Research map / Adversarial robustness and security / Black-box and transfer attacks
Data-free substitute training
Attack black-box models by training substitutes without data or stealing models.
49 accepted papers at ICML, NeurIPS, ICLR, CVPR and AAAI (2018–2026) · an approach in Black-box and transfer attacks, keyword cluster “query · black box · box adversarial”
State History Tried Checklist Preprints Who Export
Where it stands
Not enough benchmark data Fewer than four papers report the same benchmark, so there is no record to follow.
7 papers in 2023–24 and 27 in 2025–26 (at ICML, NeurIPS, ICLR, CVPR and AAAI); its share of the topic grew, from 7.9% to 23.3%.
How this is decided
A benchmark is tracked when at least four papers of this approach report their own method on the same dataset and metric in at least two different years. Its record is the best number reported up to 2024 compared with the best reported in 2025–26: still improving means at least 1% better, flat means at most 0.2% better with at least two papers from 2025–26 trying. Numbers on a different scale from the rest (a fraction among percentages) and far outliers are left out. Results come from different papers with different setups, so they are signals, not head-to-head comparisons. The share of papers is counted at ICML, NeurIPS, ICLR, CVPR and AAAI.
How it got here
Most cited paper of each year
- 2018 · Towards Reverse-Engineering Black-Box Neural Networks (ICLR 2018 · 269 citations)
- 2019 · Sensitive-Sample Fingerprinting of Deep Neural Networks (CVPR 2019 · 86 citations)
- 2020 · DaST: Data-Free Substitute Training for Adversarial Attacks (CVPR 2020 · 171 citations)
- 2021 · Data-Free Model Extraction (CVPR 2021 · 177 citations)
- 2022 · Towards Data-Free Model Stealing in a Hard Label Setting (CVPR 2022 · 81 citations)
- 2023 · Reinforcement Learning-Based Black-Box Model Inversion Attacks (CVPR 2023 · 36 citations)
- 2024 · Stealing part of a production language model (ICML 2024 · 7 citations)
- 2025 · From Head to Tail: Efficient Black-box Model Inversion Attack via Long-tailed Learning (CVPR 2025 · 4 citations)
- 2026 · Rethinking Forgery Attacks on Semantic Watermarks in Black-Box Settings: A Geometric Distortion Perspective (ICML 2026 · 0 citations)
Earliest papers here
- Towards Reverse-Engineering Black-Box Neural Networks (ICLR 2018 · 269 citations)
- Sensitive-Sample Fingerprinting of Deep Neural Networks (CVPR 2019 · 86 citations)
- DaST: Data-Free Substitute Training for Adversarial Attacks (CVPR 2020 · 171 citations)
What has been tried
31 papers here report 321 measured changes (a component added, removed or swapped, compared with a baseline): helped 71%, no clear effect 6%, hurt 14%, mixed 8%. Papers mostly publish changes that helped, so "helped" is over-represented.
Ablations in recent papers
| What was changed | Measured on | Result | Effect | Paper |
|---|---|---|---|---|
| add DKL distillation loss | VGGFace2, InceptionV1 surrogate; CelebA prior; 2.5K samples · surrogate accuracy | 5.00/11.74 -> 12.94/25.11 | Helped | From Head to Tail: Efficient Black-box Model Inversion Attack via Long-tailed Learning (CVPR 2025 · 4 citations) |
| Add LLM-based anchor document selection instead of rotating the top five documents | MS MARCO Easy with BERT · Boost | 37.1 -> 44.5 | Helped | Attack-in-the-Chain: Bootstrapping Large Language Models for Attacks Against Black-Box Neural Ranking Models (AAAI 2025 · 3 citations) |
| Add diversity loss to query-free augmentation plus harmony loss | CIFAR10 · accuracy (%) | 31.2 -> 43.8 | Helped | Exploring Query Efficient Data Generation Towards Data-Free Model Stealing in Hard Label Setting (AAAI 2025 · 2 citations) |
| add target fusion (TF) | FLICKR-25K · t-MAP | 72.55 -> 78.15 | Helped | HUANG: A Robust Diffusion Model-based Targeted Adversarial Attack Against Deep Hashing Retrieval (AAAI 2025 · 2 citations) |
| Add Adaptive Semantic Embedding | CIFAR-10, non-targeted, probability output · ASR (%) | 71.21 -> 78.36 | Helped | Power of Diversity: Enhancing Data-Free Black-Box Attack with Domain-Augmented Learning (AAAI 2025 · 0 citations) |
| Add confidence loss Lcf to data-intrinsic disguising | CIFAR10 → STL10 · unauthorized-domain accuracy | 59.6 -> 61.1 | Helped | Jailbreaking the Non-Transferable Barrier via Test-Time Data Disguising (CVPR 2025 · 0 citations) |
| Add prior-knowledge filtering | VL-MIA/DALL-E · AUC | Helped | Black-Box Membership Inference Attack for LVLMs via Prior Knowledge-Calibrated Memory Probing (NeurIPS 2025 · 0 citations) | |
| Increase leakage pairs from 0.5K to 4K | CIFAR-10 and CIFAR-100 · accuracy | Mixed | BridgePure: Limited Protection Leakage Can Break Black-Box Data Protection (NeurIPS 2025 · 0 citations) | |
| Use smaller sensitivity ε | Stable Diffusion, CNN, 30-bit watermark · number of surrogate models needed for a given evasion rate | Helped | A Transfer Attack to Image Watermarks (ICLR 2025 · 0 citations) |
What reviewers will expect
Datasets and baselines named in the 18 papers of this approach from 2025–2026 that have a full-text summary. Leaving out the common ones is a frequent review question.
Datasets
- CIFAR-10 · 6 of 18 papers
- CIFAR-100 · 5 of 18 papers
- ImageNet · 3 of 18 papers
- MNIST · 2 of 18 papers
- CelebA · 2 of 18 papers
Baselines
- DiffPure · 2 of 18 papers
Recent preprints
Loading recent arXiv preprints…
Who publishes on it
Institutions on the most papers of this approach since 2023 (of 34 papers; from OpenAlex and the papers' affiliations).
- Tsinghua University · 3 papers
- Korea Advanced Institute of Science and Technology · 2 papers
- The University of Sydney · 2 papers
- University of Illinois at Urbana-Champaign · 2 papers
Use it
Download BibTeX of 37 key papersOpen the topic in the interactive map
Get alerts. Describe your idea in scime atlas and save it (free scime account): you get a weekly email when new preprints land close to it.
Related approaches
Same keyword cluster
- Robustness benchmarks and defenses (89 papers)
- Query-efficient black-box attacks (78 papers)
- Decision-based boundary attacks (24 papers)
Elsewhere in the topic
- Transferable adversarial examples (86 papers)
- Transfer attacks on face recognition (48 papers)
- Transfer attacks on vision transformers (9 papers)
Benchmark numbers, ablations and baseline numbers are extracted by AI from each paper's full text and can be wrong; the paper is the authority. Data: results index of 2026-11-02, citation counts from OpenAlex (2026-10-09).