxyplD9AfW5w+qkZZv</latexit><latexit sha1_base64="itdpNiRN4ATA+sSNHWPhxin61qI=">AAACAHicbVDLSsNAFJ3UV62vqgsXbgaL4MaSiKDLohuXFewDmlAm05t26GQSZiZCCdn4K25cKOLWz3Dn3zhJs9DWAxcO59w7d+7xY86Utu1vq7Kyura+Ud2sbW3v7O7V9w+6KkokhQ6NeCT7PlHAmYCOZppDP5ZAQp9Dz5/e5n7vEaRikXjQsxi8kIwFCxgl2kjD+pFbvJH6PIEMn2MXYsV47jTspl0ALxOnJA1Uoj2sf7mjiCYhCE05UWrg2LH2UiI1oxyympsoiAmdkjEMDBUkBOWlxfIMnxplhINImhIaF+rviZSESs1C33SGRE/UopeL/3mDRAfXXspEnGgQdL4oSDjWEc7TwCMmgWo+M4RQycxfMZ0QSag2mdVMCM7iycuke9F07KZzf9lo3ZRxVNExOkFnyEFXqIXuUBt1EEUZekav6M16sl6sd+tj3lqxyplD9AfW5w+qkZZv</latexit><latexit sha1_base64="itdpNiRN4ATA+sSNHWPhxin61qI=">AAACAHicbVDLSsNAFJ3UV62vqgsXbgaL4MaSiKDLohuXFewDmlAm05t26GQSZiZCCdn4K25cKOLWz3Dn3zhJs9DWAxcO59w7d+7xY86Utu1vq7Kyura+Ud2sbW3v7O7V9w+6KkokhQ6NeCT7PlHAmYCOZppDP5ZAQp9Dz5/e5n7vEaRikXjQsxi8kIwFCxgl2kjD+pFbvJH6PIEMn2MXYsV47jTspl0ALxOnJA1Uoj2sf7mjiCYhCE05UWrg2LH2UiI1oxyympsoiAmdkjEMDBUkBOWlxfIMnxplhINImhIaF+rviZSESs1C33SGRE/UopeL/3mDRAfXXspEnGgQdL4oSDjWEc7TwCMmgWo+M4RQycxfMZ0QSag2mdVMCM7iycuke9F07KZzf9lo3ZRxVNExOkFnyEFXqIXuUBt1EEUZekav6M16sl6sd+tj3lqxyplD9AfW5w+qkZZv</latexit><latexit sha1_base64="itdpNiRN4ATA+sSNHWPhxin61qI=">AAACAHicbVDLSsNAFJ3UV62vqgsXbgaL4MaSiKDLohuXFewDmlAm05t26GQSZiZCCdn4K25cKOLWz3Dn3zhJs9DWAxcO59w7d+7xY86Utu1vq7Kyura+Ud2sbW3v7O7V9w+6KkokhQ6NeCT7PlHAmYCOZppDP5ZAQp9Dz5/e5n7vEaRikXjQsxi8kIwFCxgl2kjD+pFbvJH6PIEMn2MXYsV47jTspl0ALxOnJA1Uoj2sf7mjiCYhCE05UWrg2LH2UiI1oxyympsoiAmdkjEMDBUkBOWlxfIMnxplhINImhIaF+rviZSESs1C33SGRE/UopeL/3mDRAfXXspEnGgQdL4oSDjWEc7TwCMmgWo+M4RQycxfMZ0QSag2mdVMCM7iycuke9F07KZzf9lo3ZRxVNExOkFnyEFXqIXuUBt1EEUZekav6M16sl6sd+tj3lqxyplD9AfW5w+qkZZv</latexit>

x+<latexit sha1_base64="c2u5ctJ8kP52hs64MllXycXX0hw=">AAACA3icbVDLSsNAFJ3UV62vqDvdDBZBEEoigi6LblxWsA9oS5lMb9qhk0mYmYglBNz4K25cKOLWn3Dn3zhJs9DWAwOHc+5rjhdxprTjfFulpeWV1bXyemVjc2t7x97da6kwlhSaNOSh7HhEAWcCmpppDp1IAgk8Dm1vcp357XuQioXiTk8j6AdkJJjPKNFGGtgHvXxGMpIAIsW9gOix5ycP6eB0YFedmpMDLxK3IFVUoDGwv3rDkMYBCE05UarrOpHuJ0RqRjmklV6sICJ0QkbQNVSQAFQ/yfen+NgoQ+yH0jyhca7+7khIoNQ08ExldqOa9zLxP68ba/+ynzARxRoEnS3yY451iLNA8JBJoJpPDSFUMnMrpmMiCdUmtooJwZ3/8iJpndVcp+benlfrV0UcZXSIjtAJctEFqqMb1EBNRNEjekav6M16sl6sd+tjVlqyip599AfW5w+Xepgb</latexit><latexit sha1_base64="c2u5ctJ8kP52hs64MllXycXX0hw=">AAACA3icbVDLSsNAFJ3UV62vqDvdDBZBEEoigi6LblxWsA9oS5lMb9qhk0mYmYglBNz4K25cKOLWn3Dn3zhJs9DWAwOHc+5rjhdxprTjfFulpeWV1bXyemVjc2t7x97da6kwlhSaNOSh7HhEAWcCmpppDp1IAgk8Dm1vcp357XuQioXiTk8j6AdkJJjPKNFGGtgHvXxGMpIAIsW9gOix5ycP6eB0YFedmpMDLxK3IFVUoDGwv3rDkMYBCE05UarrOpHuJ0RqRjmklV6sICJ0QkbQNVSQAFQ/yfen+NgoQ+yH0jyhca7+7khIoNQ08ExldqOa9zLxP68ba/+ynzARxRoEnS3yY451iLNA8JBJoJpPDSFUMnMrpmMiCdUmtooJwZ3/8iJpndVcp+benlfrV0UcZXSIjtAJctEFqqMb1EBNRNEjekav6M16sl6sd+tjVlqyip599AfW5w+Xepgb</latexit><latexit sha1_base64="c2u5ctJ8kP52hs64MllXycXX0hw=">AAACA3icbVDLSsNAFJ3UV62vqDvdDBZBEEoigi6LblxWsA9oS5lMb9qhk0mYmYglBNz4K25cKOLWn3Dn3zhJs9DWAwOHc+5rjhdxprTjfFulpeWV1bXyemVjc2t7x97da6kwlhSaNOSh7HhEAWcCmpppDp1IAgk8Dm1vcp357XuQioXiTk8j6AdkJJjPKNFGGtgHvXxGMpIAIsW9gOix5ycP6eB0YFedmpMDLxK3IFVUoDGwv3rDkMYBCE05UarrOpHuJ0RqRjmklV6sICJ0QkbQNVSQAFQ/yfen+NgoQ+yH0jyhca7+7khIoNQ08ExldqOa9zLxP68ba/+ynzARxRoEnS3yY451iLNA8JBJoJpPDSFUMnMrpmMiCdUmtooJwZ3/8iJpndVcp+benlfrV0UcZXSIjtAJctEFqqMb1EBNRNEjekav6M16sl6sd+tjVlqyip599AfW5w+Xepgb</latexit><latexit sha1_base64="c2u5ctJ8kP52hs64MllXycXX0hw=">AAACA3icbVDLSsNAFJ3UV62vqDvdDBZBEEoigi6LblxWsA9oS5lMb9qhk0mYmYglBNz4K25cKOLWn3Dn3zhJs9DWAwOHc+5rjhdxprTjfFulpeWV1bXyemVjc2t7x97da6kwlhSaNOSh7HhEAWcCmpppDp1IAgk8Dm1vcp357XuQioXiTk8j6AdkJJjPKNFGGtgHvXxGMpIAIsW9gOix5ycP6eB0YFedmpMDLxK3IFVUoDGwv3rDkMYBCE05UarrOpHuJ0RqRjmklV6sICJ0QkbQNVSQAFQ/yfen+NgoQ+yH0jyhca7+7khIoNQ08ExldqOa9zLxP68ba/+ynzARxRoEnS3yY451iLNA8JBJoJpPDSFUMnMrpmMiCdUmtooJwZ3/8iJpndVcp+benlfrV0UcZXSIjtAJctEFqqMb1EBNRNEjekav6M16sl6sd+tjVlqyip599AfW5w+Xepgb</latexit>

