Research map / Adversarial robustness and security / Black-box and transfer attacks
How to Robustify Black-Box ML Models? A Zeroth-Order Optimization Perspective
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's title only (no summary yet). Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Add an autoencoder to reduce the ZO estimation dimension | ZO-DS · CIFAR-10, ResNet-110, r=0.50 | certified accuracy (%): 5.06% to 35.5% | Helped |
| Replace RGE with CGE (ablation) | ZO-AE-DS · CIFAR-10, ResNet-110, r=0.50 | certified accuracy (%): 27.84 -> 35.50 | Helped |
| Use RGE with q=20 instead of CGE with q=192 (ablation) | ZO-AE-DS · CIFAR-10, ResNet-110, r=0.50 | certified accuracy (%): 35.50 -> 17.85 | Hurt |
| Use RGE with q=100 instead of CGE with q=192 (ablation) | ZO-AE-DS · CIFAR-10, ResNet-110, r=0.50 | certified accuracy (%): 35.50 -> 24.28 | Hurt |
| Add the autoencoder dimension-reduction approach to direct ZO-DS | ZO-DS · CIFAR-10, ResNet-110, r=0.50 | certified accuracy (%): 5.06 -> 27.84 | Helped |
| Train the denoiser from scratch rather than pre-training and fine-tuning it (ablation) | ZO-AE-DS · CIFAR-10, ResNet-110, r=0.50 | certified accuracy (%): 26.26 -> 35.50 | Helped |
| Use AE-192 instead of AE-96 (ablation) | FO-AE-DS · CIFAR-10, ResNet-110, r=0.50 | certified accuracy (%): 37.09 -> 38.50 | Helped |
| Train the encoder as well as the denoiser (ablation) | FO-AE-DS · CIFAR-10, ResNet-110, r=0.50 | certified accuracy (%): 35.68 -> 38.50 | Helped |
| Train the full AE rather than only the denoiser and encoder (ablation) | FO-AE-DS · CIFAR-10, ResNet-110, r=0.50 | certified accuracy (%): 38.50 -> 38.88 | Helped |
| Use ZO-AE-DS instead of direct ZO-DS | black-box image classification · STL-10, ResNet-18, r=0.50 | certified accuracy (%): 9.58 -> 26.70 | Helped |
| Use ZO-AE-DS rather than FO-DS | STL-10 image classification · STL-10, ResNet-18, r=0.00 | standard accuracy (%): 53.36 -> 45.67 | Hurt |
| Use ZO-AE-DS rather than FO-DS | STL-10 image classification · STL-10, ResNet-18, r=0.50 | certified accuracy (%): 21.61 -> 26.70 | Helped |
Closest papers by meaning
- Understanding the Robustness of Randomized Feature Defense Against Query-Based Adversarial Attacks (ICLR 2024 · similarity 0.90)
- Towards Query-Efficient Black-Box Adversary with Zeroth-Order Natural Gradient Descent (AAAI 2020 · similarity 0.89)
- Efficient Black-box Adversarial Attacks via Bayesian Optimization Guided by a Function Prior (ICML 2024 · similarity 0.87)
- Adversarial Training Should Be Cast as a Non-Zero-Sum Game (ICLR 2024 · similarity 0.87)
- Learning Better Certified Models from Empirically-Robust Teachers (NeurIPS 2026 · similarity 0.87)
- DeepZero: Scaling Up Zeroth-Order Optimization for Deep Model Training (ICLR 2024 · similarity 0.87)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.