mlsanityData to 7 Oct 2026

A Strong Baseline for Query Efficient Attacks in a Black Box Setting

arXiv 2109.04775 ↗First posted 10 Sep 2021cs.CLcited by 16

Not on the map. Why?

Abstract (arXiv)

Existing black box search methods have achieved high success rate in generating adversarial attacks against NLP models. However, such search methods are inefficient as they do not consider the amount of queries required to generate adversarial attacks. Also, prior attacks do not maintain a consistent search space while comparing different search methods. In this paper, we propose a query efficient attack strategy to generate plausible adversarial examples on text classification and entailment tasks. Our attack jointly leverages attention mechanism and locality sensitive hashing (LSH) to reduce the query count. We demonstrate the efficacy of our approach by comparing our attack with four baselines across three different search spaces. Further, we benchmark our results across the same search space used in prior attacks. In comparison to attacks proposed, on an average, we are able to reduce the query count by 75% across all datasets and target models. We also demonstrate that our attack achieves a higher success rate when compared to prior attacks in a limited query setting.

Key facts. Cited by 16 papers in the map (data through 7 Oct 2026). Builds on 22 of its 41 references that are in the map. First posted on arXiv 10 Sep 2021.

Builds on

22 of 41 references.

References · 22

  1. 2018BERT: Pre-training of Deep Bidirectional Transformers for Language Understandingcited by 40,204
  2. 2013Intriguing properties of neural networkscited by 5,114
  3. 2017A Broad-Coverage Challenge Corpus for Sentence Understanding through Inferencecited by 2,665
  4. 2015Character-level Convolutional Networks for Text Classificationcited by 2,293
  5. 2015A large annotated corpus for learning natural language inferencecited by 1,837
  6. 2020Reformer: The Efficient Transformercited by 1,658
  7. 2016Practical Black-Box Attacks against Machine Learningcited by 893
  8. 2019Universal Adversarial Triggers for Attacking and Analyzing NLPcited by 709
  9. 2020BERT-ATTACK: Adversarial Attack Against BERT Using BERTcited by 488
  10. 2018Universal Sentence Encodercited by 485
  11. 2018Generating Natural Language Adversarial Examplescited by 422
  12. 2018TextBugger: Generating Adversarial Text Against Real-world Applicationscited by 376
10 more
  1. 2020BAE: BERT-based Adversarial Examples for Text Classificationcited by 316
  2. 2016A Decomposable Attention Model for Natural Language Inferencecited by 214
  3. 2019Probing Neural Network Comprehension of Natural Language Argumentscited by 212
  4. 2016Counter-fitting Word Vectors to Linguistic Constraintscited by 138
  5. 2020Contextualized Perturbation for Textual Adversarial Attackcited by 136
  6. 2017Deep Text Classification Can be Fooledcited by 105
  7. 2020Generating Natural Language Attacks in a Hard Label Black Box Settingcited by 50
  8. 2019Word-level Textual Adversarial Attacking as Combinatorial Optimizationcited by 37
  9. 2020Searching for a Search Method: Benchmarking Search Algorithms for Generating NLP Adversarial Examplescited by 23
  10. 2020A Context Aware Approach for Generating Natural Language Attackscited by 5

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2022: 4; 2023: 2; 2024: 4; 2025: 4; 2026: 2.

16 papers.

Sort:

By area:

  1. 2022Query-Efficient and Scalable Black-Box Adversarial Attacks on Discrete Sequential Data via Bayesian Optimizationcited by 22
  2. 2024HQA-Attack: Toward High Quality Black-Box Hard-Label Adversarial Attack on Textcited by 16
  3. 2022Practice Makes a Solver Perfect: Data Augmentation for Math Word Problem Solverscited by 9
  4. 2022Rethinking Textual Adversarial Defense for Pre-trained Language Modelscited by 5
  5. 2023Masked Language Model Based Textual Adversarial Example Detectioncited by 5
  6. 2022Are Synonym Substitution Attacks Really Synonym Substitution Attacks?cited by 4
  7. 2023A Black-Box Attack on Code Models via Representation Nearest Neighbor Searchcited by 3
  8. 2025CAMOUFLAGE: Exploiting Misinformation Detection Systems Through LLM-driven Adversarial Claim Transformationcited by 3
  9. 2025Adversarial Defence without Adversarial Defence: Enhancing Language Model Robustness via Instance-level Principal Component Removalcited by 2
  10. 2024Exploiting Class Probabilities for Black-box Sentence-level Attackscited by 1
  11. 2024Assessing biomedical knowledge robustness in large language models by query-efficient sampling attackscited by 1
  12. 2025Multi-task Adversarial Attacks against Black-box Model with Few-shot Queriescited by 1
4 more
  1. 2024GenFighter: A Generative and Evolutive Textual Attack Removalcited by 0
  2. 2025Robustness of Misinformation Classification Systems to Adversarial Examples Through BeamAttackcited by 0
  3. 2026Agentic Adversarial Rewriting Exposes Architectural Vulnerabilities in Black-Box NLP Pipelinescited by 0
  4. 2026LBA: Textual Hard-Label Adversarial Attack under Low Query Budgetscited by 0