Boundary Attack

Boundary Attack is a decision-based adversarial attack that performs a random walk along the decision boundary — starting from an adversarial image and iteratively reducing the perturbation while maintaining misclassification, using only the model's top-1 predicted label.

How Boundary Attack Works

• Initialize: Start with an image classified as the target class (random noise or a real image).
• Orthogonal Step: Take a random step orthogonal to the direction toward the clean image (stay on boundary).
• Step Toward Original: Take a step toward the clean image (reduce perturbation).
• Accept: If still adversarial, accept the new point. If not, reject and try again.

Why It Matters

• Truly Black-Box: Only needs the final predicted class — no probabilities, logits, or gradients.
• Pioneering: One of the first effective decision-based attacks (Brendel et al., 2018).
• Simple: Conceptually simple random walk — easy to implement and understand.

Boundary Attack is the random walk on the adversarial frontier — progressively shrinking the perturbation through random exploration along the decision boundary.