mlsanityData to 14 Oct 2026

STBA: Towards Evaluating the Robustness of DNNs for Query-Limited Black-box Scenario

arXiv 2404.00362 ↗First posted 30 Mar 2024cs.CV eess.IVcited by 2

Not on the map. Why?

Abstract (arXiv)

Many attack techniques have been proposed to explore the vulnerability of DNNs and further help to improve their robustness. Despite the significant progress made recently, existing black-box attack methods still suffer from unsatisfactory performance due to the vast number of queries needed to optimize desired perturbations. Besides, the other critical challenge is that adversarial examples built in a noise-adding manner are abnormal and struggle to successfully attack robust models, whose robustness is enhanced by adversarial training against small perturbations. There is no doubt that these two issues mentioned above will significantly increase the risk of exposure and result in a failure to dig deeply into the vulnerability of DNNs. Hence, it is necessary to evaluate DNNs' fragility sufficiently under query-limited settings in a non-additional way. In this paper, we propose the Spatial Transform Black-box Attack (STBA), a novel framework to craft formidable adversarial examples in the query-limited scenario. Specifically, STBA introduces a flow field to the high-frequency part of clean images to generate adversarial examples and adopts the following two processes to enhance their naturalness and significantly improve the query efficiency: a) we apply an estimated flow field to the high-frequency part of clean images to generate adversarial examples instead of introducing external noise to the benign image, and b) we leverage an efficient gradient estimation method based on a batch of samples to optimize such an ideal flow field under query-limited settings. Compared to existing score-based black-box baselines, extensive experiments indicated that STBA could effectively improve the imperceptibility of the adversarial examples and remarkably boost the attack success rate under query-limited settings.

Key facts. Cited by 2 papers in the map (data through 14 Oct 2026). Builds on 51 of its 86 references that are in the map. First posted on arXiv 30 Mar 2024.

Builds on

51 of 86 references.

References · 51

  1. 2015Deep Residual Learning for Image Recognitioncited by 52,096
  2. 2014Very Deep Convolutional Networks for Large-Scale Image Recognitioncited by 15,364
  3. 2018The Unreasonable Effectiveness of Deep Features as a Perceptual Metriccited by 11,177
  4. 2016Densely Connected Convolutional Networkscited by 6,720
  5. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,415
  6. 2018MobileNetV2: Inverted Residuals and Linear Bottleneckscited by 4,795
  7. 2016Adversarial examples in the physical worldcited by 1,769
  8. 2018Glow: Generative Flow with Invertible 1x1 Convolutionscited by 1,545
  9. 2019Theoretically Principled Trade-off between Robustness and Accuracycited by 1,517
  10. 2015Spatial Transformer Networkscited by 1,429
  11. 2018ShuffleNet V2: Practical Guidelines for Efficient CNN Architecture Designcited by 1,136
  12. 2016SqueezeNet: AlexNet-level accuracy with 50x fewer parameters and <0.5MB model sizecited by 1,060
38 more
  1. 2020Image Quality Assessment: Unifying Structure and Texture Similaritycited by 811
  2. 2020Fast is better than free: Revisiting adversarial trainingcited by 727
  3. 2019Square Attack: a query-efficient black-box adversarial attack via random searchcited by 685
  4. 2017ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Modelscited by 666
  5. 2020RobustBench: a standardized adversarial robustness benchmarkcited by 661
  6. 2019Adversarial Training for Free!cited by 643
  7. 2018Black-box Adversarial Attacks with Limited Queries and Informationcited by 501
  8. 2017Decision-Based Adversarial Attacks: Reliable Attacks Against Black-Box Machine Learning Modelscited by 462
  9. 2017Mitigating Adversarial Effects Through Randomizationcited by 383
  10. 2020Do Adversarially Robust ImageNet Models Transfer Better?cited by 316
  11. 2019Simple Black-box Adversarial Attackscited by 251
  12. 2019Adversarial Attacks and Defenses in Images, Graphs and Text: A Reviewcited by 237
  13. 2018Spatially Transformed Adversarial Examplescited by 195
  14. 2019Efficient Decision-based Black-box Adversarial Attacks on Face Recognitioncited by 175
  15. 2018Prior Convictions: Black-Box Adversarial Attacks with Bandits and Priorscited by 146
  16. 2019Sign-OPT: A Query-Efficient Hard-label Adversarial Attackcited by 120
  17. 2021Robust Learning Meets Generative Models: Can Proxy Distributions Improve Adversarial Robustness?cited by 113
  18. 2022Robustness and Accuracy Could Be Reconcilable by (Proper) Definitioncited by 111
  19. 2020QEBA: Query-Efficient Boundary-Based Blackbox Attackcited by 104
  20. 2019NATTACK: Learning the Distributions of Adversarial Examples for an Improved Black-Box Attack on Deep Neural Networkscited by 94
  21. 2020Learnable Boundary Guided Adversarial Trainingcited by 93
  22. 2020Sparse-RS: a versatile framework for query-efficient sparse black-box adversarial attackscited by 65
  23. 2021AdvDrop: Adversarial Attack to DNNs by Dropping Informationcited by 56
  24. 2022Efficient and Effective Augmentation Strategy for Adversarial Trainingcited by 43
  25. 2022Query-Efficient Black-box Adversarial Attacks Guided by a Transfer-based Priorcited by 38
  26. 2020AdvFlow: Inconspicuous Black-box Adversarial Attacks using Normalizing Flowscited by 36
  27. 2019Hybrid Batch Attacks: Finding Black-box Adversarial Examples with Limited Queriescited by 33
  28. 2023Generalizable Black-Box Adversarial Attack with Meta Learningcited by 29
  29. 2021Delving into Data: Effectively Substitute Training for Black-box Attackcited by 27
  30. 2020Towards Query-Efficient Black-Box Adversary with Zeroth-Order Natural Gradient Descentcited by 18
  31. 2020Generalizing Universal Adversarial Attacks Beyond Additive Perturbationscited by 17
  32. 2019Learning Generalizable and Identity-Discriminative Representations for Face Anti-Spoofingcited by 16
  33. 2020Pasadena: Perceptually Aware and Stealthy Adversarial Denoise Attackcited by 14
  34. 2023Boosting Black-box Attack to Deep Neural Networks with Conditional Diffusion Modelscited by 12
  35. 2023Adversarial Attacks on Video Object Segmentation with Hard Region Discoverycited by 9
  36. 2021Imperceptible Adversarial Examples by Spatial Chroma-Shiftcited by 7
  37. 2017Query-limited Black-box Attacks to Classifierscited by 4
  38. 2023AFLOW: Developing Adversarial Examples under Extremely Noise-limited Settingscited by 4

50 most cited of 51 All 51 (JSON)

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2026: 2.

2 papers.

  1. 2026PWAVEP: Purifying Imperceptible Adversarial Perturbations in 3D Point Clouds via Spectral Graph Waveletscited by 0
  2. 2026CAAP: Capture-Aware Adversarial Patch Attacks on Palmprint Recognition Modelscited by 0