Research map / Adversarial robustness and security / Black-box and transfer attacks
Decision-based boundary attacks
Attack models using only hard-label outputs by approximating decision boundaries.
24 accepted papers at ICML, NeurIPS, ICLR, CVPR and AAAI (2018–2026) · an approach in Black-box and transfer attacks, keyword cluster “query · black box · box adversarial”
State History Tried Checklist Preprints Export
Where it stands
Not enough benchmark data Fewer than four papers report the same benchmark, so there is no record to follow.
7 papers in 2023–24 and 6 in 2025–26 (at ICML, NeurIPS, ICLR, CVPR and AAAI); its share of the topic shrank, from 7.9% to 5.2%.
How this is decided
A benchmark is tracked when at least four papers of this approach report their own method on the same dataset and metric in at least two different years. Its record is the best number reported up to 2024 compared with the best reported in 2025–26: still improving means at least 1% better, flat means at most 0.2% better with at least two papers from 2025–26 trying. Numbers on a different scale from the rest (a fraction among percentages) and far outliers are left out. Results come from different papers with different setups, so they are signals, not head-to-head comparisons. The share of papers is counted at ICML, NeurIPS, ICLR, CVPR and AAAI.
How it got here
Most cited paper of each year
- 2018 · Decision-Based Adversarial Attacks: Reliable Attacks Against Black-Box Machine Learning Models (ICLR 2018 · 133 citations)
- 2019 · White-box vs Black-box: Bayes Optimal Strategies for Membership Inference (ICML 2019 · 111 citations)
- 2020 · QEBA: Query-Efficient Boundary-Based Blackbox Attack (CVPR 2020 · 154 citations)
- 2021 · Characterizing the risk of fairwashing (NeurIPS 2021 · 6 citations)
- 2022 · Investigating Top-k White-Box and Transferable Black-Box Attack (CVPR 2022 · 37 citations)
- 2023 · Unfooling Perturbation-Based Post Hoc Explainers (AAAI 2023 · 13 citations)
- 2024 · TTTS: Tree Test Time Simulation for Enhancing Decision Tree Robustness against Adversarial Examples (AAAI 2024 · 8 citations)
- 2025 · ADBA: Approximation Decision Boundary Approach for Black-Box Adversarial Attacks (AAAI 2025 · 5 citations)
- 2026 · Fading the Digital Ink: A Universal Black-Box Attack Framework for 3DGS Watermarking Systems (AAAI 2026 · 1 citation)
Earliest papers here
- Decision-Based Adversarial Attacks: Reliable Attacks Against Black-Box Machine Learning Models (ICLR 2018 · 133 citations)
- White-box vs Black-box: Bayes Optimal Strategies for Membership Inference (ICML 2019 · 111 citations)
- QEBA: Query-Efficient Boundary-Based Blackbox Attack (CVPR 2020 · 154 citations)
What has been tried
20 papers here report 202 measured changes (a component added, removed or swapped, compared with a baseline): helped 63%, no clear effect 9%, hurt 22%, mixed 5%. Papers mostly publish changes that helped, so "helped" is over-represented.
Ablations in recent papers
| What was changed | Measured on | Result | Effect | Paper |
|---|---|---|---|---|
| