mlsanityData to 7 Oct 2026

Delving into Data: Effectively Substitute Training for Black-box Attack

arXiv 2104.12378 ↗First posted 26 Apr 2021cs.CVcited by 27

Not on the map. Why?

Abstract (arXiv)

Deep models have shown their vulnerability when processing adversarial samples. As for the black-box attack, without access to the architecture and weights of the attacked model, training a substitute model for adversarial attacks has attracted wide attention. Previous substitute training approaches focus on stealing the knowledge of the target model based on real training data or synthetic data, without exploring what kind of data can further improve the transferability between the substitute and target models. In this paper, we propose a novel perspective substitute training that focuses on designing the distribution of data used in the knowledge stealing process. More specifically, a diverse data generation module is proposed to synthesize large-scale data with wide distribution. And adversarial substitute training strategy is introduced to focus on the data distributed near the decision boundary. The combination of these two modules can further boost the consistency of the substitute model and target model, which greatly improves the effectiveness of adversarial attack. Extensive experiments demonstrate the efficacy of our method against state-of-the-art competitors under non-target and target attack settings. Detailed visualization and analysis are also provided to help understand the advantage of our method.

Key facts. Cited by 27 papers in the map (data through 7 Oct 2026). Builds on 27 of its 34 references that are in the map. First posted on arXiv 26 Apr 2021.

Builds on

27 of 34 references.

References · 27

  1. 2015Deep Residual Learning for Image Recognitioncited by 51,809
  2. 2014Very Deep Convolutional Networks for Large-Scale Image Recognitioncited by 15,267
  3. 2014ImageNet Large Scale Visual Recognition Challengecited by 8,441
  4. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  5. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  6. 2013Intriguing properties of neural networkscited by 5,114
  7. 2013Distributed Representations of Words and Phrases and their Compositionalitycited by 3,462
  8. 2016Towards Evaluating the Robustness of Neural Networkscited by 2,976
  9. 2016Adversarial examples in the physical worldcited by 1,762
  10. 2016Practical Black-Box Attacks against Machine Learningcited by 893
  11. 2015The Limitations of Deep Learning in Adversarial Settingscited by 784
  12. 2017ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Modelscited by 656
15 more
  1. 2016Stealing Machine Learning Models via Prediction APIscited by 602
  2. 2018Black-box Adversarial Attacks with Limited Queries and Informationcited by 499
  3. 2017Decision-Based Adversarial Attacks: Reliable Attacks Against Black-Box Machine Learning Modelscited by 459
  4. 2019Dreaming to Distill: Data-free Knowledge Transfer via DeepInversioncited by 419
  5. 2018Knockoff Nets: Stealing Functionality of Black-Box Modelscited by 285
  6. 2019Simple Black-box Adversarial Attackscited by 249
  7. 2019Efficient Decision-based Black-box Adversarial Attacks on Face Recognitioncited by 173
  8. 2018Prior Convictions: Black-Box Adversarial Attacks with Bandits and Priorscited by 145
  9. 2018AutoZOOM: Autoencoder-based Zeroth Order Optimization Method for Attacking Black-box Neural Networkscited by 137
  10. 2018Query-Efficient Hard-label Black-box Attack:An Optimization-based Approachcited by 130
  11. 2020DaST: Data-free Substitute Training for Adversarial Attackscited by 60
  12. 2020Universal Adversarial Attack on Attention and the Resulting Dataset DAmageNetcited by 45
  13. 2020Hermes Attack: Steal DNN Models with Lossless Inference Accuracycited by 41
  14. 2018Towards Imperceptible and Robust Adversarial Example Attacks against Neural Networkscited by 38
  15. 2019Curls & Whey: Boosting Black-Box Adversarial Attackscited by 37

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 4; 2022: 7; 2023: 9; 2024: 5; 2025: 1; 2026: 1.

27 papers.

Sort:

By area:

  1. 2021Advances in adversarial attacks and defenses in computer vision: A surveycited by 127
  2. 2021Adv-Makeup: A New Imperceptible and Transferable Attack on Face Recognitioncited by 95
  3. 2022Towards Data-Free Model Stealing in a Hard Label Settingcited by 57
  4. 2022Exploring Frequency Adversarial Attacks for Face Forgery Detectioncited by 45
  5. 2022Adv-Attribute: Inconspicuous and Transferable Adversarial Attack on Face Recognitioncited by 42
  6. 2023Sibling-Attack: Rethinking Transferable Adversarial Attacks against Face Recognitioncited by 32
  7. 2021Data-Free Knowledge Transfer: A Surveycited by 31
  8. 2023Robustness of SAM: Segment Anything Under Corruptions and Beyondcited by 30
  9. 20213D High-Fidelity Mask Face Presentation Attack Detection Challengecited by 18
  10. 2022IDEAL: Query-Efficient Data-Free Learning from Black-box Modelscited by 16
  11. 2022DST: Dynamic Substitute Training for Data-free Black-box Attackcited by 7
  12. 2022Boosting the Adversarial Transferability of Surrogate Models with Dark Knowledgecited by 6
15 more
  1. 2023On the Robustness of Split Learning against Adversarial Attackscited by 6
  2. 2023Bridging the Gap between Decision and Logits in Decision-based Knowledge Distillation for Pre-trained Language Modelscited by 5
  3. 2024Fully Exploiting Every Real Sample: SuperPixel Sample Gradient Model Stealingcited by 5
  4. 2023SAME: Sample Reconstruction against Model Extraction Attackscited by 4
  5. 2023FDINet: Protecting against DNN Model Extraction via Feature Distortion Indexcited by 3
  6. 2024Improving the Transferability of Adversarial Attacks on Face Recognition with Diverse Parameters Augmentationcited by 3
  7. 2024STBA: Towards Evaluating the Robustness of DNNs for Query-Limited Black-box Scenariocited by 2
  8. 2025Examining the Threat Landscape: Foundation Models and Model Stealingcited by 2
  9. 2022SeqNet: An Efficient Neural Network for Automatic Malware Detectioncited by 1
  10. 2023Latent Code Augmentation Based on Stable Diffusion for Data-free Substitute Attackscited by 1
  11. 2023SCME: A Self-Contrastive Method for Data-free and Query-Limited Model Extraction Attackcited by 1
  12. 2023DREAM: Domain-free Reverse Engineering Attributes of Black-box Modelcited by 0
  13. 2024A Generative Approach to Surrogate-based Black-box Attackscited by 0
  14. 2024Sustainable Self-evolution Adversarial Trainingcited by 0
  15. 2026DDSA: Dual-Domain Strategic Attack for Spatial-Temporal Efficiency in Adversarial Robustness Testingcited by 0