mlsanityData to 7 Oct 2026

Guessing Smart: Biased Sampling for Efficient Black-Box Adversarial Attacks

arXiv 1812.09803 ↗First posted 24 Dec 2018stat.ML cs.CR cs.CVcited by 46

Not on the map. Why?

Abstract (arXiv)

We consider adversarial examples for image classification in the black-box decision-based setting. Here, an attacker cannot access confidence scores, but only the final label. Most attacks for this scenario are either unreliable or inefficient. Focusing on the latter, we show that a specific class of attacks, Boundary Attacks, can be reinterpreted as a biased sampling framework that gains efficiency from domain knowledge. We identify three such biases, image frequency, regional masks and surrogate gradients, and evaluate their performance against an ImageNet classifier. We show that the combination of these biases outperforms the state of the art by a wide margin. We also showcase an efficient way to attack the Google Cloud Vision API, where we craft convincing perturbations with just a few hundred queries. Finally, the methods we propose have also been found to work very well against strong defenses: Our targeted attack won second place in the NeurIPS 2018 Adversarial Vision Challenge.

Key facts. Cited by 46 papers in the map (data through 7 Oct 2026). First posted on arXiv 24 Dec 2018.

Builds on

No reference list yet.

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 14; 2022: 6; 2023: 12; 2024: 6; 2025: 7; 2026: 1.

46 papers.

Sort:

By area:

  1. 2021Improving Robustness using Generated Datacited by 233
  2. 2021Advances in adversarial attacks and defenses in computer vision: A surveycited by 127
  3. 2021Adversarial Attacks On Multi-Agent Communicationcited by 48
  4. 2022Query-Efficient Black-box Adversarial Attacks Guided by a Transfer-based Priorcited by 38
  5. 2021A Review of Adversarial Attack and Defense for Classification Methodscited by 29
  6. 2021On the Convergence of Prior-Guided Zeroth-Order Optimization Algorithmscited by 23
  7. 2021QAIR: Practical Query-efficient Black-Box Attacks for Image Retrievalcited by 22
  8. 2023CGBA: Curvature-aware Geometric Black-box Attackcited by 20
  9. 2023Physical Adversarial Attacks For Camera-based Smart Systems: Current Trends, Categorization, Applications, Research Challenges, and Future Outlookcited by 20
  10. 2023A Survey of Robustness and Safety of 2D and 3D Deep Learning Models Against Adversarial Attackscited by 19
  11. 2022Attacking deep networks with surrogate-based adversarial black-box methods is easycited by 18
  12. 2021Decision-based Black-box Attack Against Vision Transformers via Patch-wise Adversarial Removalcited by 16
34 more
  1. 2021Attack as the Best Defense: Nullifying Image-to-image Translation GANs via Limit-aware Adversarial Attackcited by 15
  2. 2023Evading Black-box Classifiers Without Breaking Eggscited by 13
  3. 2021Finding Optimal Tangent Points for Reducing Distortions of Hard-label Attackscited by 11
  4. 2021RamBoAttack: A Robust Query Efficient Deep Neural Network Decision Exploitcited by 11
  5. 2024Hard-label based Small Query Black-box Adversarial Attackcited by 10
  6. 2021Black-box Adversarial Attacks in Autonomous Vehicle Technologycited by 9
  7. 20233DHacker: Spectrum-based Decision Boundary Generation for Hard-label 3D Point Cloud Attackcited by 9
  8. 2023Threatening Patch Attacks on Object Detection in Optical Remote Sensing Imagescited by 8
  9. 2024BruSLeAttack: A Query-Efficient Score-Based Black-Box Sparse Adversarial Attackcited by 7
  10. 2024ADBA:Approximation Decision Boundary Approach for Black-Box Adversarial Attackscited by 7
  11. 2025Black-box Optimization of LLM Outputs by Asking for Directionscited by 7
  12. 2023SoK: Pitfalls in Evaluating Black-Box Attackscited by 6
  13. 2023Certifiable Black-Box Attacks with Randomized Adversarial Examples: Breaking Defenses with Provable Confidencecited by 5
  14. 2023The Adaptive Arms Race: Redefining Robustness in AI Securitycited by 4
  15. 2022Universal Distributional Decision-based Black-box Adversarial Attack with Reinforcement Learningcited by 2
  16. 2023OMG-ATTACK: Self-Supervised On-Manifold Generation of Transferable Evasion Attackscited by 2
  17. 2025NoPain: No-box Point Cloud Attack via Optimal Transport Singular Boundarycited by 2
  18. 2025GSBAK: top-K Geometric Score-based Black-box Attackcited by 2
  19. 2025Adversarial Attacks Against Deep Learning-Based Radio Frequency Fingerprint Identificationcited by 2
  20. 2021LSDAT: Low-Rank and Sparse Decomposition for Decision-based Adversarial Attackcited by 1
  21. 2023Boosting Decision-Based Black-Box Adversarial Attack with Gradient Priorscited by 1
  22. 2025Accelerating Targeted Hard-Label Adversarial Attacks in Low-Query Black-Box Settingscited by 1
  23. 2025Boosting Ray Search Procedure of Hard-label Attacks with Transfer-based Priorscited by 1
  24. 2021Automated Decision-based Adversarial Attackscited by 0
  25. 2021Adversarial Attacks with Time-Scale Representationscited by 0
  26. 2022Art-Attack: Black-Box Adversarial Attack via Evolutionary Artcited by 0
  27. 2022An Efficient Multi-Step Framework for Malware Packing Identificationcited by 0
  28. 2022Distributed Black-box Attack: Do Not Overestimate Black-box Attackscited by 0
  29. 2023Decision-BADGE: Decision-based Adversarial Batch Attack with Directional Gradient Estimationcited by 0
  30. 2024Lp-norm Distortion-Efficient Adversarial Attackcited by 0
  31. 2024SemiAdv: Query-Efficient Black-Box Adversarial Attack with Unlabeled Imagescited by 0
  32. 2024Hard-Label Black-Box Attacks on 3D Point Cloudscited by 0
  33. 2025Improving the Convergence Rate of Ray Search Optimization for Query-Efficient Hard-Label Attackscited by 0
  34. 2026Operational Robustness of LLMs on Code Generationcited by 0