Brendel & Bethge (B&B) Attack is a decision-based adversarial attack that starts from an adversarial point and walks along the decision boundary toward the original input — minimizing the perturbation while staying adversarial, requiring only hard-label (top-1) predictions.

How B&B Attack Works

• Start: Begin from an adversarial starting point (e.g., random image of the target class).
• Boundary Walk: Iteratively move toward the clean input while constraining the trajectory to stay on the adversarial side of the decision boundary.
• Gradient Estimation: Estimate the boundary normal direction using finite differences or surrogate gradients.
• Convergence: The perturbation decreases each iteration until a minimum-norm adversarial example is found.

Why It Matters

• Decision-Based: Only requires the predicted label — no need for gradients, logits, or probabilities.
• Black-Box: Works against any model, including models behind APIs with limited output.
• Strong: One of the strongest decision-based attacks — used in AutoAttack as a component.

B&B Attack is walking the decision boundary — starting from an adversarial point and minimizing the perturbation while staying on the adversarial side.