Skip to content
Switch branches/tags


Failed to load latest commit information.
Latest commit message
Commit time

Code for Black-box Adversarial Attacks with Limited Queries and Information

Codebase for reproducing the results in the paper "Black-Box Adversarial Attacks with Limited Queries and Information". The paper can be found on arxiv, and our explanatory blog post can be found on

To reproduce our results:

  1. Make a directory tools/data, and in it put the decompressed Inceptionv3 classifier from (
  2. Set IMAGENET_PATH in,, and to the location of the ImageNet dataset on your machine.
  3. Precompute the starting images (for partial-information and label-only attacks) with python
  4. Run the reproduction scripts with {query-limited|partial-info|label-only}.sh, making sure to first edit them specifying an img-index (by default runs on imagenet image 0)


  author = {Andrew Ilyas and Logan Engstrom and Anish Athalye and Jessy Lin},
  title = {Black-box Adversarial Attacks with Limited Queries and Information},
  booktitle = {Proceedings of the 35th International Conference on Machine Learning, {ICML} 2018},
  year = {2018},
  month = jul,
  url = {},