Skip to content
Branch: master
Find file Copy path
Find file Copy path
Fetching contributors…
Cannot retrieve contributors at this time
34 lines (27 sloc) 1.85 KB

Prior Convictions: Black-box Adversarial Attacks with Bandits and Priors

This is the code for reproducing the paper "Prior Convictions: Black-box Adversarial Attacks with Bandits and Priors" (arxiv) to appear at ICLR 2019. The paper can be cited as follows:

  title={Prior Convictions: Black-Box Adversarial Attacks with Bandits and Priors},
  author={Andrew Ilyas and Logan Engstrom and Aleksander Madry},
  journal={ICLR 2019},


Avg Queries Failure Rate Avg Queries on NES success
Method l-inf l-2 l-inf l-2 l-inf l-2
NES 1735 2938 22.2% 34.4% 1735 2938
Bandits[T] (ours) 1781 2690 11.6% 30.4% 1214 2421
Bandits[TD] (ours) 1117 1858 4.6% 15.5% 703 999

Reproducing the results


  • Pytorch (torch, torchvision) packages
  • argparse package

The results can be reproduced (with the default hyperparameters) with the following command:

python [--nes] [--tiling] --json-config [configs/l2.json | configs/linf.json | configs/linf-nes.json | configs/l2-nes.json]

You can run python --help to see all of the available options/hyperparameters. Although the hyperparameters were tuned for Inception-v3, the attack can by run with the flag --classifier {inception_v3,resnet50,vgg16_bn} to attack other classifiers.

You can’t perform that action at this time.