# Superpixel Attack: Enhancing Black-box Adversarial Attack with Image-driven Division Areas

Source: [Superpixel Attack: Enhancing Black-box Adversarial Attack with Image-driven Division Areas](<https://www.sota2.com/research/paper/692fc3e7d6b0dd334293318c>)

Collection index: [llms.txt](<https://www.sota2.com/research/llms.txt>)

Data updated: 2025-12-04T05:02:42.220Z

Authors: Issa Oe, Keiichiro Yamamura, Hiroki Ishikura, Ryo Hamahira, Katsuki Fujisawa

Published: 2025-11-29T05:28:52.000Z

## Abstract

Deep learning models are used in safety-critical tasks such as automated driving and face recognition. However, small perturbations in the model input can significantly change the predictions. Adversarial attacks are used to identify small perturbations that can lead to misclassifications. More powerful black-box adversarial attacks are required to develop more effective defenses. A promising approach to black-box adversarial attacks is to repeat the process of extracting a specific image area and changing the perturbations added to it. Existing attacks adopt simple rectangles as the areas where perturbations are changed in a single iteration. We propose applying superpixels instead, which achieve a good balance between color variance and compactness. We also propose a new search method, versatile search, and a novel attack method, Superpixel Attack, which applies superpixels and performs versatile search. Superpixel Attack improves attack success rates by an average of 2.10% compared with existing attacks. Most models used in this study are robust against adversarial attacks, and this improvement is significant for black-box adversarial attacks. The code is avilable at https://github.com/oe1307/SuperpixelAttack.git.

## Recorded benchmark results

A research result applies to its stated dataset, split, metric and evaluation configuration. Compare like-for-like settings, preserve the metric's unit and direction, and distinguish paper-reported results from independent reproduction. The best result recorded here is not a claim of exhaustive, current global coverage.

- [Adversarial Attack on ImageNet (Perturbation Metrics)](<https://www.sota2.com/research/sota/adversarial-attack-on-imagenet-perturbation-metrics.md>): Adversarial Attack; ImageNet; Parsimon: not recorded.

- [Adversarial Attack Perturbation Analysis on ImageNet](<https://www.sota2.com/research/sota/adversarial-attack-perturbation-analysis-on-imagenet.md>): Adversarial Attack; ImageNet; Parsimon: not recorded.

## Original sources and implementation

[Original paper](<https://arxiv.org/abs/2512.02062>)

[PDF](<https://arxiv.org/pdf/2512.02062.pdf>)