mlsanityData to 7 Oct 2026

AdvFlow: Inconspicuous Black-box Adversarial Attacks using Normalizing Flows

arXiv 2007.07435 ↗First posted 15 Jul 2020cs.LG cs.CR cs.CVcited by 35

Not on the map. Why?

Abstract (arXiv)

Deep learning classifiers are susceptible to well-crafted, imperceptible variations of their inputs, known as adversarial attacks. In this regard, the study of powerful attack models sheds light on the sources of vulnerability in these classifiers, hopefully leading to more robust ones. In this paper, we introduce AdvFlow: a novel black-box adversarial attack method on image classifiers that exploits the power of normalizing flows to model the density of adversarial examples around a given target image. We see that the proposed method generates adversaries that closely follow the clean data distribution, a property which makes their detection less likely. Also, our experimental results show competitive performance of the proposed approach with some of the existing attack methods on defended classifiers. The code is available at https://github.com/hmdolatabadi/AdvFlow.

Key facts. Cited by 35 papers in the map (data through 7 Oct 2026). First posted on arXiv 15 Jul 2020.

Builds on

No reference list yet.

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 7; 2022: 6; 2023: 11; 2024: 4; 2025: 4; 2026: 3.

35 papers.

Sort:

By area:

  1. 2021Advances in adversarial attacks and defenses in computer vision: A surveycited by 127
  2. 2022How to Backdoor Diffusion Models?cited by 102
  3. 2023VillanDiffusion: A Unified Backdoor Attack Framework for Diffusion Modelscited by 68
  4. 2023Generalizable Black-Box Adversarial Attack with Meta Learningcited by 29
  5. 2023Attacks in Adversarial Machine Learning: A Systematic Survey from the Life-cycle Perspectivecited by 19
  6. 2022Attacking deep networks with surrogate-based adversarial black-box methods is easycited by 18
  7. 2022Imperceptible Adversarial Attack via Invertible Neural Networkscited by 12
  8. 2023Boosting Black-box Attack to Deep Neural Networks with Conditional Diffusion Modelscited by 12
  9. 2023Adv3D: Generating 3D Adversarial Examples for 3D Object Detection in Driving Scenarios with NeRFcited by 10
  10. 2022On the Role of Generalization in Transferability of Adversarial Examplescited by 9
  11. 2023Attacking Perceptual Similarity Metricscited by 8
  12. 2021Semantic Perturbations with Normalizing Flows for Improved Generalizationcited by 6
23 more
  1. 2023SoK: Pitfalls in Evaluating Black-Box Attackscited by 6
  2. 2021Adversarial for Good? How the Adversarial ML Community's Values Impede Socially Beneficial Uses of Attackscited by 5
  3. 2022PublicCheck: Public Integrity Verification for Services of Run-time Deep Modelscited by 5
  4. 2025Adaptive Token Merging for Efficient Transformer Semantic Communication at the Edgecited by 5
  5. 2021Suppressing Static Visual Cues via Normalizing Flows for Self-Supervised Video Representation Learningcited by 4
  6. 2023AFLOW: Developing Adversarial Examples under Extremely Noise-limited Settingscited by 4
  7. 2025Reinforcement Learning Platform for Adversarial Black-box Attacks with Custom Distortion Filterscited by 3
  8. 2021Energy Attack: On Transferring Adversarial Examplescited by 2
  9. 2023OMG-ATTACK: Self-Supervised On-Manifold Generation of Transferable Evasion Attackscited by 2
  10. 2024STBA: Towards Evaluating the Robustness of DNNs for Query-Limited Black-box Scenariocited by 2
  11. 2024DifAttack++: Query-Efficient Black-Box Adversarial Attack via Hierarchical Disentangled Feature Space in Cross-Domaincited by 2
  12. 2024RobustBlack: Challenging Black-Box Adversarial Attacks on State-of-the-Art Defensescited by 2
  13. 2021LSDAT: Low-Rank and Sparse Decomposition for Decision-based Adversarial Attackcited by 1
  14. 2021On the Robustness of Domain Adaption to Adversarial Attackscited by 1
  15. 2023DifAttack: Query-Efficient Black-Box Attack via Disentangled Feature Spacecited by 1
  16. 2024Design of Restricted Normalizing Flow towards Arbitrary Stochastic Policy with Computational Efficiencycited by 1
  17. 2025Cross-Modal Consistency Learning for Sign Language Recognitioncited by 1
  18. 2025Adversarial Examples in Environment Perception for Automated Driving (Review)cited by 1
  19. 2022Learning Multivariate CDFs and Copulas using Tensor Factorizationcited by 0
  20. 2023DTA: Distribution Transform-based Attack for Query-Limited Scenariocited by 0
  21. 2026LA-Sign: Looped Transformers with Geometry-aware Alignment for Skeleton-based Sign Language Recognitioncited by 0
  22. 2026Adversarial Flow Matching for Imperceptible Attacks on End-to-End Autonomous Drivingcited by 0
  23. 2026Discovering Natural Transformation Vulnerabilities in Black-Box Vision Modelscited by 0