Reinforcement Learning Inspired Black-box Adversarial Attacks for Computer Vision
Florian Krone, Elena Hoemann, Sven Hallerbach
cs.LG · cs.CR · cs.CV
Quick verdict
RIBA: per-image SAC-style black-box attack; beats Square Attack on median queries (CIFAR-10/ViT) but trails on ImageNet averages; evaluation narrow.
Summary
The paper introduces RIBA, a score-based black-box adversarial attack that repurposes soft actor-critic (SAC) for perturbation search. The authors cast adversarial example generation as a degenerate one-step MDP (identity transition, ZOO-style log-ratio reward) and strip SAC of its state dependence: the actor is a per-image Gaussian over perturbations, the critic a one-hidden-layer MLP predicting reward from a perturbation, with 40 critic and 120 actor updates per target-model query. Trained from scratch per image, RIBA reaches 100% attack success rate on CIFAR-10 ResNet-18 (ε=8/255, 9498 images) with median 50 / average 107 queries, versus Square Attack's 67/147. On ImageNet (1000 images, ε=0.05) results are mixed: against ViT-B/16, RIBA wins on median (79 vs 102) but loses on average queries (311 vs 204); against Inception-v3, Square Attack stays ahead on both metrics, though RIBA is cheaper on the hardest 5% of samples (2069 vs 2779 average). Against an adversarially trained WideResNet-82-8, RIBA matches PGD's 18% success rate. Ablations credit the log reward (579→107 average queries) and target entropy −3 (306→107). Limitations: only SimBA and Square Attack are compared empirically (no Bandits/NES), no confidence intervals or seed variance, hyperparameters tuned on CIFAR-10 without a stated tuning split, and no code release is mentioned.
Review complete
Assessment at a glance
6
risk flags identified
● high 0
● medium 3
● low 3
5 strengths · 5 weaknesses · 5 author questions
AI text signal = Binoculars zero-shot detector score over 20 sampled passages (Fast-DetectGPT co-reported) — absence does not prove human authorship, and a flag does not imply misconduct.
Levels reflect verification complexity — not a quality score. Evolve never rates your paper.
Key claims under review
- Adversarial perturbation generation can be formulated as a one-step MDP with an identity transition and solved by a state-free variant of soft actor-critic trained per image.
- RIBA requires 25.4% fewer median queries than Square Attack against ResNet-18 on CIFAR-10 at ε=8/255 (median 50 vs 67) with 100% attack success rate.
- RIBA requires 22.5% fewer median queries than Square Attack against ViT-B/16 on ImageNet (79 vs 102) and fewer queries on the hardest 5% of Inception-v3 samples (2069 vs 2779 average).
- On an adversarially trained WideResNet-82-8, RIBA matches the 18% attack success rate of white-box PGD at ε=8/255.
- Exploiting off-policy structure, RIBA can batch perturbation candidates, reducing target-model invocations for a single image from 107 to 24 at batch size 8.
Strengths
Clean, large-scale CIFAR-10 win
On all 9498 correctly classified CIFAR-10 test images vs ResNet-18 at ε=8/255, RIBA hits 100% ASR with median 50 / average 107 queries vs Square Attack's 67/147 (Table 2), with higher success at every query cap (Fig. 2).
Unusually complete algorithmic specification
Alg. 1 plus Table 1 give everything needed to reimplement: reward Eq. 5, clip(x+ε·tanh δ) application, 40 critic/120 actor updates per query, AdamW lr 0.02, critic hidden dim 6, batch sizes 400/650, 5 replay-init samples, target entropy −3.
Honest failure-mode analysis
Ablations quantify each design choice
Practical batched-query property
Weaknesses
Cherry-picked headline metrics
Thin baseline set
No statistical rigor
Possible evaluation-set tuning
Weak robust-model evidence
Full Review Report
$1.99 · one-timeUnlock the complete preliminary analysis Evolve produced for this paper.
Report preview
Scope & Claims
RIBA is a method paper proposing a score-based black-box adversarial attack for image classifiers. Five claims are made: (1) adversarial perturbation generation can be cast as an MDP (Sec. 3.1); (2) a SAC-derived algorithm solves this MDP efficiently with no pretraining (Sec. 3.2, Alg. 1); (3) RIBA needs 25.4% fewer median queries than Square Attack against ResNet-18/CIFAR-10 and 22.5% fewer against ViT-B/16/ImageNet (Abstract, Tables 2–3); (4) it matches white-box attacks on an adversarially trained WideResNet-82-8 (Table 5); (5) its off-policy structure enables batched queries for single images (Sec. 4.5). Claims 1–2 are well argued; claim 3 is accurate but selectively framed (median only); claim 4 rests on weak evidence; claim 5 is demonstrated at small scale.
The remaining sections cover Methodology Assessment, Statistical Evidence, Results & Reproducibility, Limitations & Risks, and Verdict & Recommendations.
- All 5 strengths & 5 weaknesses, analyzed in detail
- 6 risk flags with severity, section & reviewer questions
- Methods & statistical evidence assessment
- 5 questions a peer reviewer would ask
- Full six-dimension evaluation report & recommendations
One-time purchase · this paper only
One-time purchase, this paper only. AI-generated preliminary analysis — not peer review.
Frequently asked questions
What is RIBA in adversarial machine learning?
RIBA (Reinforcement Learning Inspired Black-box Adversarial Attack) is a method for fooling image classifiers when the attacker can only see the model's output scores. It trains a small soft actor-critic-inspired agent separately for each image to generate an l∞-bounded perturbation, aiming to fool the model in as few queries as possible.
How does RIBA compare to Square Attack?
On CIFAR-10 (ResNet-18, ε=8/255), RIBA uses fewer queries (median 50 vs 67, average 107 vs 147) with a 100% success rate. On ImageNet the picture is mixed: RIBA wins on median queries against ViT-B/16 (79 vs 102) but Square Attack has lower average queries on both ImageNet models tested and remains stronger on easy Inception-v3 samples.
Does RIBA work against robust (adversarially trained) models?
In the paper, RIBA achieved an 18% attack success rate on 100 images against an adversarially trained WideResNet-82-8 on CIFAR-10 at ε=8/255, equal to the white-box PGD attack in the same test, though both figures are low because the model is highly robust.
Is code for RIBA available?
The paper does not mention any code release. However, the algorithm (Alg. 1) and all hyperparameters (Table 1) are fully specified, and the experiments use public datasets and models, so reimplementation is feasible.
About this review
This is an AI-generated preliminary review by Evolve.Pub, produced from the openly available text of the paper. It is not peer review and does not represent the authors' views. The canonical record of the paper is at the publisher link above.
- Figures 2–4 appear in the extraction only as axis labels; curve shapes and crossover points could not be visually verified.
- RIBA median values of 50 (CIFAR-10) and 79 (ViT-B/16) are derived from the abstract's 25.4%/22.5% claims because the corresponding table rows are truncated in the extracted text.
- Code availability is inferred from the absence of any release statement, not from an explicit refusal.
- arXiv preprint (v1); no peer-review status stated.
Go deeper on this paper
Wrote a paper? Stress-test it before reviewers do.
Upload your manuscript for the same structured scrutiny — reasoning, statistics, evidence, figures, and reproducibility.