Hybrid Batch Attacks: Finding Black-box Adversarial Examples with Limited Queries

David Evans; Fnu Suya; Jianfeng Chi; Yuan Tian

REVIEW 3 major objections 4 minor 45 references

Hybrid Batch Attacks: Finding Black-box Adversarial Examples with Limited Queries

T0 review · 3 major / 4 minor · reviewed 2026-08-14 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Hybrid black-box attacks start optimization at failed transfer candidates and cut query cost per adversarial example by up to 81 percent.

desk verdict The central idea—start black-box optimization attacks from local adversarial candidates—holds up and cuts query cost by 50–80% on normal models, but the baseline accounting in Table 3 is inconsistent and the tuning component backfires on CIFAR10, so the paper needs fixes, not rejection. read the letter →

arxiv 1908.07000 v3 pith:2F7TYZVO submitted 2019-08-19 cs.CR

Fnu Suya , Jianfeng Chi , David Evans , Yuan Tian This is my paper · ORCID

classification cs.CR

keywords black-boxadversarialexamplesqueryefficiencytransferattacksoptimization-basedhybridseedprioritizationbatchrobustmodels

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper argues that the two standard black-box attack strategies, transfer attacks and optimization attacks, should be combined rather than treated as alternatives. Its central claim is that adversarial examples generated against local models, even when they fail to transfer to the target, are much better starting points for optimization attacks than the original clean images, and this cuts the average number of queries per adversarial example by up to 81 percent on normally trained models. A second claim is that in resource-limited batch settings, ranking seeds by how easily local models produce adversarial examples and by target-model loss lets attackers obtain many adversarial examples with only a handful of queries. If the paper is right, black-box attacks are substantially cheaper than prior work suggested, and defenders should prepare for hybrid attackers rather than for pure transfer or pure optimization attackers.

What carries the argument

The mechanism is the hybrid attack loop. A local ensemble is attacked with a white-box PGD attack to produce a candidate adversarial example; the candidate is sent to the target model with one query; if it fails to transfer, a zeroth-order optimization attack (NES or AutoZOOM) runs from the candidate rather than from the original seed, with perturbations clipped to the original seed's L-infinity ball. The input-label pairs produced during that search are used to periodically fine-tune the local models, which the paper shows helps on MNIST. A second mechanism, seed prioritization, orders seeds in the transfer phase by the number of local models compromised and the number of PGD steps needed, and in the optimization phase by the target-model loss of the candidate starting point.

What would settle it

Run the hybrid attack against a target model whose vulnerability surface is deliberately mismatched to every available local model, for example a target trained on a different data distribution or with adversarial training the attacker does not know about, and measure the distribution of queries per successful adversarial example; if starting from local candidates does not beat starting from original seeds on average across seeds, the claim that failed transfers are useful starting points would be refuted.

Watch

Extended reading notes

Core claim

The paper's central claim is that failed transfer candidates are not wasted effort: a candidate adversarial example produced by a local ensemble, even when it does not transfer to the target model, still lies closer to the target's decision boundary than the original seed, so optimization attacks launched from it succeed with fewer queries. The paper demonstrates this across MNIST, CIFAR10, and ImageNet, with mean query cost per adversarial example dropping by up to 81 percent (AutoZOOM on normal MNIST) and with nearly all seeds benefiting, at most 28 of 1,000 seeds on MNIST being worse from the local candidate. It also finds that a third hypothesis, that local-model gradients can be combined with estimated target gradients to guide the search, is not supported because local and target gradients are nearly orthogonal. The benefit is conditional on the vulnerability surface matching: normal local models give under 4 percent cost reduction against a robust CIFAR10 target, while robust local models give a 20.5 percent reduction.

Load-bearing premise

The attack's savings rest on the attacker having access to pretrained local models whose vulnerability surface resembles the target's, normal local models for normal targets and robust local models for robust targets, and when that match is absent the query savings largely disappear.

