mlsanityData to 14 Oct 2026

BruSLeAttack: A Query-Efficient Score-Based Black-Box Sparse Adversarial Attack

arXiv 2404.05311 ↗First posted 8 Apr 2024cs.LG cs.CRcited by 8

Not on the map. Why?

Abstract (arXiv)

We study the unique, less-well understood problem of generating sparse adversarial samples simply by observing the score-based replies to model queries. Sparse attacks aim to discover a minimum number-the l0 bounded-perturbations to model inputs to craft adversarial examples and misguide model decisions. But, in contrast to query-based dense attack counterparts against black-box models, constructing sparse adversarial perturbations, even when models serve confidence score information to queries in a score-based setting, is non-trivial. Because, such an attack leads to i) an NP-hard problem; and ii) a non-differentiable search space. We develop the BruSLeAttack-a new, faster (more query-efficient) Bayesian algorithm for the problem. We conduct extensive attack evaluations including an attack demonstration against a Machine Learning as a Service (MLaaS) offering exemplified by Google Cloud Vision and robustness testing of adversarial training regimes and a recent defense against black-box attacks. The proposed attack scales to achieve state-of-the-art attack success rates and query efficiency on standard computer vision tasks such as ImageNet across different model architectures. Our artefacts and DIY attack samples are available on GitHub. Importantly, our work facilitates faster evaluation of model vulnerabilities and raises our vigilance on the safety, security and reliability of deployed systems.

Key facts. Cited by 8 papers in the map (data through 14 Oct 2026). Builds on 39 of its 68 references that are in the map. First posted on arXiv 8 Apr 2024.

Builds on

39 of 68 references.

References · 39

  1. 2015Deep Residual Learning for Image Recognitioncited by 52,096
  2. 2020An Image is Worth 16x16 Words: Transformers for Image Recognition at Scalecited by 30,186
  3. 2014Explaining and Harnessing Adversarial Examplescited by 7,364
  4. 2016Grad-CAM: Visual Explanations from Deep Networks via Gradient-based Localizationcited by 6,733
  5. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,415
  6. 2013Intriguing properties of neural networkscited by 5,155
  7. 2016Towards Evaluating the Robustness of Neural Networkscited by 2,998
  8. 2018ImageNet-trained CNNs are biased towards texture; increasing shape bias improves accuracy and robustnesscited by 1,432
  9. 2018Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examplescited by 1,268
  10. 2015The Limitations of Deep Learning in Adversarial Settingscited by 790
  11. 2019Square Attack: a query-efficient black-box adversarial attack via random searchcited by 685
  12. 2017ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Modelscited by 666
27 more
  1. 2020RobustBench: a standardized adversarial robustness benchmarkcited by 661
  2. 2017One pixel attack for fooling deep neural networkscited by 582
  3. 2018Black-box Adversarial Attacks with Limited Queries and Informationcited by 501
  4. 2021Intriguing Properties of Vision Transformerscited by 446
  5. 2019HopSkipJumpAttack: A Query-Efficient Decision-Based Attackcited by 333
  6. 2019Simple Black-box Adversarial Attackscited by 251
  7. 2018Prior Convictions: Black-Box Adversarial Attacks with Bandits and Priorscited by 146
  8. 2018AutoZOOM: Autoencoder-based Zeroth Order Optimization Method for Attacking Black-box Neural Networkscited by 137
  9. 2018Towards the first adversarially robust neural network model on MNISTcited by 104
  10. 2020QEBA: Query-Efficient Boundary-Based Blackbox Attackcited by 104
  11. 2019Sparse and Imperceivable Adversarial Attackscited by 95
  12. 2018SparseFool: a few pixels make a big differencecited by 94
  13. 2019Wasserstein Adversarial Examples via Projected Sinkhorn Iterationscited by 89
  14. 2021Black-box Detection of Backdoor Attacks with Limited Information and Datacited by 73
  15. 2020Sparse-RS: a versatile framework for query-efficient sparse black-box adversarial attackscited by 65
  16. 2021Think Global and Act Local: Bayesian Optimisation over High-Dimensional Categorical and Mixed Search Spacescited by 53
  17. 2021Mind the box: l1-APGD for sparse adversarial attacks on image classifierscited by 51
  18. 2021Random Noise Defense Against Query-Based Black-Box Attackscited by 47
  19. 2018Guessing Smart: Biased Sampling for Efficient Black-Box Adversarial Attackscited by 46
  20. 2020GreedyFool: Distortion-Aware Sparse Adversarial Attackcited by 37
  21. 2016Infinite Variational Autoencoder for Semi-Supervised Learningcited by 23
  22. 2019On the Design of Black-box Adversarial Examples by Leveraging Gradient-free Optimization and Operator Splitting Methodcited by 21
  23. 2020Simple and Efficient Hard Label Black-box Adversarial Attacks in Low Query Budget Regimescited by 17
  24. 2021Sparse and Imperceptible Adversarial Attack via a Homotopy Algorithmcited by 15
  25. 2022Query Efficient Decision Based Sparse Attacks Against Black-Box Deep Learning Modelscited by 13
  26. 2020Towards Feature Space Adversarial Attackcited by 11
  27. 2021RamBoAttack: A Robust Query Efficient Deep Neural Network Decision Exploitcited by 11

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2024: 3; 2025: 2; 2026: 3.

8 papers.

  1. 2024Transferable Adversarial Attacks on SAM and Its Downstream Modelscited by 21
  2. 2025Query-Based and Unnoticeable Graph Injection Attack from Neighborhood Perspectivecited by 3
  3. 2024Model Mimic Attack: Knowledge Distillation for Provably Transferable Adversarial Examplescited by 2
  4. 2024Take Fake as Real: Realistic-like Robust Black-box Adversarial Attack to Evade AIGC Detectioncited by 2
  5. 2025Towards Interpretable Adversarial Examples via Sparse Adversarial Attackcited by 1
  6. 2026Random Logit Scaling: Defending Deep Neural Networks Against Black-Box Score-Based Adversarial Example Attackscited by 1
  7. 2026TIGA: Trajectory-Injected Generative Attack against Black-box AIGC Detectorscited by 0
  8. 2026Mitigating Black-Box Score-Based Query Attacks via Gradient Confusioncited by 0