mlsanityData to 7 Oct 2026

Multi-task Adversarial Attacks against Black-box Model with Few-shot Queries

arXiv 2508.10039 ↗First posted 10 Aug 2025cs.CR cs.AIcited by 1

Not on the map. Why?

Abstract (arXiv)

Current multi-task adversarial text attacks rely on abundant access to shared internal features and numerous queries, often limited to a single task type. As a result, these attacks are less effective against practical scenarios involving black-box feedback APIs, limited queries, or multiple task types. To bridge this gap, we propose Cluster and Ensemble Multi-task Text Adversarial Attack (CEMA), an effective black-box attack that exploits the transferability of adversarial texts across different tasks. CEMA simplifies complex multi-task scenarios by using a textitdeep-level substitute model trained in a textitplug-and-play manner for text classification, enabling attacks without mimicking the victim model. This approach requires only a few queries for training, converting multi-task attacks into classification attacks and allowing attacks across various tasks. CEMA generates multiple adversarial candidates using different text classification methods and selects the one that most effectively attacks substitute models. In experiments involving multi-task models with two, three, or six tasks--spanning classification, translation, summarization, and text-to-image generation--CEMA demonstrates significant attack success with as few as 100 queries. Furthermore, CEMA can target commercial APIs (e.g., Baidu and Google Translate), large language models (e.g., ChatGPT 4o), and image-generation models (e.g., Stable Diffusion V2), showcasing its versatility and effectiveness in real-world applications.

Key facts. Cited by 1 paper in the map (data through 7 Oct 2026). Builds on 50 of its 81 references that are in the map. First posted on arXiv 10 Aug 2025.

Builds on

50 of 81 references.

References · 50

  1. 2017Attention Is All You Needcited by 59,932
  2. 2021Learning Transferable Visual Models From Natural Language Supervisioncited by 33,456
  3. 2014Neural Machine Translation by Jointly Learning to Align and Translatecited by 4,530
  4. 2019Unsupervised Cross-lingual Representation Learning at Scalecited by 3,907
  5. 2020mT5: A massively multilingual pre-trained text-to-text transformercited by 1,813
  6. 2016Practical Black-Box Attacks against Machine Learningcited by 893
  7. 2019Is BERT Really Robust? A Strong Baseline for Natural Language Attack on Text Classification and Entailmentcited by 663
  8. 2020BERT-ATTACK: Adversarial Attack Against BERT Using BERTcited by 488
  9. 2018TextBugger: Generating Adversarial Text Against Real-world Applicationscited by 376
  10. 2018Black-box Generation of Adversarial Text Sequences to Evade Deep Learning Classifierscited by 341
  11. 2020BAE: BERT-based Adversarial Examples for Text Classificationcited by 316
  12. 2017Synthetic and Natural Noise Both Break Neural Machine Translationcited by 304
38 more
  1. 2021Gradient-based Adversarial Attacks against Text Transformerscited by 233
  2. 2020ADAHESSIAN: An Adaptive Second Order Optimizer for Machine Learningcited by 201
  3. 2021Feature Importance-aware Transferable Adversarial Attackscited by 125
  4. 2019Robust Neural Machine Translation with Doubly Adversarial Inputscited by 105
  5. 2016Crafting Adversarial Input Sequences for Recurrent Neural Networkscited by 102
  6. 2018Seq2Sick: Evaluating the Robustness of Sequence-to-Sequence Models with Adversarial Examplescited by 93
  7. 2019Cross-Domain Transferability of Adversarial Perturbationscited by 92
  8. 2017Adversarial Multi-task Learning for Text Classificationcited by 91
  9. 2018On Adversarial Examples for Character-Level Neural Machine Translationcited by 85
  10. 2018Interpretable Adversarial Perturbation in Input Embedding Space for Textcited by 67
  11. 2020It's Morphin' Time! Combating Linguistic Discrimination with Inflectional Perturbationscited by 64
  12. 2020DaST: Data-free Substitute Training for Adversarial Attackscited by 60
  13. 2019On Evaluation of Adversarial Perturbations for Sequence-to-Sequence Modelscited by 56
  14. 2021Meta Gradient Adversarial Attackcited by 55
  15. 2020Generating Natural Language Attacks in a Hard Label Black Box Settingcited by 50
  16. 2018Beyond One-hot Encoding: lower dimensional target embeddingcited by 42
  17. 2022SemAttack: Natural Textual Attacks via Different Semantic Spacescited by 42
  18. 2020Practical No-box Adversarial Attacks against DNNscited by 32
  19. 2023Rethinking the Backward Propagation for Adversarial Transferabilitycited by 27
  20. 2021A Multi-modal and Multi-task Learning Method for Action Unit and Expression Recognitioncited by 24
  21. 2022Query-Efficient and Scalable Black-Box Adversarial Attacks on Discrete Sequential Data via Bayesian Optimizationcited by 22
  22. 2020A Geometry-Inspired Attack for Generating Natural Language Adversarial Examplescited by 20
  23. 2021Adversarial Robustness in Multi-Task Learning: Promises and Illusionscited by 17
  24. 2021A Strong Baseline for Query Efficient Attacks in a Black Box Settingcited by 16
  25. 2024HQA-Attack: Toward High Quality Black-Box Hard-Label Adversarial Attack on Textcited by 16
  26. 2019White-to-Black: Efficient Distillation of Black-Box Adversarial Attackscited by 14
  27. 2021Adversarial Attacks on Multi-task Visual Perception for Autonomous Drivingcited by 14
  28. 2023TransFool: An Adversarial Attack against Neural Machine Translation Modelscited by 12
  29. 2020Beware the Black-Box: on the Robustness of Recent Defenses to Adversarial Examplescited by 11
  30. 2020Two Sides of the Same Coin: White-box and Black-box Attacks for Transfer Learningcited by 9
  31. 2023LimeAttack: Local Explainable Method for Textual Hard-Label Adversarial Attackcited by 9
  32. 2024A Modified Word Saliency-Based Adversarial Attack on Text Classification Modelscited by 9
  33. 2021Adversarial Transfer Attacks With Unknown Data and Class Overlapcited by 8
  34. 2020Multi-Task Adversarial Attackcited by 7
  35. 2022Alibaba-Translate China's Submission for WMT 2022 Metrics Shared Taskcited by 7
  36. 2020Data-Free Adversarial Perturbations for Practical Black-Box Attackcited by 5
  37. 2024A Multi-task Adversarial Attack Against Face Authenticationcited by 3
  38. 2021Reversible Attack based on Local Visual Adversarial Perturbationcited by 1

Built on by

Cited by year

Citing papers per year: 2025: 1.

1 paper.

  1. 2025Style Attack Disguise: When Fonts Become a Camouflage for Adversarial Intentcited by 2

Similar, not cited

Close in wording, no citation either way

  1. 2025Layer-Wise Perturbations via Sparse Autoencoders for Adversarial Text Generation
  2. 2026Unifying Adversarial Robustness and Training Across Text Scoring Models
  3. 2026One Attack to Fool Them All: Highly Transferable Black-Box Adversarial Attacks on Frontier MLLMs
  4. 2024Improved Generation of Adversarial Examples Against Safety-aligned LLMs
  5. 2026Adversarial Attacks on Multimodal Large Language Models: A Comprehensive Survey
  6. 2023Baseline Defenses for Adversarial Attacks Against Aligned Language Models
  7. 2025Transferable Adversarial Attacks on Black-Box Vision-Language Models
  8. 2025Universal Adversarial Attack on Aligned Multimodal LLMs