Data to 14 Oct 2026

HopSkipJumpAttack: A Query-Efficient Decision-Based Attack

arXiv 1904.02144 ↗First posted 3 Apr 2019cs.LG cs.CR math.OCcited by 333

Not on the map. Why?

Cited by 26 in LLM safety and security, but placed by its own abstract, which didn’t fit.

Abstract (arXiv)

The goal of a decision-based adversarial attack on a trained model is to generate adversarial examples based solely on observing output labels returned by the targeted model. We develop HopSkipJumpAttack, a family of algorithms based on a novel estimate of the gradient direction using binary information at the decision boundary. The proposed family includes both untargeted and targeted attacks optimized for ℓ2 and ℓ_∞ similarity metrics respectively. Theoretical analysis is provided for the proposed algorithms and the gradient direction estimate. Experiments show HopSkipJumpAttack requires significantly fewer model queries than Boundary Attack. It also achieves competitive performance in attacking several widely-used defense mechanisms. (HopSkipJumpAttack was named Boundary Attack++ in a previous version of the preprint.)

Key facts. Cited by 333 papers in the map (data through 14 Oct 2026). First posted on arXiv 3 Apr 2019.

Builds on

No reference list yet.

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2021: 67; 2022: 57; 2023: 74; 2024: 58; 2025: 43; 2026: 34.

333 papers.

Sort:

By area:

2021Advances in adversarial attacks and defenses in computer vision: A surveycited by 127
2023Anti-DreamBooth: Protecting users from personalized text-to-image synthesiscited by 120
2022Shadows can be Dangerous: Stealthy and Effective Physical-world Adversarial Attack by Natural Phenomenoncited by 101
2023Evading Watermark based Detection of AI-Generated Contentcited by 78
2021Mitigating Membership Inference Attacks by Self-Distillation Through a Novel Ensemble Architecturecited by 67
2023How Deep Learning Sees the World: A Survey on Adversarial Attacks & Defensescited by 66
2022Label-Only Model Inversion Attacks via Boundary Repulsioncited by 56
2022"Real Attackers Don't Compute Gradients": Bridging the Gap Between Adversarial ML Research and Practicecited by 56
2022A Large-scale Multiple-objective Method for Black-box Attack against Object Detectioncited by 55
2021AEVA: Black-box Backdoor Detection Using Adversarial Extreme Value Analysiscited by 53
2021Adversarial Example Detection for DNN Models: A Review and Experimental Comparisoncited by 52
2023Prompt Stealing Attacks Against Text-to-Image Generation Modelscited by 51

38 more

2021Adversarial Attacks On Multi-Agent Communicationcited by 49
2021Triangle Attack: A Query-efficient Decision-based Adversarial Attackcited by 48
2024Learn What You Want to Unlearn: Unlearning Inversion Attacks against Machine Unlearningcited by 48
2021Random Noise Defense Against Query-Based Black-Box Attackscited by 47
2021Adversarial Attacks for Tabular Data: Application to Fraud Detection and Imbalanced Datacited by 45
2022Beyond ImageNet Attack: Towards Crafting Adversarial Examples for Black-box Domainscited by 42
2021Robust Machine Learning Systems: Challenges, Current Trends, Perspectives, and the Road Aheadcited by 41
2021Poison Forensics: Traceback of Data Poisoning Attacks in Neural Networkscited by 40
2021Improving the Transferability of Adversarial Examples with Resized-Diverse-Inputs, Diversity-Ensemble and Region Fittingcited by 37
2021A Review of Adversarial Attack and Defense for Classification Methodscited by 29
2023Generalizable Black-Box Adversarial Attack with Meta Learningcited by 29
2023Improving Adversarial Transferability via Intermediate-level Perturbation Decaycited by 29
2022Auditing Membership Leakages of Multi-Exit Networkscited by 27
2023Rethinking the Backward Propagation for Adversarial Transferabilitycited by 27
2021BASAR:Black-box Attack on Skeletal Action Recognitioncited by 26
2021Black-box Adversarial Attacks on Commercial Speech Platforms with Minimal Informationcited by 25
2021ML Attack Models: Adversarial Attacks and Data Poisoning Attackscited by 24
2024AudioMarkBench: Benchmarking Robustness of Audio Watermarkingcited by 23
2021QAIR: Practical Query-efficient Black-Box Attacks for Image Retrievalcited by 22
2022Rainproof: An Umbrella To Shield Text Generators From Out-Of-Distribution Datacited by 21
2023CGBA: Curvature-aware Geometric Black-box Attackcited by 21
2024Transferable Adversarial Attacks on SAM and Its Downstream Modelscited by 21
2022Membership Inference Attack Using Self Influence Functionscited by 20
2023Attacks in Adversarial Machine Learning: A Systematic Survey from the Life-cycle Perspectivecited by 20
2023Physical Adversarial Attacks For Camera-based Smart Systems: Current Trends, Categorization, Applications, Research Challenges, and Future Outlookcited by 20
2021Predify: Augmenting deep neural networks with brain-inspired predictive coding dynamicscited by 19
2022Leveraging Adversarial Examples to Quantify Membership Information Leakagecited by 19
2022Adversarial Attack on Attackers: Post-Process to Mitigate Black-Box Score-Based Query Attackscited by 19
2023Query-Efficient Decision-based Black-Box Patch Attackcited by 19
2023A Survey of Robustness and Safety of 2D and 3D Deep Learning Models Against Adversarial Attackscited by 19
2021Demiguise Attack: Crafting Invisible Semantic Adversarial Perturbations with Perceptual Similaritycited by 18
2021Context-Aware Transfer Attacks for Object Detectioncited by 18
2022Unrestricted Black-box Adversarial Attack Using GAN with Limited Queriescited by 18
2021On the Effectiveness of Small Input Noise for Defending Against Query-based Black-Box Attackscited by 17
2022Zero-Query Transfer Attacks on Context-Aware Object Detectorscited by 17
2023Survey on Adversarial Attack and Defense for Medical Image Analysis: Methods and Challengescited by 17
2021Back in Black: A Comparative Evaluation of Recent State-Of-The-Art Black-Box Attackscited by 16
2021Decision-based Black-box Attack Against Vision Transformers via Patch-wise Adversarial Removalcited by 16

50 most cited of 333 All 333 (JSON)