x�<latexit sha1_base64="vBq5WUZhj2F4gNwNCtzcp3V40aw=">AAACAnicbVDLSsNAFL2pr1pfUVfiZrAIbiyJCLosunFZwT6gDWEynbRDJw9mJmIJwY2/4saFIm79Cnf+jZM0C209MHA4577meDFnUlnWt1FZWl5ZXauu1zY2t7Z3zN29jowSQWibRDwSPQ9LyllI24opTnuxoDjwOO16k+vc795TIVkU3qlpTJ0Aj0LmM4KVllzzYFDMSD2e0AwNAqzGnp8+ZO6pa9athlUALRK7JHUo0XLNr8EwIklAQ0U4lrJvW7FyUiwUI5xmtUEiaYzJBI9oX9MQB1Q6abE+Q8daGSI/EvqFChXq744UB1JOA09X5jfKeS8X//P6ifIvnZSFcaJoSGaL/IQjFaE8DzRkghLFp5pgIpi+FZExFpgonVpNh2DPf3mRdM4attWwb8/rzasyjiocwhGcgA0X0IQbaEEbCDzCM7zCm/FkvBjvxsestGKUPfvwB8bnD8u6l6o=</latexit><latexit sha1_base64="vBq5WUZhj2F4gNwNCtzcp3V40aw=">AAACAnicbVDLSsNAFL2pr1pfUVfiZrAIbiyJCLosunFZwT6gDWEynbRDJw9mJmIJwY2/4saFIm79Cnf+jZM0C209MHA4577meDFnUlnWt1FZWl5ZXauu1zY2t7Z3zN29jowSQWibRDwSPQ9LyllI24opTnuxoDjwOO16k+vc795TIVkU3qlpTJ0Aj0LmM4KVllzzYFDMSD2e0AwNAqzGnp8+ZO6pa9athlUALRK7JHUo0XLNr8EwIklAQ0U4lrJvW7FyUiwUI5xmtUEiaYzJBI9oX9MQB1Q6abE+Q8daGSI/EvqFChXq744UB1JOA09X5jfKeS8X//P6ifIvnZSFcaJoSGaL/IQjFaE8DzRkghLFp5pgIpi+FZExFpgonVpNh2DPf3mRdM4attWwb8/rzasyjiocwhGcgA0X0IQbaEEbCDzCM7zCm/FkvBjvxsestGKUPfvwB8bnD8u6l6o=</latexit><latexit sha1_base64="vBq5WUZhj2F4gNwNCtzcp3V40aw=">AAACAnicbVDLSsNAFL2pr1pfUVfiZrAIbiyJCLosunFZwT6gDWEynbRDJw9mJmIJwY2/4saFIm79Cnf+jZM0C209MHA4577meDFnUlnWt1FZWl5ZXauu1zY2t7Z3zN29jowSQWibRDwSPQ9LyllI24opTnuxoDjwOO16k+vc795TIVkU3qlpTJ0Aj0LmM4KVllzzYFDMSD2e0AwNAqzGnp8+ZO6pa9athlUALRK7JHUo0XLNr8EwIklAQ0U4lrJvW7FyUiwUI5xmtUEiaYzJBI9oX9MQB1Q6abE+Q8daGSI/EvqFChXq744UB1JOA09X5jfKeS8X//P6ifIvnZSFcaJoSGaL/IQjFaE8DzRkghLFp5pgIpi+FZExFpgonVpNh2DPf3mRdM4attWwb8/rzasyjiocwhGcgA0X0IQbaEEbCDzCM7zCm/FkvBjvxsestGKUPfvwB8bnD8u6l6o=</latexit><latexit sha1_base64="vBq5WUZhj2F4gNwNCtzcp3V40aw=">AAACAnicbVDLSsNAFL2pr1pfUVfiZrAIbiyJCLosunFZwT6gDWEynbRDJw9mJmIJwY2/4saFIm79Cnf+jZM0C209MHA4577meDFnUlnWt1FZWl5ZXauu1zY2t7Z3zN29jowSQWibRDwSPQ9LyllI24opTnuxoDjwOO16k+vc795TIVkU3qlpTJ0Aj0LmM4KVllzzYFDMSD2e0AwNAqzGnp8+ZO6pa9athlUALRK7JHUo0XLNr8EwIklAQ0U4lrJvW7FyUiwUI5xmtUEiaYzJBI9oX9MQB1Q6abE+Q8daGSI/EvqFChXq744UB1JOA09X5jfKeS8X//P6ifIvnZSFcaJoSGaL/IQjFaE8DzRkghLFp5pgIpi+FZExFpgonVpNh2DPf3mRdM4attWwb8/rzasyjiocwhGcgA0X0IQbaEEbCDzCM7zCm/FkvBjvxsestGKUPfvwB8bnD8u6l6o=</latexit>

Page 7: SimBA: Simple Black-box Adversarial Attacks · SimBA: Simple Black-box Adversarial Attacks Chuan Guo, Jacob R. Gardner, Yurong You, Andrew Gordon Wilson, Kilian Q. Weinberger. Adversarial

Simple Black-box Attack (SimBA)

✤ Can be implemented in ~20 lines of code!

x<latexit sha1_base64="P/78WoKPqTPMAmrnJ7K8sbyWLsQ=">AAAB8XicbVBNS8NAFHypX7V+VT16WSyCp5KIoMeiF48VbCu2oWy2m3bpZhN2X8QS+i+8eFDEq//Gm//GTZuDtg4sDDPvsfMmSKQw6LrfTmlldW19o7xZ2dre2d2r7h+0TZxqxlsslrG+D6jhUijeQoGS3yea0yiQvBOMr3O/88i1EbG6w0nC/YgOlQgFo2ilh15EcRSE2dO0X625dXcGsky8gtSgQLNf/eoNYpZGXCGT1Jiu5yboZ1SjYJJPK73U8ISyMR3yrqWKRtz42SzxlJxYZUDCWNunkMzU3xsZjYyZRIGdzBOaRS8X//O6KYaXfiZUkiJXbP5RmEqCMcnPJwOhOUM5sYQyLWxWwkZUU4a2pIotwVs8eZm0z+qeW/duz2uNq6KOMhzBMZyCBxfQgBtoQgsYKHiGV3hzjPPivDsf89GSU+wcwh84nz/9OZEc</latexit><latexit sha1_base64="P/78WoKPqTPMAmrnJ7K8sbyWLsQ=">AAAB8XicbVBNS8NAFHypX7V+VT16WSyCp5KIoMeiF48VbCu2oWy2m3bpZhN2X8QS+i+8eFDEq//Gm//GTZuDtg4sDDPvsfMmSKQw6LrfTmlldW19o7xZ2dre2d2r7h+0TZxqxlsslrG+D6jhUijeQoGS3yea0yiQvBOMr3O/88i1EbG6w0nC/YgOlQgFo2ilh15EcRSE2dO0X625dXcGsky8gtSgQLNf/eoNYpZGXCGT1Jiu5yboZ1SjYJJPK73U8ISyMR3yrqWKRtz42SzxlJxYZUDCWNunkMzU3xsZjYyZRIGdzBOaRS8X//O6KYaXfiZUkiJXbP5RmEqCMcnPJwOhOUM5sYQyLWxWwkZUU4a2pIotwVs8eZm0z+qeW/duz2uNq6KOMhzBMZyCBxfQgBtoQgsYKHiGV3hzjPPivDsf89GSU+wcwh84nz/9OZEc</latexit><latexit sha1_base64="P/78WoKPqTPMAmrnJ7K8sbyWLsQ=">AAAB8XicbVBNS8NAFHypX7V+VT16WSyCp5KIoMeiF48VbCu2oWy2m3bpZhN2X8QS+i+8eFDEq//Gm//GTZuDtg4sDDPvsfMmSKQw6LrfTmlldW19o7xZ2dre2d2r7h+0TZxqxlsslrG+D6jhUijeQoGS3yea0yiQvBOMr3O/88i1EbG6w0nC/YgOlQgFo2ilh15EcRSE2dO0X625dXcGsky8gtSgQLNf/eoNYpZGXCGT1Jiu5yboZ1SjYJJPK73U8ISyMR3yrqWKRtz42SzxlJxYZUDCWNunkMzU3xsZjYyZRIGdzBOaRS8X//O6KYaXfiZUkiJXbP5RmEqCMcnPJwOhOUM5sYQyLWxWwkZUU4a2pIotwVs8eZm0z+qeW/duz2uNq6KOMhzBMZyCBxfQgBtoQgsYKHiGV3hzjPPivDsf89GSU+wcwh84nz/9OZEc</latexit><latexit sha1_base64="P/78WoKPqTPMAmrnJ7K8sbyWLsQ=">AAAB8XicbVBNS8NAFHypX7V+VT16WSyCp5KIoMeiF48VbCu2oWy2m3bpZhN2X8QS+i+8eFDEq//Gm//GTZuDtg4sDDPvsfMmSKQw6LrfTmlldW19o7xZ2dre2d2r7h+0TZxqxlsslrG+D6jhUijeQoGS3yea0yiQvBOMr3O/88i1EbG6w0nC/YgOlQgFo2ilh15EcRSE2dO0X625dXcGsky8gtSgQLNf/eoNYpZGXCGT1Jiu5yboZ1SjYJJPK73U8ISyMR3yrqWKRtz42SzxlJxYZUDCWNunkMzU3xsZjYyZRIGdzBOaRS8X//O6KYaXfiZUkiJXbP5RmEqCMcnPJwOhOUM5sYQyLWxWwkZUU4a2pIotwVs8eZm0z+qeW/duz2uNq6KOMhzBMZyCBxfQgBtoQgsYKHiGV3hzjPPivDsf89GSU+wcwh84nz/9OZEc</latexit>

