The DOI matches its DataCite record; 12 of the 14 references it cites were found in a registry or an index.
Query-Efficient Hard-label Black-box Attack:An Optimization-based Approach
Open accessAbstract
We study the problem of attacking a machine learning model in the hard-label black-box setting, where no model information is revealed except that the attacker can make queries to probe the corresponding hard-label decisions. This is a very challenging problem since the direct extension of state-of-the-art white-box attacks (e.g., CW or PGD) to the hard-label black-box setting will require minimizing a non-continuous step function, which is combinatorial and cannot be solved by a gradient-based optimizer. The only current approach is based on random walk on the boundary, which requires lots of queries and lacks convergence guarantees. We propose a novel way to formulate the hard-label black-box attack as a real-valued optimization problem which is usually continuous and can be solved by any zeroth order optimization algorithm. For example, using the Randomized Gradient-Free method, we are able to bound the number of iterations needed for our algorithm to achieve stationary points. We demonstrate that our proposed method outperforms the previous random walk approach to attacking convolutional neural networks on MNIST, CIFAR, and ImageNet datasets. More interestingly, we show that the proposed algorithm can also be used to attack other discrete and non-continuous machine learning models, such as Gradient Boosting Decision Trees (GBDT).
Overview
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
The source backs part of the claim, not all of it — or backs it for a different population, condition or comparison.
In the citing paper
“Natural evolutionary strategies (NES) for gradient estimation is one of the state-of-the-art methods in black-box adversarial ML [10, 25, 38].”
From Adversarial Detection Avoidance Attacks: Evaluating the robustness of perceptual hashing-based client-side scanning (2021) · cites this paper as [10]
Experimental — accuracy not yet measured
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Citations
Cites
Deep Residual Learning for Image Recognition
He, K., Zhang, X., Ren, S., & Sun, J. (2016) · 2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR) · doi:10.1109/cvpr.2016.90 · Cited by 235,474
ImageNet: A large-scale hierarchical image database
Deng, J., Dong, W., Socher, R., Li, L.-J., Li, K., & Fei-Fei, L. (2009) · 2009 IEEE Conference on Computer Vision and Pattern Recognition · doi:10.1109/cvpr.2009.5206848 · Cited by 65,333
Gradient-based learning applied to document recognition
Lecun, Y., Bottou, L., Bengio, Y., & Haffner, P. (1998) · Proceedings of the IEEE · doi:10.1109/5.726791 · Cited by 58,805
Learning Multiple Layers of Features from Tiny Images
Krizhevsky, A. (2024) · doi:10.57702/zp44cu3g · Cited by 23,889
Towards Evaluating the Robustness of Neural Networks
Carlini, N., & Wagner, D. (2017) · 2017 IEEE Symposium on Security and Privacy (SP) · doi:10.1109/sp.2017.49 · Cited by 8,859
Chen, P., Zhang, H., Sharma, Y., Yi, J., & Hsieh, C. (2017) · ACM Workshop on Artificial Intelligence and Security (AISec) · doi:10.1145/3128572.3140448 · Cited by 1,864
Self-citationSearching for exotic particles in high-energy physics with deep learning
Baldi, P., Sadowski, P., & Whiteson, D. (2014) · Nature Communications · doi:10.1038/ncomms5308 · Cited by 1,261
Decision-based adversarial attacks: Reliable attacks against black-box machine learning models
Brendel, W., Rauber, J., & Bethge, M. (2017) · arXiv · doi:10.48550/arxiv.1712.04248 · Cited by 1,018
Seq2Sick: Evaluating the Robustness of Sequence-to-Sequence Models with Adversarial Examples
Cheng, M., Yi, J., Chen, P., Zhang, H., & Hsieh, C. (2020) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v34i04.5767 · Cited by 218
Self-citationExploring the Space of Black-box Attacks on Deep Neural NetworksPreprint
Bhagoji, A. N., He, W., Li, B., & Song, D. X. (2017) · arXiv (Cornell University) · doi:10.48550/arxiv.1712.09491 · Cited by 92
Research works printed but not linked: 11
- [2][2] Yurii Nesterov and Vladimir Spokoiny. Random gradient-free minimization of convex functions. Foundations of Computational Mathematics , 17(2):527-566, 2017. -
- [3][3] Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6572 , 2014. - · arXiv
- [4][4] Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. Intriguing properties of neural networks. arXiv preprint arXiv:1312.6199 , 2013. - · arXiv
- [6][6] Seyed Mohsen Moosavi Dezfooli, Alhussein Fawzi, and Pascal Frossard. Deepfool: a simple and accurate method to fool deep neural networks. In Proceedings of 2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR) , number EPFL-CONF-218057, 2016. -
- [7][7] Hongge Chen, Huan Zhang, Pin-Yu Chen, Jinfeng Yi, and Cho-Jui Hsieh. Attacking visual language grounding with adversarial examples: A case study on neural image captioning. In ACL , 2018. -
- [10][10] Pin-Yu Chen, Huan Zhang, Yash Sharma, Jinfeng Yi, and Cho-Jui Hsieh. Zoo: Zeroth order optimization based black-box attacks to deep neural networks without training substitute models. In Proceedings of the 10th ACM Workshop on Artificial Intelligence and Security , pages 15-26. ACM, 2017. -
- [11][11] Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. In ICLR , 2018. -
- [12][12] Pin-Yu Chen, Yash Sharma, Huan Zhang, Jinfeng Yi, and Cho-Jui Hsieh. Ead: elastic-net attacks to deep neural networks via adversarial examples. In AAAI , 2018. -
- [14][14] Nicolas Papernot, Patrick McDaniel, Ian Goodfellow, Somesh Jha, Z Berkay Celik, and Ananthram Swami. Practical black-box attacks against machine learning. In Proceedings of the 2017 ACM on Asia Conference on Computer and Communications Security , pages 506-519. ACM, 2017. -
- [16][16] Chun-Chen Tu, Pai-Shun Ting, Pin-Yu Chen, Sijia Liu, Huan Zhang, Jinfeng Yi, Cho-Jui Hsieh, and Shin-Ming Cheng. Autozoom: Autoencoder-based zeroth order optimization method for attacking black-box neural networks. CoRR , abs/1805.11770, 2018. - · arXiv
- [18][18] Saeed Ghadimi and Guanghui Lan. Stochastic first-and zeroth-order methods for nonconvex stochastic programming. SIAM Journal on Optimization , 23(4):2341-2368, 2013. -
Cited by
Sorted by citations
Items 101–200 of 268
Practical Disruption of Image Translation Deepfake Networks
Ruiz, N., Bargal, S. A., Xie, C., & Sclaroff, S. (2023) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v37i12.26693 · Cited by 15
FIMAP: Feature Importance by Minimal Adversarial Perturbation
Chapman-Rounds, M., Bhatt, U., Pazos, E., Schulz, M.-A., & Georgatzis, K. (2021) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v35i13.17362 · Cited by 18
Query-Efficient Adversarial Attack Based On Latin Hypercube Sampling
Wang, D., Lin, J., & Wang, Y. (2022) · Proceedings - International Conference on Image Processing · doi:10.1109/icip46576.2022.9897705 · Cited by 14
Time-aware and task-transferable adversarial attack for perception of autonomous vehicles
Lu, Y., Ren, H., Chai, W., Velipasalar, S., & Li, Y. (2024) · Pattern Recognition Letters · doi:10.1016/j.patrec.2024.01.010 · Cited by 14
Practical Relative Order Attack in Deep Ranking
Zhou, M., Wang, L., Niu, Z., Zhang, Q., Xu, Y., Zheng, N., & Hua, G. (2021) · IEEE/CVF International Conference on Computer Vision (ICCV) · doi:10.1109/iccv48922.2021.01610 · Cited by 15
Pashamokhtari, A., Batista, G., & Gharakheili, H. H. (2022) · Computers & Security · doi:10.1016/j.cose.2022.102801 · Cited by 14
Jiang, W., You, S., Zhan, J., Wang, X., Lei, H., & Adhikari, D. (2022) · IEEE Transactions on Evolutionary Computation · doi:10.1109/tevc.2022.3231460 · Cited by 13
Evaluating the Robustness of Nearest Neighbor Classifiers: A Primal-Dual PerspectivePreprint
Wang, L., Liu, X., Yi, J., Zhou, Z., & Hsieh, C. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1906.03972 · Cited by 18
Self-citationCost-Aware Robust Tree Ensembles for Security ApplicationsPreprint
Chen, Y., Wang, S., Jiang, W., Cidon, A., & Jana, S. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1912.01149 · Cited by 13
Query-Efficient Black-Box Adversarial Attacks on Automatic Speech Recognition
Tong, C., Zheng, X., Li, J., Ma, X., Gao, L., & Xiang, Y. (2023) · IEEE/ACM Transactions on Audio Speech and Language Processing · doi:10.1109/taslp.2023.3304476 · Cited by 12
Interpretable Spectrum Transformation Attacks to Speaker Recognition Systems
Yao, J., Luo, H., Qi, J., & Zhang, X.-L. (2024) · IEEE/ACM Transactions on Audio Speech and Language Processing · doi:10.1109/taslp.2024.3364100 · Cited by 13
Zhu, R., Ma, S., Lian, J., He, L., & Mei, S. (2024) · IEEE Journal of Selected Topics in Applied Earth Observations and Remote Sensing · doi:10.1109/jstars.2024.3399780 · Cited by 13
Non-Singular Adversarial Robustness of Neural Networks
Tsai, Y.-L., Hsu, C., Yu, C.-M., & Chen, P. (2021) · IEEE International Conference on Acoustics Speech and Signal Processing · doi:10.1109/icassp39728.2021.9414325 · Cited by 12
Self-citationEager Falsification for Accelerating Robustness Verification of Deep Neural Networks
Guo, X., Wan, W., Zhang, Z., Zhang, M., Song, F., & Wen, X. (2021) · Proceedings/Proceedings - International Symposium on Software Reliability Engineering · doi:10.1109/issre52982.2021.00044 · Cited by 15
TextCheater: A Query-Efficient Textual Adversarial Attack in the Hard-Label Setting
Peng, H., Guo, S., Zhao, D., Zhang, X., Han, J., Ji, S., Yang, X., & Zhong, M. J. (2023) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2023.3339802 · Cited by 12
MC-Net: Realistic Sample Generation for Black-Box Attacks
Duan, M., Jiao, K., Yu, S., Yang, Z., Xiao, B., & Li, K. (2024) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2024.3356812 · Cited by 11
Perception-Driven Imperceptible Adversarial Attack Against Decision-Based Black-Box Models
Zhang, S., Zheng, B., Jiang, P., Zhao, L., Shen, C. Q., & Wang, Q. (2024) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2024.3359441 · Cited by 11
Toward Model Resistant to Transferable Adversarial Examples via Trigger Activation
Yu, Y., Xia, S., Lin, X., Kong, C., Yang, W., Lu, S., Tan, Y., & Kot, A. C. (2025) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2025.3553043 · Cited by 13
Low-Rank and Sparse Decomposition for Low-Query Decision-Based Adversarial Attacks
Esmaeili, A., Edraki, M., Rahnavard, N., Mian, A. S., & Shah, M. (2023) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2023.3275737 · Cited by 13
Spanning attack: reinforce black-box attacks with unlabeled data
Wang, L., Zhang, H., Yi, J., Hsieh, C., & Jiang, Y. Y. (2020) · Machine Learning · doi:10.1007/s10994-020-05916-1 · Cited by 11
Self-citationOn-manifold adversarial attack based on latent space substitute model
Zhang, C., Luo, X., & Han, P. (2022) · Computers & Security · doi:10.1016/j.cose.2022.102770 · Cited by 9
Variational Adversarial Defense: A Bayes Perspective for Adversarial Training
Zhao, C., Mei, S., Ni, B., Yuan, S., Yu, Z., & Wang, J. (2023) · IEEE Transactions on Pattern Analysis and Machine Intelligence · doi:10.1109/tpami.2023.3341639 · Cited by 10
Liu, W., Wang, B., Huang, D., Luo, H., & Lu, L. C. (2024) · Computers & Security · doi:10.1016/j.cose.2024.103882 · Cited by 10
GCSA: A New Adversarial Example-Generating Scheme Toward Black-Box Adversarial Attacks
Fan, X., Li, M., Zhou, J., Jing, Q., Lin, C., Lu, Y., & Bi, J. (2024) · IEEE Transactions on Consumer Electronics · doi:10.1109/tce.2024.3358179 · Cited by 12
Hierarchical Perceptual Noise Injection for Social Media Fingerprint Privacy Protection
Li, S., Xu, H., Wang, J., Xu, R., Liu, A., He, F., Liu, X., & Tao, D. (2024) · IEEE Transactions on Image Processing · doi:10.1109/tip.2024.3381771 · Cited by 10
Fuzzing-based hard-label black-box attacks against machine learning models
Qin, Y., & Yue, C. (2022) · Computers & Security · doi:10.1016/j.cose.2022.102694 · Cited by 13
Feature partitioning for robust tree ensembles and their certification in adversarial scenarios
Calzavara, S., Lucchese, C., Marcuzzi, F., & Orlando, S. (2021) · EURASIP Journal on Information Security · doi:10.1186/s13635-021-00127-0 · Cited by 11
PatchAttack: A Black-box Texture-based Attack with Reinforcement LearningPreprint
Yang, C., Kortylewski, A., Xie, C., Cao, Y., & Yuille, A. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2004.05682 · Cited by 10
Not All Datasets Are Born Equal: On Heterogeneous Data and Adversarial ExamplesPreprint
Mathov, Y., Levy, E., Katzir, Z., Shabtai, A., & Elovici, Y. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2010.03180 · Cited by 10
No-Box Universal Adversarial Perturbations Against Image Classifiers via Artificial Textures
Mou, N., Guo, B., Zhao, L., Wang, C., Zhao, Y., & Wang, Q. (2024) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2024.3478828 · Cited by 9
Adversarial evasion attacks detection for tree-based ensembles: A representation learning approach
Braun, G., Cohen, S., & Rokach, L. (2025) · Information Fusion · doi:10.1016/j.inffus.2025.102964 · Cited by 10
A Lazy Approach to Long-Horizon Gradient-Based Meta-Learning
Jamal, M. A., Wang, L., & Gong, B. (2021) · IEEE/CVF International Conference on Computer Vision (ICCV) · doi:10.1109/iccv48922.2021.00651 · Cited by 9
Training Provably Robust Models by Polyhedral Envelope Regularization
Liu, C., Salzmann, M., & Susstrunk, S. E. (2021) · IEEE Transactions on Neural Networks and Learning Systems · doi:10.1109/tnnls.2021.3111892 · Cited by 9
Feng, R., Mangaokar, N., Chen, J., Fernandes, E., Jha, S., & Prakash, A. (2022) · IEEE European Symposium on Security and Privacy · doi:10.1109/eurosp53844.2022.00047 · Cited by 12
Decision-Based Attack to Speaker Recognition System via Local Low-Frequency Perturbation
Deng, J., Dong, L., Wang, R., Yang, R., & Yan, D. (2022) · IEEE Signal Processing Letters · doi:10.1109/lsp.2022.3183538 · Cited by 9
Xiao, Y., Zhou, J., Chen, K., & Liu, Z. (2023) · Pattern Recognition · doi:10.1016/j.patcog.2023.109828 · Cited by 8
Decision-based Universal Adversarial AttackPreprint
Wu, J., Zhou, M., Liu, S., Liu, Y., & Zhu, C. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2009.07024 · Cited by 13
A Unified Optimization Framework for Feature-Based Transferable Attacks
Xu, N., Feng, W., Zhang, T., & Zhang, Y. (2024) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2024.3380248 · Cited by 10
Improving transferability of adversarial examples via statistical attribution-based attacks
Zhu, H., Jia, Y., Yan, Y., & Yang, Z. (2025) · Neural Networks · doi:10.1016/j.neunet.2025.107341 · Cited by 9
Visualizing One Pixel Attack Using Adversarial Maps
Wang, W., Sun, J. Q., & Wang, G. (2020) · Chinese Automation Congress · doi:10.1109/cac51589.2020.9327603 · Cited by 8
DiffDefense: Defending Against Adversarial Attacks via Diffusion Models
Silva, H. P., Seidenari, L., & Bimbo, A. D. (2023) · Lecture notes in computer science · doi:10.1007/978-3-031-43153-1_36 · Cited by 9
A New Black Box Attack Generating Adversarial Examples Based on Reinforcement Learning
Xiao, W., Jiang, H., & Xia, S. (2020) · Information Communication Technologies Conference (ICTC) · doi:10.1109/ictc49638.2020.9123270 · Cited by 8
An Advanced Black-Box Adversarial Attack for Deep Driving Maneuver Classification Models
Sarker, A., Shen, H., Sen, T., & Uehara, H. (2020) · IEEE International Conference on Mobile Ad-Hoc and Sensor Systems (MASS) · doi:10.1109/mass50613.2020.00032 · Cited by 8
Learning to Learn by Zeroth-Order OraclePreprint
Ruan, Y., Xiong, Y., Reddi, S. J., Kumar, S., & Hsieh, C. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1910.09464 · Cited by 8
Self-citationMitigating Black-Box Adversarial Attacks via Output Noise Perturbation
Aithal, M. B., & Li, X. (2022) · IEEE Access · doi:10.1109/access.2022.3146198 · Cited by 7
Boosting Query Efficiency of Meta Attack With Dynamic Fine-Tuning
Lin, D., Wang, Y., Tang, W., & Kang, X. (2022) · IEEE Signal Processing Letters · doi:10.1109/lsp.2022.3229558 · Cited by 7
Towards Black-Box Adversarial Attacks on Interpretable Deep Learning Systems
Zhan, Y., Zheng, B., Wang, Q., Mou, N., Guo, B., Li, Q., Shen, C. Q., & Wang, C. (2022) · IEEE International Conference on Multimedia and Expo (ICME) · doi:10.1109/icme52920.2022.9859856 · Cited by 9
Jain, S., Cretu, A.-M., & de Montjoye, Y.-A. (2021) · arXiv · doi:10.48550/arxiv.2106.09820 · Cited by 21
BounceAttack: A Query-Efficient Decision-based Adversarial Attack by Bouncing into the Wild
Wan, J., Fu, J., Wang, L., & Yang, Z. (2024) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp54263.2024.00068 · Cited by 7
Robust Deep Object Tracking against Adversarial Attacks
Jia, S., Ma, C., Song, Y., Yang, X., & Yang, M. (2024) · International Journal of Computer Vision · doi:10.1007/s11263-024-02226-0 · Cited by 7
Dynamic Routing and Knowledge Re-Learning for Data-Free Black-Box Attack
Qian, X., Wang, W., Jiang, Y., Xue, X., & Fu, Y. (2024) · IEEE Transactions on Pattern Analysis and Machine Intelligence · doi:10.1109/tpami.2024.3469952 · Cited by 6
Zeroth-order Optimization on Riemannian Manifolds
Li, J., Balasubramanian, K., & Ma, S. (2020) · Cited by 5
Evaluating Effectiveness of Adversarial Examples on State of Art License Plate Recognition Models
Rana, K., & Madaan, R. (2020) · IEEE International Conference on Intelligence and Security Informatics (ISI) · doi:10.1109/isi49825.2020.9280477 · Cited by 6
Nakai, T., Suzuki, D., & Fujino, T. (2021) · IACR Transactions on Cryptographic Hardware and Embedded Systems · doi:10.46586/tches.v2021.i3.149-175 · Cited by 6
Boundary Defense Against Black-box Adversarial Attacks
Aithal, M. B., & Li, X. (2022) · Proceedings - International Conference on Pattern Recognition/Proceedings/International Conference on Pattern Recognition · doi:10.1109/icpr56361.2022.9956476 · Cited by 6
Simple Black-Box Adversarial Examples Generation with Very Few Queries
Senzaki, Y., Ohata, S., & Matsuura, K. (2020) · IEICE Transactions on Information and Systems · doi:10.1587/transinf.2019inp0002 · Cited by 6
Efficient Model Extraction by Data Set Stealing, Balancing, and Filtering
Yang, P., Wu, Q., & Zhang, X. (2023) · IEEE Internet of Things Journal · doi:10.1109/jiot.2023.3304345 · Cited by 6
MPass: Bypassing Learning-based Static Malware Detectors
Wang, J., Qu, W., Rong, Y., Qiu, H., Li, Q. L., Li, Z., & Zhang, C. (2023) · ACM/IEEE Design Automation Conference (DAC) · doi:10.1109/dac56929.2023.10247858 · Cited by 5
RamBoAttack: A Robust and Query Efficient Deep Neural Network Decision Exploit
Vo, V. Q., Abbasnejad, E., & Ranasinghe, D. C. (2022) · Network and Distributed System Security Symposium · doi:10.14722/ndss.2022.24200 · Cited by 7
Hong, H., Zhang, X., Wang, B., Ba, Z., & Hong, Y. (2024) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3658644.3690343 · Cited by 6
Roken, N. A., Hacid, H., Bouridane, A., & Hussain, A. J. (2025) · Intelligent Systems with Applications · doi:10.1016/j.iswa.2025.200554 · Cited by 8
Hard-Label Black-Box Adversarial Attack on Deep Electrocardiogram Classifier
Lam, J., Quan, P., Xu, J., Jeyakumar, J. V., & Srivastava, M. B. (2020) · doi:10.1145/3417312.3431827 · Cited by 5
Efficient Black-Box Adversarial Attacks for Deep Driving Maneuver Classification Models
Sarker, A., Shen, H., Sen, T., & Mendelson, Q. (2021) · IEEE International Conference on Mobile Ad-Hoc and Sensor Systems (MASS) · doi:10.1109/mass52906.2021.00072 · Cited by 5
Evading Black-box Classifiers Without Breaking Eggs
Debenedetti, E., Carlini, N., & Tramèr, F. (2024) · IEEE Conference on Secure and Trustworthy Machine Learning (SaTML) · doi:10.1109/satml59370.2024.00027 · Cited by 11
A Context-aware Black-box Adversarial Attack for Deep Driving Maneuver Classification Models
Sarker, A., Shen, H., & Sen, T. (2021) · IEEE International Conference on Sensing, Communication, and Networking (SECON) · doi:10.1109/secon52354.2021.9491584 · Cited by 5
A Suspicion-Free Black-box Adversarial Attack for Deep Driving Maneuver Classification Models
Sarker, A., Shen, H., & Sen, T. (2021) · IEEE International Conference on Distributed Computing Systems (ICDCS) · doi:10.1109/icdcs51616.2021.00080 · Cited by 5
Performance Evaluation of Adversarial Attacks: Discrepancies and SolutionsPreprint
Wu, J., Zhou, M., Zhu, C., Liu, Y., Harandi, M. T., & Li, L. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2104.11103 · Cited by 17
Certifying Robustness to Programmable Data Bias in Decision TreesPreprint
Meyer, A. P., Albarghouthi, A., & D’Antoni, L. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2110.04363 · Cited by 5
FeatureBA: Hard label black box attack based on internal layer features of surrogate model
Li, J., Tan, Y., Liu, R., Meng, W., & Li, Y. (2025) · Expert Systems with Applications · doi:10.1016/j.eswa.2025.127082 · Cited by 4
Zhu, X., Chen, W., & Jiang, Q. (2025) · Displays · doi:10.1016/j.displa.2024.102957 · Cited by 4
Towards Query Efficient and Derivative Free Black Box Adversarial Machine Learning Attack
Mukeri, A. F., & Gaikwad, D. P. (2022) · International Journal of Image Graphics and Signal Processing · doi:10.5815/ijigsp.2022.02.02 · Cited by 4
SpotOn: A Gradient-based Targeted Data Poisoning Attack on Deep Neural Networks
Khare, Y., Lakara, K., Mittal, S., Kaushik, A., & Singhal, R. (2023) · International Symposium on Quality Electronic Design (ISQED) · doi:10.1109/isqed57927.2023.10129311 · Cited by 4
Xiao, Y., Pun, C., & Chen, K. (2023) · Knowledge-Based Systems · doi:10.1016/j.knosys.2023.111063 · Cited by 4
Efficient polar coordinates attack with adaptive activation strategy
Ren, Y., Zhu, H., Liu, C., & Li, C. (2024) · Expert Systems with Applications · doi:10.1016/j.eswa.2024.123850 · Cited by 4
Diffusion Patch Attack With Spatial–Temporal Cross-Evolution for Video Recognition
Yang, J., Guan, Z., Li, J., Shi, Z., & Liu, X. (2024) · IEEE Transactions on Circuits and Systems for Video Technology · doi:10.1109/tcsvt.2024.3452475 · Cited by 5
Evaluating Adversarial Robustness of Secret Key-Based Defenses
Ali, Z. T. M., Mohammed, A., & Ahmad, I. (2022) · IEEE Access · doi:10.1109/access.2022.3162874 · Cited by 4
Confusing and Detecting ML Adversarial Attacks with Injected Attractors
Zhang, J., Chang, E., & Lee, H. K. (2022) · ACM Asia Conference on Computer and Communications Security (ASIA CCS) · doi:10.1145/3488932.3497752 · Cited by 4
Sparse Adversarial Video Attacks via Superpixel-Based Jacobian Computation
Du, Z., Liu, F., & Yan, X. (2022) · Sensors · doi:10.3390/s22103686 · Cited by 4
Vadera, M. P., Shukla, S. N., Jalaian, B. A., & Marlin, B. M. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2002.02842 · Cited by 5
Zeroth-Order Hybrid Gradient Descent: Towards A Principled Black-Box Optimization FrameworkPreprint
Sharma, P., Xu, K., Liu, S., Chen, P., Lin, X., & Varshney, P. K. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2012.11518 · Cited by 4
Self-citationRethinking Image-Scaling Attacks: The Interplay Between Vulnerabilities in Machine Learning SystemsPreprint
Gao, Y., Shumailov, I., & Fawaz, K. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2104.08690 · Cited by 5
Hasan, M. M., Islam, R., Mamun, Q., Islam, M. Z., & Gao, J. (2025) · SSRN Electronic Journal · doi:10.2139/ssrn.5096420 · Cited by 5
Boosting Adversarial Transferability via Relative Feature Importance-Aware Attacks
Li, J.-W., Shao, W., Sun, Y., Wang, L.-Q., Ge, Q., & Xiao, L. (2025) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2025.3552030 · Cited by 3
Exploring black-box adversarial attacks on Interpretable Deep Learning Systems
Zhan, Y., Zheng, B., Liu, D., Deng, B., & Xu, Y. (2025) · Computer Vision and Image Understanding · doi:10.1016/j.cviu.2025.104423 · Cited by 4
Zhao, Z., Meng, J., & Li, Y. (2022) · International Conference on Inventive Computation Technologies (ICICT) · doi:10.1109/icict54344.2022.9850630 · Cited by 3
Enhancing the Transferability of Targeted Attacks with Adversarial Perturbation Transform
Deng, Z., Xiao, W. F., Li, X., He, S., & Wang, Y. (2023) · Electronics · doi:10.3390/electronics12183895 · Cited by 5
Time-Series Misalignment Aware DNN Adversarial Attacks for Connected Autonomous Vehicles
Liu, Q., Shen, H., Sen, T., & Ning, R. (2023) · IEEE International Conference on Mobile Ad-Hoc and Sensor Systems (MASS) · doi:10.1109/mass58611.2023.00039 · Cited by 3
Object-attentional untargeted adversarial attack
Zhou, C., Wang, Y., & Zhu, G. (2024) · Journal of Information Security and Applications · doi:10.1016/j.jisa.2024.103710 · Cited by 3
SoK: Pitfalls in Evaluating Black-Box Attacks
Suya, F., Suri, A., Zhang, T., Hong, J., Tian, Y., & Evans, D. (2024) · IEEE Conference on Secure and Trustworthy Machine Learning (SaTML) · doi:10.1109/satml59370.2024.00026 · Cited by 4
Vulnerability of Deep Forest to Adversarial Attacks
Ali, Z. T. M., Mohammed, A., & Ahmad, I. (2024) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2024.3402309 · Cited by 3
Continual Learning From a Stream of APIs
Yang, E., Wang, Z., Shen, L., Yin, N., Liu, T., Guo, G., Wang, X., & Tao, D. (2024) · IEEE Transactions on Pattern Analysis and Machine Intelligence · doi:10.1109/tpami.2024.3460871 · Cited by 6
A Hybrid Query-Efficient Black-Box Adversarial Attack on Power System Event Classifiers
Cheng, Y., Yamashita, K., Yu, N., & Liu, Y. (2024) · IEEE International Conference on Communications, Control, and Computing Technologies for Smart Grids (SmartGridComm) · doi:10.1109/smartgridcomm60555.2024.10738066 · Cited by 3
Robust Decision-Based Black-Box Adversarial Attack via Coarse-To-Fine Random Search
Kim, B. C., Yu, Y., & Ro, Y. M. (2021) · Proceedings - International Conference on Image Processing · doi:10.1109/icip42928.2021.9506464 · Cited by 4
Transferable Adversarial Robustness using Adversarially Trained Autoencoders.Preprint
Vaishnavi, P., Eykholt, K., Prakash, A., & Rahmati, A. (2019) · arXiv (Cornell University) · Cited by 3
Adversarial Attack across DatasetsPreprint
Qin, Y., Xiong, Y., Yi, J., Cao, L., & Hsieh, C.-J. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2110.07718 · Cited by 3
Self-citationA Few Seconds Can Change Everything: Fast Decision-based Attacks against DNNs
Mou, N., Zheng, B., Wang, Q., Ge, Y., & Guo, B. (2022) · International Joint Conference on Artificial Intelligence · doi:10.24963/ijcai.2022/464 · Cited by 2
Chen, P., & Hsieh, C. (2022) · Elsevier eBooks · doi:10.1016/b978-0-12-824020-5.00012-0 · Cited by 2
Self-citationOn the Adversarial Robustness of Decision Trees and a Symmetry Defense
Lindqvist, B. (2025) · IEEE Access · doi:10.1109/access.2025.3530695 · Cited by 2
Karunanayake, N., Silva, B., Ginige, Y., Seneviratne, S., & Chawla, S. (2025) · ACM Transactions on Privacy and Security · doi:10.1145/3716384 · Cited by 3
Label-only model inversion attacks: Adaptive boundary exclusion for limited queries
Wu, J., Wan, C., Chen, H., Zheng, Z., & Sun, Y. (2025) · Neurocomputing · doi:10.1016/j.neucom.2025.129902 · Cited by 3
Metadata
- Authors
- Cheng, M., Le, T., Chen, P.-Y., Yi, J., Zhang, H., & Hsieh, C.-J.
- Affiliations
- University of California, Davis (US)
- IBM (United States) (US)
- University of California, Los Angeles (US)
- Venue
- arXiv
- Publisher
- arXiv
- Published
- 2018
- ISSN
- 2331-8422 (ISSN-L)
- arXiv
- 1807.04457
- OpenAlex
- W2874797877
- Cited by
- 269
- References
- 14
- Citations by year
- 2025: 20 · 2024: 36 · 2023: 39 · 2022: 48 · 2021: 57 · 2020: 46 · 2019: 22 · 2018: 1
- Type
- posted content
- Language
- en
- Open access
- green
- arxiv.org
- Locations
- arXiv (Cornell University) (submittedVersion)
- Rare & Special e-Zone (The Hong Kong University of Science and Technology) (submittedVersion)
- arXiv (Cornell University)
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
- Physical Sciences › Computer Science › Software › Software Testing and Debugging Techniques
- Physical Sciences › Computer Science › Hardware and Architecture › Security and Verification in Computing
- Keywords
- adversarial attacks, derivative-free optimization, gradient boosting decision tree, convolutional neural networks, adversarial robustness
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
