mlsanityData to 14 Oct 2026

Evading Black-box Classifiers Without Breaking Eggs

arXiv 2306.02895 ↗First posted 5 Jun 2023cs.CR cs.LG stat.MLcited by 13

Not on the map. Why?

Abstract (arXiv)

Decision-based evasion attacks repeatedly query a black-box classifier to generate adversarial examples. Prior work measures the cost of such attacks by the total number of queries made to the classifier. We argue this metric is flawed. Most security-critical machine learning systems aim to weed out "bad" data (e.g., malware, harmful content, etc). Queries to such systems carry a fundamentally asymmetric cost: queries detected as "bad" come at a higher cost because they trigger additional security filters, e.g., usage throttling or account suspension. Yet, we find that existing decision-based attacks issue a large number of "bad" queries, which likely renders them ineffective against security-critical systems. We then design new attacks that reduce the number of bad queries by 1.5-7.3×, but often at a significant increase in total (non-bad) queries. We thus pose it as an open problem to build black-box attacks that are more effective under realistic cost metrics.

Key facts. Cited by 13 papers in the map (data through 14 Oct 2026). Builds on 27 of its 42 references that are in the map. First posted on arXiv 5 Jun 2023.

Builds on

27 of 42 references.

References · 27

  1. 2015Deep Residual Learning for Image Recognitioncited by 52,096
  2. 2014Adam: A Method for Stochastic Optimizationcited by 37,240
  3. 2021Learning Transferable Visual Models From Natural Language Supervisioncited by 33,744
  4. 2019PyTorch: An Imperative Style, High-Performance Deep Learning Librarycited by 20,305
  5. 2013Intriguing properties of neural networkscited by 5,155
  6. 2022LAION-5B: An open large-scale dataset for training next generation image-text modelscited by 4,152
  7. 2017Evasion Attacks against Machine Learning at Test Timecited by 689
  8. 2017ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Modelscited by 666
  9. 2020On Adaptive Attacks to Adversarial Example Defensescited by 555
  10. 2017Decision-Based Adversarial Attacks: Reliable Attacks Against Black-Box Machine Learning Modelscited by 462
  11. 2016Transferability in Machine Learning: from Phenomena to Black-Box Attacks using Adversarial Samplescited by 446
  12. 2019HopSkipJumpAttack: A Query-Efficient Decision-Based Attackcited by 333
15 more
  1. 2018Query-Efficient Hard-label Black-box Attack:An Optimization-based Approachcited by 130
  2. 2019Sign-OPT: A Query-Efficient Hard-label Adversarial Attackcited by 120
  3. 2018Zeroth-Order Stochastic Variance Reduction for Nonconvex Optimizationcited by 111
  4. 2020QEBA: Query-Efficient Boundary-Based Blackbox Attackcited by 104
  5. 2020RayS: A Ray Searching Method for Hard-label Adversarial Attackcited by 96
  6. 2018Motivating the Rules of the Game for Adversarial Example Researchcited by 57
  7. 2019Stateful Detection of Black-Box Adversarial Attackscited by 56
  8. 2022"Real Attackers Don't Compute Gradients": Bridging the Gap Between Adversarial ML Research and Practicecited by 56
  9. 2018Guessing Smart: Biased Sampling for Efficient Black-Box Adversarial Attackscited by 46
  10. 2020Blacklight: Scalable Defense for Neural Networks against Query-Based Black-Box Attackscited by 37
  11. 2021Black-box Adversarial Attacks on Commercial Speech Platforms with Minimal Informationcited by 25
  12. 2018AdVersarial: Perceptual Ad Blocking meets Adversarial Machine Learningcited by 14
  13. 2019Adversarial attacks on Copyright Detection Systemscited by 11
  14. 2019Safe non-smooth black-box optimization with application to policy searchcited by 6
  15. 2022Preprocessors Matter! Realistic Decision-Based Attacks on Machine Learning Systemscited by 5

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2023: 4; 2024: 4; 2025: 3; 2026: 2.

13 papers.

Sort:

By area:

  1. 2024SoK: Blockchain-Based Decentralized AI (DeAI)cited by 6
  2. 2023The Adaptive Arms Race: Redefining Robustness in AI Securitycited by 5
  3. 2023Turn Fake into Real: Adversarial Head Turn Attacks Against Deepfake Detectioncited by 3
  4. 2024Towards Non-Adversarial Algorithmic Recoursecited by 2
  5. 2023Constrained Adaptive Attacks: Realistic Evaluation of Adversarial Examples and Robust Training of Deep Neural Networks for Tabular Datacited by 1
  6. 2024Taking off the Rose-Tinted Glasses: A Critical Look at Adversarial ML Through the Lens of Evasion Attackscited by 1
  7. 2025Understanding Adversarial Transfer: Why Representation-Space Attacks Fail Where Data-Space Attacks Succeedcited by 1
  8. 2023SEA: Shareable and Explainable Attribution for Query-based Black-box Attackscited by 0
  9. 2024TA3: Testing Against Adversarial Attacks on Machine Learning Modelscited by 0
  10. 2025FRAUD-RLA: A new reinforcement learning adversarial attack against credit card fraud detectioncited by 0
  11. 2025Rewriting the Budget: A General Framework for Black-Box Attacks Under Cost Asymmetrycited by 0
  12. 2026Almost for Free: Crafting Adversarial Examples with Convolutional Image Filterscited by 0
1 more
  1. 2026REPLICANT: Learning Policies for Evading and Hardening Malware Detectorscited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2023Pick your Poison: Undetectability versus Robustness in Data Poisoning Attacks
  2. 2021Black-Box Attacks on Sequential Recommenders via Data-Free Model Extraction
  3. 2021Excess Capacity and Backdoor Poisoning
  4. 2022Not All Poisons are Created Equal: Robust Training against Data Poisoning
  5. 2026All you need to break LLMs are Black-Box, Adapting, Efficient, Transferable, Harmful, Applicable ... Attacks
  6. 2021Black-box Detection of Backdoor Attacks with Limited Information and Data
  7. 2023Defending Against Backdoor Attacks by Layer-wise Feature Analysis
  8. 2026Discard the Dross and Select the Essential: Pre-query Sample Selection for Black-box Membership Inference Attacks