# Spanning Attack: Reinforce Black-box Attacks with Unlabeled Data

arXiv: https://arxiv.org/abs/2005.04871 · HTML: https://mlsanity.com/paper/2005.04871/

## Key facts

- Cited by 6 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 11 May 2020.

## Built on by (most cited first, 6 of 6)

- [A Review of Adversarial Attack and Defense for Classification Methods](https://mlsanity.com/paper/2111.09961/) (2021)
- [Training Meta-Surrogate Model for Transferable Adversarial Attack](https://mlsanity.com/paper/2109.01983/) (2021)
- [SoK: Pitfalls in Evaluating Black-Box Attacks](https://mlsanity.com/paper/2310.17534/) (2023)
- [Adversarial Attack across Datasets](https://mlsanity.com/paper/2110.07718/) (2021)
- [Sparse and Transferable Universal Singular Vectors Attack](https://mlsanity.com/paper/2401.14031/) (2024)
- [Evaluating robustness of support vector machines with the Lagrangian dual approach](https://mlsanity.com/paper/2306.02639/) (2023)

## Abstract (arXiv)

Adversarial black-box attacks aim to craft adversarial perturbations by querying input-output pairs of machine learning models. They are widely used to evaluate the robustness of pre-trained models. However, black-box attacks often suffer from the issue of query inefficiency due to the high dimensionality of the input space, and therefore incur a false sense of model robustness. In this paper, we relax the conditions of the black-box threat model, and propose a novel technique called the spanning attack. By constraining adversarial perturbations in a low-dimensional subspace via spanning an auxiliary unlabeled dataset, the spanning attack significantly improves the query efficiency of a wide variety of existing black-box attacks. Extensive experiments show that the proposed method works favorably in both soft-label and hard-label black-box attacks. Our code is available at https://github.com/wangwllu/spanning_attack.