Consensus-based optimization for closed-box adversarial attacks and a connection to evolution strategies
Not on the map. Why?
Abstract (arXiv)
Consensus-based optimization (CBO) has established itself as an efficient gradient-free optimization scheme, with attractive mathematical properties, such as mean-field convergence results for non-convex loss functions. In this work, we study CBO in the context of closed-box adversarial attacks, which are imperceptible input perturbations that aim to fool a classifier, without accessing its gradient. Our contribution is to establish a connection between the so-called consensus hopping as introduced by Riedl et al. and natural evolution strategies (NES) commonly applied in the context of adversarial attacks and to rigorously relate both methods to gradient-based optimization schemes. Beyond that, we provide a comprehensive experimental study that shows that despite the conceptual similarities, CBO can outperform NES and other evolutionary strategies in certain scenarios.
Key facts. Cited by 2 papers in the map (data through 14 Oct 2026). Builds on 77 of its 113 references that are in the map. First posted on arXiv 30 Jun 2025.
Builds on
77 of 113 references.
References · 77
- 2014Adam: A Method for Stochastic Optimizationcited by 37,240
- 2019PyTorch: An Imperative Style, High-Performance Deep Learning Librarycited by 20,305
- 2014Very Deep Convolutional Networks for Large-Scale Image Recognitioncited by 15,364
- 2014Explaining and Harnessing Adversarial Examplescited by 7,364
- 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,415
- 2015Rethinking the Inception Architecture for Computer Visioncited by 5,475
- 2013Intriguing properties of neural networkscited by 5,155
- 2015Delving Deep into Rectifiers: Surpassing Human-Level Performance on ImageNet Classificationcited by 3,611
- 2016Towards Evaluating the Robustness of Neural Networkscited by 2,998
- 2017Visualizing the Loss Landscape of Neural Netscited by 1,130
- 2016Practical Black-Box Attacks against Machine Learningcited by 903
- 2019Square Attack: a query-efficient black-box adversarial attack via random searchcited by 685
38 more
- 2017ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Modelscited by 666
- 2017One pixel attack for fooling deep neural networkscited by 582
- 2017Evolution Strategies as a Scalable Alternative to Reinforcement Learningcited by 574
- 2016Stein Variational Gradient Descent: A General Purpose Bayesian Inference Algorithmcited by 507
- 2018Black-box Adversarial Attacks with Limited Queries and Informationcited by 501
- 2014One weird trick for parallelizing convolutional neural networkscited by 264
- 2018Generating Adversarial Examples with Adversarial Networkscited by 258
- 2019Simple Black-box Adversarial Attackscited by 251
- 2018Sorting out Lipschitz function approximationcited by 213
- 2018Prior Convictions: Black-Box Adversarial Attacks with Bandits and Priorscited by 146
- 2019NATTACK: Learning the Distributions of Adversarial Examples for an Improved Black-Box Attack on Deep Neural Networkscited by 94
- 2024Soft Prompt Threats: Attacking Safety Alignment and Unlearning in Open-Source LLMs through the Embedding Spacecited by 91
- 2021Training Certifiably Robust Neural Networks with Efficient Local Lipschitz Boundscited by 65
- 2022Rethinking Lipschitz Neural Networks and Certified Robustness: A Boolean Function Perspectivecited by 51
- 2019Parsimonious Black-Box Adversarial Attacks via Efficient Combinatorial Optimizationcited by 49
- 2019A Survey of Black-Box Adversarial Attacks on Computer Vision Modelscited by 37
- 2022On Almost Sure Convergence Rates of Stochastic Gradient Methodscited by 35
- 2021CLIP: Cheap Lipschitz Training of Neural Networkscited by 29
- 2021On the Existence of the Adversarial Bayes Classifier (Extended Version)cited by 25
- 2019A consensus-based global optimization method for high dimensional machine learning problemscited by 23
- 2016A consensus-based model for global optimization and its mean-field limitcited by 21
- 2022The Multimarginal Optimal Transport Formulation of Adversarial Multiclass Classificationcited by 21
- 2023Certified Robustness via Dynamic Margin Maximization and Improved Lipschitz Regularizationcited by 21
- 2023BlackboxBench: A Comprehensive Benchmark of Black-box Adversarial Attackscited by 21
- 2020Towards Query-Efficient Black-Box Adversary with Zeroth-Order Natural Gradient Descentcited by 18
- 2019Yet another but more efficient black-box adversarial attack: tiling and evolution strategiescited by 17
- 2020Simple and Efficient Hard Label Black-box Adversarial Attacks in Low Query Budget Regimescited by 17
- 2021Consensus-Based Optimization Methods Converge Globallycited by 16
- 2021Back in Black: A Comparative Evaluation of Recent State-Of-The-Art Black-Box Attackscited by 16
- 2022A Hamilton-Jacobi-based Proximal Operatorcited by 13
- 2021Black-box adversarial attacks using Evolution Strategiescited by 11
- 2022Gamma-convergence of a nonlocal perimeter arising in adversarial machine learningcited by 10
- 2019There are No Bit Parts for Sign Bits in Black-Box Attackscited by 8
- 2020An Empirical Study of Derivative-Free-Optimization Algorithms for Targeted Black-Box Attacks in Deep Neural Networkscited by 8
- 2022Polarized consensus-based dynamics for optimization and samplingcited by 7
- 2023SoK: Pitfalls in Evaluating Black-Box Attackscited by 6
- 2021Mean-field particle swarm optimizationcited by 5
- 2021Convergence of Anisotropic Consensus-Based Optimization in Mean-Field Lawcited by 5
50 most cited of 77 All 77 (JSON)
Built on by
Citing papers per year: 2026: 2.
2 papers.