3 ms·

You don't necessarily need to know the whole model, but you need accurate enough prediction score outputs for each category. I think if you have that, that's en

You don't necessarily need to know the whole model, but you need accurate enough prediction score outputs for each category. I think if you have that, that's enough to numerically approximate the gradient of the output scores and perform gradient descent.

zeitbeule 9y ago
Someone just published a new attack at ICLR that does not even need confidence scores but works solely on the final decision output of the network and works as well as the best known attacks (that so far required gradients): https://openreview.net/forum?id=SyZI0GWCZ&noteId=SyZI0GWCZ https://openreview.net/forum?id=SyZI0GWCZ&noteId=SyZI0GWCZ