mlsanityData to 13 Oct 2026

RayS: A Ray Searching Method for Hard-label Adversarial Attack

arXiv 2006.12792 ↗First posted 23 Jun 2020cs.LG cs.AI stat.MLcited by 94

Not on the map. Why?

Abstract (arXiv)

Deep neural networks are vulnerable to adversarial attacks. Among different attack settings, the most challenging yet the most practical one is the hard-label setting where the attacker only has access to the hard-label output (prediction label) of the target model. Previous attempts are neither effective enough in terms of attack success rate nor efficient enough in terms of query complexity under the widely used L_∞ norm threat model. In this paper, we present the Ray Searching attack (RayS), which greatly improves the hard-label attack effectiveness as well as efficiency. Unlike previous works, we reformulate the continuous problem of finding the closest decision boundary into a discrete problem that does not require any zeroth-order gradient estimation. In the meantime, all unnecessary searches are eliminated via a fast check step. This significantly reduces the number of queries needed for our hard-label attack. Moreover, interestingly, we found that the proposed RayS attack can also be used as a sanity check for possible "falsely robust" models. On several recently proposed defenses that claim to achieve the state-of-the-art robust accuracy, our attack method demonstrates that the current white-box/black-box attacks could still give a false sense of security and the robust accuracy drop between the most popular PGD attack and RayS attack could be as large as 28%. We believe that our proposed RayS attack could help identify falsely robust models that beat most white-box/black-box attacks.

Key facts. Cited by 94 papers in the map (data through 13 Oct 2026). First posted on arXiv 23 Jun 2020.

Builds on

No reference list yet.

Built on by

Cited by year (2026 to 13 Oct)

Citing papers per year: 2021: 19; 2022: 19; 2023: 25; 2024: 14; 2025: 12; 2026: 5.

94 papers.

Sort:

By area:

  1. 2021On the Robustness of Vision Transformers to Adversarial Examplescited by 167
  2. 2022Robustness and Accuracy Could Be Reconcilable by (Proper) Definitioncited by 110
  3. 2023A Pilot Study of Query-Free Adversarial Attack against Stable Diffusioncited by 76
  4. 2022Evaluating the Adversarial Robustness of Adaptive Test-time Defensescited by 64
  5. 2022A Survey of Robust Adversarial Training in Pattern Recognition: Fundamental, Theory, and Methodologiescited by 44
  6. 2021Reveal of Vision Transformers Robustness against Adversarial Attackscited by 43
  7. 2021Attacking Adversarial Attacks as A Defensecited by 31
  8. 2021A Review of Adversarial Attack and Defense for Classification Methodscited by 29
  9. 2023Generalizable Black-Box Adversarial Attack with Meta Learningcited by 29
  10. 2022One-shot Neural Backdoor Erasing via Adversarial Weight Maskingcited by 28
  11. 2023Randomized Adversarial Training via Taylor Expansioncited by 28
  12. 2024Breaking the False Sense of Security in Backdoor Defense through Re-Activation Attackcited by 28
38 more
  1. 2022Removing Batch Normalization Boosts Adversarial Trainingcited by 24
  2. 2024ADBM: Adversarial diffusion bridge model for reliable adversarial purificationcited by 24
  3. 2022Scaling Adversarial Training to Large Perturbation Boundscited by 20
  4. 2023Attacks in Adversarial Machine Learning: A Systematic Survey from the Life-cycle Perspectivecited by 20
  5. 2023CGBA: Curvature-aware Geometric Black-box Attackcited by 20
  6. 2023A Survey of Robustness and Safety of 2D and 3D Deep Learning Models Against Adversarial Attackscited by 19
  7. 2024SleeperNets: Universal Backdoor Poisoning Attacks Against Reinforcement Learning Agentscited by 19
  8. 2022Recognizing Object by Components with Human Prior Knowledge Enhances Adversarial Robustness of Deep Neural Networkscited by 18
  9. 2021Back in Black: A Comparative Evaluation of Recent State-Of-The-Art Black-Box Attackscited by 16
  10. 2021Two Coupled Rejection Metrics Can Tell Adversarial Examples Apartcited by 14
  11. 2021Label Noise in Adversarial Training: A Novel Perspective to Study Robust Overfittingcited by 14
  12. 2023Fast Adversarial Training with Smooth Convergencecited by 14
  13. 2022Query Efficient Decision Based Sparse Attacks Against Black-Box Deep Learning Modelscited by 13
  14. 2023Evading Black-box Classifiers Without Breaking Eggscited by 13
  15. 2023Mitigating Accuracy-Robustness Trade-off via Balanced Multi-Teacher Adversarial Distillationcited by 13
  16. 2023Boosting Black-box Attack to Deep Neural Networks with Conditional Diffusion Modelscited by 12
  17. 2021Finding Optimal Tangent Points for Reducing Distortions of Hard-label Attackscited by 11
  18. 2022Part-Based Models Improve Adversarial Robustnesscited by 11
  19. 2021Improving Model Robustness with Latent Distribution Locally and Globallycited by 9
  20. 2021MedRDF: A Robust and Retrain-Less Diagnostic Framework for Medical Pretrained Models Against Adversarial Attackcited by 9
  21. 2023Robust Spatiotemporal Traffic Forecasting with Reinforced Dynamic Adversarial Trainingcited by 9
  22. 2025Towards Effective and Sparse Adversarial Attack on Spiking Neural Networks via Breaking Invisible Surrogate Gradientscited by 9
  23. 2021Progressive-Scale Boundary Blackbox Attack via Projective Gradient Estimationcited by 8
  24. 2022Adversarial Purification with the Manifold Hypothesiscited by 8
  25. 2021Rethinking Image-Scaling Attacks: The Interplay Between Vulnerabilities in Machine Learning Systemscited by 7
  26. 2021Performance Evaluation of Adversarial Attacks: Discrepancies and Solutionscited by 7
  27. 2022Learnability Lock: Authorized Learnability Control Through Adversarial Invertible Transformationscited by 7
  28. 2022Randomized Smoothing under Attack: How Good is it in Pratice?cited by 7
  29. 2022InfoAT: Improving Adversarial Training Using the Information Bottleneck Principlecited by 7
  30. 2022Adversarial Framework with Certified Robustness for Time-Series Domain via Statistical Featurescited by 7
  31. 2022Understanding the Vulnerability of Skeleton-based Human Activity Recognition via Black-box Attackcited by 7
  32. 2024Boosting Adversarial Transferability with Low-Cost Optimization via Maximin Expected Flatnesscited by 7
  33. 2024ADBA:Approximation Decision Boundary Approach for Black-Box Adversarial Attackscited by 7
  34. 2024AdvQDet: Detecting Query-Based Adversarial Attacks with Adversarial Contrastive Prompt Tuningcited by 7
  35. 2021Mixture of Robust Experts (MoRE):A Robust Denoising Method towards multiple perturbationscited by 6
  36. 2023SoK: Pitfalls in Evaluating Black-Box Attackscited by 6
  37. 2023Certifiable Black-Box Attacks with Randomized Adversarial Examples: Breaking Defenses with Provable Confidencecited by 5
  38. 2023Towards Robust and Accurate Visual Promptingcited by 5

50 most cited of 94 All 94 (JSON)