mlsanityData to 7 Oct 2026

Prior Convictions: Black-Box Adversarial Attacks with Bandits and Priors

arXiv 1807.07978 ↗First posted 20 Jul 2018stat.ML cs.CR cs.LGcited by 145

Not on the map. Why?

Abstract (arXiv)

We study the problem of generating adversarial examples in a black-box setting in which only loss-oracle access to a model is available. We introduce a framework that conceptually unifies much of the existing work on black-box attacks, and we demonstrate that the current state-of-the-art methods are optimal in a natural sense. Despite this optimality, we show how to improve black-box attacks by bringing a new element into the problem: gradient priors. We give a bandit optimization-based algorithm that allows us to seamlessly integrate any such priors, and we explicitly identify and incorporate two examples. The resulting methods use two to four times fewer queries and fail two to five times less often than the current state-of-the-art.

Key facts. Cited by 145 papers in the map (data through 7 Oct 2026). First posted on arXiv 20 Jul 2018.

Builds on

No reference list yet.

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 37; 2022: 30; 2023: 28; 2024: 21; 2025: 13; 2026: 16.

145 papers.

Sort:

By area:

  1. 2021AdvSim: Generating Safety-Critical Scenarios for Self-Driving Vehiclescited by 132
  2. 2021Advances in adversarial attacks and defenses in computer vision: A surveycited by 127
  3. 2023Automatic Prompt Augmentation and Selection with Chain-of-Thought from Labeled Datacited by 119
  4. 2022KING: Generating Safety-Critical Driving Scenarios for Robust Imitation via Kinematics Gradientscited by 95
  5. 2023DeepZero: Scaling up Zeroth-Order Optimization for Deep Model Trainingcited by 76
  6. 2022Black-box Prompt Learning for Pre-trained Language Modelscited by 70
  7. 2023Black Box Adversarial Prompting for Foundation Modelscited by 62
  8. 2021Relating Adversarially Robust Generalization to Flat Minimacited by 57
  9. 2021Adversarial Robustness Comparison of Vision Transformer and MLP-Mixer to CNNscited by 57
  10. 2022Patch-Fool: Are Vision Transformers Always Robust Against Adversarial Perturbations?cited by 47
  11. 2021Random Noise Defense Against Query-Based Black-Box Attackscited by 46
  12. 2022How to Robustify Black-Box ML Models? A Zeroth-Order Optimization Perspectivecited by 39
38 more
  1. 2022Query-Efficient Black-box Adversarial Attacks Guided by a Transfer-based Priorcited by 38
  2. 2022Transferable Adversarial Attack based on Integrated Gradientscited by 35
  3. 2021Drawing Robust Scratch Tickets: Subnetworks with Inborn Robustness Are Found within Randomly Initialized Networkscited by 29
  4. 2021A Review of Adversarial Attack and Defense for Classification Methodscited by 29
  5. 2023Generalizable Black-Box Adversarial Attack with Meta Learningcited by 29
  6. 2023Improving Adversarial Transferability via Intermediate-level Perturbation Decaycited by 29
  7. 2021Adversarial Attacks on Black Box Video Classifiers: Leveraging the Power of Geometric Transformationscited by 28
  8. 2021Combating Adversaries with Anti-Adversariescited by 27
  9. 2021Delving into Data: Effectively Substitute Training for Black-box Attackcited by 27
  10. 2022Fast Adversarial Training with Adaptive Step Sizecited by 24
  11. 2021On the Convergence of Prior-Guided Zeroth-Order Optimization Algorithmscited by 23
  12. 2023Efficient Robustness Assessment via Adversarial Spatial-Temporal Focus on Videoscited by 20
  13. 2023CGBA: Curvature-aware Geometric Black-box Attackcited by 20
  14. 2024Transferable Adversarial Attacks on SAM and Its Downstream Modelscited by 20
  15. 2021Just Noticeable Difference for Deep Machine Visioncited by 19
  16. 2023Attacks in Adversarial Machine Learning: A Systematic Survey from the Life-cycle Perspectivecited by 19
  17. 2023A Survey of Robustness and Safety of 2D and 3D Deep Learning Models Against Adversarial Attackscited by 19
  18. 2022Attacking deep networks with surrogate-based adversarial black-box methods is easycited by 18
  19. 2022Adversarial Attack on Attackers: Post-Process to Mitigate Black-Box Score-Based Query Attackscited by 18
  20. 2021On the Effectiveness of Small Input Noise for Defending Against Query-based Black-Box Attackscited by 17
  21. 2023Survey on Adversarial Attack and Defense for Medical Image Analysis: Methods and Challengescited by 16
  22. 2021Attack as the Best Defense: Nullifying Image-to-image Translation GANs via Limit-aware Adversarial Attackcited by 15
  23. 2021Learning to Learn Transferable Attackcited by 13
  24. 2022Blackbox Attacks via Surrogate Ensemble Searchcited by 13
  25. 2022Towards Lightweight Black-Box Attacks against Deep Neural Networkscited by 13
  26. 2021Exploiting epistemic uncertainty of the deep learning models to generate adversarial samplescited by 12
  27. 2022Saliency Attack: Towards Imperceptible Black-box Adversarial Attackcited by 12
  28. 2022Understanding Adversarial Robustness Against On-manifold Adversarial Examplescited by 12
  29. 2023Boosting Black-box Attack to Deep Neural Networks with Conditional Diffusion Modelscited by 12
  30. 2021Adversarial Token Attacks on Vision Transformerscited by 11
  31. 2021Finding Optimal Tangent Points for Reducing Distortions of Hard-label Attackscited by 11
  32. 2022Holistic Adversarial Robustness of Deep Learning Modelscited by 11
  33. 2023Certified Zeroth-order Black-Box Defense with Robust UNet Denoisercited by 11
  34. 2024Hard-label based Small Query Black-box Adversarial Attackcited by 10
  35. 2024Efficient Black-box Adversarial Attacks via Bayesian Optimization Guided by a Function Priorcited by 10
  36. 2022An Intermediate-level Attack Framework on The Basis of Linear Regressioncited by 9
  37. 2022Bandits for Structure Perturbation-based Black-box Attacks to Graph Neural Networks with Theoretical Guaranteescited by 9
  38. 2023An End-to-End Framework for Marketing Effectiveness Optimization under Budget Constraintcited by 9

50 most cited of 145 All 145 (JSON)