brendel & bethge attack

**Brendel & Bethge (B&B) Attack** is a **decision-based adversarial attack that starts from an adversarial point and walks along the decision boundary toward the original input** — minimizing the perturbation while staying adversarial, requiring only hard-label (top-1) predictions. **How B&B Attack Works** - **Start**: Begin from an adversarial starting point (e.g., random image of the target class). - **Boundary Walk**: Iteratively move toward the clean input while constraining the trajectory to stay on the adversarial side of the decision boundary. - **Gradient Estimation**: Estimate the boundary normal direction using finite differences or surrogate gradients. - **Convergence**: The perturbation decreases each iteration until a minimum-norm adversarial example is found. **Why It Matters** - **Decision-Based**: Only requires the predicted label — no need for gradients, logits, or probabilities. - **Black-Box**: Works against any model, including models behind APIs with limited output. - **Strong**: One of the strongest decision-based attacks — used in AutoAttack as a component. **B&B Attack** is **walking the decision boundary** — starting from an adversarial point and minimizing the perturbation while staying on the adversarial side.