mlsanityData to 7 Oct 2026

Black-box Adversarial Attacks with Limited Queries and Information

arXiv 1804.08598 ↗First posted 23 Apr 2018cs.CV cs.CR stat.MLcited by 499

Not on the map. Why?

Cited by 32 in Multimodal LLMs / vision-language models, but placed by its own abstract, which didn’t fit.

Abstract (arXiv)

Current neural network-based classifiers are susceptible to adversarial examples even in the black-box setting, where the attacker only has query access to the model. In practice, the threat model for real-world systems is often more restrictive than the typical black-box model where the adversary can observe the full output of the network on arbitrarily many chosen inputs. We define three realistic threat models that more accurately characterize many real-world classifiers: the query-limited setting, the partial-information setting, and the label-only setting. We develop new attacks that fool classifiers under these more restrictive threat models, where previous methods would be impractical or ineffective. We demonstrate that our methods are effective against an ImageNet classifier under our proposed threat models. We also demonstrate a targeted black-box attack against a commercial classifier, overcoming the challenges of limited query access, partial information, and other practical issues to break the Google Cloud Vision API.

Key facts. Cited by 499 papers in the map (data through 7 Oct 2026). First posted on arXiv 23 Apr 2018.

Builds on

No reference list yet.

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 102; 2022: 88; 2023: 100; 2024: 101; 2025: 63; 2026: 45.

499 papers.

Sort:

By area:

  1. 2023Jailbreaking Black Box Large Language Models in Twenty Queriescited by 1,326
  2. 2023Visual Adversarial Examples Jailbreak Aligned Large Language Modelscited by 307
  3. 2023On Evaluating Adversarial Robustness of Large Vision-Language Modelscited by 281
  4. 2021Enhancing the Transferability of Adversarial Attacks through Variance Tuningcited by 242
  5. 2023How Robust is Google's Bard to Adversarial Image Attacks?cited by 177
  6. 2021The Values Encoded in Machine Learning Researchcited by 172
  7. 2021AdvSim: Generating Safety-Critical Scenarios for Self-Driving Vehiclescited by 132
  8. 2021Feature Importance-aware Transferable Adversarial Attackscited by 125
  9. 2024Black-Box Access is Insufficient for Rigorous AI Auditscited by 123
  10. 2023Automatic Prompt Augmentation and Selection with Chain-of-Thought from Labeled Datacited by 119
  11. 2024Revisiting Zeroth-Order Optimization for Memory-Efficient LLM Fine-Tuning: A Benchmarkcited by 113
  12. 2022Shadows can be Dangerous: Stealthy and Effective Physical-world Adversarial Attack by Natural Phenomenoncited by 101
38 more
  1. 2022Improving Adversarial Transferability via Neuron Attribution-Based Attackscited by 92
  2. 2022Parallel Rectangle Flip Attack: A Query-based Black-box Attack against Object Detectioncited by 79
  3. 2023DeepZero: Scaling up Zeroth-Order Optimization for Deep Model Trainingcited by 76
  4. 2021On Improving Adversarial Transferability of Vision Transformerscited by 70
  5. 2022Black-box Prompt Learning for Pre-trained Language Modelscited by 70
  6. 2024Inducing High Energy-Latency of Large Vision-Language Models with Verbose Imagescited by 69
  7. 2022Boosting the Transferability of Adversarial Attacks with Reverse Adversarial Perturbationcited by 67
  8. 2023How Deep Learning Sees the World: A Survey on Adversarial Attacks & Defensescited by 65
  9. 2024Gradient Cuff: Detecting Jailbreak Attacks on Large Language Models by Exploring Refusal Loss Landscapescited by 63
  10. 2023Black Box Adversarial Prompting for Foundation Modelscited by 62
  11. 2023Structure Invariant Transformation for better Adversarial Transferabilitycited by 61
  12. 2021Adversarial Robustness Comparison of Vision Transformer and MLP-Mixer to CNNscited by 57
  13. 2024Sparse MeZO: Less Parameters for Better Performance in Zeroth-Order LLM Fine-Tuningcited by 53
  14. 2021Triangle Attack: A Query-efficient Decision-based Adversarial Attackcited by 48
  15. 2024Enhancing Zeroth-order Fine-tuning for Language Models with Low-rank Structurescited by 48
  16. 2022Patch-Fool: Are Vision Transformers Always Robust Against Adversarial Perturbations?cited by 47
  17. 2021A Zeroth-Order Block Coordinate Descent Algorithm for Huge-Scale Black-Box Optimizationcited by 46
  18. 2021Random Noise Defense Against Query-Based Black-Box Attackscited by 46
  19. 2022Simultaneously Optimizing Perturbations and Positions for Black-box Adversarial Patch Attackscited by 41
  20. 2023Backdoor Attacks Against Deep Image Compression via Adaptive Frequency Triggercited by 40
  21. 2024An Image Is Worth 1000 Lies: Adversarial Transferability across Prompts on Vision-Language Modelscited by 40
  22. 2021Harnessing Perceptual Adversarial Patches for Crowd Countingcited by 39
  23. 2022How to Robustify Black-Box ML Models? A Zeroth-Order Optimization Perspectivecited by 39
  24. 2024One Perturbation is Enough: On Generating Universal Adversarial Perturbations against Vision-Language Pre-training Modelscited by 39
  25. 2022Query-Efficient Black-box Adversarial Attacks Guided by a Transfer-based Priorcited by 38
  26. 2023Privacy Side Channels in Machine Learning Systemscited by 38
  27. 2023Evading DeepFake Detectors via Adversarial Statistical Consistencycited by 37
  28. 2024Chain of Attack: On the Robustness of Vision-Language Models Against Transfer-Based Adversarial Attackscited by 37
  29. 2022Towards Understanding and Boosting Adversarial Transferability from a Distribution Perspectivecited by 36
  30. 2021Recent advances for quantum classifierscited by 35
  31. 2022Transferable Adversarial Attack based on Integrated Gradientscited by 35
  32. 2023Neural Polarizer: A Lightweight and Effective Backdoor Defense via Purifying Poisoned Featurescited by 35
  33. 2023Diversifying the High-level Features for better Adversarial Transferabilitycited by 34
  34. 2025A Frustratingly Simple Yet Highly Effective Attack Baseline: Over 90% Success Rate Against the Strong Black-box Models of GPT-4.5/4o/o1cited by 34
  35. 2025R-TPT: Improving Adversarial Robustness of Vision-Language Models through Test-Time Prompt Tuningcited by 33
  36. 2021Drawing Robust Scratch Tickets: Subnetworks with Inborn Robustness Are Found within Randomly Initialized Networkscited by 29
  37. 2021A Review of Adversarial Attack and Defense for Classification Methodscited by 29
  38. 2023Generalizable Black-Box Adversarial Attack with Meta Learningcited by 29

50 most cited of 499 All 499 (JSON)