Latent Geometric Chords slip past robust vision models

Problem

This paper studies query-efficient decision-based black-box adversarial attacks that must operate using only top-1 labels. Existing pixel-wise attacks create unnatural, high-frequency artifacts and do not align with human perception, while prior latent-space attacks are constrained by low-dimensional generative manifolds and suffer reconstruction errors from encoder–decoder inversion. These limitations lead to poor visual fidelity, slow convergence and failure against robust models; addressing them matters because practical attackers often only have hard-label access and aim to produce perceptually stealthy inputs with few queries.

Approach

The authors propose Latent Geometric Chords (LGC) and a faster variant LGC-H. LGC operates in the compressed latent space of an autoencoder and carries out a curvature-aware, semicircular geometric search to trace decision boundaries efficiently. A central component, Residual-based Adversarial Generation (RAG), computes the residual between decoded baseline and decoded perturbed latents (a geometric chord) and directly superimposes that residual onto the original image, rather than using the decoder output alone. This both mitigates decoder reconstruction artefacts and expands the admissible search space: mathematically the chord construction raises the Hausdorff dimension of perturbations to at most 2k when the generator is k-dimensional. Experiments use ImageNet, Places365 and CelebAMask-HQ; target models include ViT, ResNet-50, VGG16, DenseNet and ResNet-18. Evaluation metrics include attack success rate versus queries, L2 norm, Structural Similarity Index Measure (SSIM) and LPIPS perceptual distance.

Key Findings

• LGC produces high-fidelity adversarial examples with very few queries: reported SSIM exceeding 0.99 and LPIPS below 0.01 at 5,000 queries in some settings, and rapid convergence within roughly 2,000–5,000 queries under strict perceptual constraints.
• RAG substantially reduces decoder reconstruction errors and effectively doubles the latent-search dimensionality to a space of chord residuals, enabling navigation of adversarial regions that standard latent optimisation misses; the paper proves the chord set has Hausdorff dimension at most 2k under a Lipschitz assumption on the generator.
• Compared with state-of-the-art baselines, LGC achieves far better perceptual stealth while remaining competitive or superior in L2 norms—targeted attacks on ResNet-50 report up to a sixfold reduction in perturbation magnitude versus prior methods while maintaining near-perfect structural similarity. LGC also successfully attacks adversarially trained Vision Transformers and generalises across datasets using a single ImageNet-trained autoencoder.

Limitations

The approach depends on a pre-trained autoencoder backbone; performance varies by backbone (VGG16 latent space gave more predictable, visually coherent results than ResNet-50). The theoretical expansion to 2k dimensions assumes Lipschitz continuity of the generator. RAG mitigates but does not eliminate all reconstruction risks and the method still requires thousands of queries, which may be impractical in some deployed settings.

Implications

Offensive security implications are clear: attackers with only hard-label access can craft highly stealthy, semantically grounded adversarial inputs that preserve human-perceived image structure and require relatively few queries to succeed, including against adversarially trained models. Defences that rely on low-dimensional latent checks, reconstruction errors or focus solely on pixel-level perturbation norms may not detect or prevent such attacks. The authors release code, enabling reproducible assessment and threat modelling of vision systems against this more stealthy class of decision-based attacks.