# Towards Query-Efficient Black-Box Adversary with Zeroth-Order Natural Gradient Descent

arXiv: https://arxiv.org/abs/2002.07891 · HTML: https://mlsanity.com/paper/2002.07891/

## Key facts

- Cited by 18 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 18 Feb 2020.

## Built on by (most cited first, 18 of 18)

- [Triangle Attack: A Query-efficient Decision-based Adversarial Attack](https://mlsanity.com/paper/2112.06569/) (2021)
- [Speech Robust Bench: A Robustness Benchmark For Speech Recognition](https://mlsanity.com/paper/2403.07937/) (2024)
- [Back in Black: A Comparative Evaluation of Recent State-Of-The-Art Black-Box Attacks](https://mlsanity.com/paper/2109.15031/) (2021)
- [Boosting Black-box Attack to Deep Neural Networks with Conditional Diffusion Models](https://mlsanity.com/paper/2310.07492/) (2023)
- [Holistic Adversarial Robustness of Deep Learning Models](https://mlsanity.com/paper/2202.07201/) (2022)
- [SoK: Pitfalls in Evaluating Black-Box Attacks](https://mlsanity.com/paper/2310.17534/) (2023)
- [Expert System Gradient Descent Style Training: Development of a Defensible Artificial Intelligence Technique](https://mlsanity.com/paper/2103.04314/) (2021)
- [STARNet: Sensor Trustworthiness and Anomaly Recognition via Approximated Likelihood Regret for Robust Edge Autonomy](https://mlsanity.com/paper/2309.11006/) (2023)
- [Data-Driven Lipschitz Continuity: A Cost-Effective Approach to Improve Adversarial Robustness](https://mlsanity.com/paper/2406.19622/) (2024)
- [STBA: Towards Evaluating the Robustness of DNNs for Query-Limited Black-box Scenario](https://mlsanity.com/paper/2404.00362/) (2024)
- [Consensus-based optimization for closed-box adversarial attacks and a connection to evolution strategies](https://mlsanity.com/paper/2506.24048/) (2025)
- [On the Optimal Construction of Unbiased Gradient Estimators for Zeroth-Order Optimization](https://mlsanity.com/paper/2510.19953/) (2025)
- [Determining Sentencing Recommendations and Patentability Using a Machine Learning Trained Expert System](https://mlsanity.com/paper/2108.04088/) (2021)
- [Fake News and Phishing Detection Using a Machine Learning Trained Expert System](https://mlsanity.com/paper/2108.08264/) (2021)
- [Automating the Design and Development of Gradient Descent Trained Expert System Networks](https://mlsanity.com/paper/2207.02845/) (2022)
- [DTA: Distribution Transform-based Attack for Query-Limited Scenario](https://mlsanity.com/paper/2312.07245/) (2023)
- [Implementation and Evaluation of a Gradient Descent-Trained Defensible Blackboard Architecture System](https://mlsanity.com/paper/2404.11714/) (2024)
- [Reinforcement Learning Inspired Black-box Adversarial Attacks for Computer Vision](https://mlsanity.com/paper/2609.24249/) (2026)

## Abstract (arXiv)

Despite the great achievements of the modern deep neural networks (DNNs), the vulnerability/robustness of state-of-the-art DNNs raises security concerns in many application domains requiring high reliability. Various adversarial attacks are proposed to sabotage the learning performance of DNN models. Among those, the black-box adversarial attack methods have received special attentions owing to their practicality and simplicity. Black-box attacks usually prefer less queries in order to maintain stealthy and low costs. However, most of the current black-box attack methods adopt the first-order gradient descent method, which may come with certain deficiencies such as relatively slow convergence and high sensitivity to hyper-parameter settings. In this paper, we propose a zeroth-order natural gradient descent (ZO-NGD) method to design the adversarial attacks, which incorporates the zeroth-order gradient estimation technique catering to the black-box attack scenario and the second-order natural gradient descent to achieve higher query efficiency. The empirical evaluations on image classification datasets demonstrate that ZO-NGD can obtain significantly lower model query complexities compared with state-of-the-art attack methods.