# QAIR: Practical Query-efficient Black-Box Attacks for Image Retrieval Source: [QAIR: Practical Query-efficient Black-Box Attacks for Image Retrieval]() Collection index: [llms.txt]() Data updated: 2026-01-04T05:04:56.497Z Authors: Xiaodan Li, Jinfeng Li, Yuefeng Chen, Shaokai Ye, Yuan He, Shuhui Wang, Hang Su, Hui Xue Published: 2021-03-04T10:18:43.000Z ## Abstract We study the query-based attack against image retrieval to evaluate its robustness against adversarial examples under the black-box setting, where the adversary only has query access to the top-k ranked unlabeled images from the database. Compared with query attacks in image classification, which produce adversaries according to the returned labels or confidence score, the challenge becomes even more prominent due to the difficulty in quantifying the attack effectiveness on the partial retrieved list. In this paper, we make the first attempt in Query-based Attack against Image Retrieval (QAIR), to completely subvert the top-k retrieval results. Specifically, a new relevance-based loss is designed to quantify the attack effects by measuring the set similarity on the top-k retrieval results before and after attacks and guide the gradient optimization. To further boost the attack efficiency, a recursive model stealing method is proposed to acquire transferable priors on the target model and generate the prior-guided gradients. Comprehensive experiments show that the proposed attack achieves a high attack success rate with few queries against the image retrieval systems under the black-box setting. The attack evaluations on the real-world visual search engine show that it successfully deceives a commercial system such as Bing Visual Search with 98% attack success rate by only 33 queries on average. ## Recorded benchmark results A research result applies to its stated dataset, split, metric and evaluation configuration. Compare like-for-like settings, preserve the metric's unit and direction, and distinguish paper-reported results from independent reproduction. The best result recorded here is not a claim of exhaustive, current global coverage. - [Black-box Adversarial Attack (Image Retrieval) on CUB-200 (test)](): Black-box Adversarial Attack (Image Retrieval); CUB-200 (test); Recall@1: 59. - [Black-box Adversarial Attack (Image Retrieval) on Stanford Online Products (test)](): Black-box Adversarial Attack (Image Retrieval); Stanford Online Products (SOP) (test); Recall@1: 17.6. - [Black-box Adversarial Attack (Image Retrieval) on In-Shop Clothes (test)](): Black-box Adversarial Attack (Image Retrieval); In-Shop Clothes (test); Recall@1: 29.6. ## Original sources and implementation [Original paper]() [PDF]()