+✏<latexit sha1_base64="bw4LelN1w3VUQih3C5XrU9toAkI=">AAACAXicbVBNSwMxEJ2tX7V+Vb0IXoJFEISyK4Iei148VrC10F1KNp22odnskmSFstSLf8WLB0W8+i+8+W9M2z1o64OBx3szmcwLE8G1cd1vp7C0vLK6VlwvbWxube+Ud/eaOk4VwwaLRaxaIdUouMSG4UZgK1FIo1DgfTi8nvj3D6g0j+WdGSUYRLQveY8zaqzUKR/40zeyvkKUY3JKfEw0FxOr4lbdKcgi8XJSgRz1TvnL78YsjVAaJqjWbc9NTJBRZTgTOC75qcaEsiHtY9tSSSPUQTbdPibHVumSXqxsSUOm6u+JjEZaj6LQdkbUDPS8NxH/89qp6V0GGZdJalCy2aJeKoiJySQO0uUKmREjSyhT3P6VsAFVlBkbWsmG4M2fvEiaZ1XPrXq355XaVR5HEQ7hCE7AgwuowQ3UoQEMHuEZXuHNeXJenHfnY9ZacPKZffgD5/MHdWmW4A==</latexit><latexit sha1_base64="bw4LelN1w3VUQih3C5XrU9toAkI=">AAACAXicbVBNSwMxEJ2tX7V+Vb0IXoJFEISyK4Iei148VrC10F1KNp22odnskmSFstSLf8WLB0W8+i+8+W9M2z1o64OBx3szmcwLE8G1cd1vp7C0vLK6VlwvbWxube+Ud/eaOk4VwwaLRaxaIdUouMSG4UZgK1FIo1DgfTi8nvj3D6g0j+WdGSUYRLQveY8zaqzUKR/40zeyvkKUY3JKfEw0FxOr4lbdKcgi8XJSgRz1TvnL78YsjVAaJqjWbc9NTJBRZTgTOC75qcaEsiHtY9tSSSPUQTbdPibHVumSXqxsSUOm6u+JjEZaj6LQdkbUDPS8NxH/89qp6V0GGZdJalCy2aJeKoiJySQO0uUKmREjSyhT3P6VsAFVlBkbWsmG4M2fvEiaZ1XPrXq355XaVR5HEQ7hCE7AgwuowQ3UoQEMHuEZXuHNeXJenHfnY9ZacPKZffgD5/MHdWmW4A==</latexit><latexit sha1_base64="bw4LelN1w3VUQih3C5XrU9toAkI=">AAACAXicbVBNSwMxEJ2tX7V+Vb0IXoJFEISyK4Iei148VrC10F1KNp22odnskmSFstSLf8WLB0W8+i+8+W9M2z1o64OBx3szmcwLE8G1cd1vp7C0vLK6VlwvbWxube+Ud/eaOk4VwwaLRaxaIdUouMSG4UZgK1FIo1DgfTi8nvj3D6g0j+WdGSUYRLQveY8zaqzUKR/40zeyvkKUY3JKfEw0FxOr4lbdKcgi8XJSgRz1TvnL78YsjVAaJqjWbc9NTJBRZTgTOC75qcaEsiHtY9tSSSPUQTbdPibHVumSXqxsSUOm6u+JjEZaj6LQdkbUDPS8NxH/89qp6V0GGZdJalCy2aJeKoiJySQO0uUKmREjSyhT3P6VsAFVlBkbWsmG4M2fvEiaZ1XPrXq355XaVR5HEQ7hCE7AgwuowQ3UoQEMHuEZXuHNeXJenHfnY9ZacPKZffgD5/MHdWmW4A==</latexit><latexit sha1_base64="bw4LelN1w3VUQih3C5XrU9toAkI=">AAACAXicbVBNSwMxEJ2tX7V+Vb0IXoJFEISyK4Iei148VrC10F1KNp22odnskmSFstSLf8WLB0W8+i+8+W9M2z1o64OBx3szmcwLE8G1cd1vp7C0vLK6VlwvbWxube+Ud/eaOk4VwwaLRaxaIdUouMSG4UZgK1FIo1DgfTi8nvj3D6g0j+WdGSUYRLQveY8zaqzUKR/40zeyvkKUY3JKfEw0FxOr4lbdKcgi8XJSgRz1TvnL78YsjVAaJqjWbc9NTJBRZTgTOC75qcaEsiHtY9tSSSPUQTbdPibHVumSXqxsSUOm6u+JjEZaj6LQdkbUDPS8NxH/89qp6V0GGZdJalCy2aJeKoiJySQO0uUKmREjSyhT3P6VsAFVlBkbWsmG4M2fvEiaZ1XPrXq355XaVR5HEQ7hCE7AgwuowQ3UoQEMHuEZXuHNeXJenHfnY9ZacPKZffgD5/MHdWmW4A==</latexit>

�✏<latexit sha1_base64="itdpNiRN4ATA+sSNHWPhxin61qI=">AAACAHicbVDLSsNAFJ3UV62vqgsXbgaL4MaSiKDLohuXFewDmlAm05t26GQSZiZCCdn4K25cKOLWz3Dn3zhJs9DWAxcO59w7d+7xY86Utu1vq7Kyura+Ud2sbW3v7O7V9w+6KkokhQ6NeCT7PlHAmYCOZppDP5ZAQp9Dz5/e5n7vEaRikXjQsxi8kIwFCxgl2kjD+pFbvJH6PIEMn2MXYsV47jTspl0ALxOnJA1Uoj2sf7mjiCYhCE05UWrg2LH2UiI1oxyympsoiAmdkjEMDBUkBOWlxfIMnxplhINImhIaF+rviZSESs1C33SGRE/UopeL/3mDRAfXXspEnGgQdL4oSDjWEc7TwCMmgWo+M4RQycxfMZ0QSag2mdVMCM7iycuke9F07KZzf9lo3ZRxVNExOkFnyEFXqIXuUBt1EEUZekav6M16sl6sd+tj3lqxyplD9AfW5w+qkZZv</latexit><latexit sha1_base64="itdpNiRN4ATA+sSNHWPhxin61qI=">AAACAHicbVDLSsNAFJ3UV62vqgsXbgaL4MaSiKDLohuXFewDmlAm05t26GQSZiZCCdn4K25cKOLWz3Dn3zhJs9DWAxcO59w7d+7xY86Utu1vq7Kyura+Ud2sbW3v7O7V9w+6KkokhQ6NeCT7PlHAmYCOZppDP5ZAQp9Dz5/e5n7vEaRikXjQsxi8kIwFCxgl2kjD+pFbvJH6PIEMn2MXYsV47jTspl0ALxOnJA1Uoj2sf7mjiCYhCE05UWrg2LH2UiI1oxyympsoiAmdkjEMDBUkBOWlxfIMnxplhINImhIaF+rviZSESs1C33SGRE/UopeL/3mDRAfXXspEnGgQdL4oSDjWEc7TwCMmgWo+M4RQycxfMZ0QSag2mdVMCM7iycuke9F07KZzf9lo3ZRxVNExOkFnyEFXqIXuUBt1EEUZekav6M16sl6sd+tj3lqxyplD9AfW5w+qkZZv</latexit><latexit sha1_base64="itdpNiRN4ATA+sSNHWPhxin61qI=">AAACAHicbVDLSsNAFJ3UV62vqgsXbgaL4MaSiKDLohuXFewDmlAm05t26GQSZiZCCdn4K25cKOLWz3Dn3zhJs9DWAxcO59w7d+7xY86Utu1vq7Kyura+Ud2sbW3v7O7V9w+6KkokhQ6NeCT7PlHAmYCOZppDP5ZAQp9Dz5/e5n7vEaRikXjQsxi8kIwFCxgl2kjD+pFbvJH6PIEMn2MXYsV47jTspl0ALxOnJA1Uoj2sf7mjiCYhCE05UWrg2LH2UiI1oxyympsoiAmdkjEMDBUkBOWlxfIMnxplhINImhIaF+rviZSESs1C33SGRE/UopeL/3mDRAfXXspEnGgQdL4oSDjWEc7TwCMmgWo+M4RQycxfMZ0QSag2mdVMCM7iycuke9F07KZzf9lo3ZRxVNExOkFnyEFXqIXuUBt1EEUZekav6M16sl6sd+tj3lqxyplD9AfW5w+qkZZv</latexit><latexit sha1_base64="itdpNiRN4ATA+sSNHWPhxin61qI=">AAACAHicbVDLSsNAFJ3UV62vqgsXbgaL4MaSiKDLohuXFewDmlAm05t26GQSZiZCCdn4K25cKOLWz3Dn3zhJs9DWAxcO59w7d+7xY86Utu1vq7Kyura+Ud2sbW3v7O7V9w+6KkokhQ6NeCT7PlHAmYCOZppDP5ZAQp9Dz5/e5n7vEaRikXjQsxi8kIwFCxgl2kjD+pFbvJH6PIEMn2MXYsV47jTspl0ALxOnJA1Uoj2sf7mjiCYhCE05UWrg2LH2UiI1oxyympsoiAmdkjEMDBUkBOWlxfIMnxplhINImhIaF+rviZSESs1C33SGRE/UopeL/3mDRAfXXspEnGgQdL4oSDjWEc7TwCMmgWo+M4RQycxfMZ0QSag2mdVMCM7iycuke9F07KZzf9lo3ZRxVNExOkFnyEFXqIXuUBt1EEUZekav6M16sl6sd+tj3lqxyplD9AfW5w+qkZZv</latexit>

