mlsanityData to 14 Oct 2026

Parsimonious Black-Box Adversarial Attacks via Efficient Combinatorial Optimization

arXiv 1905.06635 ↗First posted 16 May 2019cs.LG cs.CR cs.CVcited by 49

Not on the map. Why?

Abstract (arXiv)

Solving for adversarial examples with projected gradient descent has been demonstrated to be highly effective in fooling the neural network based classifiers. However, in the black-box setting, the attacker is limited only to the query access to the network and solving for a successful adversarial example becomes much more difficult. To this end, recent methods aim at estimating the true gradient signal based on the input queries but at the cost of excessive queries. We propose an efficient discrete surrogate to the optimization problem which does not require estimating the gradient and consequently becomes free of the first order update hyperparameters to tune. Our experiments on Cifar-10 and ImageNet show the state of the art black-box attack performance with significant reduction in the required queries compared to a number of recently proposed methods. The source code is available at https://github.com/snu-mllab/parsimonious-blackbox-attack.

Key facts. Cited by 49 papers in the map (data through 14 Oct 2026). First posted on arXiv 16 May 2019.

Builds on

No reference list yet.

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2021: 15; 2022: 10; 2023: 9; 2024: 7; 2025: 6; 2026: 2.

49 papers.

Sort:

By area:

  1. 2023Black Box Adversarial Prompting for Foundation Modelscited by 62
  2. 2021Random Noise Defense Against Query-Based Black-Box Attackscited by 47
  3. 2021AdvRush: Searching for Adversarially Robust Neural Architecturescited by 28
  4. 2021ML Attack Models: Adversarial Attacks and Data Poisoning Attackscited by 24
  5. 2023Attacks in Adversarial Machine Learning: A Systematic Survey from the Life-cycle Perspectivecited by 20
  6. 2023A Survey of Robustness and Safety of 2D and 3D Deep Learning Models Against Adversarial Attackscited by 19
  7. 2022Attacking deep networks with surrogate-based adversarial black-box methods is easycited by 18
  8. 2021Efficient Combinatorial Optimization for Word-level Adversarial Textual Attackcited by 17
  9. 2022Saliency Attack: Towards Imperceptible Black-box Adversarial Attackcited by 12
  10. 2021Finding Optimal Tangent Points for Reducing Distortions of Hard-label Attackscited by 11
  11. 2023Stateful Defenses for Machine Learning Models Are Not Yet Secure Against Black-box Attackscited by 11
  12. 2021DI-AA: An Interpretable White-box Attack for Fooling Deep Neural Networkscited by 10
37 more
  1. 2022On the Role of Generalization in Transferability of Adversarial Examplescited by 9
  2. 2024Machine Learning Robustness: A Primercited by 8
  3. 2024ADBA:Approximation Decision Boundary Approach for Black-Box Adversarial Attackscited by 8
  4. 2021Adversarial Robustness by Design through Analog Computing and Synthetic Gradientscited by 7
  5. 2021Meta-Learning the Search Distribution of Black-Box Random Search Based Adversarial Attackscited by 7
  6. 2022Learnability Lock: Authorized Learnability Control Through Adversarial Invertible Transformationscited by 7
  7. 2021SpecRepair: Counter-Example Guided Safety Repair of Deep Neural Networkscited by 6
  8. 2022Threshold-adaptive Unsupervised Focal Loss for Domain Adaptation of Semantic Segmentationcited by 6
  9. 2023SoK: Pitfalls in Evaluating Black-Box Attackscited by 6
  10. 2022Adversarial Scratches: Deployable Attacks to CNN Classifierscited by 5
  11. 2023Certifiable Black-Box Attacks with Randomized Adversarial Examples: Breaking Defenses with Provable Confidencecited by 5
  12. 2024Guardians of Image Quality: Benchmarking Defenses Against Adversarial Attacks on Image Quality Metricscited by 5
  13. 2025TRAP: Targeted Redirecting of Agentic Preferencescited by 5
  14. 2021EvoBA: An Evolution Strategy as a Strong Baseline forBlack-Box Adversarial Attackscited by 4
  15. 2022Audit and Improve Robustness of Private Neural Networks on Encrypted Datacited by 4
  16. 2024Sparse-PGD: A Unified Framework for Sparse Adversarial Perturbations Generationcited by 4
  17. 2022Publishing Efficient On-device Models Increases Adversarial Vulnerabilitycited by 3
  18. 2024BadPart: Unified Black-box Adversarial Patch Attacks against Pixel-wise Regression Taskscited by 3
  19. 2025GreedyPixel: Fine-Grained Black-Box Adversarial Attack Via Greedy Algorithmcited by 3
  20. 2021You Only Query Once: Effective Black Box Adversarial Attacks with Minimal Repeated Queriescited by 2
  21. 2021ROPUST: Improving Robustness through Fine-tuning with Photonic Processors and Synthetic Gradientscited by 2
  22. 2021Improving Robustness of Malware Classifiers using Adversarial Strings Generated from Perturbed Latent Representationscited by 2
  23. 2025Consensus-based optimization for closed-box adversarial attacks and a connection to evolution strategiescited by 2
  24. 2022Neural Predictor for Black-Box Adversarial Attacks on Speech Recognitioncited by 1
  25. 2023Exploring Non-additive Randomness on ViT against Query-Based Black-Box Attackscited by 1
  26. 2024Delving into Decision-based Black-box Attacks on Semantic Segmentationcited by 1
  27. 2021On Procedural Adversarial Noise Attack And Defensecited by 0
  28. 2021On the Noise Stability and Robustness of Adversarially Trained Networks on NVM Crossbarscited by 0
  29. 2022Distributed Black-box Attack: Do Not Overestimate Black-box Attackscited by 0
  30. 2023SEA: Shareable and Explainable Attribution for Query-based Black-box Attackscited by 0
  31. 2023Exploring the Adversarial Robustness of Face Forgery Detection with Decision-based Black-box Attackscited by 0
  32. 2024Counter-Samples: A Stateless Strategy to Neutralize Black Box Adversarial Attackscited by 0
  33. 2025With Great Backbones Comes Great Adversarial Transferabilitycited by 0
  34. 2025Can You Trust What You See? Alpha Channel No-Box Attacks on Video Object Detectioncited by 0
  35. 2025Superpixel Attack: Enhancing Black-box Adversarial Attack with Image-driven Division Areascited by 0
  36. 2026Low-Cost Hard-Label Adversarial Attack with Theoretical Foundationscited by 0
  37. 2026Attacking the First-Principle: A Black-Box, Query-Free Targeted Mimicry Attack on Binary Function Classifierscited by 0