Square Attack is a score-based adversarial attack that uses random square-shaped perturbations — a query-efficient black-box attack that modifies random square patches of the input, requiring only the model's output probabilities (no gradients).

How Square Attack Works

• Random Squares: Generate random square-shaped perturbation patches at random positions.
• Query: Evaluate the model's confidence on the perturbed input.
• Accept/Reject: If the perturbation reduces confidence in the true class, keep it; otherwise, discard.
• Adaptive: Decrease the square size and perturbation magnitude over iterations for refinement.

Why It Matters

• No Gradients: Only needs model output probabilities — works for any black-box model.
• Competitive: Achieves attack success rates comparable to gradient-based methods with ~1000 queries.
• AutoAttack: Included in the AutoAttack ensemble as the score-based black-box component.

Square Attack is random patch perturbation — a simple yet surprisingly effective black-box attack using random square modifications.