mlsanityData to 7 Oct 2026

Decision-Based Adversarial Attacks: Reliable Attacks Against Black-Box Machine Learning Models

arXiv 1712.04248 ↗First posted 12 Dec 2017stat.ML cs.CR cs.CVcited by 459

Not on the map. Why?

Abstract (arXiv)

Many machine learning algorithms are vulnerable to almost imperceptible perturbations of their inputs. So far it was unclear how much risk adversarial perturbations carry for the safety of real-world machine learning applications because most methods used to generate such perturbations rely either on detailed model information (gradient-based attacks) or on confidence scores such as class probabilities (score-based attacks), neither of which are available in most real-world scenarios. In many such cases one currently needs to retreat to transfer-based attacks which rely on cumbersome substitute models, need access to the training data and can be defended against. Here we emphasise the importance of attacks which solely rely on the final model decision. Such decision-based attacks are (1) applicable to real-world black-box models such as autonomous cars, (2) need less knowledge and are easier to apply than transfer-based attacks and (3) are more robust to simple defences than gradient- or score-based attacks. Previous attacks in this category were limited to simple models or simple datasets. Here we introduce the Boundary Attack, a decision-based attack that starts from a large adversarial perturbation and then seeks to reduce the perturbation while staying adversarial. The attack is conceptually simple, requires close to no hyperparameter tuning, does not rely on substitute models and is competitive with the best gradient-based attacks in standard computer vision tasks like ImageNet. We apply the attack on two black-box algorithms from Clarifai.com. The Boundary Attack in particular and the class of decision-based attacks in general open new avenues to study the robustness of machine learning models and raise new questions regarding the safety of deployed machine learning systems. An implementation of the attack is available as part of Foolbox at https://github.com/bethgelab/foolbox .

Key facts. Cited by 459 papers in the map (data through 7 Oct 2026). First posted on arXiv 12 Dec 2017.

Builds on

No reference list yet.

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 118; 2022: 90; 2023: 105; 2024: 62; 2025: 53; 2026: 31.

459 papers.

Sort:

By area:

  1. 2021Unsolved Problems in ML Safetycited by 291
  2. 2021Enhancing the Transferability of Adversarial Attacks through Variance Tuningcited by 242
  3. 2021On the Robustness of Vision Transformers to Adversarial Examplescited by 167
  4. 2021Advances in adversarial attacks and defenses in computer vision: A surveycited by 127
  5. 2021Feature Importance-aware Transferable Adversarial Attackscited by 125
  6. 2023Anti-DreamBooth: Protecting users from personalized text-to-image synthesiscited by 114
  7. 2022Shadows can be Dangerous: Stealthy and Effective Physical-world Adversarial Attack by Natural Phenomenoncited by 101
  8. 2023Diffusion Models for Imperceptible and Transferable Adversarial Attackcited by 93
  9. 2021Adversarial Sticker: A Stealthy Attack Method in the Physical Worldcited by 92
  10. 2022Improving Adversarial Transferability via Neuron Attribution-Based Attackscited by 92
  11. 2022Parallel Rectangle Flip Attack: A Query-based Black-box Attack against Object Detectioncited by 79
  12. 2023A Pilot Study of Query-Free Adversarial Attack against Stable Diffusioncited by 75
38 more
  1. 2023How Deep Learning Sees the World: A Survey on Adversarial Attacks & Defensescited by 65
  2. 2021Mitigating Membership Inference Attacks by Self-Distillation Through a Novel Ensemble Architecturecited by 63
  3. 2023Black Box Adversarial Prompting for Foundation Modelscited by 62
  4. 2023Structure Invariant Transformation for better Adversarial Transferabilitycited by 61
  5. 2022T-SEA: Transfer-based Self-Ensemble Attack on Object Detectioncited by 59
  6. 2021Adversarial Robustness Comparison of Vision Transformer and MLP-Mixer to CNNscited by 57
  7. 2021Meta Gradient Adversarial Attackcited by 55
  8. 2024Query-Based Adversarial Prompt Generationcited by 55
  9. 2021Adversarial Example Detection for DNN Models: A Review and Experimental Comparisoncited by 51
  10. 2022Shape-invariant 3D Adversarial Point Cloudscited by 49
  11. 2022Improving the Transferability of Targeted Adversarial Examples through Object-Based Diverse Inputcited by 49
  12. 2021Adversarial Attacks On Multi-Agent Communicationcited by 48
  13. 2021Triangle Attack: A Query-efficient Decision-based Adversarial Attackcited by 48
  14. 2023Boosting Adversarial Transferability by Achieving Flat Local Maximacited by 48
  15. 2024Erasing Undesirable Concepts in Diffusion Models with Adversarial Preservationcited by 48
  16. 2021Exploring Adversarial Robustness of Multi-Sensor Perception Systems in Self Drivingcited by 45
  17. 2021Adversarial Attacks for Tabular Data: Application to Fraud Detection and Imbalanced Datacited by 45
  18. 2022A Survey of Robust Adversarial Training in Pattern Recognition: Fundamental, Theory, and Methodologiescited by 44
  19. 2021NeuronFair: Interpretable White-Box Fairness Testing through Biased Neuron Identificationcited by 42
  20. 2022Beyond ImageNet Attack: Towards Crafting Adversarial Examples for Black-box Domainscited by 42
  21. 2022Adv-Attribute: Inconspicuous and Transferable Adversarial Attack on Face Recognitioncited by 42
  22. 2021A Comprehensive Evaluation Framework for Deep Model Robustnesscited by 41
  23. 2021Robust Machine Learning Systems: Challenges, Current Trends, Perspectives, and the Road Aheadcited by 40
  24. 2021Harnessing Perceptual Adversarial Patches for Crowd Countingcited by 39
  25. 2022Query-Efficient Black-box Adversarial Attacks Guided by a Transfer-based Priorcited by 38
  26. 2021TRS: Transferability Reduced Ensemble via Encouraging Gradient Diversity and Model Smoothnesscited by 37
  27. 2021Zero-Shot Knowledge Distillation from a Decision-Based Black-Box Modelcited by 37
  28. 2021Poison Forensics: Traceback of Data Poisoning Attacks in Neural Networkscited by 37
  29. 2021Improving the Transferability of Adversarial Examples with Resized-Diverse-Inputs, Diversity-Ensemble and Region Fittingcited by 37
  30. 2023Among Us: Adversarially Robust Collaborative Perception by Consensuscited by 37
  31. 2022Towards Understanding and Boosting Adversarial Transferability from a Distribution Perspectivecited by 36
  32. 2021Physical Adversarial Attacks on an Aerial Imagery Object Detectorcited by 35
  33. 2021Improving robustness against common corruptions with frequency biased modelscited by 34
  34. 2023Diversifying the High-level Features for better Adversarial Transferabilitycited by 34
  35. 2025Fantastic Targets for Concept Erasure in Diffusion Models and Where To Find Themcited by 34
  36. 2021Detecting Adversarial Examples from Sensitivity Inconsistency of Spatial-Transform Domaincited by 29
  37. 2021Deep Learning-Based Autonomous Driving Systems: A Survey of Attacks and Defensescited by 29
  38. 2021A Review of Adversarial Attack and Defense for Classification Methodscited by 29

50 most cited of 459 All 459 (JSON)