mlsanityData to 7 Oct 2026

Sign-OPT: A Query-Efficient Hard-label Adversarial Attack

arXiv 1909.10773 ↗First posted 24 Sep 2019cs.LG stat.MLcited by 118

Not on the map. Why?

Abstract (arXiv)

We study the most practical problem setup for evaluating adversarial robustness of a machine learning system with limited access: the hard-label black-box attack setting for generating adversarial examples, where limited model queries are allowed and only the decision is provided to a queried data input. Several algorithms have been proposed for this problem but they typically require huge amount (>20,000) of queries for attacking one example. Among them, one of the state-of-the-art approaches (Cheng et al., 2019) showed that hard-label attack can be modeled as an optimization problem where the objective function can be evaluated by binary search with additional model queries, thereby a zeroth order optimization algorithm can be applied. In this paper, we adopt the same optimization formulation but propose to directly estimate the sign of gradient at any direction instead of the gradient itself, which enjoys the benefit of single query. Using this single query oracle for retrieving sign of directional derivative, we develop a novel query-efficient Sign-OPT approach for hard-label black-box attack. We provide a convergence analysis of the new algorithm and conduct experiments on several models on MNIST, CIFAR-10 and ImageNet. We find that Sign-OPT attack consistently requires 5X to 10X fewer queries when compared to the current state-of-the-art approaches, and usually converges to an adversarial example with smaller perturbation.

Key facts. Cited by 118 papers in the map (data through 7 Oct 2026). First posted on arXiv 24 Sep 2019.

Builds on

No reference list yet.

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 35; 2022: 19; 2023: 23; 2024: 21; 2025: 11; 2026: 9.

118 papers.

Sort:

By area:

  1. 2021Advances in adversarial attacks and defenses in computer vision: A surveycited by 127
  2. 2024Revisiting Zeroth-Order Optimization for Memory-Efficient LLM Fine-Tuning: A Benchmarkcited by 113
  3. 2024A Survey of Attacks on Large Vision-Language Models: Resources, Advances, and Future Trendscited by 82
  4. 2023A Pilot Study of Query-Free Adversarial Attack against Stable Diffusioncited by 75
  5. 2022Boosting the Transferability of Adversarial Attacks with Reverse Adversarial Perturbationcited by 67
  6. 2021AEVA: Black-box Backdoor Detection Using Adversarial Extreme Value Analysiscited by 52
  7. 2022Improving the Transferability of Targeted Adversarial Examples through Object-Based Diverse Inputcited by 49
  8. 2021Triangle Attack: A Query-efficient Decision-based Adversarial Attackcited by 48
  9. 2021Random Noise Defense Against Query-Based Black-Box Attackscited by 46
  10. 2021Zero-Shot Knowledge Distillation from a Decision-Based Black-Box Modelcited by 37
  11. 2023Towards Trustworthy and Aligned Machine Learning: A Data-centric Survey with Causality Perspectivescited by 30
  12. 2021A Review of Adversarial Attack and Defense for Classification Methodscited by 29
38 more
  1. 2023Generalizable Black-Box Adversarial Attack with Meta Learningcited by 29
  2. 2021A Hard Label Black-box Adversarial Attack Against Graph Neural Networkscited by 26
  3. 2021BASAR:Black-box Attack on Skeletal Action Recognitioncited by 25
  4. 2021QAIR: Practical Query-efficient Black-Box Attacks for Image Retrievalcited by 22
  5. 2023CGBA: Curvature-aware Geometric Black-box Attackcited by 20
  6. 2023A Survey of Robustness and Safety of 2D and 3D Deep Learning Models Against Adversarial Attackscited by 19
  7. 2022Adversarial Attack on Attackers: Post-Process to Mitigate Black-Box Score-Based Query Attackscited by 18
  8. 2021On the Effectiveness of Small Input Noise for Defending Against Query-based Black-Box Attackscited by 17
  9. 2022Reverse Engineering of Imperceptible Adversarial Image Perturbationscited by 17
  10. 2021Decision-based Black-box Attack Against Vision Transformers via Patch-wise Adversarial Removalcited by 16
  11. 2021Training Meta-Surrogate Model for Transferable Adversarial Attackcited by 15
  12. 2022Query Efficient Decision Based Sparse Attacks Against Black-Box Deep Learning Modelscited by 13
  13. 2023Evading Black-box Classifiers Without Breaking Eggscited by 13
  14. 2021Reinforcement Learning Based Sparse Black-box Adversarial Attack on Video Recognition Modelscited by 12
  15. 2023Boosting Black-box Attack to Deep Neural Networks with Conditional Diffusion Modelscited by 12
  16. 2021Black-box adversarial attacks using Evolution Strategiescited by 11
  17. 2021Finding Optimal Tangent Points for Reducing Distortions of Hard-label Attackscited by 11
  18. 2021RamBoAttack: A Robust Query Efficient Deep Neural Network Decision Exploitcited by 11
  19. 2022D4: Detection of Adversarial Diffusion Deepfakes Using Disjoint Ensemblescited by 11
  20. 2022Holistic Adversarial Robustness of Deep Learning Modelscited by 11
  21. 2025ComPO: Preference Alignment via Comparison Oraclescited by 11
  22. 2024Hard-label based Small Query Black-box Adversarial Attackcited by 10
  23. 2021Nonlinear Projection Based Gradient Estimation for Query Efficient Blackbox Attackscited by 9
  24. 2021Progressive-Scale Boundary Blackbox Attack via Projective Gradient Estimationcited by 8
  25. 2022On the amplification of security and privacy risks by post-hoc explanations in machine learning modelscited by 8
  26. 2021Rethinking Image-Scaling Attacks: The Interplay Between Vulnerabilities in Machine Learning Systemscited by 7
  27. 2021Performance Evaluation of Adversarial Attacks: Discrepancies and Solutionscited by 7
  28. 2021Curvature-Aware Derivative-Free Optimizationcited by 7
  29. 2022Understanding the Vulnerability of Skeleton-based Human Activity Recognition via Black-box Attackcited by 7
  30. 2024ADBA:Approximation Decision Boundary Approach for Black-Box Adversarial Attackscited by 7
  31. 2024AdvQDet: Detecting Query-Based Adversarial Attacks with Adversarial Contrastive Prompt Tuningcited by 7
  32. 2021Statistical Inference for Polyak-Ruppert Averaged Zeroth-order Stochastic Gradient Algorithmcited by 6
  33. 2022Interactive Machine Learning: A State of the Art Reviewcited by 6
  34. 2023SoK: Pitfalls in Evaluating Black-Box Attackscited by 6
  35. 2022Preprocessors Matter! Realistic Decision-Based Attacks on Machine Learning Systemscited by 5
  36. 2023Certifiable Black-Box Attacks with Randomized Adversarial Examples: Breaking Defenses with Provable Confidencecited by 5
  37. 2023PhantomSound: Black-Box, Query-Efficient Audio Adversarial Attack via Split-Second Phoneme Injectioncited by 5
  38. 2023STARNet: Sensor Trustworthiness and Anomaly Recognition via Approximated Likelihood Regret for Robust Edge Autonomycited by 5

50 most cited of 118 All 118 (JSON)