Editorial extensions

If this is right

On normally trained MNIST and CIFAR10 models, hybrid attacks reduce mean query cost per adversarial example by over 75 percent compared with starting optimization from original seeds.
On ImageNet, the transfer-only attack succeeds on 3.4 percent of seeds while the hybrid attack approaches 100 percent success, so combining strategies removes the main weakness of transfer attacks.
Against robust CIFAR10, using an ensemble of robust local models yields a 20.5 percent query-cost reduction where normal local models give under 4 percent, showing that the attacker should match the vulnerability surface of the target.
Fine-tuning local models with attack byproducts raises MNIST transfer rates from 60.6 percent to 76.9 percent and lowers query cost, but on CIFAR10 the same tuning hurts, so this part of the method is dataset-dependent.
With seed prioritization, a batch attacker obtains ten adversarial examples from 1,000 robust CIFAR10 seeds in about 20 queries on average, versus about 24,000 queries with random ordering.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

Editorial inference: if query count is the main cost and the main detection signal, hybrid attacks' reduced query footprint makes query-based detection harder, so defenders should focus on shrinking the transfer surface rather than only on query thresholds.
Editorial inference: the normal-versus-robust attack-surface mismatch suggests a practical adaptive strategy the paper only mentions in passing: an attacker could probe a handful of seeds with different local ensembles, measure direct transfer rates, and then commit to the ensemble whose transfer rate is highest.
Editorial inference: because the benefit of starting from a local candidate does not depend on getting score feedback, the same hybrid starting-point idea should carry over to label-only black-box attacks, though the paper only states this as an expectation and does not test it.

Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

The main result is solid: failed transfer candidates are genuinely better starting points for black-box optimization attacks, and using them cuts queries per adversarial example by 50–80% on normally trained models across MNIST, CIFAR10, and ImageNet. The paper is also honest in the right places—it reports that Hypothesis 3 (local gradients as priors) found no support, and it shows the tuning idea failing on CIFAR10 rather than hiding it. The artifact is released and the experiments use 5-run averages, which is more than most papers in this area do.

The stress-test concern about Table 3 is real. The caption defines Queries/Search as the average number of queries per successful adversarial example found using the gradient attack, excluding direct transfers. Under that definition, the Base rows must match Queries/AE, because Base starts from original seeds and has no direct-transfer phase. They don't match anywhere—MNIST AutoZOOM shows 3,248 vs 1,610. The Ours rows are internally consistent with the formula, so the problem is specifically with the baseline. This does not overturn the primary Queries/AE numbers, which are direct measurements and clearly favorable to the hybrid approach. But the paper's secondary claim that local candidates help "beyond direct transfer" by up to 76% rests on this questionable accounting and needs to be rechecked or explicitly redefined.

The tuning component (H2) is a softer but still real problem. Table 6 shows that on CIFAR10, tuning local models with attack byproducts raises query cost for AutoZOOM from 276 to 459 and drops transfer rate from 65.6% to 19.7%. The authors admit they don't know why. That is an acceptable negative result, but the abstract and introduction describe the tuning as part of the proposed hybrid attack without noting that it is harmful on two of the three datasets. The paper would be strengthened by presenting H2 as a failed hypothesis and repositioning the contribution around H1 and seed prioritization.

One more limitation worth naming: the gains against robust models depend on having local models trained with the same robustness paradigm. With normal local ensembles, the improvement against robust CIFAR10 is under 4%. The authors acknowledge this and discuss adaptive ensembles, but it does qualify the practical reach of the method.

Overall, this is a useful, influential paper for adversarial ML and ML-as-a-service security. The central insight is simple and likely to persist; the execution is mostly careful; the flaws are reporting issues, not load-bearing errors. Send it to peer review, and ask the authors to fix the Table 3 baseline accounting and reframe the tuning results before publication.

Referee Report

3 major / 4 minor

Summary. The paper proposes hybrid black-box attacks that combine transfer-based and optimization-based methods: local-model adversarial candidates are used as starting points for gradient-based black-box attacks (Hypothesis 1), label byproducts from optimization attacks are used to fine-tune local models (Hypothesis 2), and a seed prioritization strategy is introduced for batch attacks. The authors evaluate on MNIST, CIFAR10, and ImageNet using AutoZOOM and NES as the optimization attacks. They report large query-cost reductions on normally trained models (up to 81% for MNIST AutoZOOM), smaller gains against robust models, and substantial savings from seed prioritization in batch scenarios. Hypothesis 3 (combining local gradients with estimated gradients) is tested and not supported. The paper is empirical, with 5-run averages and an artifact-evaluated code release.

Significance. If the results hold, this is a practical contribution to black-box adversarial-example research: it shows that failed transfer candidates, which are often discarded, can serve as effective starting points for query-based optimization, and it quantifies the benefit of seed prioritization under a limited-query budget. The paper is transparent about negative results, including the failure of Hypothesis 2 on CIFAR10 and the dependence of gains on matching the attack surface of local and target models. The artifact evaluation passed, and the comparisons are against established baselines rather than against strawmen. The main quantitative claims are supported by multiple datasets and two optimization attacks, though one important metric definition needs clarification.

major comments (3)

[§4.6, Table 6] The tuning mechanism (Hypothesis 2) is presented as a component of the hybrid attack in Algorithm 1 and in the abstract, but Table 6 shows that on CIFAR10 tuning consistently harms the attack: for the normal target with AutoZOOM the transfer rate falls from 65.6% to 19.7%, Queries/AE rises from 276 to 459, and success drops from 98.2% to 96.3%; the NES attack shows a similar transfer-rate collapse (65.6% to 40.7%). The text states that the authors do not have a clear understanding of this failure. Because CIFAR10 is one of only three datasets and the only non-MNIST dataset with tuning results, the general claim that label byproducts improve hybrid attacks is not supported; the paper should either restrict the H2 claim to MNIST, identify a condition that predicts when tuning helps, or present model tuning as a dataset-specific extension rather than as a core component of the proposed method.
[§4.4, Table 3] The Queries/Search metric is load-bearing because Section 4.4 uses reductions in this column to argue that local candidates help beyond direct transfer, but the definition is ambiguous for the Base rows. The caption says Base starts from original seeds and Queries/Search excludes direct transfers; if Base has no transfer phase, an unqualified reading would require Queries/Search to equal Queries/AE, which no Base row satisfies (e.g., MNIST AutoZOOM 3,248 vs. 1,610). The body text clarifies that the last two columns are the mean query cost for adversarial examples found from non-transferring seeds, which implies that for Base the nontransferring subset is determined by the transferability of the local candidates. Please state this definition in the caption and specify how the numerator and denominator are computed for Base and Ours, so that the non-transfer cost reductions can be verified from the raw query accounting.
[§4.5, Table 4] The paper's practical claim is conditioned on the attacker having local models whose attack surface matches the target: normal local ensembles give only 3.8% cost reduction against a robust CIFAR10 target with AutoZOOM, whereas robust local ensembles give 20.5%, and the reverse is true for normal targets. This is acknowledged in the text, but the abstract and introduction should state this limitation more prominently, since the 'universal local ensemble' experiments show that no single ensemble works well for both target types and the proposed remedy (dynamically selecting ensembles) is not evaluated.

minor comments (4)

[§4.4, Table 3 caption] The phrase 'non-transfering seeds' in Section 4.4 should be corrected to 'non-transferring seeds,' and the caption should state explicitly that for Base rows the nontransferring subset is defined by the transferability of local adversarial candidates rather than by an actual transfer phase in the baseline.
[§4.6] The paper does not evaluate Hypothesis 2 on ImageNet; this should be stated in the abstract or contributions section so that readers do not overgeneralize the tuning results.
[§4.5, Table 4] The 'Fraction Better (%)' column in Table 4 is used later in the text but is not defined in the caption; please define it as the fraction of seeds for which the local candidate gives a lower total query cost than the original seed.
[§5.3, Table 10] For the two-phase strategy, the reported query counts for 'Top x%' should specify whether they include the first-phase transfer queries; the current text implies they do, but this should be stated explicitly for reproducibility.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity found: the claimed cost reductions are empirical comparisons against external baselines, and the sole self-citation is background, not load-bearing.

full rationale

The paper's central claim is empirical, not derivational: it measures whether using failed local transfer candidates as starting points for AutoZOOM/NES reduces the average number of queries needed to find adversarial examples. The primary metric, Queries/AE, is defined as total model queries divided by the number of successful adversarial examples found across a fixed seed set, and the comparison is made against external baseline attacks (AutoZOOM and NES) with raw query counts, independently sampled test images, and results averaged over five runs. No parameter is fitted to the target metric and then renamed as a prediction. The one self-citation, reference [38], appears only in a background enumeration of prior optimization attacks ('Previous black-box attacks can be grouped into two categories: transfer attacks [35, 36] and optimization attacks [10, 21, 22, 38, 43]') and is not used to justify the hybrid method or to rule out alternatives. The paper also explicitly reports negative results and limitations, including the failure to find evidence for Hypothesis 3 and the degraded CIFAR10 transfer rates after tuning, which is not how a circular derivation would behave. A reviewer concern about the internal consistency of Table 3's Base Queries/Search column (e.g., MNIST AutoZOOM Base Queries/AE=1,610 versus Queries/Search=3,248 despite the Base condition having no stated transfer stage) is a correctness/accounting question about the baseline metric, not a circularity of the claim; the central non-transfer cost reductions are still directly measured quantities. For these reasons, no circular step is identified and the circularity score is 0.

Assumptions & free parameters 0 free parameters · 4 assumptions · 0 invented entities

No free parameters are fitted to data; all configuration choices (epsilon, query limits, retraining threshold c) are taken from prior work or set as standard experimental constants. The axioms are standard domain assumptions for black-box adversarial attack research, with the key fragility being that local models must match the target model's robustness regime.

assumptions (4)

domain assumption The adversary has access to pretrained local models for the same task as the target model.
Stated in the threat model (Section 3) and used to generate transfer candidates and to tune models throughout Algorithm 1.
domain assumption Local and target models share decision-boundary structure, so local adversarial examples lie closer to target adversarial regions.
Hypothesis H1 in Section 3, justified by Liu et al. [29]; without this similarity, candidates would not help.
domain assumption The adversary receives full prediction scores from each query.
Assumed in Section 2.2 and the experimental setup; all attack algorithms and loss-based prioritization depend on score feedback.
domain assumption Robust and normal models have different attack surfaces, so local models must match the target's training paradigm.
Section 4.5 shows normal local models give little benefit against robust targets; robust local ensembles are needed for robust targets.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Hybrid Batch Attacks: Finding Black-box Adversarial Examples with Limited Queries." pith.science (2026). https://pith.science/paper/2F7TYZVO

@misc{pith2026190807000,
  author       = {Pith},
  title        = {Pith review of: Hybrid Batch Attacks: Finding Black-box Adversarial Examples with Limited Queries},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/2F7TYZVO}},
  note         = {Machine review of arXiv:1908.07000}
}

read the original abstract

We study adversarial examples in a black-box setting where the adversary only has API access to the target model and each query is expensive. Prior work on black-box adversarial examples follows one of two main strategies: (1) transfer attacks use white-box attacks on local models to find candidate adversarial examples that transfer to the target model, and (2) optimization-based attacks use queries to the target model and apply optimization techniques to search for adversarial examples. We propose hybrid attacks that combine both strategies, using candidate adversarial examples from local models as starting points for optimization-based attacks and using labels learned in optimization-based attacks to tune local models for finding transfer candidates. We empirically demonstrate on the MNIST, CIFAR10, and ImageNet datasets that our hybrid attack strategy reduces cost and improves success rates. We also introduce a seed prioritization strategy which enables attackers to focus their resources on the most promising seeds. Combining hybrid attacks with our seed prioritization strategy enables batch attacks that can reliably find adversarial examples with only a handful of queries.

Figures

Figures reproduced from arXiv: 1908.07000 by the authors.

**Figure 1.** Transfer rates of different local ensembles. The Normal-3 ensemble is composed of the three normal models, NA, NB, and NC; the Robust-2 ensemble is composed of R-DenseNet and R-ResNet. The All-5 is composed of all of the 5 local models. Transfer rate is measured on independently sampled test images and is averaged over 5 runs. next explore if a universal local model ensemble exists that works well for both normal an… view at source ↗

**Figure 2.** First phase (transfer only) attack prioritization (untargeted attack on robust CIFAR10 model, average over 5 runs). [PITH_FULL_IMAGE:figures/full_fig_p012_2.png] view at source ↗

**Figure 3.** Query cost of NES attack on MNIST, CIFAR10 and ImageNet models. We exclude direct transfers (successfully [PITH_FULL_IMAGE:figures/full_fig_p013_3.png] view at source ↗

Figures from the paper (3 more)

**Figure 4.** Figure 4: Impact of seed prioritization strategies in the second phase (AutoZOOM untargeted attack on robust CIFAR10 model, [PITH_FULL_IMAGE:figures/full_fig_p014_4.png]

**Figure 5.** Figure 5: Comparison of the target loss value based seed prioritization strategy to retroactive optimal and random search strategies [PITH_FULL_IMAGE:figures/full_fig_p015_5.png]

**Figure 6.** Figure 6: Comparison of the two-phase seed prioritization strategy to retroactive optimal and random search strategies [PITH_FULL_IMAGE:figures/full_fig_p016_6.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

45 extracted references · 35 canonical work pages

[1]

There are no bit parts for sign bits in black-box attacks

Abdullah Al-Dujaili and Una-May O’Reilly. There are no bit parts for sign bits in black-box attacks. arXiv:1902.06894, 2019

arXiv 1902
[2]

GenAttack: Practical black-box attacks with gradient-free optimization

Moustafa Alzantot, Yash Sharma, Supriyo Chakraborty, and Mani Srivastava. GenAttack: Practical black-box attacks with gradient-free optimization. In The Genetic and Evolutionary Computation Conference, 2019

work page 2019
[3]

The shat- tered gradients problem: If resnets are the answer, then what is the question? In International Conference on Machine Learning, 2017

David Balduzzi, Marcus Frean, Lennox Leary, JP Lewis, Kurt Wan-Duo Ma, and Brian McWilliams. The shat- tered gradients problem: If resnets are the answer, then what is the question? In International Conference on Machine Learning, 2017

work page 2017
[4]

Exploring the space of black-box attacks on deep neural networks

Arjun Nitin Bhagoji, Warren He, Bo Li, and Dawn Song. Exploring the space of black-box attacks on deep neural networks. In European Conference on Computer Vision, 2019

work page 2019
[5]

Decision-based adversarial attacks: Reliable attacks against black-box machine learning models

Wieland Brendel, Jonas Rauber, and Matthias Bethge. Decision-based adversarial attacks: Reliable attacks against black-box machine learning models. In Interna- tional Conference on Learning Representations, 2018

work page 2018
[6]

Guessing smart: Biased sampling for e ﬃcient black-box adversarial attacks

Thomas Brunner, Frederik Diehl, Michael Truong Le, and Alois Knoll. Guessing smart: Biased sampling for e ﬃcient black-box adversarial attacks. arXiv:1812.09803, 2018

arXiv 2018
[7]

Prototypical examples in deep learning: Metrics, characteristics, and utility

Nicholas Carlini, Ulfar Erlingsson, and Nico- las Papernot. Prototypical examples in deep learning: Metrics, characteristics, and utility. https://openreview.net/forum?id=r1xyx3R9tQ, 2018

work page 2018
[8]

Towards evaluating the robustness of neural networks

Nicholas Carlini and David Wagner. Towards evaluating the robustness of neural networks. In IEEE Symposium on Security and Privacy, 2017

2017

Show all 45 references

[9]

Boundary at- tack++: Query-eﬃcient decision-based adversarial at- tack

Jianbo Chen and Michael I Jordan. Boundary at- tack++: Query-eﬃcient decision-based adversarial at- tack. arXiv:1904.02144, 2019

1904 arXiv
[10]

ZOO: Zeroth order optimization based black-box attacks to deep neural networks without training substitute models

Pin-Yu Chen, Huan Zhang, Yash Sharma, Jinfeng Yi, and Cho-Jui Hsieh. ZOO: Zeroth order optimization based black-box attacks to deep neural networks without training substitute models. In 10th ACM Workshop on Artiﬁcial Intelligence and Security, 2017

2017
[11]

Stateful detection of black-box adversarial attacks

Steven Chen, Nicholas Carlini, and David Wagner. Stateful detection of black-box adversarial attacks. arXiv:1907.05587, 2019

1907 arXiv
[12]

Query-eﬃcient hard- label black-box attack: An optimization-based approach

Minhao Cheng, Thong Le, Pin-Yu Chen, Jinfeng Yi, Huan Zhang, and Cho-Jui Hsieh. Query-eﬃcient hard- label black-box attack: An optimization-based approach. In International Conference on Learning Representa- tions, 2019

2019
[13]

Improving black-box adversarial attacks with a transfer-based prior

Shuyu Cheng, Yinpeng Dong, Tianyu Pang, Hang Su, and Jun Zhu. Improving black-box adversarial attacks with a transfer-based prior. arXiv:1906.06919, 2019

1906 arXiv
[14]

J. Deng, W. Dong, R. Socher, L.-J. Li, K. Li, and L. Fei- Fei. ImageNet: A Large-Scale Hierarchical Image Database. In IEEE Conference on Computer Vision and Pattern Recognition, 2009

2009
[15]

Boosting adver- sarial attacks with momentum

Yinpeng Dong, Fangzhou Liao, Tianyu Pang, Hang Su, Jun Zhu, Xiaolin Hu, and Jianguo Li. Boosting adver- sarial attacks with momentum. In IEEE Conference on Computer Vision and Pattern Recognition, 2018

2018
[16]

Evading defenses to transferable adversarial examples by translation-invariant attacks

Yinpeng Dong, Tianyu Pang, Hang Su, and Jun Zhu. Evading defenses to transferable adversarial examples by translation-invariant attacks. In IEEE Conference on Computer Vision and Pattern Recognition, 2019

2019
[17]

Explaining and harnessing adversarial exam- ples

Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial exam- ples. In International Conference on Learning Repre- sentations, 2015

2015
[18]

Simple black-box adversarial attacks

Chuan Guo, Jacob R Gardner, Yurong You, Andrew Gor- don Wilson, and Kilian Q Weinberger. Simple black-box adversarial attacks. In International Conference on Ma- chine Learning, 2019

2019
[19]

Deep residual learning for image recognition

Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In IEEE Conference on Computer Vision and Pattern Recognition, 2016

2016
[20]

Densely connected convolutional networks

Gao Huang, Zhuang Liu, Laurens Van Der Maaten, and Kilian Q Weinberger. Densely connected convolutional networks. In IEEE Conference on Computer Vision and Pattern Recognition, 2017

2017
[21]

Black-box adversarial attacks with limited queries and information

Andrew Ilyas, Logan Engstrom, Anish Athalye, and Jessy Lin. Black-box adversarial attacks with limited queries and information. In International Conference on Machine Learning, July 2018

2018
[22]

Prior convictions: Black-box adversarial attacks with bandits and priors

Andrew Ilyas, Logan Engstrom, and Aleksander Madry. Prior convictions: Black-box adversarial attacks with bandits and priors. In International Conference on Learning Representations, 2019

2019
[23]

Learning mul- tiple layers of features from tiny images

Alex Krizhevsky and Geoﬀrey Hinton. Learning mul- tiple layers of features from tiny images. Technical Report, 2009

2009
[24]

Ad- versarial examples in the physical world

Alexey Kurakin, Ian Goodfellow, and Samy Bengio. Ad- versarial examples in the physical world. In ICLR Work- shop, 2016

2016
[25]

The MNIST database of handwritten digits

Yann LeCun. The MNIST database of handwritten digits. http://yann.lecun.com/exdb/mnist/, 1998. 17

1998
[26]

Gradient-based learning applied to document recognition

Yann LeCun, Léon Bottou, Yoshua Bengio, Patrick Haﬀner, et al. Gradient-based learning applied to document recognition. Proceedings of the IEEE , 86(11):2278–2324, 1998

1998
[27]

Query- eﬃcient black-box attack by active learning

Pengcheng Li, Jinfeng Yi, and Lijun Zhang. Query- eﬃcient black-box attack by active learning. In IEEE International Conference on Data Mining, 2018

2018
[28]

Nattack: Learning the distributions of adversarial examples for an improved black-box attack on deep neural networks

Yandong Li, Lijun Li, Liqiang Wang, Tong Zhang, and Boqing Gong. Nattack: Learning the distributions of adversarial examples for an improved black-box attack on deep neural networks. In International Conference on Machine Learning, 2019

2019
[29]

Delving into transferable adversarial examples and black-box attacks

Yanpei Liu, Xinyun Chen, Chang Liu, and Dawn Song. Delving into transferable adversarial examples and black-box attacks. In International Conference on Learning Representations, 2017

2017
[30]

CIFAR10 adversarial examples challenge

Aleksander Madry. CIFAR10 adversarial examples challenge. https://github.com/MadryLab/cifar10_challenge, July 2017

2017
[31]

MNIST adversarial examples chal- lenge

Aleksander Madry. MNIST adversarial examples chal- lenge. https://github.com/MadryLab/mnist_challenge, June 2017

2017
[32]

Towards deep learning models resistant to adversarial attacks

Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. In International Conference on Learning Representations, 2018

2018
[33]

Parsi- monious black-box adversarial attacks via eﬃcient com- binatorial optimization

Seungyong Moon, Gaon An, and Hyun Oh Song. Parsi- monious black-box adversarial attacks via eﬃcient com- binatorial optimization. In International Conference on Machine Learning, 2019

2019
[34]

Simple black-box adversarial perturbations for deep net- works

Nina Narodytska and Shiva Prasad Kasiviswanathan. Simple black-box adversarial perturbations for deep net- works. In CVPR Workshop, 2017

2017
[35]

Transferability in machine learning: from phe- nomena to black-box attacks using adversarial samples

Nicolas Papernot, Patrick McDaniel, and Ian Goodfel- low. Transferability in machine learning: from phe- nomena to black-box attacks using adversarial samples. arXiv:1605.07277, 2016

2016 arXiv
[36]

Practical black-box attacks against machine learning

Nicolas Papernot, Patrick McDaniel, Ian Goodfellow, Somesh Jha, Z Berkay Celik, and Ananthram Swami. Practical black-box attacks against machine learning. In ACM Asia Conference on Computer and Communica- tions Security, 2017

2017
[37]

Very deep con- volutional networks for large-scale image recognition

Karen Simonyan and Andrew Zisserman. Very deep con- volutional networks for large-scale image recognition. In International Conference on Learning Representa- tions, 2015

2015
[38]

Query-limited black-box attacks to classiﬁers

Fnu Suya, Yuan Tian, David Evans, and Paolo Papotti. Query-limited black-box attacks to classiﬁers. In NIPS Workshop in Machine Learning and Computer Security, 2017

2017
[39]

Intriguing properties of neural networks

Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. Intriguing properties of neural networks. In International Conference on Learning Representations, 2014

2014
[40]

Targeted adversarial examples for black box audio systems

Rohan Taori, Amog Kamsetty, Brenton Chu, and Nikita Vemuri. Targeted adversarial examples for black box audio systems. arXiv:1805.07820, 2018

2018 arXiv
[41]

En- semble adversarial training: Attacks and defenses

Florian Tramèr, Alexey Kurakin, Nicolas Papernot, Ian Goodfellow, Dan Boneh, and Patrick McDaniel. En- semble adversarial training: Attacks and defenses. In International Conference on Learning Representations, 2018

2018
[42]

Robustness may be at odds with accuracy

Dimitris Tsipras, Shibani Santurkar, Logan Engstrom, Alexander Turner, and Aleksander Madry. Robustness may be at odds with accuracy. In International Confer- ence on Learning Representations, 2019

2019
[43]

Autozoom: Autoencoder-based zeroth order optimization method for attacking black-box neural net- works

Chun-Chen Tu, Paishun Ting, Pin-Yu Chen, Sijia Liu, Huan Zhang, Hsieh Cho-Jui Yi, Jinfeng, and Shin-Ming Cheng. Autozoom: Autoencoder-based zeroth order optimization method for attacking black-box neural net- works. In AAAI Conference on Artiﬁcial Intelligence, 2018

2018
[44]

Natural evolution strategies

Daan Wierstra, Tom Schaul, Jan Peters, and Juergen Schmidhuber. Natural evolution strategies. In IEEE Congress on Evolutionary Computation, 2008

2008
[45]

Improving transferability of adversarial examples with input diversity

Cihang Xie, Zhishuai Zhang, Jianyu Wang, Yuyin Zhou, Zhou Ren, and Alan Yuille. Improving transferability of adversarial examples with input diversity. In IEEE Con- ference on Computer Vision and Pattern Recognition, 2019. 18

2019

Pith tools

Reviewed August 14, 2026 · model on record in the stance chip above.

[1] [1]

There are no bit parts for sign bits in black-box attacks

Abdullah Al-Dujaili and Una-May O’Reilly. There are no bit parts for sign bits in black-box attacks. arXiv:1902.06894, 2019

arXiv 1902

[2] [2]

GenAttack: Practical black-box attacks with gradient-free optimization

Moustafa Alzantot, Yash Sharma, Supriyo Chakraborty, and Mani Srivastava. GenAttack: Practical black-box attacks with gradient-free optimization. In The Genetic and Evolutionary Computation Conference, 2019

work page 2019

[3] [3]

The shat- tered gradients problem: If resnets are the answer, then what is the question? In International Conference on Machine Learning, 2017

David Balduzzi, Marcus Frean, Lennox Leary, JP Lewis, Kurt Wan-Duo Ma, and Brian McWilliams. The shat- tered gradients problem: If resnets are the answer, then what is the question? In International Conference on Machine Learning, 2017

work page 2017

[4] [4]

Exploring the space of black-box attacks on deep neural networks

Arjun Nitin Bhagoji, Warren He, Bo Li, and Dawn Song. Exploring the space of black-box attacks on deep neural networks. In European Conference on Computer Vision, 2019

work page 2019

[5] [5]

Decision-based adversarial attacks: Reliable attacks against black-box machine learning models

Wieland Brendel, Jonas Rauber, and Matthias Bethge. Decision-based adversarial attacks: Reliable attacks against black-box machine learning models. In Interna- tional Conference on Learning Representations, 2018

work page 2018

[6] [6]

Guessing smart: Biased sampling for e ﬃcient black-box adversarial attacks

Thomas Brunner, Frederik Diehl, Michael Truong Le, and Alois Knoll. Guessing smart: Biased sampling for e ﬃcient black-box adversarial attacks. arXiv:1812.09803, 2018

arXiv 2018

[7] [7]

Prototypical examples in deep learning: Metrics, characteristics, and utility

Nicholas Carlini, Ulfar Erlingsson, and Nico- las Papernot. Prototypical examples in deep learning: Metrics, characteristics, and utility. https://openreview.net/forum?id=r1xyx3R9tQ, 2018

work page 2018

[8] [8]

Towards evaluating the robustness of neural networks

Nicholas Carlini and David Wagner. Towards evaluating the robustness of neural networks. In IEEE Symposium on Security and Privacy, 2017

2017