boundary attack

**Boundary Attack** is a **decision-based adversarial attack that performs a random walk along the decision boundary** — starting from an adversarial image and iteratively reducing the perturbation while maintaining misclassification, using only the model's top-1 predicted label. **How Boundary Attack Works** - **Initialize**: Start with an image classified as the target class (random noise or a real image). - **Orthogonal Step**: Take a random step orthogonal to the direction toward the clean image (stay on boundary). - **Step Toward Original**: Take a step toward the clean image (reduce perturbation). - **Accept**: If still adversarial, accept the new point. If not, reject and try again. **Why It Matters** - **Truly Black-Box**: Only needs the final predicted class — no probabilities, logits, or gradients. - **Pioneering**: One of the first effective decision-based attacks (Brendel et al., 2018). - **Simple**: Conceptually simple random walk — easy to implement and understand. **Boundary Attack** is **the random walk on the adversarial frontier** — progressively shrinking the perturbation through random exploration along the decision boundary.