HORNET: Fast and minimal adversarial perturbations

Visualization of HORNET. HORNET starts with a source model f s and an input x , used by a fixed-budget attack ( A ) to create an adversarial example ( x a d v ) with budget ε . The adversarial example x a d v is then tested on the unknown target model f t . Based on whether the example successfully fools the target model, the budget ε is iteratively adjusted (decreased on success, increased on failure) and a new adversarial example is generated. This process continues until a minimal successful perturbation is found. This iterative process continues until the maximum query count for the target model is reached or the adversarial example cannot be further optimized. Fixed-budget attacks aim to generate adversarial examples—carefully crafted inputs designed to induce misclassifications during inference—while adhering to a predefined perturbation budget. These attacks maximize misclassification confidence and benefit from the transferability property, enabling the generated adversarial examples to remain effective even against multiple unknown models. However, to preserve their transferability, such attacks often yield perceptible perturbations, compromising the visual integrity of the adversarial examples. In this paper, we introduce HORNET, an extension of gradient-based fixed-budget attacks designed to minimize the perturbation magnitude of adversarial examples while maintaining their transferability against the target model. HORNET utilizes a distinct source model to craft the adversarial examples and employs a limited number of queries to the unknown target model to further minimize perturbation magnitude. We evaluate HORNET empirically by integrating it with 41 existing attack implementations and testing it against 9 different models, resulting in a total of 1700 unique configurations. Our results demonstrate that HORNET outperforms the state of the art in generating minimally perturbed yet highly transferable adversarial examples across all tested models. Code available at: https://github.com/louiswup/HORNET . • We propose HORNET, a novel framework for crafting minimum-norm transferable adversarial examples. • HORNET integrates fixed-budget attacks with an efficient search strategy to minimize perturbation size while maintaining high transfer success rates. • We assess HORNET across four ℓ p -norms and leverage 41 attack implementations from widely-used adversarial libraries. • We conduct extensive experiments comprising 1700 configurations, demonstrating that HORNET significantly outperforms state-of-the-art methods in both transferability and perturbation efficiency.