Query-Efficient Hard-Label Attack: A Prior-Guided Adam Ray Search Optimization

Deep neural networks are vulnerable to adversarial examples, even in hard-label black-box settings where only the top-1 prediction is available. To address the challenges of high-dimensional optimization under limited query budgets, we propose two query-efficient attack methods: Adam-OPT, which integrates Adam-based adaptive optimization into the ray-search framework to stabilize and accelerate zeroth-order gradient updates; Prior-Adam-OPT, which further incorporates transfer-based priors from surrogate models to enhance gradient estimation. Adam-OPT leverages historical gradient information and per-parameter adaptive updates to improve convergence, while Prior-Adam-OPT constructs a prior-guided orthogonal search basis that combines surrogate and random directions, enhancing both gradient accuracy and query efficiency. Our approach demonstrates superior performance across CIFAR-10, ImageNet, and zero-shot CLIP models, consistently reducing perturbation magnitudes and improving attack efficiency compared to state-of-the-art hard-label attacks. Ablation studies highlight the importance of the number of vectors used for gradient estimation and the quality of surrogate models, showing that combining adaptive optimization with transfer-based priors provides a scalable and robust framework for generating high-quality adversarial examples in challenging black-box scenarios.