# AdvFlow: Inconspicuous Black-box Adversarial Attacks using Normalizing Flows

arXiv: https://arxiv.org/abs/2007.07435 · HTML: https://mlsanity.com/paper/2007.07435/

## Key facts

- Cited by 36 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 15 Jul 2020.

## Built on by (most cited first, 30 of 36)

- [Advances in adversarial attacks and defenses in computer vision: A survey](https://mlsanity.com/paper/2108.00401/) (2021)
- [How to Backdoor Diffusion Models?](https://mlsanity.com/paper/2212.05400/) (2022)
- [VillanDiffusion: A Unified Backdoor Attack Framework for Diffusion Models](https://mlsanity.com/paper/2306.06874/) (2023)
- [Generalizable Black-Box Adversarial Attack with Meta Learning](https://mlsanity.com/paper/2301.00364/) (2023)
- [Attacks in Adversarial Machine Learning: A Systematic Survey from the Life-cycle Perspective](https://mlsanity.com/paper/2302.09457/) (2023)
- [Attacking deep networks with surrogate-based adversarial black-box methods is easy](https://mlsanity.com/paper/2203.08725/) (2022)
- [Imperceptible Adversarial Attack via Invertible Neural Networks](https://mlsanity.com/paper/2211.15030/) (2022)
- [Boosting Black-box Attack to Deep Neural Networks with Conditional Diffusion Models](https://mlsanity.com/paper/2310.07492/) (2023)
- [Attacking Perceptual Similarity Metrics](https://mlsanity.com/paper/2305.08840/) (2023)
- [Adv3D: Generating 3D Adversarial Examples for 3D Object Detection in Driving Scenarios with NeRF](https://mlsanity.com/paper/2309.01351/) (2023)
- [On the Role of Generalization in Transferability of Adversarial Examples](https://mlsanity.com/paper/2206.09238/) (2022)
- [Adaptive Token Merging for Efficient Transformer Semantic Communication at the Edge](https://mlsanity.com/paper/2509.09955/) (2025)
- [Semantic Perturbations with Normalizing Flows for Improved Generalization](https://mlsanity.com/paper/2108.07958/) (2021)
- [SoK: Pitfalls in Evaluating Black-Box Attacks](https://mlsanity.com/paper/2310.17534/) (2023)
- [Adversarial for Good? How the Adversarial ML Community's Values Impede Socially Beneficial Uses of Attacks](https://mlsanity.com/paper/2107.10302/) (2021)
- [PublicCheck: Public Integrity Verification for Services of Run-time Deep Models](https://mlsanity.com/paper/2203.10902/) (2022)
- [Suppressing Static Visual Cues via Normalizing Flows for Self-Supervised Video Representation Learning](https://mlsanity.com/paper/2112.03803/) (2021)
- [AFLOW: Developing Adversarial Examples under Extremely Noise-limited Settings](https://mlsanity.com/paper/2310.09795/) (2023)
- [LiRA: Light-Robust Adversary for Model-based Reinforcement Learning in Real World](https://mlsanity.com/paper/2409.19617/) (2024)
- [Reinforcement Learning Platform for Adversarial Black-box Attacks with Custom Distortion Filters](https://mlsanity.com/paper/2501.14122/) (2025)
- [Energy Attack: On Transferring Adversarial Examples](https://mlsanity.com/paper/2109.04300/) (2021)
- [OMG-ATTACK: Self-Supervised On-Manifold Generation of Transferable Evasion Attacks](https://mlsanity.com/paper/2310.03707/) (2023)
- [STBA: Towards Evaluating the Robustness of DNNs for Query-Limited Black-box Scenario](https://mlsanity.com/paper/2404.00362/) (2024)
- [DifAttack++: Query-Efficient Black-Box Adversarial Attack via Hierarchical Disentangled Feature Space in Cross-Domain](https://mlsanity.com/paper/2406.03017/) (2024)
- [RobustBlack: Challenging Black-Box Adversarial Attacks on State-of-the-Art Defenses](https://mlsanity.com/paper/2412.20987/) (2024)
- [LSDAT: Low-Rank and Sparse Decomposition for Decision-based Adversarial Attack](https://mlsanity.com/paper/2103.10787/) (2021)
- [On the Robustness of Domain Adaption to Adversarial Attacks](https://mlsanity.com/paper/2108.01807/) (2021)
- [DifAttack: Query-Efficient Black-Box Attack via Disentangled Feature Space](https://mlsanity.com/paper/2309.14585/) (2023)
- [Design of Restricted Normalizing Flow towards Arbitrary Stochastic Policy with Computational Efficiency](https://mlsanity.com/paper/2412.12894/) (2024)
- [Cross-Modal Consistency Learning for Sign Language Recognition](https://mlsanity.com/paper/2503.12485/) (2025)

## Abstract (arXiv)

Deep learning classifiers are susceptible to well-crafted, imperceptible variations of their inputs, known as adversarial attacks. In this regard, the study of powerful attack models sheds light on the sources of vulnerability in these classifiers, hopefully leading to more robust ones. In this paper, we introduce AdvFlow: a novel black-box adversarial attack method on image classifiers that exploits the power of normalizing flows to model the density of adversarial examples around a given target image. We see that the proposed method generates adversaries that closely follow the clean data distribution, a property which makes their detection less likely. Also, our experimental results show competitive performance of the proposed approach with some of the existing attack methods on defended classifiers. The code is available at https://github.com/hmdolatabadi/AdvFlow.