# Raze to the Ground: Query-Efficient Adversarial HTML Attacks on Machine-Learning Phishing Webpage Detectors

arXiv: https://arxiv.org/abs/2310.03166 · HTML: https://mlsanity.com/paper/2310.03166/

## Key facts

- Cited by 3 papers in the map (data through 14 Oct 2026).
- Builds on 16 of its 51 references that are in the map.
- First posted on arXiv 4 Oct 2023.

## Builds on (most cited first, 16 of 16)

- [Towards Deep Learning Models Resistant to Adversarial Attacks](https://mlsanity.com/paper/1706.06083/) (2017)
- [Transferability in Machine Learning: from Phenomena to Black-Box Attacks using Adversarial Samples](https://mlsanity.com/paper/1605.07277/) (2016)
- [Wild Patterns: Ten Years After the Rise of Adversarial Machine Learning](https://mlsanity.com/paper/1712.03141/) (2017)
- [Improving Black-box Adversarial Attacks with a Transfer-based Prior](https://mlsanity.com/paper/1906.06919/) (2019)
- [Towards Transferable Adversarial Attack against Deep Face Recognition](https://mlsanity.com/paper/2004.05790/) (2020)
- [Functionality-preserving Black-box Optimization of Adversarial Windows Malware](https://mlsanity.com/paper/2003.13526/) (2020)
- [Efficient Adversarial Training with Transferable Adversarial Examples](https://mlsanity.com/paper/1912.11969/) (2019)
- [Yes, Machine Learning Can Be More Secure! A Case Study on Android Malware Detection](https://mlsanity.com/paper/1704.08996/) (2017)
- [Certified Training: Small Boxes are All You Need](https://mlsanity.com/paper/2210.04871/) (2022)
- [Advanced Evasion Attacks and Mitigations on Practical ML-Based Phishing Website Classifiers](https://mlsanity.com/paper/2004.06954/) (2020)
- [Towards Benchmark Datasets for Machine Learning Based Website Phishing Detection: An experimental study](https://mlsanity.com/paper/2010.12847/) (2020)
- [DeltaPhish: Detecting Phishing Webpages in Compromised Websites](https://mlsanity.com/paper/1707.00317/) (2017)
- [Feature Importance Guided Attack: A Model Agnostic Adversarial Attack](https://mlsanity.com/paper/2106.14815/) (2021)
- [Multi-SpacePhish: Extending the Evasion-space of Adversarial Attacks against Phishing Website Detectors using Machine Learning](https://mlsanity.com/paper/2210.13660/) (2022)
- [WAF-A-MoLE: Evading Web Application Firewalls through Adversarial Machine Learning](https://mlsanity.com/paper/2001.01952/) (2020)
- [A Large Scale Study and Classification of VirusTotal Reports on Phishing and Malware URLs](https://mlsanity.com/paper/2205.13155/) (2022)

## Built on by (most cited first, 3 of 3)

- [PhishLang: A Real-Time, Fully Client-Side Phishing Detection Framework Using MobileBERT](https://mlsanity.com/paper/2408.05667/) (2024)
- [Decoding Latent Attack Surfaces in LLMs: Prompt Injection via HTML in Web Summarization](https://mlsanity.com/paper/2509.05831/) (2025)
- [One Detector Fits All: Robust and Adaptive Detection of Malicious Packages from PyPI to Enterprises](https://mlsanity.com/paper/2512.04338/) (2025)

## Abstract (arXiv)

Machine-learning phishing webpage detectors (ML-PWD) have been shown to suffer from adversarial manipulations of the HTML code of the input webpage. Nevertheless, the attacks recently proposed have demonstrated limited effectiveness due to their lack of optimizing the usage of the adopted manipulations, and they focus solely on specific elements of the HTML code. In this work, we overcome these limitations by first designing a novel set of fine-grained manipulations which allow to modify the HTML code of the input phishing webpage without compromising its maliciousness and visual appearance, i.e., the manipulations are functionality- and rendering-preserving by design. We then select which manipulations should be applied to bypass the target detector by a query-efficient black-box optimization algorithm. Our experiments show that our attacks are able to raze to the ground the performance of current state-of-the-art ML-PWD using just 30 queries, thus overcoming the weaker attacks developed in previous work, and enabling a much fairer robustness evaluation of ML-PWD.