x+<latexit sha1_base64="c2u5ctJ8kP52hs64MllXycXX0hw=">AAACA3icbVDLSsNAFJ3UV62vqDvdDBZBEEoigi6LblxWsA9oS5lMb9qhk0mYmYglBNz4K25cKOLWn3Dn3zhJs9DWAwOHc+5rjhdxprTjfFulpeWV1bXyemVjc2t7x97da6kwlhSaNOSh7HhEAWcCmpppDp1IAgk8Dm1vcp357XuQioXiTk8j6AdkJJjPKNFGGtgHvXxGMpIAIsW9gOix5ycP6eB0YFedmpMDLxK3IFVUoDGwv3rDkMYBCE05UarrOpHuJ0RqRjmklV6sICJ0QkbQNVSQAFQ/yfen+NgoQ+yH0jyhca7+7khIoNQ08ExldqOa9zLxP68ba/+ynzARxRoEnS3yY451iLNA8JBJoJpPDSFUMnMrpmMiCdUmtooJwZ3/8iJpndVcp+benlfrV0UcZXSIjtAJctEFqqMb1EBNRNEjekav6M16sl6sd+tjVlqyip599AfW5w+Xepgb</latexit><latexit sha1_base64="c2u5ctJ8kP52hs64MllXycXX0hw=">AAACA3icbVDLSsNAFJ3UV62vqDvdDBZBEEoigi6LblxWsA9oS5lMb9qhk0mYmYglBNz4K25cKOLWn3Dn3zhJs9DWAwOHc+5rjhdxprTjfFulpeWV1bXyemVjc2t7x97da6kwlhSaNOSh7HhEAWcCmpppDp1IAgk8Dm1vcp357XuQioXiTk8j6AdkJJjPKNFGGtgHvXxGMpIAIsW9gOix5ycP6eB0YFedmpMDLxK3IFVUoDGwv3rDkMYBCE05UarrOpHuJ0RqRjmklV6sICJ0QkbQNVSQAFQ/yfen+NgoQ+yH0jyhca7+7khIoNQ08ExldqOa9zLxP68ba/+ynzARxRoEnS3yY451iLNA8JBJoJpPDSFUMnMrpmMiCdUmtooJwZ3/8iJpndVcp+benlfrV0UcZXSIjtAJctEFqqMb1EBNRNEjekav6M16sl6sd+tjVlqyip599AfW5w+Xepgb</latexit><latexit sha1_base64="c2u5ctJ8kP52hs64MllXycXX0hw=">AAACA3icbVDLSsNAFJ3UV62vqDvdDBZBEEoigi6LblxWsA9oS5lMb9qhk0mYmYglBNz4K25cKOLWn3Dn3zhJs9DWAwOHc+5rjhdxprTjfFulpeWV1bXyemVjc2t7x97da6kwlhSaNOSh7HhEAWcCmpppDp1IAgk8Dm1vcp357XuQioXiTk8j6AdkJJjPKNFGGtgHvXxGMpIAIsW9gOix5ycP6eB0YFedmpMDLxK3IFVUoDGwv3rDkMYBCE05UarrOpHuJ0RqRjmklV6sICJ0QkbQNVSQAFQ/yfen+NgoQ+yH0jyhca7+7khIoNQ08ExldqOa9zLxP68ba/+ynzARxRoEnS3yY451iLNA8JBJoJpPDSFUMnMrpmMiCdUmtooJwZ3/8iJpndVcp+benlfrV0UcZXSIjtAJctEFqqMb1EBNRNEjekav6M16sl6sd+tjVlqyip599AfW5w+Xepgb</latexit><latexit sha1_base64="c2u5ctJ8kP52hs64MllXycXX0hw=">AAACA3icbVDLSsNAFJ3UV62vqDvdDBZBEEoigi6LblxWsA9oS5lMb9qhk0mYmYglBNz4K25cKOLWn3Dn3zhJs9DWAwOHc+5rjhdxprTjfFulpeWV1bXyemVjc2t7x97da6kwlhSaNOSh7HhEAWcCmpppDp1IAgk8Dm1vcp357XuQioXiTk8j6AdkJJjPKNFGGtgHvXxGMpIAIsW9gOix5ycP6eB0YFedmpMDLxK3IFVUoDGwv3rDkMYBCE05UarrOpHuJ0RqRjmklV6sICJ0QkbQNVSQAFQ/yfen+NgoQ+yH0jyhca7+7khIoNQ08ExldqOa9zLxP68ba/+ynzARxRoEnS3yY451iLNA8JBJoJpPDSFUMnMrpmMiCdUmtooJwZ3/8iJpndVcp+benlfrV0UcZXSIjtAJctEFqqMb1EBNRNEjekav6M16sl6sd+tjVlqyip599AfW5w+Xepgb</latexit>

x�<latexit sha1_base64="vBq5WUZhj2F4gNwNCtzcp3V40aw=">AAACAnicbVDLSsNAFL2pr1pfUVfiZrAIbiyJCLosunFZwT6gDWEynbRDJw9mJmIJwY2/4saFIm79Cnf+jZM0C209MHA4577meDFnUlnWt1FZWl5ZXauu1zY2t7Z3zN29jowSQWibRDwSPQ9LyllI24opTnuxoDjwOO16k+vc795TIVkU3qlpTJ0Aj0LmM4KVllzzYFDMSD2e0AwNAqzGnp8+ZO6pa9athlUALRK7JHUo0XLNr8EwIklAQ0U4lrJvW7FyUiwUI5xmtUEiaYzJBI9oX9MQB1Q6abE+Q8daGSI/EvqFChXq744UB1JOA09X5jfKeS8X//P6ifIvnZSFcaJoSGaL/IQjFaE8DzRkghLFp5pgIpi+FZExFpgonVpNh2DPf3mRdM4attWwb8/rzasyjiocwhGcgA0X0IQbaEEbCDzCM7zCm/FkvBjvxsestGKUPfvwB8bnD8u6l6o=</latexit><latexit sha1_base64="vBq5WUZhj2F4gNwNCtzcp3V40aw=">AAACAnicbVDLSsNAFL2pr1pfUVfiZrAIbiyJCLosunFZwT6gDWEynbRDJw9mJmIJwY2/4saFIm79Cnf+jZM0C209MHA4577meDFnUlnWt1FZWl5ZXauu1zY2t7Z3zN29jowSQWibRDwSPQ9LyllI24opTnuxoDjwOO16k+vc795TIVkU3qlpTJ0Aj0LmM4KVllzzYFDMSD2e0AwNAqzGnp8+ZO6pa9athlUALRK7JHUo0XLNr8EwIklAQ0U4lrJvW7FyUiwUI5xmtUEiaYzJBI9oX9MQB1Q6abE+Q8daGSI/EvqFChXq744UB1JOA09X5jfKeS8X//P6ifIvnZSFcaJoSGaL/IQjFaE8DzRkghLFp5pgIpi+FZExFpgonVpNh2DPf3mRdM4attWwb8/rzasyjiocwhGcgA0X0IQbaEEbCDzCM7zCm/FkvBjvxsestGKUPfvwB8bnD8u6l6o=</latexit><latexit sha1_base64="vBq5WUZhj2F4gNwNCtzcp3V40aw=">AAACAnicbVDLSsNAFL2pr1pfUVfiZrAIbiyJCLosunFZwT6gDWEynbRDJw9mJmIJwY2/4saFIm79Cnf+jZM0C209MHA4577meDFnUlnWt1FZWl5ZXauu1zY2t7Z3zN29jowSQWibRDwSPQ9LyllI24opTnuxoDjwOO16k+vc795TIVkU3qlpTJ0Aj0LmM4KVllzzYFDMSD2e0AwNAqzGnp8+ZO6pa9athlUALRK7JHUo0XLNr8EwIklAQ0U4lrJvW7FyUiwUI5xmtUEiaYzJBI9oX9MQB1Q6abE+Q8daGSI/EvqFChXq744UB1JOA09X5jfKeS8X//P6ifIvnZSFcaJoSGaL/IQjFaE8DzRkghLFp5pgIpi+FZExFpgonVpNh2DPf3mRdM4attWwb8/rzasyjiocwhGcgA0X0IQbaEEbCDzCM7zCm/FkvBjvxsestGKUPfvwB8bnD8u6l6o=</latexit><latexit sha1_base64="vBq5WUZhj2F4gNwNCtzcp3V40aw=">AAACAnicbVDLSsNAFL2pr1pfUVfiZrAIbiyJCLosunFZwT6gDWEynbRDJw9mJmIJwY2/4saFIm79Cnf+jZM0C209MHA4577meDFnUlnWt1FZWl5ZXauu1zY2t7Z3zN29jowSQWibRDwSPQ9LyllI24opTnuxoDjwOO16k+vc795TIVkU3qlpTJ0Aj0LmM4KVllzzYFDMSD2e0AwNAqzGnp8+ZO6pa9athlUALRK7JHUo0XLNr8EwIklAQ0U4lrJvW7FyUiwUI5xmtUEiaYzJBI9oX9MQB1Q6abE+Q8daGSI/EvqFChXq744UB1JOA09X5jfKeS8X//P6ifIvnZSFcaJoSGaL/IQjFaE8DzRkghLFp5pgIpi+FZExFpgonVpNh2DPf3mRdM4attWwb8/rzasyjiocwhGcgA0X0IQbaEEbCDzCM7zCm/FkvBjvxsestGKUPfvwB8bnD8u6l6o=</latexit>

