Imagine you're locked out of your house and you have a bucket of blank keys. You can try each key once, but each attempt costs a dollar and you only learn pass/fail — the lock doesn't tell you how close you were. The smart move isn't to file one key down incrementally; it's to cast a maximally diverse set of blanks first, test each one cheaply, and only then start filing the one that clicks. That's GuidedRay's core mechanism: generate diverse candidate perturbation directions from target-class reference images, screen each with a single binary query (the "Fast Test"), and once you find a direction that lands in the target region, refine it with a geometric Ray Search to minimize perturbation size. The committed claim: GuidedRay is the first targeted decision-based attack to explicitly optimize for diversity in the direction-discovery initialization phase, and this diversity-first strategy consistently beats five state-of-the-art attacks (HSJA, Sign-OPT, GeoDA, RayS, and Triangle Attack) across query budgets from 500 to 5,000 on CIFAR-10, CIFAR-100, and ImageNet, including against adversarially trained and TRADES-defended models. The ladder here is clear and honestly constructed. The paper names five current baselines by name and benchmarks against all of them at four query budgets across three datasets. The gains are most dramatic at low query budgets (500–1,000 queries), which is exactly where direction discovery dominates total cost. At higher budgets the gap narrows — as you'd expect, since refinement methods converge — but GuidedRay still leads. Against robust models (adversarial training, TRADES), it achieves the highest attack success rate at all four budgets. This isn't a paper that hides from its baselines. Architecturally, GuidedRay belongs to the geometric / decision-boundary family of black-box attacks — no gradient estimation, no surrogate models, just sign-of-boundary queries. The key structural choice is generating candidate directions from target-class reference samples via diversity-promoting perturbations, then using a one-query sign test to determine if a candidate crosses into the target region. The Ray Search refinement is a bisection method on the decision-boundary radius. The whole pipeline is gradient-free and model-agnostic, leaning only on top-1 label access. Integrity is solid for adversarial ML standards. Three standard image classification benchmarks (CIFAR-10, CIFAR-100, ImageNet), five named SOTA baselines, four query budgets, and evaluation against both standard and robustly trained models. That's a thorough comparison grid — 11 tables and 8 figures across 12 pages. Code is publicly released. The main caveat: all validation is the authors' own experiments, no independent replication yet, and no pre-registration. Benchmark selection appears standard for the field, not cherry-picked. The milestone question for targeted decision-based attacks is practical: can you reliably fool a defended classifier into a specific target class within a query budget that's operationally realistic (say, under 100 queries for real-time deployment)? GuidedRay works at 500 queries; getting to sub-100 with high success rates on ImageNet-scale models would be the next unlock, and that likely requires either better direction priors (perhaps from foundation model embeddings) or adaptive diversity strategies. The obvious experiment not run: transfer across model architectures. The paper evaluates on standard CNN classifiers (ResNet, WideResNet). What happens against Vision Transformers, or against certified defenses like randomized smoothing? My read: (a) compute/time — running the full benchmark grid against ViTs and certified defenses would double the experimental surface, and (c) this is almost certainly the next paper, given that ViT robustness is the current frontier in adversarial ML.
