mlsanityData to 14 Oct 2026

Black-Box Adversarial Attack with Transferable Model-based Embedding

arXiv 1911.07140 ↗First posted 17 Nov 2019cs.LG stat.MLcited by 57

Not on the map. Why?

Abstract (arXiv)

We present a new method for black-box adversarial attack. Unlike previous methods that combined transfer-based and scored-based methods by using the gradient or initialization of a surrogate white-box model, this new method tries to learn a low-dimensional embedding using a pretrained model, and then performs efficient search within the embedding space to attack an unknown target network. The method produces adversarial perturbations with high level semantic patterns that are easily transferable. We show that this approach can greatly improve the query efficiency of black-box adversarial attack across different target network architectures. We evaluate our approach on MNIST, ImageNet and Google Cloud Vision API, resulting in a significant reduction on the number of queries. We also attack adversarially defended networks on CIFAR10 and ImageNet, where our method not only reduces the number of queries, but also improves the attack success rate.

Key facts. Cited by 57 papers in the map (data through 14 Oct 2026). First posted on arXiv 17 Nov 2019.

Builds on

No reference list yet.

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2021: 13; 2022: 15; 2023: 15; 2024: 7; 2025: 3; 2026: 4.

57 papers.

Sort:

By area:

  1. 2021Advances in adversarial attacks and defenses in computer vision: A surveycited by 127
  2. 2023Automatic Prompt Augmentation and Selection with Chain-of-Thought from Labeled Datacited by 119
  3. 2022Black-box Prompt Learning for Pre-trained Language Modelscited by 70
  4. 2024PAL: Proxy-Guided Black-Box Attack on Large Language Modelscited by 50
  5. 2023Boosting Adversarial Transferability by Achieving Flat Local Maximacited by 48
  6. 2022How to Robustify Black-Box ML Models? A Zeroth-Order Optimization Perspectivecited by 39
  7. 2022Transferable Adversarial Attack based on Integrated Gradientscited by 35
  8. 2022DISCO: Adversarial Defense with Local Implicit Functionscited by 34
  9. 2023Generalizable Black-Box Adversarial Attack with Meta Learningcited by 29
  10. 2022Investigating Top-k White-Box and Transferable Black-box Attackcited by 26
  11. 2022A Survey on Physical Adversarial Attack in Computer Visioncited by 25
  12. 2023Attacks in Adversarial Machine Learning: A Systematic Survey from the Life-cycle Perspectivecited by 20
38 more
  1. 2021Context-Aware Transfer Attacks for Object Detectioncited by 18
  2. 2022Attacking deep networks with surrogate-based adversarial black-box methods is easycited by 18
  3. 2021Back in Black: A Comparative Evaluation of Recent State-Of-The-Art Black-Box Attackscited by 16
  4. 2023Ensemble-based Blackbox Attacks on Dense Predictioncited by 16
  5. 2021Adversarial Imaging Pipelinescited by 15
  6. 2021Training Meta-Surrogate Model for Transferable Adversarial Attackcited by 15
  7. 2022Blackbox Attacks via Surrogate Ensemble Searchcited by 13
  8. 2023Boosting Black-box Attack to Deep Neural Networks with Conditional Diffusion Modelscited by 12
  9. 2023Certified Zeroth-order Black-Box Defense with Robust UNet Denoisercited by 11
  10. 2024Efficient Black-box Adversarial Attacks via Bayesian Optimization Guided by a Function Priorcited by 11
  11. 2024Hard-label based Small Query Black-box Adversarial Attackcited by 10
  12. 2021Black-box Adversarial Attacks in Autonomous Vehicle Technologycited by 9
  13. 2022An Intermediate-level Attack Framework on The Basis of Linear Regressioncited by 9
  14. 2021Meta-Learning the Search Distribution of Black-Box Random Search Based Adversarial Attackscited by 7
  15. 2022Decompiling x86 Deep Neural Network Executablescited by 7
  16. 2023SoK: Pitfalls in Evaluating Black-Box Attackscited by 6
  17. 2025StealthAttack: Robust 3D Gaussian Splatting Poisoning via Density-Guided Illusionscited by 6
  18. 2023Black-box Prompt Tuning with Subspace Learningcited by 5
  19. 2023DOEPatch: Dynamically Optimized Ensemble Model for Adversarial Patches Generationcited by 5
  20. 2022Origins of Low-dimensional Adversarial Perturbationscited by 4
  21. 2021Improving White-box Robustness of Pre-processing Defenses via Joint Adversarial Trainingcited by 3
  22. 2021Robust and Accurate Object Detection via Self-Knowledge Distillationcited by 3
  23. 2021Energy Attack: On Transferring Adversarial Examplescited by 2
  24. 2021Adversarial Attack across Datasetscited by 2
  25. 2021Scanflow: A multi-graph framework for Machine Learning workflow management, supervision, and debuggingcited by 2
  26. 2024Towards a Novel Perspective on Adversarial Examples Driven by Frequencycited by 2
  27. 2024DifAttack++: Query-Efficient Black-Box Adversarial Attack via Hierarchical Disentangled Feature Space in Cross-Domaincited by 2
  28. 2024On the Validity of Traditional Vulnerability Scoring Systems for Adversarial Attacks against LLMscited by 2
  29. 2024RobustBlack: Challenging Black-Box Adversarial Attacks on State-of-the-Art Defensescited by 2
  30. 2021LSDAT: Low-Rank and Sparse Decomposition for Decision-based Adversarial Attackcited by 1
  31. 2022Disappeared Command: Spoofing Attack On Automatic Speech Recognition Systems with Sound Maskingcited by 1
  32. 2022Unifying Gradients to Improve Real-world Robustness for Deep Networkscited by 1
  33. 2023PRAT: PRofiling Adversarial aTtackscited by 1
  34. 2023DifAttack: Query-Efficient Black-Box Attack via Disentangled Feature Spacecited by 1
  35. 2023Constrained Adaptive Attacks: Realistic Evaluation of Adversarial Examples and Robust Training of Deep Neural Networks for Tabular Datacited by 1
  36. 2025Adversarial Examples in Environment Perception for Automated Driving (Review)cited by 1
  37. 2025Non-Parametric Probabilistic Robustness: A Conservative Risk Estimator under Unknown Perturbation Distributionscited by 1
  38. 2026Learning from Adversity: Semantic-Aware Mask Refinement through Adversarial Perturbationcited by 1

50 most cited of 57 All 57 (JSON)