square attack

**Square Attack** is a **score-based adversarial attack that uses random square-shaped perturbations** — a query-efficient black-box attack that modifies random square patches of the input, requiring only the model's output probabilities (no gradients). **How Square Attack Works** - **Random Squares**: Generate random square-shaped perturbation patches at random positions. - **Query**: Evaluate the model's confidence on the perturbed input. - **Accept/Reject**: If the perturbation reduces confidence in the true class, keep it; otherwise, discard. - **Adaptive**: Decrease the square size and perturbation magnitude over iterations for refinement. **Why It Matters** - **No Gradients**: Only needs model output probabilities — works for any black-box model. - **Competitive**: Achieves attack success rates comparable to gradient-based methods with ~1000 queries. - **AutoAttack**: Included in the AutoAttack ensemble as the score-based black-box component. **Square Attack** is **random patch perturbation** — a simple yet surprisingly effective black-box attack using random square modifications.