Croce, FrancescoAndriushchenko, MaksymSingh, Naman D.Flammarion, NicolasHein, Matthias2023-02-272023-02-272023-02-272022-01-0110.1609/aaai.v36i6.20595https://infoscience.epfl.ch/handle/20.500.14299/195167WOS:000893636206061We propose a versatile framework based on random search, Sparse-RS, for score-based sparse targeted and untargeted attacks in the black-box setting. Sparse-RS does not rely on substitute models and achieves state-of-the-art success rate and query efficiency for multiple sparse attack models: l(0)-bounded perturbations, adversarial patches, and adversarial frames. The l(0)-version of untargeted Sparse-RS outperforms all black-box and even all white-box attacks for different models on MNIST, CIFAR-10, and ImageNet. Moreover, our untargeted Sparse-RS achieves very high success rates even for the challenging settings of 20 x 20 adversarial patches and 2-pixel wide adversarial frames for 224 x 224 images. Finally, we show that Sparse-RS can be applied to generate targeted universal adversarial patches where it significantly outperforms the existing approaches. Our code is available at https://github.com/fra31/sparse-rs.Computer Science, Artificial IntelligenceComputer Sciencetext::conference output::conference proceedings::conference paper