Contract And Conquer: How to Provably Compute Adversarial Examples for a Black-Box Model?

arXiv 2603.10689 ↗First posted 11 Mar 2026cs.LG cs.AIcited by 0

Not on the map. Why?

Abstract (arXiv)

Black-box adversarial attacks are widely used as tools to test the robustness of deep neural networks against malicious perturbations of input data aimed at a specific change in the output of the model. Such methods, although they remain empirically effective, usually do not guarantee that an adversarial example can be found for a particular model. In this paper, we propose Contract And Conquer (CAC), an approach to provably compute adversarial examples for neural networks in a black-box manner. The method is based on knowledge distillation of a black-box model on an expanding distillation dataset and precise contraction of the adversarial example search space. CAC is supported by the transferability guarantee: we prove that the method yields an adversarial example for the black-box model within a fixed number of algorithm iterations. Experimentally, we demonstrate that the proposed approach outperforms existing state-of-the-art black-box attack methods on ImageNet dataset for different target models, including vision transformers.

Key facts. No citing papers in the map yet (data through 14 Oct 2026). Builds on 66 of its 84 references that are in the map. First posted on arXiv 11 Mar 2026.

Builds on

66 of 84 references.

References · 66

2015Deep Residual Learning for Image Recognitioncited by 52,096
2020An Image is Worth 16x16 Words: Transformers for Image Recognition at Scalecited by 30,186
2015Distilling the Knowledge in a Neural Networkcited by 10,324
2014Explaining and Harnessing Adversarial Examplescited by 7,364
2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,415
2013Intriguing properties of neural networkscited by 5,155
2016Towards Evaluating the Robustness of Neural Networkscited by 2,998
2019Certified Adversarial Robustness via Randomized Smoothingcited by 1,340
2016Practical Black-Box Attacks against Machine Learningcited by 903
2020Fast is better than free: Revisiting adversarial trainingcited by 727
2019Square Attack: a query-efficient black-box adversarial attack via random searchcited by 685
2017ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Modelscited by 666

38 more

2019Adversarial Training for Free!cited by 643
2018Improving Transferability of Adversarial Examples with Input Diversitycited by 599
2016Delving into Transferable Adversarial Examples and Black-box Attackscited by 536
2017Countering Adversarial Images using Input Transformationscited by 520
2022Diffusion Models for Adversarial Purificationcited by 476
2018Certified Robustness to Adversarial Examples with Differential Privacycited by 468
2019HopSkipJumpAttack: A Query-Efficient Decision-Based Attackcited by 333
2018On the Effectiveness of Interval Bound Propagation for Training Verifiably Robust Modelscited by 328
2021Recent Advances in Adversarial Training for Adversarial Robustnesscited by 279
2019Simple Black-box Adversarial Attackscited by 251
2017Improving the Adversarial Robustness and Interpretability of Deep Neural Networks by Regularizing their Input Gradientscited by 236
2021Beta-CROWN: Efficient Bound Propagation with Per-neuron Split Constraints for Complete and Incomplete Neural Network Robustness Verificationcited by 228
2023PromptRobust: Towards Evaluating the Robustness of Large Language Models on Adversarial Promptscited by 226
2018Adversarial Risk and the Dangers of Evaluating Against Weak Attackscited by 221
2020Randomized Smoothing of All Shapes and Sizescited by 147
2019Enhancing Adversarial Example Transferability with an Intermediate Level Attackcited by 140
2021Feature Importance-aware Transferable Adversarial Attackscited by 127
2019Sign-OPT: A Query-Efficient Hard-label Adversarial Attackcited by 120
2022Improving Adversarial Transferability via Neuron Attribution-Based Attackscited by 93
2023Rethinking Model Ensemble in Transfer-based Adversarial Attackscited by 89
2020Robustness Verification for Transformerscited by 76
2024Jailbreaking Prompt Attack: A Controllable Adversarial Attack against Diffusion Modelscited by 72
2021On Improving Adversarial Transferability of Vision Transformerscited by 70
2022Boosting the Transferability of Adversarial Attacks with Reverse Adversarial Perturbationcited by 68
2020GeoDA: a geometric framework for black-box adversarial attackscited by 66
2020Sparse-RS: a versatile framework for query-efficient sparse black-box adversarial attackscited by 65
2020SurFree: a fast surrogate-free black-box attackcited by 60
2021Adversarial Example Detection for DNN Models: A Review and Experimental Comparisoncited by 52
2020Generating Natural Language Attacks in a Hard Label Black Box Settingcited by 50
2021Triangle Attack: A Query-efficient Decision-based Adversarial Attackcited by 48
2022Certified Neural Network Watermarks with Randomized Smoothingcited by 41
2024Chain of Attack: On the Robustness of Vision-Language Models Against Transfer-Based Adversarial Attackscited by 39
2020Improving Query Efficiency of Black-box Adversarial Attackcited by 34
2023Diversifying the High-level Features for better Adversarial Transferabilitycited by 34
2018Detection based Defense against Adversarial Examples from the Steganalysis Point of Viewcited by 32
2023Making Substitute Models More Bayesian Can Enhance Transferability of Adversarial Examplescited by 32
2023Understanding Certified Training with Interval Bound Propagationcited by 26
2021CC-Cert: A Probabilistic Approach to Certify General Robustness of Neural Networkscited by 19

50 most cited of 66 All 66 (JSON)

Built on by

Not cited yet.

Similar, not cited

Close in wording, no citation either way