mlsanityData to 7 Oct 2026

Back in Black: A Comparative Evaluation of Recent State-Of-The-Art Black-Box Attacks

arXiv 2109.15031 ↗First posted 29 Sep 2021cs.CR cs.LGcited by 16

Not on the map. Why?

Abstract (arXiv)

The field of adversarial machine learning has experienced a near exponential growth in the amount of papers being produced since 2018. This massive information output has yet to be properly processed and categorized. In this paper, we seek to help alleviate this problem by systematizing the recent advances in adversarial machine learning black-box attacks since 2019. Our survey summarizes and categorizes 20 recent black-box attacks. We also present a new analysis for understanding the attack success rate with respect to the adversarial model used in each paper. Overall, our paper surveys a wide body of literature to highlight recent attack developments and organizes them into four attack categories: score based attacks, decision based attacks, transfer attacks and non-traditional attacks. Further, we provide a new mathematical framework to show exactly how attack results can fairly be compared.

Key facts. Cited by 16 papers in the map (data through 7 Oct 2026). Builds on 43 of its 58 references that are in the map. First posted on arXiv 29 Sep 2021.

Builds on

43 of 58 references.

References · 43

  1. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  2. 2017Mask R-CNNcited by 7,259
  3. 2016Grad-CAM: Visual Explanations from Deep Networks via Gradient-based Localizationcited by 6,690
  4. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  5. 2013Intriguing properties of neural networkscited by 5,114
  6. 2015You Only Look Once: Unified, Real-Time Object Detectioncited by 4,829
  7. 2016Towards Evaluating the Robustness of Neural Networkscited by 2,976
  8. 2020Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attackscited by 1,442
  9. 2018Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examplescited by 1,259
  10. 2016Colorful Image Colorizationcited by 1,113
  11. 2016Practical Black-Box Attacks against Machine Learningcited by 893
  12. 2019Big Transfer (BiT): General Visual Representation Learningcited by 766
31 more
  1. 2019Square Attack: a query-efficient black-box adversarial attack via random searchcited by 682
  2. 2017ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Modelscited by 656
  3. 2018Black-box Adversarial Attacks with Limited Queries and Informationcited by 499
  4. 2017Decision-Based Adversarial Attacks: Reliable Attacks Against Black-Box Machine Learning Modelscited by 459
  5. 2016Transferability in Machine Learning: from Phenomena to Black-Box Attacks using Adversarial Samplescited by 439
  6. 2014Deep metric learning using Triplet networkcited by 421
  7. 2017Wild Patterns: Ten Years After the Rise of Adversarial Machine Learningcited by 411
  8. 2019HopSkipJumpAttack: A Query-Efficient Decision-Based Attackcited by 328
  9. 2017EAD: Elastic-Net Attacks to Deep Neural Networks via Adversarial Examplescited by 154
  10. 2019Improving Black-box Adversarial Attacks with a Transfer-based Priorcited by 121
  11. 2020QEBA: Query-Efficient Boundary-Based Blackbox Attackcited by 103
  12. 2019Sparse and Imperceivable Adversarial Attackscited by 95
  13. 2020RayS: A Ray Searching Method for Hard-label Adversarial Attackcited by 94
  14. 2019ColorFool: Semantic Adversarial Colorizationcited by 89
  15. 2016Robustness of classifiers: from adversarial to random noisecited by 87
  16. 2020PatchAttack: A Black-box Texture-based Attack with Reinforcement Learningcited by 67
  17. 2020GeoDA: a geometric framework for black-box adversarial attackscited by 66
  18. 2020DaST: Data-free Substitute Training for Adversarial Attackscited by 60
  19. 2020SurFree: a fast surrogate-free black-box attackcited by 59
  20. 2020Adversarial Machine Learning in Image Classification: A Survey Towards the Defender's Perspectivecited by 58
  21. 2019Black-Box Adversarial Attack with Transferable Model-based Embeddingcited by 57
  22. 2021Adversarial Example Detection for DNN Models: A Review and Experimental Comparisoncited by 51
  23. 2019A Survey of Black-Box Adversarial Attacks on Computer Vision Modelscited by 36
  24. 2019Query-efficient Meta Attack to Deep Neural Networkscited by 33
  25. 2019A geometry-inspired decision-based attackcited by 22
  26. 2019On the Design of Black-box Adversarial Examples by Leveraging Gradient-free Optimization and Operator Splitting Methodcited by 21
  27. 2020Projection & Probability-Driven Black-Box Attackcited by 19
  28. 2020Towards Query-Efficient Black-Box Adversary with Zeroth-Order Natural Gradient Descentcited by 18
  29. 2020Beware the Black-Box: on the Robustness of Recent Defenses to Adversarial Examplescited by 11
  30. 2021Nonlinear Projection Based Gradient Estimation for Query Efficient Blackbox Attackscited by 9
  31. 2019BUZz: BUffer Zones for defending adversarial examples in image classificationcited by 2

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 1; 2022: 1; 2023: 4; 2024: 6; 2025: 3; 2026: 1.

16 papers.

Sort:

By area:

  1. 2024SleeperNets: Universal Backdoor Poisoning Attacks Against Reinforcement Learning Agentscited by 19
  2. 2023Towards more Practical Threat Models in Artificial Intelligence Securitycited by 17
  3. 2022Algorithmic audits of algorithms, and the lawcited by 9
  4. 2023SoK: Pitfalls in Evaluating Black-Box Attackscited by 6
  5. 2023On the Robustness of AlphaFold: A COVID-19 Case Studycited by 2
  6. 2024Steal Now and Attack Later: Evaluating Robustness of Object Detection against Black-box Adversarial Attackscited by 2
  7. 2023Attacking All Tasks at Once Using Adversarial Examples in Multi-Task Learningcited by 1
  8. 2025On the Adversarial Vulnerabilities of Transfer Learning in Remote Sensingcited by 1
  9. 2025Consensus-based optimization for closed-box adversarial attacks and a connection to evolution strategiescited by 1
  10. 2021Multi-Trigger-Key: Towards Multi-Task Privacy Preserving In Deep Learningcited by 0
  11. 2024Counter-Samples: A Stateless Strategy to Neutralize Black Box Adversarial Attackscited by 0
  12. 2024Constructing Adversarial Examples for Vertical Federated Learning: Optimal Client Corruption through Multi-Armed Banditcited by 0
4 more
  1. 2024Discerning the Chaos: Detecting Adversarial Perturbations while Disentangling Intentional from Unintentional Noisescited by 0
  2. 2024Addressing Key Challenges of Adversarial Attacks and Defenses in the Tabular Domain: A Methodological Framework for Coherence and Consistencycited by 0
  3. 2025COBRA: Catastrophic Bit-flip Reliability Analysis of State-Space Modelscited by 0
  4. 2026QShield: Securing Neural Networks Against Adversarial Attacks using Quantum Circuitscited by 0