Search papers, labs, and topics across Lattice.
This paper introduces OASIS, a novel method for optimizing sequences of attackers in hard-label black-box text attacks, addressing the limitations of existing approaches that focus on individual attackers or manual combinations. By conducting a bi-objective search to balance attack success rates and perturbation, OASIS identifies an optimal fixed global chain of attacks that is reused during execution. Experimental results demonstrate that OASIS significantly outperforms both standalone baselines and manually constructed attack chains across various datasets and victim models, highlighting the importance of attacker composition as a key optimization target.
Optimizing attacker sequences can dramatically enhance the effectiveness of hard-label black-box text attacks, outperforming traditional methods by leveraging a strategic combination of attack strategies.
Different attack methods follow different search trajectories, they succeed on different subsets of samples, whereas existing hard-label black-box text attacks mainly focus on improving individual attackers or manually combining them. We present {\OURS}, a method for optimizing attacker sequences in hard-label black-box text attacks. {\OURS} first performs a one-time bi-objective attack chain search over candidate sequences to balance attack success rate and perturbation, and then reuses the selected fixed global chain during attack chain execution. Experiments across multiple datasets, victim models, and large language models show that {\OURS} consistently outperforms strong standalone baselines and simple manually constructed chains. These results suggest that attacker composition is not merely an implementation choice, but a practical optimization target for improving hard-label black-box text attacks.
