  Deep neural networks (DNNs) are widely used today, but they are vulnerable to
adversarial attacks. To develop effective methods of defense, it is important
to understand the potential weak spots of DNNs. Often attacks are organized
taking into account the architecture of models (white-box approach) and based
on gradient methods, but for real-world DNNs this approach in most cases is
impossible. At the same time, several gradient-free optimization algorithms are
used to attack black-box models. However, classical methods are often
ineffective in the multidimensional case. To organize black-box attacks for
computer vision models, in this work, we propose the use of an optimizer based
on the low-rank tensor train (TT) format, which has gained popularity in
various practical multidimensional applications in recent years. Combined with
the attribution of the target image, which is built by the auxiliary
(white-box) model, the TT-based optimization method makes it possible to
organize an effective black-box attack by small perturbation of pixels in the
target image. The superiority of the proposed approach over three popular
baselines is demonstrated for five modern DNNs on the ImageNet dataset.
