Data to 14 Oct 2026

Improving Black-box Adversarial Attacks with a Transfer-based Prior

arXiv 1906.06919 ↗First posted 17 Jun 2019cs.LG cs.CR cs.CVcited by 121

Not on the map. Why?

Abstract (arXiv)

We consider the black-box adversarial setting, where the adversary has to generate adversarial perturbations without access to the target models to compute gradients. Previous methods tried to approximate the gradient either by using a transfer gradient of a surrogate white-box model, or based on the query feedback. However, these methods often suffer from low attack success rates or poor query efficiency since it is non-trivial to estimate the gradient in a high-dimensional space with limited information. To address these problems, we propose a prior-guided random gradient-free (P-RGF) method to improve black-box adversarial attacks, which takes the advantage of a transfer-based prior and the query information simultaneously. The transfer-based prior given by the gradient of a surrogate model is appropriately integrated into our algorithm by an optimal coefficient derived by a theoretical analysis. Extensive experiments demonstrate that our method requires much fewer queries to attack black-box models with higher success rates compared with the alternative state-of-the-art methods.

Key facts. Cited by 121 papers in the map (data through 14 Oct 2026). First posted on arXiv 17 Jun 2019.

Builds on

No reference list yet.

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2021: 34; 2022: 32; 2023: 23; 2024: 16; 2025: 11; 2026: 5.

121 papers.

Sort:

By area:

2023On Evaluating Adversarial Robustness of Large Vision-Language Modelscited by 284
2021Advances in adversarial attacks and defenses in computer vision: A surveycited by 127
2023Automatic Prompt Augmentation and Selection with Chain-of-Thought from Labeled Datacited by 119
2022Narcissus: A Practical Clean-Label Backdoor Attack with Limited Informationcited by 103
2022Black-box Prompt Learning for Pre-trained Language Modelscited by 70
2023Structure Invariant Transformation for better Adversarial Transferabilitycited by 62
2024Query-Based Adversarial Prompt Generationcited by 62
2021Meta Gradient Adversarial Attackcited by 55
2024PAL: Proxy-Guided Black-Box Attack on Large Language Modelscited by 50
2021Adversarial Attacks On Multi-Agent Communicationcited by 49
2021TRS: Transferability Reduced Ensemble via Encouraging Gradient Diversity and Model Smoothnesscited by 38
2022Query-Efficient Black-box Adversarial Attacks Guided by a Transfer-based Priorcited by 38

38 more

2023Among Us: Adversarially Robust Collaborative Perception by Consensuscited by 37
2023Evading DeepFake Detectors via Adversarial Statistical Consistencycited by 37
2022Transferable Adversarial Attack based on Integrated Gradientscited by 35
2021A Review of Adversarial Attack and Defense for Classification Methodscited by 29
2023Generalizable Black-Box Adversarial Attack with Meta Learningcited by 29
2023Make Them Spill the Beans! Coercive Knowledge Extraction from (Production) LLMscited by 27
2021On the Convergence of Prior-Guided Zeroth-Order Optimization Algorithmscited by 23
2021Unrestricted Adversarial Attacks on ImageNet Competitioncited by 23
2024Adversarial Attacks of Vision Tasks in the Past 10 Years: A Surveycited by 23
2021QAIR: Practical Query-efficient Black-Box Attacks for Image Retrievalcited by 22
2021Adaptive Image Transformations for Transfer-based Adversarial Attackcited by 22
2022TextGrad: Advancing Robustness Evaluation in NLP by Gradient-Driven Optimizationcited by 21
2023Attacks in Adversarial Machine Learning: A Systematic Survey from the Life-cycle Perspectivecited by 20
2021Just Noticeable Difference for Deep Machine Visioncited by 19
2022Adversarial Attack on Attackers: Post-Process to Mitigate Black-Box Score-Based Query Attackscited by 19
2022On the Versatile Uses of Partial Distance Correlation in Deep Learningcited by 19
2023A Survey of Robustness and Safety of 2D and 3D Deep Learning Models Against Adversarial Attackscited by 19
2021Context-Aware Transfer Attacks for Object Detectioncited by 18
2022Attacking deep networks with surrogate-based adversarial black-box methods is easycited by 18
2023Survey on Adversarial Attack and Defense for Medical Image Analysis: Methods and Challengescited by 17
2021Back in Black: A Comparative Evaluation of Recent State-Of-The-Art Black-Box Attackscited by 16
2023Ensemble-based Blackbox Attacks on Dense Predictioncited by 16
2021Training Meta-Surrogate Model for Transferable Adversarial Attackcited by 15
2021Attack as the Best Defense: Nullifying Image-to-image Translation GANs via Limit-aware Adversarial Attackcited by 15
2024Robust Neural Information Retrieval: An Adversarial and Out-of-distribution Perspectivecited by 15
2023Mutual-modality Adversarial Attack with Semantic Perturbationcited by 14
2022Towards Transferable Unrestricted Adversarial Examples with Minimum Changescited by 13
2022Blackbox Attacks via Surrogate Ensemble Searchcited by 13
2023Boosting Black-box Attack to Deep Neural Networks with Conditional Diffusion Modelscited by 12
2024DAT: Improving Adversarial Robustness via Generative Amplitude Mix-up in Frequency Domaincited by 12
2021Finding Optimal Tangent Points for Reducing Distortions of Hard-label Attackscited by 11
2021RamBoAttack: A Robust Query Efficient Deep Neural Network Decision Exploitcited by 11
2024Efficient Black-box Adversarial Attacks via Bayesian Optimization Guided by a Function Priorcited by 11
2022Squeeze Training for Adversarial Robustnesscited by 10
2025Towards Model Resistant to Transferable Adversarial Examples via Trigger Activationcited by 10
2021Nonlinear Projection Based Gradient Estimation for Query Efficient Blackbox Attackscited by 9
2022Bandits for Structure Perturbation-based Black-box Attacks to Graph Neural Networks with Theoretical Guaranteescited by 9
2022On the Role of Generalization in Transferability of Adversarial Examplescited by 9

50 most cited of 121 All 121 (JSON)