Data to 7 Oct 2026

Square Attack: a query-efficient black-box adversarial attack via random search

arXiv 1912.00049 ↗First posted 29 Nov 2019cs.LG cs.CR cs.CVcited by 682

Not on the map. Why?

Cited by 21 in LLM safety and security, but placed by its own abstract, which didn’t fit.

Abstract (arXiv)

We propose the Square Attack, a score-based black-box l2- and l_∞-adversarial attack that does not rely on local gradient information and thus is not affected by gradient masking. Square Attack is based on a randomized search scheme which selects localized square-shaped updates at random positions so that at each iteration the perturbation is situated approximately at the boundary of the feasible set. Our method is significantly more query efficient and achieves a higher success rate compared to the state-of-the-art methods, especially in the untargeted setting. In particular, on ImageNet we improve the average query efficiency in the untargeted setting for various deep networks by a factor of at least 1.8 and up to 3 compared to the recent state-of-the-art l_∞-attack of Al-Dujaili & O'Reilly. Moreover, although our attack is black-box, it can also outperform gradient-based white-box attacks on the standard benchmarks achieving a new state-of-the-art in terms of the success rate. The code of our attack is available at https://github.com/max-andr/square-attack.

Key facts. Cited by 682 papers in the map (data through 7 Oct 2026). First posted on arXiv 29 Nov 2019.

Builds on

No reference list yet.

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 98; 2022: 112; 2023: 156; 2024: 137; 2025: 120; 2026: 59.

682 papers.

Sort:

By area:

2024Jailbreaking Leading Safety-Aligned LLMs with Simple Adaptive Attackscited by 450
2021Fixing Data Augmentation to Improve Adversarial Robustnesscited by 201
2021Data Augmentation Can Improve Robustnesscited by 193
2021Are Transformers More Robust Than CNNs?cited by 187
2021AdvSim: Generating Safety-Critical Scenarios for Self-Driving Vehiclescited by 132
2023Open Sesame! Universal Black Box Jailbreaking of Large Language Modelscited by 128
2021Advances in adversarial attacks and defenses in computer vision: A surveycited by 127
2023Automatic Prompt Augmentation and Selection with Chain-of-Thought from Labeled Datacited by 119
2023Anti-DreamBooth: Protecting users from personalized text-to-image synthesiscited by 114
2022KING: Generating Safety-Critical Driving Scenarios for Robust Imitation via Kinematics Gradientscited by 95
2022LAS-AT: Adversarial Training with Learnable Attack Strategycited by 94
2023Diffusion Models for Imperceptible and Transferable Adversarial Attackcited by 93

38 more

2021Adversarial Sticker: A Stealthy Attack Method in the Physical Worldcited by 92
2021Stable Neural ODE with Lyapunov-Stable Equilibrium Points for Defending Against Adversarial Attackscited by 91
2022Untargeted Backdoor Watermark: Towards Harmless and Stealthy Dataset Copyright Protectioncited by 80
2022Parallel Rectangle Flip Attack: A Query-based Black-box Attack against Object Detectioncited by 79
2023Revisiting Adversarial Training for ImageNet: Architectures, Training and Generalization across Threat Modelscited by 79
2021RobustART: Benchmarking Robustness on Architecture Design and Training Techniquescited by 78
2021Revisiting Adversarial Robustness Distillation: Robust Soft Labels Make Student Bettercited by 77
2023A Pilot Study of Query-Free Adversarial Attack against Stable Diffusioncited by 75
2021On Improving Adversarial Transferability of Vision Transformerscited by 70
2022Black-box Prompt Learning for Pre-trained Language Modelscited by 70
2023Robust Evaluation of Diffusion-Based Adversarial Purificationcited by 65
2023How Deep Learning Sees the World: A Survey on Adversarial Attacks & Defensescited by 65
2022Evaluating the Adversarial Robustness of Adaptive Test-time Defensescited by 64
2022A Light Recipe to Train Robust Vision Transformerscited by 64
2022When Adversarial Training Meets Vision Transformers: Recipes from Training to Architecturecited by 64
2023Black Box Adversarial Prompting for Foundation Modelscited by 62
2023Structure Invariant Transformation for better Adversarial Transferabilitycited by 61
2023A Unified Algebraic Perspective on Lipschitz Neural Networkscited by 58
2021Exploring Memorization in Adversarial Trainingcited by 55
2022A Large-scale Multiple-objective Method for Black-box Attack against Object Detectioncited by 55
2021Adversarial Example Detection for DNN Models: A Review and Experimental Comparisoncited by 51
2021Mind the box: l1-APGD for sparse adversarial attacks on image classifierscited by 50
2022Understanding Robust Overfitting of Adversarial Training and Beyondcited by 50
2022Shape-invariant 3D Adversarial Point Cloudscited by 49
2022Improving the Transferability of Targeted Adversarial Examples through Object-Based Diverse Inputcited by 49
2021Adversarial Attacks are Reversible with Natural Supervisioncited by 47
2022Patch-Fool: Are Vision Transformers Always Robust Against Adversarial Perturbations?cited by 47
2023Adversarial Counterfactual Visual Explanationscited by 47
2021Random Noise Defense Against Query-Based Black-Box Attackscited by 46
2021Detecting Adversarial Examples Is (Nearly) As Hard As Classifying Themcited by 46
2022A Survey of Robust Adversarial Training in Pattern Recognition: Fundamental, Theory, and Methodologiescited by 44
2021Reveal of Vision Transformers Robustness against Adversarial Attackscited by 43
2022Efficient and Effective Augmentation Strategy for Adversarial Trainingcited by 43
2022Enhancing Adversarial Training with Second-Order Statistics of Weightscited by 42
2023Hijacking Large Language Models via Adversarial In-Context Learningcited by 41
2021Boosting Fast Adversarial Training with Learnable Adversarial Initializationcited by 40
2022Self-Ensemble Adversarial Training for Improved Robustnesscited by 38
2023Improving the Transferability of Adversarial Samples by Path-Augmented Methodcited by 36

50 most cited of 682 All 682 (JSON)