How stealthy is stealthy? Studying the Efficacy of Black-Box Adversarial Attacks in the Real World

Francesco Panebianco; Mario D'Onghia; Stefano Zanero aand Michele Carminati

REVIEW 4 major objections 6 minor 39 references

How stealthy is stealthy? Studying the Efficacy of Black-Box Adversarial Attacks in the Real World

T0 review · 4 major / 6 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read The paper claims that a new black-box attack, ECLIPSE, balances JPEG-compression robustness, automatic-detection stealth, and human invisibility at once, a trade-off no prior evaluated attack achieves.

desk verdict Novel attack design and a useful three-property framework, but the evaluation's unequal baselines, a self-contradictory ablation table, and a collapsed detector undermine the headline claims. read the letter →

arxiv 2506.05382 v1 pith:3WVZ2VMI submitted 2025-06-03 cs.CR cs.AI

Francesco Panebianco , Mario D'Onghia , Stefano Zanero aand Michele Carminati This is my paper

classification cs.CRcs.AI

keywords AdversarialexamplesBlack-boxattacksComputervisionEvasionStealthinessJPEGcompressionGaussianblurSurrogatemodel

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper sets out to measure whether adversarial attacks on image classifiers are feasible outside the lab, where images get compressed, services watch for attack patterns, and humans might look at the picture. It defines three effectiveness properties — robustness to JPEG compression, stealthiness to spectral-based automatic detection, and stealthiness to human inspection — and evaluates three popular black-box confidence-based attacks (SimBA, SimBA-DCT, Square Attack) against them, finding that each attack satisfies some properties but fails others. The authors then propose ECLIPSE, a targeted attack that combines hill-climbing gradient estimation with Gaussian-blurred gradients and a gradient-sampling mask drawn from GradCAM heatmaps of a local surrogate model. In their experiments on the Animals-10 dataset (cats misclassified as dogs), ECLIPSE is the only method that combines a low-loss rate of 89.33% under JPEG compression, a spectral detector that performs at chance (AUC 0.50), and a 62.55% share of human ratings of 'not visible' or 'slightly visible'. The claim is that this closes the long-standing trade-off and shows that real-world black-box threats need to be taken at least as seriously as white-box ones.

What carries the argument

The load-bearing mechanism is the ECLIPSE optimization loop, whose two novel steps interact. First, Gaussian blurring of the estimated gradient tensor ($k{=}3$, standard deviation $\sigma$) spreads each sampled finite-difference gradient to neighbouring coordinates, producing smoother, coarser perturbations; the ablation study attributes JPEG-compression robustness and automatic-detection stealth mainly to this step. Second, a time-varying sampling mask derived from a GradCAM heatmap on a local surrogate DenseNet201 restricts gradient sampling to the most salient regions (mask threshold rising from 0.0 to 0.5), which mostly reduces query cost rather than visual stealth. The outer loop is standard hill climbing with a decaying step size, and the three effectiveness properties P1, P2, P3 form the evaluation scaffold that lets the paper compare ECLIPSE against SimBA, SimBA-DCT, and Square Attack $L_\infty$.

What would settle it

Take a black-box model with a markedly different inductive bias, such as a vision transformer or a CNN trained on a different dataset, and keep the DenseNet201 surrogate fixed; if ECLIPSE's JPEG-survival rate falls toward SimBA's level and the spectral detector's AUC rises well above 0.5, the transferability of the surrogate mask is refuted and the generality of the trade-off claim with it.

Watch

Extended reading notes

Core claim

ECLIPSE (Evasion of Classifiers with Local Increase in Pixel Sparse Environment) is a targeted, confidence-based black-box evasion attack built on hill climbing. The attacker queries a remote oracle for the confidence score of the desired target class, samples a small batch of coordinates inside a mask, estimates their gradients by finite differences, blurs that gradient tensor with a Gaussian kernel, and updates the image within an $L_\infty$ budget of 0.1 (0.05 for the human survey) only if the target confidence increases. The step size decays exponentially and the algorithm stops early once the target confidence exceeds 0.5. The mask is generated by GradCAM on a local DenseNet201 surrogate trained on an ImageNet subset, on the assumption that the surrogate's salient regions approximate those of the remote ResNet152V2 oracle. The paper claims these two ingredients let adversarial examples survive JPEG compression, remain statistically indistinguishable from benign images to a DCT-spectrum SVM detector, and are rated invisible or slightly visible by a majority of the 127 surveyed participants — the only evaluated method to score well on all three effectiveness properties simultaneously.

