RobustBlack: Challenging Black-Box Adversarial Attacks on State-of-the-Art Defenses
Not on the map. Why?
Abstract (arXiv)
Although adversarial robustness has been extensively studied in white-box settings, recent advances in black-box attacks (including transfer- and query-based approaches) are primarily benchmarked against weak defenses, leaving a significant gap in the evaluation of their effectiveness against more recent and moderate robust models (e.g., those featured in the Robustbench leaderboard). In this paper, we question this lack of attention from black-box attacks to robust models. We establish a framework to evaluate the effectiveness of recent black-box attacks against both top-performing and standard defense mechanisms, on the ImageNet dataset. Our empirical evaluation reveals the following key findings: (1) the most advanced black-box attacks struggle to succeed even against simple adversarially trained models; (2) robust models that are optimized to withstand strong white-box attacks, such as AutoAttack, also exhibits enhanced resilience against black-box attacks; and (3) robustness alignment between the surrogate models and the target model plays a key factor in the success rate of transfer-based attacks
Key facts. Cited by 2 papers in the map (data through 7 Oct 2026). Builds on 71 of its 91 references that are in the map. First posted on arXiv 30 Dec 2024.
Builds on
71 of 91 references.
References · 71
- 2015Deep Residual Learning for Image Recognitioncited by 51,809
- 2021Learning Transferable Visual Models From Natural Language Supervisioncited by 33,456
- 2020An Image is Worth 16x16 Words: Transformers for Image Recognition at Scalecited by 29,915
- 2014Very Deep Convolutional Networks for Large-Scale Image Recognitioncited by 15,267
- 2023LLaMA: Open and Efficient Foundation Language Modelscited by 13,958
- 2021Swin Transformer: Hierarchical Vision Transformer using Shifted Windowscited by 12,082
- 2014Explaining and Harnessing Adversarial Examplescited by 7,287
- 2016Densely Connected Convolutional Networkscited by 6,691
- 2019EfficientNet: Rethinking Model Scaling for Convolutional Neural Networkscited by 6,415
- 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
- 2017Fashion-MNIST: a Novel Image Dataset for Benchmarking Machine Learning Algorithmscited by 4,283
- 2014Going Deeper with Convolutionscited by 4,231
38 more
- 2022A ConvNet for the 2020scited by 3,545
- 2016Wide Residual Networkscited by 3,057
- 2016Aggregated Residual Transformations for Deep Neural Networkscited by 2,540
- 2016Adversarial examples in the physical worldcited by 1,762
- 2019Theoretically Principled Trade-off between Robustness and Accuracycited by 1,510
- 2020Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attackscited by 1,442
- 2016SqueezeNet: AlexNet-level accuracy with 50x fewer parameters and <0.5MB model sizecited by 1,054
- 2020Designing Network Design Spacescited by 954
- 2019Adversarial Examples Are Not Bugs, They Are Featurescited by 950
- 2018MnasNet: Platform-Aware Neural Architecture Search for Mobilecited by 937
- 2016Practical Black-Box Attacks against Machine Learningcited by 893
- 2016Universal adversarial perturbationscited by 774
- 2019Square Attack: a query-efficient black-box adversarial attack via random searchcited by 682
- 2020RobustBench: a standardized adversarial robustness benchmarkcited by 659
- 2017ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Modelscited by 656
- 2018Improving Transferability of Adversarial Examples with Input Diversitycited by 591
- 2016Delving into Transferable Adversarial Examples and Black-box Attackscited by 530
- 2017Countering Adversarial Images using Input Transformationscited by 517
- 2018Black-box Adversarial Attacks with Limited Queries and Informationcited by 499
- 2017Decision-Based Adversarial Attacks: Reliable Attacks Against Black-Box Machine Learning Modelscited by 459
- 2019Evading Defenses to Transferable Adversarial Examples by Translation-Invariant Attackscited by 440
- 2021Early Convolutions Help Transformers See Bettercited by 395
- 2019Minimally distorted Adversarial Examples with a Fast Adaptive Boundary Attackcited by 333
- 2019HopSkipJumpAttack: A Query-Efficient Decision-Based Attackcited by 328
- 2020Do Adversarially Robust ImageNet Models Transfer Better?cited by 315
- 2019Simple Black-box Adversarial Attackscited by 249
- 2020Attacks Which Do Not Kill Training Make Adversarial Learning Strongercited by 242
- 2021Enhancing the Transferability of Adversarial Attacks through Variance Tuningcited by 242
- 2023Better Diffusion Models Further Improve Adversarial Trainingcited by 207
- 2021On the Robustness of Vision Transformers to Adversarial Examplescited by 167
- 2020Skip Connections Matter: On the Transferability of Adversarial Examples Generated with ResNetscited by 165
- 2017The Space of Transferable Adversarial Examplescited by 156
- 2020Torchattacks: A PyTorch Repository for Adversarial Attackscited by 156
- 2021Admix: Enhancing the Transferability of Adversarial Attackscited by 155
- 2019Sign-OPT: A Query-Efficient Hard-label Adversarial Attackcited by 118
- 2020RayS: A Ray Searching Method for Hard-label Adversarial Attackcited by 94
- 2023A Comprehensive Study on Robustness of Image Classification Models: Benchmarking and Rethinkingcited by 85
- 2023Revisiting Adversarial Training for ImageNet: Architectures, Training and Generalization across Threat Modelscited by 79
50 most cited of 71 All 71 (JSON)
Built on by
Citing papers per year: 2025: 2.
2 papers.