# Subspace Attack: Exploiting Promising Subspaces for Query-Efficient Black-box Attacks

arXiv: https://arxiv.org/abs/1906.04392 · HTML: https://mlsanity.com/paper/1906.04392/

## Key facts

- Cited by 35 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 11 Jun 2019.

## Built on by (most cited first, 30 of 35)

- [PAL: Proxy-Guided Black-Box Attack on Large Language Models](https://mlsanity.com/paper/2402.09674/) (2024)
- [Transferable Adversarial Attack based on Integrated Gradients](https://mlsanity.com/paper/2205.13152/) (2022)
- [A Review of Adversarial Attack and Defense for Classification Methods](https://mlsanity.com/paper/2111.09961/) (2021)
- [Generalizable Black-Box Adversarial Attack with Meta Learning](https://mlsanity.com/paper/2301.00364/) (2023)
- [Improving Adversarial Transferability via Intermediate-level Perturbation Decay](https://mlsanity.com/paper/2304.13410/) (2023)
- [QAIR: Practical Query-efficient Black-Box Attacks for Image Retrieval](https://mlsanity.com/paper/2103.02927/) (2021)
- [Attacks in Adversarial Machine Learning: A Systematic Survey from the Life-cycle Perspective](https://mlsanity.com/paper/2302.09457/) (2023)
- [Just Noticeable Difference for Deep Machine Vision](https://mlsanity.com/paper/2102.08168/) (2021)
- [Adversarial Attack on Attackers: Post-Process to Mitigate Black-Box Score-Based Query Attacks](https://mlsanity.com/paper/2205.12134/) (2022)
- [A Survey of Robustness and Safety of 2D and 3D Deep Learning Models Against Adversarial Attacks](https://mlsanity.com/paper/2310.00633/) (2023)
- [Attacking deep networks with surrogate-based adversarial black-box methods is easy](https://mlsanity.com/paper/2203.08725/) (2022)
- [On the Effectiveness of Small Input Noise for Defending Against Query-based Black-Box Attacks](https://mlsanity.com/paper/2101.04829/) (2021)
- [Efficient Black-box Adversarial Attacks via Bayesian Optimization Guided by a Function Prior](https://mlsanity.com/paper/2405.19098/) (2024)
- [A Differentiable Language Model Adversarial Attack on Text Classifiers](https://mlsanity.com/paper/2107.11275/) (2021)
- [Practical No-box Adversarial Attacks with Training-free Hybrid Image Transformation](https://mlsanity.com/paper/2203.04607/) (2022)
- [An Intermediate-level Attack Framework on The Basis of Linear Regression](https://mlsanity.com/paper/2203.10723/) (2022)
- [An End-to-End Framework for Marketing Effectiveness Optimization under Budget Constraint](https://mlsanity.com/paper/2302.04477/) (2023)
- [Progressive-Scale Boundary Blackbox Attack via Projective Gradient Estimation](https://mlsanity.com/paper/2106.06056/) (2021)
- [Meta-Learning the Search Distribution of Black-Box Random Search Based Adversarial Attacks](https://mlsanity.com/paper/2111.01714/) (2021)
- [SoK: Pitfalls in Evaluating Black-Box Attacks](https://mlsanity.com/paper/2310.17534/) (2023)
- [Multi-stage Optimization based Adversarial Training](https://mlsanity.com/paper/2106.15357/) (2021)
- [Origins of Low-dimensional Adversarial Perturbations](https://mlsanity.com/paper/2203.13779/) (2022)
- [Query Attack by Multi-Identity Surrogates](https://mlsanity.com/paper/2105.15010/) (2021)
- [Adversarial Examples Detection with Bayesian Neural Network](https://mlsanity.com/paper/2105.08620/) (2021)
- [Energy Attack: On Transferring Adversarial Examples](https://mlsanity.com/paper/2109.04300/) (2021)
- [DifAttack++: Query-Efficient Black-Box Adversarial Attack via Hierarchical Disentangled Feature Space in Cross-Domain](https://mlsanity.com/paper/2406.03017/) (2024)
- [GSBAK: top-K Geometric Score-based Black-box Attack](https://mlsanity.com/paper/2503.12827/) (2025)
- [Geometrically Adaptive Dictionary Attack on Face Recognition](https://mlsanity.com/paper/2111.04371/) (2021)
- [DifAttack: Query-Efficient Black-Box Attack via Disentangled Feature Space](https://mlsanity.com/paper/2309.14585/) (2023)
- [Sparse and Transferable Universal Singular Vectors Attack](https://mlsanity.com/paper/2401.14031/) (2024)

## Abstract (arXiv)

Unlike the white-box counterparts that are widely studied and readily accessible, adversarial examples in black-box settings are generally more Herculean on account of the difficulty of estimating gradients. Many methods achieve the task by issuing numerous queries to target classification systems, which makes the whole procedure costly and suspicious to the systems. In this paper, we aim at reducing the query complexity of black-box attacks in this category. We propose to exploit gradients of a few reference models which arguably span some promising search subspaces. Experimental results show that, in comparison with the state-of-the-arts, our method can gain up to 2x and 4x reductions in the requisite mean and medium numbers of queries with much lower failure rates even if the reference models are trained on a small and inadequate dataset disjoint to the one for training the victim model. Code and models for reproducing our results will be made publicly available.