mlsanityData to 14 Oct 2026

ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Models

arXiv 1708.03999 ↗First posted 14 Aug 2017stat.ML cs.CR cs.LGcited by 666

Not on the map. Why?

Cited by 34 in LLM safety and security, but placed by its own abstract, which didn’t fit.

Abstract (arXiv)

Deep neural networks (DNNs) are one of the most prominent technologies of our time, as they achieve state-of-the-art performance in many machine learning tasks, including but not limited to image classification, text mining, and speech processing. However, recent research on DNNs has indicated ever-increasing concern on the robustness to adversarial examples, especially for security-critical tasks such as traffic sign identification for autonomous driving. Studies have unveiled the vulnerability of a well-trained DNN by demonstrating the ability of generating barely noticeable (to both human and machines) adversarial images that lead to misclassification. Furthermore, researchers have shown that these adversarial images are highly transferable by simply training and attacking a substitute model built upon the target model, known as a black-box attack to DNNs. Similar to the setting of training substitute models, in this paper we propose an effective black-box attack that also only has access to the input (images) and the output (confidence scores) of a targeted DNN. However, different from leveraging attack transferability from substitute models, we propose zeroth order optimization (ZOO) based attacks to directly estimate the gradients of the targeted DNN for generating adversarial examples. We use zeroth order stochastic coordinate descent along with dimension reduction, hierarchical attack and importance sampling techniques to efficiently attack black-box models. By exploiting zeroth order optimization, improved attacks to the targeted DNN can be accomplished, sparing the need for training substitute models and avoiding the loss in attack transferability. Experimental results on MNIST, CIFAR10 and ImageNet show that the proposed ZOO attack is as effective as the state-of-the-art white-box attack and significantly outperforms existing black-box attacks via substitute models.

Key facts. Cited by 666 papers in the map (data through 14 Oct 2026). First posted on arXiv 14 Aug 2017.

Builds on

No reference list yet.

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2021: 145; 2022: 120; 2023: 123; 2024: 113; 2025: 105; 2026: 60.

666 papers.

Sort:

By area:

  1. 2023Jailbreaking Black Box Large Language Models in Twenty Queriescited by 1,420
  2. 2023Fine-Tuning Language Models with Just Forward Passescited by 345
  3. 2023On Evaluating Adversarial Robustness of Large Vision-Language Modelscited by 284
  4. 2023Data-centric Artificial Intelligence: A Surveycited by 203
  5. 2023Open Sesame! Universal Black Box Jailbreaking of Large Language Modelscited by 134
  6. 2024Revisiting Zeroth-Order Optimization for Memory-Efficient LLM Fine-Tuning: A Benchmarkcited by 114
  7. 2022Shadows can be Dangerous: Stealthy and Effective Physical-world Adversarial Attack by Natural Phenomenoncited by 101
  8. 2022Wild Patterns Reloaded: A Survey of Machine Learning Security against Training Data Poisoningcited by 94
  9. 2023Diffusion Models for Imperceptible and Transferable Adversarial Attackcited by 94
  10. 2021Adversarial Sticker: A Stealthy Attack Method in the Physical Worldcited by 93
  11. 2021Voice2Series: Reprogramming Acoustic Models for Time Series Classificationcited by 91
  12. 2023Rethinking Model Ensemble in Transfer-based Adversarial Attackscited by 89
38 more
  1. 2022Untargeted Backdoor Watermark: Towards Harmless and Stealthy Dataset Copyright Protectioncited by 86
  2. 2022Parallel Rectangle Flip Attack: A Query-based Black-box Attack against Object Detectioncited by 79
  3. 2023A Pilot Study of Query-Free Adversarial Attack against Stable Diffusioncited by 76
  4. 2023DeepZero: Scaling up Zeroth-Order Optimization for Deep Model Trainingcited by 76
  5. 2024Gradient Cuff: Detecting Jailbreak Attacks on Large Language Models by Exploring Refusal Loss Landscapescited by 74
  6. 2021Bad Characters: Imperceptible NLP Attackscited by 71
  7. 2021On Improving Adversarial Transferability of Vision Transformerscited by 70
  8. 2023InstructZero: Efficient Instruction Optimization for Black-Box Large Language Modelscited by 68
  9. 2021HIRE-SNN: Harnessing the Inherent Robustness of Energy-Efficient Deep Spiking Neural Networks by Training with Crafted Input Noisecited by 65
  10. 2023Black Box Adversarial Prompting for Foundation Modelscited by 62
  11. 2024Query-Based Adversarial Prompt Generationcited by 62
  12. 2021Relating Adversarially Robust Generalization to Flat Minimacited by 57
  13. 2021Adversarial Robustness Comparison of Vision Transformer and MLP-Mixer to CNNscited by 57
  14. 2021Meta Gradient Adversarial Attackcited by 55
  15. 2024Sparse MeZO: Less Parameters for Better Performance in Zeroth-Order LLM Fine-Tuningcited by 54
  16. 2024Second-Order Fine-Tuning without Pain for LLMs:A Hessian Informed Zeroth-Order Optimizercited by 53
  17. 2021Adversarial Example Detection for DNN Models: A Review and Experimental Comparisoncited by 52
  18. 2022Shape-invariant 3D Adversarial Point Cloudscited by 50
  19. 2022Improving the Transferability of Targeted Adversarial Examples through Object-Based Diverse Inputcited by 50
  20. 2021Adversarial Attacks On Multi-Agent Communicationcited by 49
  21. 2022Patch-Fool: Are Vision Transformers Always Robust Against Adversarial Perturbations?cited by 49
  22. 2021Triangle Attack: A Query-efficient Decision-based Adversarial Attackcited by 48
  23. 2023Boosting Adversarial Transferability by Achieving Flat Local Maximacited by 48
  24. 2024Learn What You Want to Unlearn: Unlearning Inversion Attacks against Machine Unlearningcited by 48
  25. 2021A Zeroth-Order Block Coordinate Descent Algorithm for Huge-Scale Black-Box Optimizationcited by 46
  26. 2021Adversarial Attacks for Tabular Data: Application to Fraud Detection and Imbalanced Datacited by 45
  27. 2022Membership Inference Attacks and Defenses in Neural Network Pruningcited by 45
  28. 2024An Image Is Worth 1000 Lies: Adversarial Transferability across Prompts on Vision-Language Modelscited by 45
  29. 2022A Survey of Robust Adversarial Training in Pattern Recognition: Fundamental, Theory, and Methodologiescited by 44
  30. 2022Adv-Attribute: Inconspicuous and Transferable Adversarial Attack on Face Recognitioncited by 43
  31. 2021A Comprehensive Evaluation Framework for Deep Model Robustnesscited by 42
  32. 2021DeepSteal: Advanced Model Extractions Leveraging Efficient Weight Stealing in Memoriescited by 42
  33. 2021NeuronFair: Interpretable White-Box Fairness Testing through Biased Neuron Identificationcited by 42
  34. 2022Infrared Invisible Clothing:Hiding from Infrared Detectors at Multiple Angles in Real Worldcited by 42
  35. 2022Simultaneously Optimizing Perturbations and Positions for Black-box Adversarial Patch Attackscited by 42
  36. 2023A Guide Through the Zoo of Biased SGDcited by 40
  37. 2021Harnessing Perceptual Adversarial Patches for Crowd Countingcited by 39
  38. 2022How to Robustify Black-Box ML Models? A Zeroth-Order Optimization Perspectivecited by 39

50 most cited of 666 All 666 (JSON)