x argmin{py(x+),py(x�),py(x)}<latexit sha1_base64="dJOD6w73nz7OMAnf2tiXDGVFrJ0=">AAACgHicbVHLSsNAFJ3Ed31VXboZLEJFrYkIiivRjUsFq0JTwmR6UwcnkzBzo5aQ7/C/3PkxgpNan/XCwOGcc+e+okwKg5736rgTk1PTM7NztfmFxaXl+srqtUlzzaHNU5nq24gZkEJBGwVKuM00sCSScBPdn1X6zQNoI1J1hYMMugnrKxELztBSYf05SBjeRXHxVNJAQoxM6/SRBghPWDDdT4SyQvHpyspw0CyCYd2irwEq9euHcLvc2qH/eiOZwy/r7pj1W9wKyrDe8FreMOg48EegQUZxEdZfgl7K8wQUcsmM6fhehl07AgouoawFuYGM8XvWh46FiiVgusWwuZJuWqZH41Tbp5AO2Z8ZBUuMGSSRdVZNmr9aRf6ndXKMj7qFUFmOoPhHoTiXFFNaXYP2hAaOcmAB41rYXim/Y5pxtDer2SX4f0ceB9f7Ld9r+ZcHjZPT0TpmyTrZIE3ik0NyQs7JBWkTTt6chrPj7Lqu23T3XP/D6jqjnDXyK9zjd0M4xgQ=</latexit><latexit sha1_base64="dJOD6w73nz7OMAnf2tiXDGVFrJ0=">AAACgHicbVHLSsNAFJ3Ed31VXboZLEJFrYkIiivRjUsFq0JTwmR6UwcnkzBzo5aQ7/C/3PkxgpNan/XCwOGcc+e+okwKg5736rgTk1PTM7NztfmFxaXl+srqtUlzzaHNU5nq24gZkEJBGwVKuM00sCSScBPdn1X6zQNoI1J1hYMMugnrKxELztBSYf05SBjeRXHxVNJAQoxM6/SRBghPWDDdT4SyQvHpyspw0CyCYd2irwEq9euHcLvc2qH/eiOZwy/r7pj1W9wKyrDe8FreMOg48EegQUZxEdZfgl7K8wQUcsmM6fhehl07AgouoawFuYGM8XvWh46FiiVgusWwuZJuWqZH41Tbp5AO2Z8ZBUuMGSSRdVZNmr9aRf6ndXKMj7qFUFmOoPhHoTiXFFNaXYP2hAaOcmAB41rYXim/Y5pxtDer2SX4f0ceB9f7Ld9r+ZcHjZPT0TpmyTrZIE3ik0NyQs7JBWkTTt6chrPj7Lqu23T3XP/D6jqjnDXyK9zjd0M4xgQ=</latexit><latexit sha1_base64="dJOD6w73nz7OMAnf2tiXDGVFrJ0=">AAACgHicbVHLSsNAFJ3Ed31VXboZLEJFrYkIiivRjUsFq0JTwmR6UwcnkzBzo5aQ7/C/3PkxgpNan/XCwOGcc+e+okwKg5736rgTk1PTM7NztfmFxaXl+srqtUlzzaHNU5nq24gZkEJBGwVKuM00sCSScBPdn1X6zQNoI1J1hYMMugnrKxELztBSYf05SBjeRXHxVNJAQoxM6/SRBghPWDDdT4SyQvHpyspw0CyCYd2irwEq9euHcLvc2qH/eiOZwy/r7pj1W9wKyrDe8FreMOg48EegQUZxEdZfgl7K8wQUcsmM6fhehl07AgouoawFuYGM8XvWh46FiiVgusWwuZJuWqZH41Tbp5AO2Z8ZBUuMGSSRdVZNmr9aRf6ndXKMj7qFUFmOoPhHoTiXFFNaXYP2hAaOcmAB41rYXim/Y5pxtDer2SX4f0ceB9f7Ld9r+ZcHjZPT0TpmyTrZIE3ik0NyQs7JBWkTTt6chrPj7Lqu23T3XP/D6jqjnDXyK9zjd0M4xgQ=</latexit><latexit sha1_base64="dJOD6w73nz7OMAnf2tiXDGVFrJ0=">AAACgHicbVHLSsNAFJ3Ed31VXboZLEJFrYkIiivRjUsFq0JTwmR6UwcnkzBzo5aQ7/C/3PkxgpNan/XCwOGcc+e+okwKg5736rgTk1PTM7NztfmFxaXl+srqtUlzzaHNU5nq24gZkEJBGwVKuM00sCSScBPdn1X6zQNoI1J1hYMMugnrKxELztBSYf05SBjeRXHxVNJAQoxM6/SRBghPWDDdT4SyQvHpyspw0CyCYd2irwEq9euHcLvc2qH/eiOZwy/r7pj1W9wKyrDe8FreMOg48EegQUZxEdZfgl7K8wQUcsmM6fhehl07AgouoawFuYGM8XvWh46FiiVgusWwuZJuWqZH41Tbp5AO2Z8ZBUuMGSSRdVZNmr9aRf6ndXKMj7qFUFmOoPhHoTiXFFNaXYP2hAaOcmAB41rYXim/Y5pxtDer2SX4f0ceB9f7Ld9r+ZcHjZPT0TpmyTrZIE3ik0NyQs7JBWkTTt6chrPj7Lqu23T3XP/D6jqjnDXyK9zjd0M4xgQ=</latexit>

