Data to 14 Oct 2026

Simple Black-box Adversarial Attacks

arXiv 1905.07121 ↗First posted 17 May 2019cs.LG cs.CR stat.MLcited by 251

Not on the map. Why?

Abstract (arXiv)

We propose an intriguingly simple method for the construction of adversarial images in the black-box setting. In constrast to the white-box scenario, constructing black-box adversarial images has the additional constraint on query budget, and efficient attacks remain an open problem to date. With only the mild assumption of continuous-valued confidence scores, our highly query-efficient algorithm utilizes the following simple iterative principle: we randomly sample a vector from a predefined orthonormal basis and either add or subtract it to the target image. Despite its simplicity, the proposed method can be used for both untargeted and targeted attacks -- resulting in previously unprecedented query efficiency in both settings. We demonstrate the efficacy and efficiency of our algorithm on several real world settings including the Google Cloud Vision API. We argue that our proposed algorithm should serve as a strong baseline for future black-box attacks, in particular because it is extremely fast and its implementation requires less than 20 lines of PyTorch code.

Key facts. Cited by 251 papers in the map (data through 14 Oct 2026). First posted on arXiv 17 May 2019.

Builds on

No reference list yet.

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2021: 51; 2022: 43; 2023: 47; 2024: 53; 2025: 35; 2026: 22.

251 papers.

Sort:

By area:

2021AdvSim: Generating Safety-Critical Scenarios for Self-Driving Vehiclescited by 137
2021Explaining in Style: Training a GAN to explain a classifier in StyleSpacecited by 122
2022KING: Generating Safety-Critical Driving Scenarios for Robust Imitation via Kinematics Gradientscited by 96
2021Adversarial Sticker: A Stealthy Attack Method in the Physical Worldcited by 93
2024A Survey of Attacks on Large Vision-Language Models: Resources, Advances, and Future Trendscited by 84
2021Adversarial Laser Beam: Effective Physical-World Attack to DNNs in a Blinkcited by 75
2022Black-box Prompt Learning for Pre-trained Language Modelscited by 70
2023Boosting Adversarial Transferability by Block Shuffle and Rotationcited by 64
2023Black Box Adversarial Prompting for Foundation Modelscited by 62
2023Structure Invariant Transformation for better Adversarial Transferabilitycited by 62
2023On the Design Fundamentals of Diffusion Models: A Surveycited by 60
2021Adversarial Robustness Comparison of Vision Transformer and MLP-Mixer to CNNscited by 57

38 more

2022Shape-invariant 3D Adversarial Point Cloudscited by 50
2022Patch-Fool: Are Vision Transformers Always Robust Against Adversarial Perturbations?cited by 49
2021Random Noise Defense Against Query-Based Black-Box Attackscited by 47
2024One Perturbation is Enough: On Generating Universal Adversarial Perturbations against Vision-Language Pre-training Modelscited by 40
2024Chain of Attack: On the Robustness of Vision-Language Models Against Transfer-Based Adversarial Attackscited by 39
2023Evading DeepFake Detectors via Adversarial Statistical Consistencycited by 37
2021Imperceptible Transfer Attack and Defense on 3D Point Cloud Classificationcited by 36
2023Improving the Transferability of Adversarial Samples by Path-Augmented Methodcited by 36
2021ModelDiff: Testing-Based DNN Similarity Comparison for Model Reuse Detectioncited by 33
2021GeCo: Quality Counterfactual Explanations in Real Timecited by 32
2024Privacy Leakage on DNNs: A Survey of Model Inversion Attacks and Defensescited by 30
2021Drawing Robust Scratch Tickets: Subnetworks with Inborn Robustness Are Found within Randomly Initialized Networkscited by 29
2021A Review of Adversarial Attack and Defense for Classification Methodscited by 29
2023Generalizable Black-Box Adversarial Attack with Meta Learningcited by 29
2023Adversarial Illusions in Multi-Modal Embeddingscited by 29
2021AdvRush: Searching for Adversarially Robust Neural Architecturescited by 28
2021Combating Adversaries with Anti-Adversariescited by 27
2021Delving into Data: Effectively Substitute Training for Black-box Attackcited by 27
2022Universal Adversarial Examples in Remote Sensing: Methodology and Benchmarkcited by 24
2022Rank List Sensitivity of Recommender Systems to Interaction Perturbationscited by 20
2022Adversarial Attack and Defense of YOLO Detectors in Autonomous Driving Scenarioscited by 20
2023Attacks in Adversarial Machine Learning: A Systematic Survey from the Life-cycle Perspectivecited by 20
2022Adversarial Attack on Attackers: Post-Process to Mitigate Black-Box Score-Based Query Attackscited by 19
2023A Survey of Robustness and Safety of 2D and 3D Deep Learning Models Against Adversarial Attackscited by 19
2021Context-Aware Transfer Attacks for Object Detectioncited by 18
2022Boosting 3D Adversarial Attacks with Attacking On Frequencycited by 18
2022Attacking deep networks with surrogate-based adversarial black-box methods is easycited by 18
2024Improved Generation of Adversarial Examples Against Safety-aligned LLMscited by 18
2025Adversarial Training of Reward Modelscited by 18
2021On the Effectiveness of Small Input Noise for Defending Against Query-based Black-Box Attackscited by 17
2022Zero-Query Transfer Attacks on Context-Aware Object Detectorscited by 17
2022Robust Structured Declarative Classifiers for 3D Point Clouds: Defending Adversarial Attacks with Implicit Gradientscited by 17
2023Ensemble-based Blackbox Attacks on Dense Predictioncited by 16
2021Meta-Learning with Neural Tangent Kernelscited by 15
2021Convolutional Normalization: Improving Deep Convolutional Network Robustness and Trainingcited by 15
2022Towards Good Practices in Evaluating Transfer Adversarial Attackscited by 15
2024A Short Survey on Importance Weighting for Machine Learningcited by 15
2021On Robustness of Neural Semantic Parserscited by 14

50 most cited of 251 All 251 (JSON)