The construction of adversarial images is a search problem in high dimensions within a small region around a target image. The goal is to find an imperceptibly modified image that is misclassified by a target model. In the black-box setting, only sporadic feedback is provided through occasional model evaluations. In this paper we provide a new algorithm whose search strategy is based on an intriguingly simple iterative principle: We randomly pick a low frequency component of the discrete cosine transform (DCT) and either add or subtract it to the target image. Model evaluations are only required to identify whether an operation decreases the adversarial loss. Despite its simplicity, the proposed method can be used for targeted and untargeted attacks -resulting in previously unprecedented query efficiency in both settings. We require a median of 600 black-box model queries  to produce an adversarial ImageNet image, and we successfully attack Google Cloud Vision with 2500 median queries, averaging to a cost of only $3 per image. We argue that our proposed algorithm should serve as a strong baseline for future adversarial black-box attacks, in particular because it is extremely fast and can be implemented in less than 20 lines of PyTorch code.
This paper proposed a simple query-efficient "score-based" black-box attack based on iteratively perturbing an input image with a direction randomly sampled (w/o replacement) from a set of orthonormal bases. In particular, the authors proposed the use of low-frequency parts of DCT (discrete cosine transformation) as in (Guo 2018) to perform this task. Experimental results on ImageNet and three different classification models demonstrate the query efficiency of the proposed method -- able to achieve high attack success rate within fewer query budgets, where the visual distortion has an L2 norm threshold set to be 10. The authors also demonstrate an untargeted score-based black-box attack on Google CloudVision API.
While the results seem promising, there are several issues that may potentially weaken the query-efficient claims made in this paper, especially due to the lack of sufficient attack comparisons (on smaller datasets) and inconsistent threat models when compared to existing works. My main concerns are summarized as follows.
1. Unfair comparison due to inconsistent threat models (knowledge known to an attacker): the proposed method (simBA) is a "score-based" black-box attack, not a "decision-based" black-box attack. The proposed method assumes knowing the prediction likelihood (or prediction score) as the model output when performing black-box attacks, whereas the compared methods in black-box settings, such as Opt Attack and Boundary Attack, are "decision-based" attack that assumes only knowing the top-1 prediction label. Therefore, the query count comparison is meaningless and unfair, since these two methods require far less information from the model.
On the other hand, ZOO/AutoZOOM is a score-based attack. But ZOO can achieve a very low L2 distortion due to its coordinate descent nature. A fair comparison is to set the same L2 distortion for all score-based methods, and compare the median/avg query counts of each image to reach the same L2 distortion. The comparison to Opt-Attack / Boundary attack makes sense only if the proposed method (simBA) can also perform decision-based attack. Nonetheless, the query count to same-distortion comparison argument still holds. The authors should specify whether simBA can apply to the decision-only attack scenario. If so, how to implement and what is the performance?
Lastly, the QL attack (Ilyas 2018) can perform both score-based and decision-based attacks. So the authors should make the query comparison (to same L2 distortion) as well. According to a recent report (Table-1, NES column) in https://arxiv.org/pdf/1807.07978.pdf, the QL-attack has a comparable performance in terms of query counts as reported in this paper.
2. More experiments on targeted black-box attacks: While untargeted attacks on Imagenet is a relatively easy task, I was a bit skeptical on the attacking performance of simBA in targeted attacks - since the selection of low-frequency bases directly limits the search space of adversarial examples, as opposed to arbitrary random directions adopted in QL-attack, Boundary-attack, and Opt-attack. It is also not clear how the target label is chosen in the targeted attack experiment.
I suggest including two more experiments to validate the function of simBA: (i) compare the performance of least-likely targeted attack (ii) show results on smaller datasets such as Cifar-10. As pointed out by the authors, Imagenet has too many image dimensions and make it more vulnerable to attack. Showing attacking results on smaller datasets can properly justify the value of the proposed attack, rather than the benefit from high dimensionality.
3. Novelty relative to LFBA (Guo) should be better differentiated: The idea of using DCT is originated from the LFBA paper. Since in that paper the authors also leveraged low-frequency DCT to perform black-box attacks, it is not clear to me what makes the proposed method perform better than the LFBA paper. The novelty and difference between this paper and the LFBA paper should be addressed.
4. The Google Cloud Vision API attack is not too appealing - the tree label is still there and the trees are obviously present in the picture, while I appreciate the effect of removing the original top-3 labels. Can the authors show another set of non-trivial (more surprising) and targeted-attack experiments? Or simply do the same experiment using the same image (men snowing -> dog)  as in the QL-attack.
----
Post-rebuttal review
I appreciate the authors' efforts in clarifying some of my concerns. However, I am still not convinced the comparison has been made fair. Many numbers from Table 1, such as ZOO, Opt-attack, QL-attack and AutoZOOM seem to be directly adapted from the papers rather than implemented and reproduced based on the same setting as the proposed attack. In particular, given that QL-attack is a published work, one of the state-of-the-art method and its codes has been released, I would really love to see a direct comparison using the same data samples and threat model. I would also like to emphasize that implementing all attacks under the same setting is crucial, since different attack methods may have a different criterion to determine attack successfulness. For example, QL-attack has some pre-defined distortion (L2 or Linfinity) for determining an adversarial example is successful, in addition to a different predicted class.