py(x+)<latexit sha1_base64="Vmf8gHcZxifwnh1bdW7GgO+ZCd4=">AAACPnicbVBLSwMxGMz6rPVV9eglWAotYtkVQY9FLx4r2Ae0Zcmm37ah2eySZMWy7C/z4m/w5tGLB0W8ejR9CPYxEBhm5ku+jBdxprRtv1orq2vrG5uZrez2zu7efu7gsK7CWFKo0ZCHsukRBZwJqGmmOTQjCSTwODS8wc3IbzyAVCwU93oYQScgPcF8Rok2kpurtQOi+56fRKk7LCbt8Y1JTwKIFP95j6l7mpayhaVZj8cwEz1LS24ub5ftMfAicaYkj6aourmXdjekcQBCU06Uajl2pDsJkZpRDmm2HSuICB2QHrQMFSQA1UnGC6S4YJQu9kNpjtB4rP6fSEig1DDwTHK0pZr3RuIyrxVr/6qTMBHFGgSdPOTHHOsQj7rEXSaBaj40hFDJzK6Y9okkVJvGs6YEZ/7Li6R+XnbssnN3ka9cT+vIoGN0gorIQZeogm5RFdUQRU/oDX2gT+vZere+rO9JdMWazhyhGVg/v+lNsUs=</latexit><latexit sha1_base64="Vmf8gHcZxifwnh1bdW7GgO+ZCd4=">AAACPnicbVBLSwMxGMz6rPVV9eglWAotYtkVQY9FLx4r2Ae0Zcmm37ah2eySZMWy7C/z4m/w5tGLB0W8ejR9CPYxEBhm5ku+jBdxprRtv1orq2vrG5uZrez2zu7efu7gsK7CWFKo0ZCHsukRBZwJqGmmOTQjCSTwODS8wc3IbzyAVCwU93oYQScgPcF8Rok2kpurtQOi+56fRKk7LCbt8Y1JTwKIFP95j6l7mpayhaVZj8cwEz1LS24ub5ftMfAicaYkj6aourmXdjekcQBCU06Uajl2pDsJkZpRDmm2HSuICB2QHrQMFSQA1UnGC6S4YJQu9kNpjtB4rP6fSEig1DDwTHK0pZr3RuIyrxVr/6qTMBHFGgSdPOTHHOsQj7rEXSaBaj40hFDJzK6Y9okkVJvGs6YEZ/7Li6R+XnbssnN3ka9cT+vIoGN0gorIQZeogm5RFdUQRU/oDX2gT+vZere+rO9JdMWazhyhGVg/v+lNsUs=</latexit><latexit sha1_base64="Vmf8gHcZxifwnh1bdW7GgO+ZCd4=">AAACPnicbVBLSwMxGMz6rPVV9eglWAotYtkVQY9FLx4r2Ae0Zcmm37ah2eySZMWy7C/z4m/w5tGLB0W8ejR9CPYxEBhm5ku+jBdxprRtv1orq2vrG5uZrez2zu7efu7gsK7CWFKo0ZCHsukRBZwJqGmmOTQjCSTwODS8wc3IbzyAVCwU93oYQScgPcF8Rok2kpurtQOi+56fRKk7LCbt8Y1JTwKIFP95j6l7mpayhaVZj8cwEz1LS24ub5ftMfAicaYkj6aourmXdjekcQBCU06Uajl2pDsJkZpRDmm2HSuICB2QHrQMFSQA1UnGC6S4YJQu9kNpjtB4rP6fSEig1DDwTHK0pZr3RuIyrxVr/6qTMBHFGgSdPOTHHOsQj7rEXSaBaj40hFDJzK6Y9okkVJvGs6YEZ/7Li6R+XnbssnN3ka9cT+vIoGN0gorIQZeogm5RFdUQRU/oDX2gT+vZere+rO9JdMWazhyhGVg/v+lNsUs=</latexit><latexit sha1_base64="Vmf8gHcZxifwnh1bdW7GgO+ZCd4=">AAACPnicbVBLSwMxGMz6rPVV9eglWAotYtkVQY9FLx4r2Ae0Zcmm37ah2eySZMWy7C/z4m/w5tGLB0W8ejR9CPYxEBhm5ku+jBdxprRtv1orq2vrG5uZrez2zu7efu7gsK7CWFKo0ZCHsukRBZwJqGmmOTQjCSTwODS8wc3IbzyAVCwU93oYQScgPcF8Rok2kpurtQOi+56fRKk7LCbt8Y1JTwKIFP95j6l7mpayhaVZj8cwEz1LS24ub5ftMfAicaYkj6aourmXdjekcQBCU06Uajl2pDsJkZpRDmm2HSuICB2QHrQMFSQA1UnGC6S4YJQu9kNpjtB4rP6fSEig1DDwTHK0pZr3RuIyrxVr/6qTMBHFGgSdPOTHHOsQj7rEXSaBaj40hFDJzK6Y9okkVJvGs6YEZ/7Li6R+XnbssnN3ka9cT+vIoGN0gorIQZeogm5RFdUQRU/oDX2gT+vZere+rO9JdMWazhyhGVg/v+lNsUs=</latexit>

py(x�)<latexit sha1_base64="yFn8AIb46NEW0VmpTPrsvl5CrOg=">AAACPnicbVBLSwMxGMz6rPVV9eglWAotYtkVQY9FLx4r2Ae0Zcmm37ah2eySZMWy7C/z4m/w5tGLB0W8ejR9CPYxEBhm5ku+jBdxprRtv1orq2vrG5uZrez2zu7efu7gsK7CWFKo0ZCHsukRBZwJqGmmOTQjCSTwODS8wc3IbzyAVCwU93oYQScgPcF8Rok2kpurFdoB0X3PT6LUHRaT9vjKpCcBRIr/vMfUPU1L2aVRj8cwkzxLS24ub5ftMfAicaYkj6aourmXdjekcQBCU06Uajl2pDsJkZpRDmm2HSuICB2QHrQMFSQA1UnGC6S4YJQu9kNpjtB4rP6fSEig1DDwTHK0pZr3RuIyrxVr/6qTMBHFGgSdPOTHHOsQj7rEXSaBaj40hFDJzK6Y9okkVJvGs6YEZ/7Li6R+XnbssnN3ka9cT+vIoGN0gorIQZeogm5RFdUQRU/oDX2gT+vZere+rO9JdMWazhyhGVg/v963sUs=</latexit><latexit sha1_base64="yFn8AIb46NEW0VmpTPrsvl5CrOg=">AAACPnicbVBLSwMxGMz6rPVV9eglWAotYtkVQY9FLx4r2Ae0Zcmm37ah2eySZMWy7C/z4m/w5tGLB0W8ejR9CPYxEBhm5ku+jBdxprRtv1orq2vrG5uZrez2zu7efu7gsK7CWFKo0ZCHsukRBZwJqGmmOTQjCSTwODS8wc3IbzyAVCwU93oYQScgPcF8Rok2kpurFdoB0X3PT6LUHRaT9vjKpCcBRIr/vMfUPU1L2aVRj8cwkzxLS24ub5ftMfAicaYkj6aourmXdjekcQBCU06Uajl2pDsJkZpRDmm2HSuICB2QHrQMFSQA1UnGC6S4YJQu9kNpjtB4rP6fSEig1DDwTHK0pZr3RuIyrxVr/6qTMBHFGgSdPOTHHOsQj7rEXSaBaj40hFDJzK6Y9okkVJvGs6YEZ/7Li6R+XnbssnN3ka9cT+vIoGN0gorIQZeogm5RFdUQRU/oDX2gT+vZere+rO9JdMWazhyhGVg/v963sUs=</latexit><latexit sha1_base64="yFn8AIb46NEW0VmpTPrsvl5CrOg=">AAACPnicbVBLSwMxGMz6rPVV9eglWAotYtkVQY9FLx4r2Ae0Zcmm37ah2eySZMWy7C/z4m/w5tGLB0W8ejR9CPYxEBhm5ku+jBdxprRtv1orq2vrG5uZrez2zu7efu7gsK7CWFKo0ZCHsukRBZwJqGmmOTQjCSTwODS8wc3IbzyAVCwU93oYQScgPcF8Rok2kpurFdoB0X3PT6LUHRaT9vjKpCcBRIr/vMfUPU1L2aVRj8cwkzxLS24ub5ftMfAicaYkj6aourmXdjekcQBCU06Uajl2pDsJkZpRDmm2HSuICB2QHrQMFSQA1UnGC6S4YJQu9kNpjtB4rP6fSEig1DDwTHK0pZr3RuIyrxVr/6qTMBHFGgSdPOTHHOsQj7rEXSaBaj40hFDJzK6Y9okkVJvGs6YEZ/7Li6R+XnbssnN3ka9cT+vIoGN0gorIQZeogm5RFdUQRU/oDX2gT+vZere+rO9JdMWazhyhGVg/v963sUs=</latexit><latexit sha1_base64="yFn8AIb46NEW0VmpTPrsvl5CrOg=">AAACPnicbVBLSwMxGMz6rPVV9eglWAotYtkVQY9FLx4r2Ae0Zcmm37ah2eySZMWy7C/z4m/w5tGLB0W8ejR9CPYxEBhm5ku+jBdxprRtv1orq2vrG5uZrez2zu7efu7gsK7CWFKo0ZCHsukRBZwJqGmmOTQjCSTwODS8wc3IbzyAVCwU93oYQScgPcF8Rok2kpurFdoB0X3PT6LUHRaT9vjKpCcBRIr/vMfUPU1L2aVRj8cwkzxLS24ub5ftMfAicaYkj6aourmXdjekcQBCU06Uajl2pDsJkZpRDmm2HSuICB2QHrQMFSQA1UnGC6S4YJQu9kNpjtB4rP6fSEig1DDwTHK0pZr3RuIyrxVr/6qTMBHFGgSdPOTHHOsQj7rEXSaBaj40hFDJzK6Y9okkVJvGs6YEZ/7Li6R+XnbssnN3ka9cT+vIoGN0gorIQZeogm5RFdUQRU/oDX2gT+vZere+rO9JdMWazhyhGVg/v963sUs=</latexit>

Page 8: SimBA: Simple Black-box Adversarial Attacks · SimBA: Simple Black-box Adversarial Attacks Chuan Guo, Jacob R. Gardner, Yurong You, Andrew Gordon Wilson, Kilian Q. Weinberger. Adversarial

Evaluation

✤ ImageNet classification with ResNet-50 model

✤ Drastically improved performance compared to previous SOTA

Page 9: SimBA: Simple Black-box Adversarial Attacks · SimBA: Simple Black-box Adversarial Attacks Chuan Guo, Jacob R. Gardner, Yurong You, Andrew Gordon Wilson, Kilian Q. Weinberger. Adversarial

Evaluation

UntargetedAttack Average queries Average L2 Success rate

Label-only

Boundary attack 123,407 5.98 100%

Opt-attack 71,100 6.98 100%

LFBA 30,000 6.34 100%

Score-based

QL-attack 28,174 8.27 85.4%Bandits-TD 5,251 5.00 80.5%SimBA 1,665 3.98 98.6%

SimBA-DCT 1,283 3.06 97.8%<latexit sha1_base64="vd/QvL4W1JGbWGJjOdS0BdOR5NI=">AAAEinicjVNNT9tAEDUkLdSlbWiPvbglVFWVWLbzZdQLCajqIVJBEECKo2i93iQr7HW6u66ILP+X/qbe+m86axwIkENHsjye92bnzXjWn4dUSMv6u7FZKj97vrX9Qn+58+r1m8ru2wsRJxyTAY7DmF/5SJCQMjKQVIbkas4JivyQXPrXRwq//EW4oDE7l4s5GUVoyuiEYiQhNN7d/O35ZEpZKhGkfMmGM/lhpHuYMEk4ZVP9Hk5CxLMUg2W6FyWhpFA+iVjahGiWegBPieHNxBxhkjbJTWZ4ktxIf5IOmFSgJEEGQU/3ZkqvvoS7UiJ8nRmf7hK6oBnBaT8TUEHEOqjaHzvVVeAswZgIYXAkSWasllkjdlVlH/kkrMcsXKyK68UJCxBfGChXB4Vsp1FrWh3wWuaBC6+qbVneflUl/ZjL+h2xY9cAAaf9hNf/1utCpGHVrILRaD5k/KfoMxxzUle/PlhVfdq/l+G4NbujTndNR6muui2zWVTpIRZQKernx6qdmtOy87ZyTVXXMltLNcvh0qjXVdO2a+12S3VQtHbgmu113Prx0bnip54/gSTHbWR5ltXOszqm+6hfwoK7LVt+qI0cV/Ys0KXMeOrYhbOnFXYyrvzxghgnEawwDpEQQ9uay1GKOIwzJLC7iSAwx2tYoiG4DEVEjNL8KmXGPkQCYxJzeJg08uhqRooiIRaRD8wIyZl4jKngOmyYyIk7SimbJ5IwfFtokoSGjA11L42AcoJluAAHYU5Bq4FniCMM91DoMAT7cctPnQvHtC3TPnX2DnvFOLa199pH7bNmax3tUPuunWgDDZe2SvVSu9Qp75Sd8kH56y11c6PIeac9sPLxP5hcXf0=</latexit><latexit sha1_base64="vd/QvL4W1JGbWGJjOdS0BdOR5NI=">AAAEinicjVNNT9tAEDUkLdSlbWiPvbglVFWVWLbzZdQLCajqIVJBEECKo2i93iQr7HW6u66ILP+X/qbe+m86axwIkENHsjye92bnzXjWn4dUSMv6u7FZKj97vrX9Qn+58+r1m8ru2wsRJxyTAY7DmF/5SJCQMjKQVIbkas4JivyQXPrXRwq//EW4oDE7l4s5GUVoyuiEYiQhNN7d/O35ZEpZKhGkfMmGM/lhpHuYMEk4ZVP9Hk5CxLMUg2W6FyWhpFA+iVjahGiWegBPieHNxBxhkjbJTWZ4ktxIf5IOmFSgJEEGQU/3ZkqvvoS7UiJ8nRmf7hK6oBnBaT8TUEHEOqjaHzvVVeAswZgIYXAkSWasllkjdlVlH/kkrMcsXKyK68UJCxBfGChXB4Vsp1FrWh3wWuaBC6+qbVneflUl/ZjL+h2xY9cAAaf9hNf/1utCpGHVrILRaD5k/KfoMxxzUle/PlhVfdq/l+G4NbujTndNR6muui2zWVTpIRZQKernx6qdmtOy87ZyTVXXMltLNcvh0qjXVdO2a+12S3VQtHbgmu113Prx0bnip54/gSTHbWR5ltXOszqm+6hfwoK7LVt+qI0cV/Ys0KXMeOrYhbOnFXYyrvzxghgnEawwDpEQQ9uay1GKOIwzJLC7iSAwx2tYoiG4DEVEjNL8KmXGPkQCYxJzeJg08uhqRooiIRaRD8wIyZl4jKngOmyYyIk7SimbJ5IwfFtokoSGjA11L42AcoJluAAHYU5Bq4FniCMM91DoMAT7cctPnQvHtC3TPnX2DnvFOLa199pH7bNmax3tUPuunWgDDZe2SvVSu9Qp75Sd8kH56y11c6PIeac9sPLxP5hcXf0=</latexit><latexit sha1_base64="vd/QvL4W1JGbWGJjOdS0BdOR5NI=">AAAEinicjVNNT9tAEDUkLdSlbWiPvbglVFWVWLbzZdQLCajqIVJBEECKo2i93iQr7HW6u66ILP+X/qbe+m86axwIkENHsjye92bnzXjWn4dUSMv6u7FZKj97vrX9Qn+58+r1m8ru2wsRJxyTAY7DmF/5SJCQMjKQVIbkas4JivyQXPrXRwq//EW4oDE7l4s5GUVoyuiEYiQhNN7d/O35ZEpZKhGkfMmGM/lhpHuYMEk4ZVP9Hk5CxLMUg2W6FyWhpFA+iVjahGiWegBPieHNxBxhkjbJTWZ4ktxIf5IOmFSgJEEGQU/3ZkqvvoS7UiJ8nRmf7hK6oBnBaT8TUEHEOqjaHzvVVeAswZgIYXAkSWasllkjdlVlH/kkrMcsXKyK68UJCxBfGChXB4Vsp1FrWh3wWuaBC6+qbVneflUl/ZjL+h2xY9cAAaf9hNf/1utCpGHVrILRaD5k/KfoMxxzUle/PlhVfdq/l+G4NbujTndNR6muui2zWVTpIRZQKernx6qdmtOy87ZyTVXXMltLNcvh0qjXVdO2a+12S3VQtHbgmu113Prx0bnip54/gSTHbWR5ltXOszqm+6hfwoK7LVt+qI0cV/Ys0KXMeOrYhbOnFXYyrvzxghgnEawwDpEQQ9uay1GKOIwzJLC7iSAwx2tYoiG4DEVEjNL8KmXGPkQCYxJzeJg08uhqRooiIRaRD8wIyZl4jKngOmyYyIk7SimbJ5IwfFtokoSGjA11L42AcoJluAAHYU5Bq4FniCMM91DoMAT7cctPnQvHtC3TPnX2DnvFOLa199pH7bNmax3tUPuunWgDDZe2SvVSu9Qp75Sd8kH56y11c6PIeac9sPLxP5hcXf0=</latexit><latexit sha1_base64="vd/QvL4W1JGbWGJjOdS0BdOR5NI=">AAAEinicjVNNT9tAEDUkLdSlbWiPvbglVFWVWLbzZdQLCajqIVJBEECKo2i93iQr7HW6u66ILP+X/qbe+m86axwIkENHsjye92bnzXjWn4dUSMv6u7FZKj97vrX9Qn+58+r1m8ru2wsRJxyTAY7DmF/5SJCQMjKQVIbkas4JivyQXPrXRwq//EW4oDE7l4s5GUVoyuiEYiQhNN7d/O35ZEpZKhGkfMmGM/lhpHuYMEk4ZVP9Hk5CxLMUg2W6FyWhpFA+iVjahGiWegBPieHNxBxhkjbJTWZ4ktxIf5IOmFSgJEEGQU/3ZkqvvoS7UiJ8nRmf7hK6oBnBaT8TUEHEOqjaHzvVVeAswZgIYXAkSWasllkjdlVlH/kkrMcsXKyK68UJCxBfGChXB4Vsp1FrWh3wWuaBC6+qbVneflUl/ZjL+h2xY9cAAaf9hNf/1utCpGHVrILRaD5k/KfoMxxzUle/PlhVfdq/l+G4NbujTndNR6muui2zWVTpIRZQKernx6qdmtOy87ZyTVXXMltLNcvh0qjXVdO2a+12S3VQtHbgmu113Prx0bnip54/gSTHbWR5ltXOszqm+6hfwoK7LVt+qI0cV/Ys0KXMeOrYhbOnFXYyrvzxghgnEawwDpEQQ9uay1GKOIwzJLC7iSAwx2tYoiG4DEVEjNL8KmXGPkQCYxJzeJg08uhqRooiIRaRD8wIyZl4jKngOmyYyIk7SimbJ5IwfFtokoSGjA11L42AcoJluAAHYU5Bq4FniCMM91DoMAT7cctPnQvHtC3TPnX2DnvFOLa199pH7bNmax3tUPuunWgDDZe2SvVSu9Qp75Sd8kH56y11c6PIeac9sPLxP5hcXf0=</latexit>

TargetedAttack Average queries Average L2 Success rate

Score-based

QL-attack 20,614 11.39 98.7%AutoZOOM 13,525 26.74 100%

SimBA 7,899 9.53 100%

SimBA-DCT 8,824 7.04 96.5%<latexit sha1_base64="0knO3/PuZGZX4mUWzpyEBO97EzM=">AAAD0XicfVJLb9NAEHYTHsU8msKRy0JShFBi2U7TJLem5cCh0FbpS8RRtN5MklX9CLtr1MgyQlz5d9z4BfwNZlM39BExkuXZ+b6Z+XZ2/GnApbLt3yuF4r37Dx6uPjIfP3n6bK20/vxExolgcMziIBZnPpUQ8AiOFVcBnE0F0NAP4NQ/39X46VcQksfRkZpNoR/SccRHnFGFocH6yh/PhzGPUkUx5V3Wm6hXfdNjECkQPBqb/+AkoCJLGVpmemESKI7tkzBKNzGapR7CYyDeRE4pg7QOFxnxFFwof5QeaUjBMMOQZ3oTrda8AjtKUXaekTcLegcVU6z1JUENIJdBlb2BW7kOdBPGQEoiqIIbXZYozSVuaoldFguo6REOr6cd7tXoXBe2cO3qlrOJjuNY9Tb+K+2W1fQ2KprfSVT8eX//o4br1Ybb0AlbVlPzK45t57SFTB7udLTu1PNHpFlttdv61LYa9f8k1N7vHmlaq9pydeGmZc/rt7esxhU/vy5Ew8VjXR30ww5KZduy50buOk7ulI3cDgalX94wZkmIm8ACKmXPsaeqn1KB0wwAVyCRgGM8x9fooRvREGQ/nW9kRjYwMiSjWOAXKTKPXs9IaSjlLPSRGVI1kbcxHVyG9RI1avVTHk0TBRG7bDRKAqJiotebDLkApoIZOpQJjloJm1BBGa6zNHEIzu0r33VOXMuxLefQLW/v5ONYNV4ar423hmM0jW3jg3FgHBus8KmgClnhW7FbnBW/F39cUgsrec4L44YVf/4FIlcs5w==</latexit><latexit sha1_base64="0knO3/PuZGZX4mUWzpyEBO97EzM=">AAAD0XicfVJLb9NAEHYTHsU8msKRy0JShFBi2U7TJLem5cCh0FbpS8RRtN5MklX9CLtr1MgyQlz5d9z4BfwNZlM39BExkuXZ+b6Z+XZ2/GnApbLt3yuF4r37Dx6uPjIfP3n6bK20/vxExolgcMziIBZnPpUQ8AiOFVcBnE0F0NAP4NQ/39X46VcQksfRkZpNoR/SccRHnFGFocH6yh/PhzGPUkUx5V3Wm6hXfdNjECkQPBqb/+AkoCJLGVpmemESKI7tkzBKNzGapR7CYyDeRE4pg7QOFxnxFFwof5QeaUjBMMOQZ3oTrda8AjtKUXaekTcLegcVU6z1JUENIJdBlb2BW7kOdBPGQEoiqIIbXZYozSVuaoldFguo6REOr6cd7tXoXBe2cO3qlrOJjuNY9Tb+K+2W1fQ2KprfSVT8eX//o4br1Ybb0AlbVlPzK45t57SFTB7udLTu1PNHpFlttdv61LYa9f8k1N7vHmlaq9pydeGmZc/rt7esxhU/vy5Ew8VjXR30ww5KZduy50buOk7ulI3cDgalX94wZkmIm8ACKmXPsaeqn1KB0wwAVyCRgGM8x9fooRvREGQ/nW9kRjYwMiSjWOAXKTKPXs9IaSjlLPSRGVI1kbcxHVyG9RI1avVTHk0TBRG7bDRKAqJiotebDLkApoIZOpQJjloJm1BBGa6zNHEIzu0r33VOXMuxLefQLW/v5ONYNV4ar423hmM0jW3jg3FgHBus8KmgClnhW7FbnBW/F39cUgsrec4L44YVf/4FIlcs5w==</latexit><latexit sha1_base64="0knO3/PuZGZX4mUWzpyEBO97EzM=">AAAD0XicfVJLb9NAEHYTHsU8msKRy0JShFBi2U7TJLem5cCh0FbpS8RRtN5MklX9CLtr1MgyQlz5d9z4BfwNZlM39BExkuXZ+b6Z+XZ2/GnApbLt3yuF4r37Dx6uPjIfP3n6bK20/vxExolgcMziIBZnPpUQ8AiOFVcBnE0F0NAP4NQ/39X46VcQksfRkZpNoR/SccRHnFGFocH6yh/PhzGPUkUx5V3Wm6hXfdNjECkQPBqb/+AkoCJLGVpmemESKI7tkzBKNzGapR7CYyDeRE4pg7QOFxnxFFwof5QeaUjBMMOQZ3oTrda8AjtKUXaekTcLegcVU6z1JUENIJdBlb2BW7kOdBPGQEoiqIIbXZYozSVuaoldFguo6REOr6cd7tXoXBe2cO3qlrOJjuNY9Tb+K+2W1fQ2KprfSVT8eX//o4br1Ybb0AlbVlPzK45t57SFTB7udLTu1PNHpFlttdv61LYa9f8k1N7vHmlaq9pydeGmZc/rt7esxhU/vy5Ew8VjXR30ww5KZduy50buOk7ulI3cDgalX94wZkmIm8ACKmXPsaeqn1KB0wwAVyCRgGM8x9fooRvREGQ/nW9kRjYwMiSjWOAXKTKPXs9IaSjlLPSRGVI1kbcxHVyG9RI1avVTHk0TBRG7bDRKAqJiotebDLkApoIZOpQJjloJm1BBGa6zNHEIzu0r33VOXMuxLefQLW/v5ONYNV4ar423hmM0jW3jg3FgHBus8KmgClnhW7FbnBW/F39cUgsrec4L44YVf/4FIlcs5w==</latexit><latexit sha1_base64="0knO3/PuZGZX4mUWzpyEBO97EzM=">AAAD0XicfVJLb9NAEHYTHsU8msKRy0JShFBi2U7TJLem5cCh0FbpS8RRtN5MklX9CLtr1MgyQlz5d9z4BfwNZlM39BExkuXZ+b6Z+XZ2/GnApbLt3yuF4r37Dx6uPjIfP3n6bK20/vxExolgcMziIBZnPpUQ8AiOFVcBnE0F0NAP4NQ/39X46VcQksfRkZpNoR/SccRHnFGFocH6yh/PhzGPUkUx5V3Wm6hXfdNjECkQPBqb/+AkoCJLGVpmemESKI7tkzBKNzGapR7CYyDeRE4pg7QOFxnxFFwof5QeaUjBMMOQZ3oTrda8AjtKUXaekTcLegcVU6z1JUENIJdBlb2BW7kOdBPGQEoiqIIbXZYozSVuaoldFguo6REOr6cd7tXoXBe2cO3qlrOJjuNY9Tb+K+2W1fQ2KprfSVT8eX//o4br1Ybb0AlbVlPzK45t57SFTB7udLTu1PNHpFlttdv61LYa9f8k1N7vHmlaq9pydeGmZc/rt7esxhU/vy5Ew8VjXR30ww5KZduy50buOk7ulI3cDgalX94wZkmIm8ACKmXPsaeqn1KB0wwAVyCRgGM8x9fooRvREGQ/nW9kRjYwMiSjWOAXKTKPXs9IaSjlLPSRGVI1kbcxHVyG9RI1avVTHk0TBRG7bDRKAqJiotebDLkApoIZOpQJjloJm1BBGa6zNHEIzu0r33VOXMuxLefQLW/v5ONYNV4ar423hmM0jW3jg3FgHBus8KmgClnhW7FbnBW/F39cUgsrec4L44YVf/4FIlcs5w==</latexit>

✤ ImageNet classification with ResNet-50 model

✤ Drastically improved performance compared to previous SOTA

Page 10: SimBA: Simple Black-box Adversarial Attacks · SimBA: Simple Black-box Adversarial Attacks Chuan Guo, Jacob R. Gardner, Yurong You, Andrew Gordon Wilson, Kilian Q. Weinberger. Adversarial

Attacking Google Cloud Vision

✤ Generated using 5000 queries ($10 cost)

✤ 70% success rate across 50 images

Page 11: SimBA: Simple Black-box Adversarial Attacks · SimBA: Simple Black-box Adversarial Attacks Chuan Guo, Jacob R. Gardner, Yurong You, Andrew Gordon Wilson, Kilian Q. Weinberger. Adversarial

Collaborators

Jacob R. Gardner2 Yurong You1 Andrew GordonWilson1

Kilian Q.Weinberger1

1 Cornell University2 Uber AI Labs

Poster session: June 12 (today) 6:30-9:00 PM @ Pacific Ballroom #70