Stroke attack uses simple occlusion patches to fool AI image classifiers
STROKE: Simple Sparse Structural Occlusions for Black-Box Adversarial Attacks
Computer Vision and Pattern RecognitionCryptography and SecurityHuman-Computer Interaction
Summary
It can be hard for some AI systems to recognize images correctly when small parts are blocked or altered. The authors introduce STROKE, a method that attacks image recognition by covering parts of an image with simple rectangular shapes. This approach finds effective ways to confuse AI quickly and with few guesses. Because it uses simple shapes and a fast search, it can fool many different classifiers efficiently.
What this means in practice
- •For security teams: Test AI image classification defenses by simulating realistic occlusion-based attacks with low query budgets.
- •For ai robustness engineers: Evaluate the robustness of image recognition models against efficient localized adversarial occlusions.
Authors
Ankit Gupta, Akshat Pandya, Paul Lin, Christoph Adami, Emily Dolson
Abstract
We introduce STROKE, a query-efficient score-based black-box adversarial attack that constructs perturbations from simple oriented rectangular occlusions. STROKE optimizes these perturbations through a lightweight greedy add-and-refine procedure. Across diverse image classifiers, STROKE achieves high attack success with low query counts at nominal 1--2\% area settings, showing favorable performance relative to existing patch-based attacks in several configurations. Matched comparisons further demonstrate substantial reductions in wall-clock attack time, while ablation studies examine the key design choices and effectiveness across structural primitives. These findings suggest that simple structural occlusions offer an effective and computationally efficient search space for black-box adversarial attacks.