Load-bearing premise

Everything hinges on the local DenseNet201 surrogate approximating the remote ResNet152V2 oracle closely enough that GradCAM heatmaps point to the same image regions; if the surrogate's attention diverges from the oracle's, the sampling mask guides queries to irrelevant areas and the attack's success, compression survival, and stealth all degrade together.

Editorial extensions

If this is right

Confidence-scoring computer-vision APIs should be treated as practically attackable: an attacker can now craft examples that survive the compression and detection layers that such APIs typically apply.
JPEG compression alone is not a reliable defense against black-box attacks, and spectral-fingerprint detectors will miss ECLIPSE-style perturbations, so effective defenses need to combine multiple cues.
The three-property framework gives a common yardstick: future attacks can report P1, P2, P3 scores, and future defenses can measure how much they degrade each property, rather than only fooling rate.
Because ECLIPSE is a targeted attack demonstrated on a cat-to-dog task, the underlying machinery should transfer to other source-target pairs and to other confidence-scoring domains, widening the practical threat.
The ablation results indicate that the Gaussian blur is the main driver of compression robustness and detection stealth, while the surrogate mask mainly improves query efficiency — so even attackers with weak surrogates can keep part of the benefit.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

The evaluation uses one remote oracle (ResNet152V2) and one surrogate (DenseNet201), both CNNs trained on overlapping data; if the oracle were a vision transformer or trained on a different distribution, the GradCAM mask could lose alignment and the trade-off could narrow — the paper does not test this.
Median query cost is about 8,125 calls per example, which is high for real deployments; a rate-limited or billed API would force the attacker to spread queries over time or across accounts, an operational constraint the paper mentions but does not fold into the three-property framework.
Gradient blurring and attention masking are attack-agnostic ingredients that could in principle be grafted onto Square Attack or SimBA; the paper does not test that transfer, but it would be a natural way to see if the trade-off improvement is intrinsic to these steps.
The human survey finds that respondents who do not know what adversarial examples are score all images as more altered, including clean ones; this suggests absolute visibility numbers depend on the population, so cross-study comparisons should control for awareness or use paired clean-image baselines.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Colleague,

The thing to know: this paper has a genuinely new attack design and a sensible evaluation framework, but the experiments as reported don't support the headline claims. ECLIPSE combines Gaussian blurring of estimated gradients with a sampling mask derived from a local surrogate's GradCAM heatmaps, inside a hill-climbing loop. That combination is new to me, and the three-property formalization (compression robustness, automatic-detection evasion, human invisibility) is a useful way to organize the space. The human survey with 127 participants is real work, and the ablation study is the right instinct.

The soft spots are serious but fixable. First, the comparison is apples-to-oranges: ECLIPSE gets a surrogate model (DenseNet201) to guide its sampling, while SimBA, SimBA-DCT, and Square Attack are treated as query-only. That gives ECLIPSE information the baselines lack. Either give all attacks a surrogate or make ECLIPSE query-only. Second, the ablation narrative contradicts its own Table 5. The text says removing Gaussian blur improves robustness to processing and cuts queries; the table shows the opposite — blur removal worsens median loss (0.36 vs 0.15), low-loss rate (24% vs 89.33%), survival (0.67% vs 18.67%), and median queries (12870 vs 8125). That is not a minor typo; it inverts the conclusion for one of the two claimed contributions.

The bigger problem is the 'perfect stealthiness' claim. Table 3 reports, for Normal vs ECLIPSE, accuracy 0.87, precision 0.03, recall 0.01, AUC 0.50, on a balanced 150/150 set. Those numbers are mutually impossible: precision 0.03 and recall 0.01 imply about 1.5 true positives and 48.5 false positives, which gives accuracy around 0.34, not 0.87. The AUC of 0.50 with those precision/recall values means the SVM collapsed to predicting 'normal' for nearly everything. So 'perfect stealthiness' is not demonstrated; it's an artifact of a broken detector. Re-baseline the detector or soften the claim.

If these are fixed — equalize the threat model, correct the ablation discussion, and re-evaluate or re-report the detection results — the paper could be a reasonable contribution to the adversarial-ML literature. As it stands, I wouldn't rely on the reported numbers.

Recommendation: send it to peer review, but expect heavy revision. The core idea is worth referee time, and the framework is useful for the community. I'd bring it to a reading group, mainly to discuss the evaluation pitfalls.

Referee Report

4 major / 6 minor

Summary. The paper proposes ECLIPSE, a confidence-based black-box evasion attack that combines Hill Climbing with two novel components: Gaussian blurring of estimated gradients and a sampling mask derived from GradCAM heatmaps of a local surrogate model. The authors introduce three effectiveness properties for real-world attacks—robustness to JPEG compression (P1), stealthiness to automatic spectral detection (P2), and stealthiness to human inspection (P3)—and evaluate ECLIPSE against SimBA, SimBA-DCT, and Square Attack L∞ on the Animals-10 dataset using a ResNet152V2 oracle. The central claim is that ECLIPSE achieves the best published trade-off among the three properties, including 'perfect stealthiness' against spectral detection (AUC 0.5) and strong compression robustness.

Significance. If the results were fully supported, the proposed three-property evaluation framework would be a useful contribution to the adversarial machine learning literature, and ECLIPSE would be a noteworthy attack design. The paper also includes a human perception survey and an ablation study, which are valuable empirical components. However, the current evidence does not establish the central trade-off claim: the detection metrics in Table 3 are internally inconsistent, the ablation text contradicts the data in Tables 4 and 5, and the comparison to baselines is inequitable because ECLIPSE receives external surrogate knowledge. With these issues fixed, the framework and the attack could be of interest to the community, but as presented the main conclusions are not reliable.

major comments (4)

[§5, Table 3 and Table 4] The reported detection metrics for 'Normal vs ECLIPSE' are internally inconsistent on a balanced set of 150 normal and 150 adversarial examples. Precision 0.03 with recall 0.01 implies TP ≈ 1.5, FP ≈ 48.5, and TN ≈ 101.5, yielding an accuracy of approximately 0.34, not the reported 0.87. The large standard deviation around precision (±0.20) indicates degenerate cross-validation folds in which the SVM essentially never predicts the adversarial class. Consequently, the AUC of 0.50 cannot be interpreted as evidence of 'perfect stealthiness'; it may simply reflect a detector that has collapsed to predicting 'normal' for essentially every input. This directly undermines the P2 comparison in Figure 9 and the corresponding conclusion in Section 6.
[§5, 'ECLIPSE Ablation Study' and Table 5] The ablation text directly contradicts the data it cites. The paper states that removing Gaussian blur 'improves robustness to processing,' but Table 5 reports, for No Gaussian blur versus ECLIPSE, median loss 0.36 versus 0.15, low-loss 24.00% versus 89.33%, and surviving 0.67% versus 18.67%—every compression metric worsens when blur is removed. Similarly, the text says that removing the local surrogate 'benefits stealthiness, with a drop in ROC AUC from 0.71 to 0.5,' but Table 4 shows the opposite: ECLIPSE has AUC 0.50 and No Local Surrogate has AUC 0.71, meaning removal makes the attack more detectable. These contradictions must be resolved before the ablation can support the claimed contribution of either component.
[§4 (Local Surrogate) and §5 (Table 2)] The experimental comparison is inequitable because ECLIPSE is given access to a local surrogate model (DenseNet201 trained on a 12-class ImageNet subset) while SimBA, SimBA-DCT, and Square Attack are strictly query-only. The GradCAM-derived mask is external knowledge about the oracle that the baselines do not receive, so the reported advantages in query counts, compression robustness, and detectability may reflect this additional information rather than the attack mechanism itself. The paper should either add an ECLIPSE variant without the surrogate to the main comparison, or explicitly frame ECLIPSE as a transfer-assisted attack and benchmark it against transfer-based baselines under the same assumptions.
[§6 Conclusions] The phrase 'perfect stealthiness (AUC 0.5)' is an overstatement. A ROC AUC of 0.5 means no discriminability, which is not the same as evading a working detector; given the inconsistent metrics in Table 3, the paper has not excluded the possibility that the detector simply failed to train for this comparison. The claim should be softened to something like 'not detected by the tested spectral detector under the reported cross-validation conditions,' and the detector should be validated with positive and negative controls before any stealthiness conclusion is drawn.

minor comments (6)

[§5, P1] Table 1 reports median loss, low-loss percentage, and surviving percentage without confidence intervals or the number of images per attack; given that the P2 experiments use 150 samples, it is unclear whether differences such as 18.67% versus 15.33% are statistically significant. Please report per-sample distributions and significance tests.
[§5, P2] The description of the detection classifier omits the DCT feature extraction procedure, the dimensionality of the features, the SVM kernel and hyperparameters, and the exact cross-validation scheme (number of folds and stratification). Without these details the experiments cannot be replicated.
[Algorithm 1, line 9] The notation f(C_{t-1}+1(i,j,c)) is ambiguous; please define the one-hot unit perturbation at coordinate (i,j,c) explicitly.
[Figure 7] The caption contains a typo: 'attach' should be 'attack'.
[Figure 9] The label 'P3 (% of 0-1 ans.)' is unclear; expand it to specify that it is the percentage of survey responses with scores 0 or 1, and consider adding error bars or confidence intervals.
[References] Some references contain duplicated author names, for example reference [23] repeats 'Binghui Wang' and 'Michael I. Jordan' multiple times; these appear to be formatting artifacts and should be cleaned up.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity: ECLIPSE is an empirically evaluated heuristic; the reported P2 inconsistencies are validity concerns, not circular derivation.

full rationale

ECLIPSE is constructed as a heuristic optimization loop: finite-difference gradient estimates are Gaussian-blurred, sampling is masked by GradCAM heatmaps from a DenseNet201 surrogate, and hill climbing is driven by the oracle's confidence. The three effectiveness properties (compression robustness, spectral-detection evasion, human invisibility) are external evaluation criteria; they do not appear as terms in the attack's objective, and no parameter is fitted to the JPEG-compression, DCT-detector, or human-survey results. The local surrogate is an external pretrained model whose transferability is an empirical assumption, not a definition of the target model's behavior. References are to standard prior work (SimBA, Square Attack, GradCAM, Gaussian blur), and no load-bearing self-citation appears. The 'perfect stealthiness' statement is simply the operational reading of AUC 0.5 for one fitted SVM detector; while Table 3's metrics are mutually inconsistent on a balanced 150/150 set (accuracy 0.87 cannot coexist with precision 0.03 and recall 0.01), and the ablation text appears to contradict its own Table 5, these are correctness or validity threats rather than instances of the derivation reducing to its inputs. No equation or fitted parameter in the paper makes the claimed results equivalent to the inputs by construction, so no circularity step can be exhibited and the circularity score is 0.

Assumptions & free parameters 4 free parameters · 3 assumptions · 0 invented entities

The paper introduces no new physical or conceptual entities. Its central claim depends on the chosen hyperparameters and on the validity of the surrogate transfer and detector representativeness assumptions.

free parameters (4)

initial learning rate epsilon_0 = 0.1 (step size in Table 2)
Chosen by hand, not fitted; the central comparison uses this fixed value.
L_infinity budget beta = 0.1 (0.05 for human survey)
Selected to match baseline settings; the perturbation level directly affects all three properties.
Gaussian blur kernel size k = 3
Arbitrary choice; the ablation shows it changes the trade-off, but no sensitivity analysis is given.
mask threshold increment = 0.01 per iteration
Hand-specified scheduling parameter affecting where perturbations are sampled.

assumptions (3)

domain assumption A local surrogate model trained on an ImageNet subset reliably approximates the remote oracle ResNet152V2 on the Animals-10 task.
Invoked in Section 4 (Local Surrogate) and used to generate all ECLIPSE masks; if the surrogate is misaligned, the attack loses its guidance mechanism.
domain assumption The DCT-spectrum SVM detector is representative of automatic adversarial example detection.
Used in Section 5 (P2) to measure stealthiness; a single detector type cannot represent all detection methods.
domain assumption The 127-person survey provides a reliable measure of human visual stealthiness.
Used in Section 5 (P3); the sample skews young and STEM, so generalizability to broader human inspection is limited.

how reviews work

0 comments

Cite this review

Pith. "Pith review of How stealthy is stealthy? Studying the Efficacy of Black-Box Adversarial Attacks in the Real World." pith.science (2026). https://pith.science/paper/3WVZ2VMI

@misc{pith2026250605382,
  author       = {Pith},
  title        = {Pith review of: How stealthy is stealthy? Studying the Efficacy of Black-Box Adversarial Attacks in the Real World},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/3WVZ2VMI}},
  note         = {Machine review of arXiv:2506.05382}
}

read the original abstract

Deep learning systems, critical in domains like autonomous vehicles, are vulnerable to adversarial examples (crafted inputs designed to mislead classifiers). This study investigates black-box adversarial attacks in computer vision. This is a realistic scenario, where attackers have query-only access to the target model. Three properties are introduced to evaluate attack feasibility: robustness to compression, stealthiness to automatic detection, and stealthiness to human inspection. State-of-the-Art methods tend to prioritize one criterion at the expense of others. We propose ECLIPSE, a novel attack method employing Gaussian blurring on sampled gradients and a local surrogate model. Comprehensive experiments on a public dataset highlight ECLIPSE's advantages, demonstrating its contribution to the trade-off between the three properties.

Figures

Figures reproduced from arXiv: 2506.05382 by the authors.

**Figure 1.** Main steps of the ECLIPSE algorithm: The perturbation mask is computed initially, while other steps iterate until convergence [PITH_FULL_IMAGE:figures/full_fig_p006_1.png] view at source ↗

**Figure 2.** Example comparison of GradCAM heatmaps on a local surrogate and a remote model. Cat image is from the Animals-10 [14] dataset. Local Surrogate. Adversarial optimization benefits from identifying relevant input features, which is challenging in query-only scenarios. Surrogate models trained on the same task can approximate remote behavior. We thus leverage a white-box explainability technique (GradCAM [36], Gradient… view at source ↗

**Figure 3.** Visual comparison of the processed DCT spectra of adversarial examples generated by each attack against the unaltered image (leftmost). Support Vector Machines (SVMs) with polynomial kernels were trained to classify adversarial examples. ECLIPSE and SimBA were indistinguishable from benign images, while SimBA-DCT achieved actionable separability (precision = 1.0, recall = 0.47), and Square Attack L∞ was highly dete… view at source ↗

Figures from the paper (6 more)

**Figure 4.** Figure 4: Scatterplot of projected spectral features using t-SNE dimensionality reduction. Eclipse SimBA SimBA-DCT Square Attack L 0k 5k 10k 15k 20k 25k 30k Number of inference calls Requests to the remote model Eclipse SimBA SimBA-DCT Square Attack L 0k 2k 4k 6k 8k Median numbe…

**Figure 5.** Figure 5: Distribution of requests to the remote model as boxplot without outliers. On the right, the barplot shows the median request count for each attack. population in terms of scientific/non-scientific background. The Ethical statement at the end of this paper discusses the…

**Figure 6.** Figure 6: Proportion of respondents from S.T.E.M. fields, awareness of adversarial examples within S.T.E.M. and Non-S.T.E.M. population. Original Eclipse SimBA SimBA-DCT Square Attack L 0% 10% 20% 30% 40% 50% 60% 70% 80% Percentage of Occurrences Visibility scoring of Attacks […

**Figure 7.** Figure 7: Distribution of visibility scores for each attach on the general population. Scores are from 0 (not visible, blue) to 3 (very much visible, light green). The leftmost category corresponds to unaltered images. attack and unaltered images. SimBA-DCT can produce very conv…

**Figure 8.** Figure 8: ECLIPSE ablation study results [PITH_FULL_IMAGE:figures/full_fig_p011_8.png]

**Figure 9.** Figure 9: Summary of evaluation of the main metrics of each effectiveness property. are indistinguishable from benign images. Notably, a classifier trained for this distinction performs no better than random chance. While ECLIPSE does not set new benchmarks for query efficiency…

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

39 extracted references · 25 canonical work pages

[1]

api4ai Object Detection Endpoint (2024)

work page 2024
[2]

Clarifai Object Detection Endpoint (2024)

work page 2024
[3]

Hamidouche, Sid Ahmed Fezza, O

Ahmed Aldahdooh, W. Hamidouche, Sid Ahmed Fezza, O. Déforges: Adversarial example detection for DNN models: a review and experimental comparison. Artificial Intelligence Review (2021). https://doi.org/10.1007/s10462-021-10125-w

doi:10.1007/s10462-021-10125-w 2021
[4]

In: International Conference on Learning Representations (2020), https://openreview.net/forum?id=SygW0TEFwH

Al-Dujaili, A., O’Reilly, U.M.: Sign Bits Are All You Need for Black-Box Attacks. In: International Conference on Learning Representations (2020), https://openreview.net/forum?id=SygW0TEFwH

work page 2020
[5]

Andrew Starnes, Clayton Webster: Gaussian smoothing stochastic gradient descent (GSmoothSGD) (2023), aRXIV_ID: 2311.00531

work page Pith review arXiv 2023
[6]

European Conference on Computer Vision (2020)

Andriushchenko, M., Croce, F., Flammarion, N., Hein, M.: Square attack: a query- efficient black-box adversarial attack via random search. European Conference on Computer Vision (2020)

work page 2020
[7]

arXiv preprint arXiv:2201.07706 (2022)

Balasubramaniam, A., Pasricha, S.: Object detection in autonomous vehicles: Status and open challenges. arXiv preprint arXiv:2201.07706 (2022)

arXiv 2022
[8]

International Conference on Learning Representations (Feb 2018)

Brendel, W., Rauber, J., Bethge, M.: Decision-Based Adversarial Attacks: Reliable Attacks Against Black-Box Machine Learning Models. International Conference on Learning Representations (Feb 2018)

work page 2018

Show all 39 references

[9]

In: Proceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision (WACV)

Byun, J., Go, H., Kim, C.: On the Effectiveness of Small Input Noise for Defending Against Query-Based Black-Box Attacks. In: Proceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision (WACV). pp. 3051–3060 (Jan 2022)

2022
[10]

In: 2017 IEEE Symposium on Security and Privacy (SP)

Carlini, N., Wagner, D.: Towards evaluating the robustness of neural networks. In: 2017 IEEE Symposium on Security and Privacy (SP). pp. 39–57. IEEE Computer Society, Los Alamitos, CA, USA (May 2017). https://doi.org/10.1109/SP.2017.49 14 Panebianco et al

2017 doi
[11]

In: Proceedings of the 10th ACM Workshop on Artificial Intelligence and Security

Chen, P.Y., Zhang, H., Sharma, Y., Yi, J., Hsieh, C.J.: Zoo: Zeroth order optimization based black-box attacks to deep neural networks without training substitute models. In: Proceedings of the 10th ACM Workshop on Artificial Intelligence and Security. p. 15–26. AISec ’17, Ass...

2017
[12]

arXiv: Cryptography and Security (Jul 2019)

Chen, S.L., Chen, S.W., Carlini, N., Wagner, D.: Stateful Detection of Black-Box Adversarial Attacks. arXiv: Cryptography and Security (Jul 2019). https://doi.org/10.1145/3385003.3410925

2019
[13]

Future Gener

Choi, S.H., Shin, J., Choi, Y.H.: PIHA: Detection Method Using Perceptual Image Hashing against Query-Based Adversarial Attacks. Future Gener. Comput. Syst.145(C), 563–577 (Aug 2023). https://doi.org/10.1016/j.future.2023.04.005, https://doi.org/10.1016/j.future.2023.04.005, p...

2023 doi
[14]

Corrado, A.: Animals-10, https://www.kaggle.com/datasets/alessiocorrado99/animals10
[15]

In: Proceedings of the AAAI Conference on Artificial Intelligence

Croce, F., Andriushchenko, M., Singh, N.D., Flammarion, N., Hein, M.: Sparse-rs: a ver- satile framework for query-efficient sparse black-box adversarial attacks. In: Proceedings of the AAAI Conference on Artificial Intelligence. vol. 36, pp. 6437–6445 (2022), issue: 6

2022
[16]

Conference on Computer and Communications Security (May 2017)

Dang, H., Huang, Y., Chang, E.C.: Evading Classifiers by Morphing in the Dark. Conference on Computer and Communications Security (May 2017). https://doi.org/10.1145/3133956.3133978

2017
[17]

IEEE Transactions on Industrial Informatics18(12), 8477–8486 (2022)

Esmaeili, B., Azmoodeh, A., Dehghantanha, A., Karimipour, H., Zolfaghari, B., Hammoudeh, M.: IIoT Deep Malware Threat Hunting: From Adversarial Example Detection to Adversarial Scenario Detection. IEEE Transactions on Industrial Informatics18(12), 8477–8486 (2022). https://doi...

2022
[18]

Pattern Recognition133, 108985 (2023)

Giulivi, L., Jere, M., Rossi, L., Koushanfar, F., Ciocarlie, G., Hitaj, B., Boracchi, G.: Adversarial scratches: Deployable attacks to cnn classifiers. Pattern Recognition133, 108985 (2023)

2023
[19]

Prentice-Hall, Inc., USA (2006)

Gonzalez, R.C., Woods, R.E.: Digital Image Processing (3rd Edition). Prentice-Hall, Inc., USA (2006)

2006
[20]

InternationalConferenceofLearningRepresentations(Dec2015),aRXIV_ID:1412.6572

Goodfellow, I., Shlens, J., Szegedy, C.: Explaining and Harnessing Adversarial Examples. InternationalConferenceofLearningRepresentations(Dec2015),aRXIV_ID:1412.6572

arXiv
[21]

International Conference on Machine Learning pp

Guo, C., Gardner, J.R., You, Y., Wilson, A.G., Weinberger, K.Q.: Simple Black-box Adversarial Attacks. International Conference on Machine Learning pp. 2484–2493 (Jan 2019)

2019
[22]

Annals of Statistics39, 333–361 (2011)

Hanneke, S.: Rates of convergence in active learning. Annals of Statistics39, 333–361 (2011). https://doi.org/10.1214/10-AOS843

2011 doi
[23]

arXiv: Cryptography and Security (Apr 2020)

Inkawhich, N., Liang, K.J., Binghui Wang, Binghui Wang, Wang, B., Inkawhich, M., Carin, L., Yiran Chen, Chen, Y., Chen, Y.: Perturbing Across the Feature Hierarchy to Improve Standard and Strict Blackbox Attack Transferability. arXiv: Cryptography and Security (Apr 2020)

2020
[24]

Jordan, Jordan, M.I., Michael I

Jianbo Chen, Chen, J., Michael I. Jordan, Jordan, M.I., Michael I. Jordan, Martin J. Wainwright, Wainwright, M.J.: HopSkipJumpAttack: A Query-Efficient Decision-Based Attack. IEEE Symposium on Security and Privacy pp. 1277–1294 (May 2020). https://doi.org/10.1109/sp40000.2020.00045

2020
[25]

arXiv: Computer Vision and Pattern Recognition (Jul 2016)

Kurakin, A., Goodfellow, I., Bengio, S.: Adversarial examples in the phys- ical world. arXiv: Computer Vision and Pattern Recognition (Jul 2016). https://doi.org/10.1201/9781351251389-8

2016 doi
[26]

In: 2020 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR)

Li, H., Xu, X., Zhang, X., Yang, S., Li, B.: Qeba: Query-efficient boundary-based blackbox attack. In: 2020 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR). pp. 1218–1227. IEEE Computer Society, Los Alamitos, CA, USA (Jun 2020). https://doi.org/10.1109/CV...

2020
[27]

In: 31st USENIX Se- curity Symposium (USENIX Security 22)

Li, H., Shan, S., Wenger, E., Zhang, J., Zheng, H., Zhao, B.Y.: Blacklight: Scalable De- fense for Neural Networks against Query-Based Black-Box Attacks. In: 31st USENIX Se- curity Symposium (USENIX Security 22). pp. 2117–2134. USENIX Association, Boston, MA (Aug 2022), https:...

2022
[28]

International Conference on Learning Representations (Nov 2016)

Liu, Y., Chen, X., Liu, C., Song, D.: Delving into Transferable Adversarial Examples and Black-box Attacks. International Conference on Learning Representations (Nov 2016)

2016
[29]

In: European Symposium on Research in Computer Security

Liu, Z., Li, F., Lin, J., Li, Z., Luo, B.: Hide and Seek: on the Stealthiness of Attacks against Deep Learning Systems. In: European Symposium on Research in Computer Security. pp. 343–363. Springer (2022)

2022
[30]

Lulu, second edn

Luke, S.: Essentials of Metaheuristics. Lulu, second edn
[31]

vanderMaaten,L.,Hinton,G.:Visualizingdatausingt-sne.JournalofMachineLearning Research9(86), 2579–2605 (2008), http://jmlr.org/papers/v9/vandermaaten08a.html

2008
[32]

IEEE Workshop/Winter Conference on Applications of Computer Vision pp

Muzammal Naseer, Naseer, M., Salman Khan, Khan, S., Salman Khan, Salman Khan, Salman Khan, Khan, S., Khan, S.A., Fatih Porikli, Porikli, F., Fatih Porikli: Local Gradients Smoothing: Defense Against Localized Adversarial Attacks. IEEE Workshop/Winter Conference on Applications...

2019
[33]

Papernot, N., McDaniel, P., Goodfellow, I.: Transferability in machine learning: from phenomena to black-box attacks using adversarial samples, _eprint: 1605.07277

arXiv
[34]

ACM Asia Confer- ence on Computer and Communications Security pp

Papernot, N., McDaniel, P., Goodfellow, I., Jha, S., Celik, Z.B., Swami, A.: Practical Black-Box Attacks against Machine Learning. ACM Asia Confer- ence on Computer and Communications Security pp. 506–519 (Apr 2017). https://doi.org/10.1145/3052973.3053009

2017
[35]

Jha, Atul Prakash: Stateful Defenses for Machine Learning Models Are Not Yet Secure Against Black-box Attacks

Ryan Feng, Ashish Hooda, Neal Mangaokar, Kassem Fawaz, S. Jha, Atul Prakash: Stateful Defenses for Machine Learning Models Are Not Yet Secure Against Black-box Attacks. Conference on Computer and Communications Security (2023). https://doi.org/10.1145/3576915.3623116

2023
[36]

In: Proceedings of the IEEE international conference on computer vision

Selvaraju, R.R., Cogswell, M., Das, A., Vedantam, R., Parikh, D., Batra, D.: Grad-cam: Visual explanations from deep networks via gradient-based localization. In: Proceedings of the IEEE international conference on computer vision. pp. 618–626
[37]

International Conference on Learning Representations (Jan 2014)

Szegedy, C., Zaremba, W., Sutskever, I., Bruna, J., Erhan, D., Goodfellow, I., Fergus, R.: Intriguing properties of neural networks. International Conference on Learning Representations (Jan 2014)

2014
[38]

arXiv: Cryptography and Security (2020)

Thibault Maho, Maho, T., Teddy Furon, Furon, T., Erwan Le Merrer, Le Merrer, E.: SurFree: a fast surrogate-free black-box attack. arXiv: Cryptography and Security (2020). https://doi.org/10.1109/cvpr46437.2021.01029

2020
[39]

Information Sciences550, 285–296 (2021)

Wei, X., Guo, Y., Li, B.: Black-box adversarial attacks by manip- ulating image attributes. Information Sciences550, 285–296 (2021). https://doi.org/https://doi.org/10.1016/j.ins.2020.10.028

2021 doi

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.

[1] [1]

api4ai Object Detection Endpoint (2024)

work page 2024

[2] [2]

Clarifai Object Detection Endpoint (2024)

work page 2024

[3] [3]

Hamidouche, Sid Ahmed Fezza, O

Ahmed Aldahdooh, W. Hamidouche, Sid Ahmed Fezza, O. Déforges: Adversarial example detection for DNN models: a review and experimental comparison. Artificial Intelligence Review (2021). https://doi.org/10.1007/s10462-021-10125-w

doi:10.1007/s10462-021-10125-w 2021

[4] [4]

In: International Conference on Learning Representations (2020), https://openreview.net/forum?id=SygW0TEFwH

Al-Dujaili, A., O’Reilly, U.M.: Sign Bits Are All You Need for Black-Box Attacks. In: International Conference on Learning Representations (2020), https://openreview.net/forum?id=SygW0TEFwH

work page 2020

[5] [5]

Andrew Starnes, Clayton Webster: Gaussian smoothing stochastic gradient descent (GSmoothSGD) (2023), aRXIV_ID: 2311.00531

work page Pith review arXiv 2023

[6] [6]

European Conference on Computer Vision (2020)

Andriushchenko, M., Croce, F., Flammarion, N., Hein, M.: Square attack: a query- efficient black-box adversarial attack via random search. European Conference on Computer Vision (2020)

work page 2020

[7] [7]

arXiv preprint arXiv:2201.07706 (2022)

Balasubramaniam, A., Pasricha, S.: Object detection in autonomous vehicles: Status and open challenges. arXiv preprint arXiv:2201.07706 (2022)

arXiv 2022

[8] [8]

International Conference on Learning Representations (Feb 2018)

Brendel, W., Rauber, J., Bethge, M.: Decision-Based Adversarial Attacks: Reliable Attacks Against Black-Box Machine Learning Models. International Conference on Learning Representations (Feb 2018)

work page 2018