Recent studies have shown that deep neural networks can be misled by adversarial examples that involve only imperceptible perturbations. Among these, one-pixel attacks (OPA) represent an extreme yet powerful threat, as they alter only a single pixel of an input image while causing misclassification. While prior work has demonstrated the effectiveness of OPAs on low-resolution datasets, extending these attacks to high-resolution images poses a significant challenge due to the dramatic increase in the number of pixels and the resulting expansion of the search space. In this paper, we address this challenge by proposing a scalable one-pixel attack framework for deep neural networks on high-resolution images. The key difficulty in high-resolution OPAs lies in identifying a vulnerable pixel among tens of thousands of candidates under a black-box setting, where exhaustive pixel-wise probing is prohibitively expensive. To overcome this limitation, we decompose the attack into two phases. In the first phase, we efficiently identify a small set of promising pixel locations using a hierarchical patch-based search strategy, which iteratively prunes large image regions via coarse-grained patch perturbations, thereby substantially reducing the number of required model queries. In the second phase, for each selected pixel candidate, we search for adversarial RGB values using a black-box optimization method based on momentum-accelerated finite-difference gradient estimation. We evaluate our method on popular deep neural network architectures using high-resolution ImageNet images. The experimental results demonstrate that our approach achieves high attack success rates while significantly reducing query cost and improving the quality of the resulting adversarial perturbations compared to existing strategies.
Nam et al. (Tue,) studied this question.