# A Survey of Black-Box Adversarial Attacks on Computer Vision Models

arXiv: https://arxiv.org/abs/1912.01667 · HTML: https://mlsanity.com/paper/1912.01667/

## Key facts

- Cited by 37 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 3 Dec 2019.

## Built on by (most cited first, 30 of 37)

- [Trustworthy AI: From Principles to Practices](https://mlsanity.com/paper/2110.01167/) (2021)
- [Black-Box Access is Insufficient for Rigorous AI Audits](https://mlsanity.com/paper/2401.14446/) (2024)
- [Interpretability Benchmark for Evaluating Spatial Misalignment of Prototypical Parts Explanations](https://mlsanity.com/paper/2308.08162/) (2023)
- [A Survey of Adversarial Defences and Robustness in NLP](https://mlsanity.com/paper/2203.06414/) (2022)
- [Pixle: a fast and effective black-box attack based on rearranging pixels](https://mlsanity.com/paper/2202.02236/) (2022)
- [On the Effectiveness of Small Input Noise for Defending Against Query-based Black-Box Attacks](https://mlsanity.com/paper/2101.04829/) (2021)
- [Adversarial Patch Attacks and Defences in Vision-Based Tasks: A Survey](https://mlsanity.com/paper/2206.08304/) (2022)
- [Back in Black: A Comparative Evaluation of Recent State-Of-The-Art Black-Box Attacks](https://mlsanity.com/paper/2109.15031/) (2021)
- [Understanding and Improving Ensemble Adversarial Defense](https://mlsanity.com/paper/2310.18477/) (2023)
- [Black-box adversarial attacks using Evolution Strategies](https://mlsanity.com/paper/2104.15064/) (2021)
- [Selection of Source Images Heavily Influences the Effectiveness of Adversarial Attacks](https://mlsanity.com/paper/2106.07141/) (2021)
- [SoK: Pitfalls in Evaluating Black-Box Attacks](https://mlsanity.com/paper/2310.17534/) (2023)
- [Certifiable Black-Box Attacks with Randomized Adversarial Examples: Breaking Defenses with Provable Confidence](https://mlsanity.com/paper/2304.04343/) (2023)
- [Robustness and Visual Explanation for Black Box Image, Video, and ECG Signal Classification with Reinforcement Learning](https://mlsanity.com/paper/2403.18985/) (2024)
- [Adversarial Attacks against Neural Ranking Models via In-Context Learning](https://mlsanity.com/paper/2508.15283/) (2025)
- [Attention-Guided Black-box Adversarial Attacks with Large-Scale Multiobjective Evolutionary Optimization](https://mlsanity.com/paper/2101.07512/) (2021)
- [RES-HD: Resilient Intelligent Fault Diagnosis Against Adversarial Attacks Using Hyper-Dimensional Computing](https://mlsanity.com/paper/2203.08148/) (2022)
- [Exploring the Adversarial Frontier: Quantifying Robustness via Adversarial Hypervolume](https://mlsanity.com/paper/2403.05100/) (2024)
- [Saliency Diversified Deep Ensemble for Robustness to Adversaries](https://mlsanity.com/paper/2112.03615/) (2021)
- [Enhancing TinyML Security: Study of Adversarial Attack Transferability](https://mlsanity.com/paper/2407.11599/) (2024)
- [Edge-Only Universal Adversarial Attacks in Distributed Learning](https://mlsanity.com/paper/2411.10500/) (2024)
- [Consensus-based optimization for closed-box adversarial attacks and a connection to evolution strategies](https://mlsanity.com/paper/2506.24048/) (2025)
- [False Alarms, Real Damage: Adversarial Attacks Using LLM-based Models on Text-based Cyber Threat Intelligence Systems](https://mlsanity.com/paper/2507.06252/) (2025)
- [Red Teaming with Mind Reading: White-Box Adversarial Policies Against RL Agents](https://mlsanity.com/paper/2209.02167/) (2022)
- [Physics-Guided Adversarial Machine Learning for Aircraft Systems Simulation](https://mlsanity.com/paper/2209.03431/) (2022)
- [Transparency Attacks: How Imperceptible Image Layers Can Fool AI Perception](https://mlsanity.com/paper/2401.15817/) (2024)
- [Distributionally Robust Multi-Output Regression Ranking](https://mlsanity.com/paper/2109.12803/) (2021)
- [Evaluation of Four Black-box Adversarial Attacks and Some Query-efficient Improvement Analysis](https://mlsanity.com/paper/2201.05001/) (2022)
- [Distributed Black-box Attack: Do Not Overestimate Black-box Attacks](https://mlsanity.com/paper/2210.16371/) (2022)
- [General Lipschitz: Certified Robustness Against Resolvable Semantic Transformations via Transformation-Dependent Randomized Smoothing](https://mlsanity.com/paper/2309.16710/) (2023)

## Abstract (arXiv)

Machine learning has seen tremendous advances in the past few years, which has lead to deep learning models being deployed in varied applications of day-to-day life. Attacks on such models using perturbations, particularly in real-life scenarios, pose a severe challenge to their applicability, pushing research into the direction which aims to enhance the robustness of these models. After the introduction of these perturbations by Szegedy et al. [1], significant amount of research has focused on the reliability of such models, primarily in two aspects - white-box, where the adversary has access to the targeted model and related parameters; and the black-box, which resembles a real-life scenario with the adversary having almost no knowledge of the model to be attacked. To provide a comprehensive security cover, it is essential to identify, study, and build defenses against such attacks. Hence, in this paper, we propose to present a comprehensive comparative study of various black-box adversarial attacks and defense techniques.