mlsanityData to 7 Oct 2026

NATTACK: Learning the Distributions of Adversarial Examples for an Improved Black-Box Attack on Deep Neural Networks

arXiv 1905.00441 ↗First posted 1 May 2019cs.LG cs.CR cs.CVcited by 94

Not on the map. Why?

Abstract (arXiv)

Powerful adversarial attack methods are vital for understanding how to construct robust deep neural networks (DNNs) and for thoroughly testing defense techniques. In this paper, we propose a black-box adversarial attack algorithm that can defeat both vanilla DNNs and those generated by various defense techniques developed recently. Instead of searching for an "optimal" adversarial example for a benign input to a targeted DNN, our algorithm finds a probability density distribution over a small region centered around the input, such that a sample drawn from this distribution is likely an adversarial example, without the need of accessing the DNN's internal layers or weights. Our approach is universal as it can successfully attack different neural networks by a single algorithm. It is also strong; according to the testing against 2 vanilla DNNs and 13 defended ones, it outperforms state-of-the-art black-box or white-box attack methods for most test cases. Additionally, our results reveal that adversarial training remains one of the best defense techniques, and the adversarial examples are not as transferable across defended DNNs as them across vanilla DNNs.

Key facts. Cited by 94 papers in the map (data through 7 Oct 2026). First posted on arXiv 1 May 2019.

Builds on

No reference list yet.

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 30; 2022: 23; 2023: 25; 2024: 10; 2025: 5; 2026: 1.

94 papers.

Sort:

By area:

  1. 2021Enhancing the Transferability of Adversarial Attacks through Variance Tuningcited by 242
  2. 2021Admix: Enhancing the Transferability of Adversarial Attackscited by 155
  3. 2022LAS-AT: Adversarial Training with Learnable Attack Strategycited by 94
  4. 2021Improving Adversarial Robustness via Channel-wise Activation Suppressingcited by 76
  5. 2021Black-box Detection of Backdoor Attacks with Limited Information and Datacited by 71
  6. 2023Structure Invariant Transformation for better Adversarial Transferabilitycited by 61
  7. 2021Probabilistic Margins for Instance Reweighting in Adversarial Trainingcited by 57
  8. 2021Meta Gradient Adversarial Attackcited by 55
  9. 2021Boosting Adversarial Transferability through Enhanced Momentumcited by 53
  10. 2021A Comprehensive Evaluation Framework for Deep Model Robustnesscited by 41
  11. 2022Query-Efficient Black-box Adversarial Attacks Guided by a Transfer-based Priorcited by 38
  12. 2023Unlearnable Examples for Diffusion Models: Protect Data from Unauthorized Exploitationcited by 37
38 more
  1. 2023Diversifying the High-level Features for better Adversarial Transferabilitycited by 34
  2. 2021Analysis and Applications of Class-wise Robustness in Adversarial Trainingcited by 33
  3. 2021A Review of Adversarial Attack and Defense for Classification Methodscited by 29
  4. 2022Boosting the Transferability of Adversarial Attacks with Global Momentum Initializationcited by 29
  5. 2023Generalizable Black-Box Adversarial Attack with Meta Learningcited by 29
  6. 2023Probabilistically robust conformal predictioncited by 25
  7. 2024Learning to Transform Dynamically for Better Adversarial Transferabilitycited by 23
  8. 2021Adaptive Image Transformations for Transfer-based Adversarial Attackcited by 22
  9. 2022Towards Understanding and Mitigating Audio Adversarial Examples for Speaker Recognitioncited by 22
  10. 2023Attacks in Adversarial Machine Learning: A Systematic Survey from the Life-cycle Perspectivecited by 19
  11. 2023A Survey of Robustness and Safety of 2D and 3D Deep Learning Models Against Adversarial Attackscited by 19
  12. 2021Zeroth-Order Methods for Convex-Concave Minmax Problems: Applications to Decision-Dependent Risk Minimizationcited by 18
  13. 2022Attacking deep networks with surrogate-based adversarial black-box methods is easycited by 18
  14. 2022PointDP: Diffusion-driven Purification against Adversarial Attacks on 3D Point Cloud Recognitioncited by 16
  15. 2023Feature Separation and Recalibration for Adversarial Robustnesscited by 16
  16. 2021Adversarial Imaging Pipelinescited by 15
  17. 2022Strong Transferable Adversarial Attacks via Ensembled Asymptotically Normal Distribution Learningcited by 15
  18. 2021Universal Spectral Adversarial Attacks for Deformable Shapescited by 14
  19. 2022Understanding Adversarial Robustness Against On-manifold Adversarial Examplescited by 12
  20. 2024DAT: Improving Adversarial Robustness via Generative Amplitude Mix-up in Frequency Domaincited by 12
  21. 2022PointCAT: Contrastive Adversarial Training for Robust Point Cloud Recognitioncited by 10
  22. 2024Efficient Black-box Adversarial Attacks via Bayesian Optimization Guided by a Function Priorcited by 10
  23. 2025Response Attack: Exploiting Contextual Priming to Jailbreak Large Language Modelscited by 10
  24. 2021Practical Relative Order Attack in Deep Rankingcited by 9
  25. 2021A Simple and Strong Baseline for Universal Targeted Attacks on Siamese Visual Trackingcited by 9
  26. 2022Bandits for Structure Perturbation-based Black-box Attacks to Graph Neural Networks with Theoretical Guaranteescited by 9
  27. 2023Fast Propagation is Better: Accelerating Single-Step Adversarial Training via Sampling Subnetworkscited by 8
  28. 2021Performance Evaluation of Adversarial Attacks: Discrepancies and Solutionscited by 7
  29. 2022RSTAM: An Effective Black-Box Impersonation Attack on Face Recognition using a Mobile and Compact Printercited by 7
  30. 2023Adversarial Attack with Raindropscited by 7
  31. 2021Statistical Inference for Polyak-Ruppert Averaged Zeroth-order Stochastic Gradient Algorithmcited by 6
  32. 2021Improving the Robustness of Adversarial Attacks Using an Affine-Invariant Gradient Estimatorcited by 6
  33. 2021Adaptive Perturbation for Adversarial Attackcited by 6
  34. 2023SoK: Pitfalls in Evaluating Black-Box Attackscited by 6
  35. 2021All You Need is RAW: Defending Against Adversarial Attacks with Camera Image Pipelinescited by 5
  36. 2022PublicCheck: Public Integrity Verification for Services of Run-time Deep Modelscited by 5
  37. 2023A Certified Radius-Guided Attack Framework to Image Segmentation Modelscited by 5
  38. 2023Certifiable Black-Box Attacks with Randomized Adversarial Examples: Breaking Defenses with Provable Confidencecited by 5

50 most cited of 94 All 94 (JSON)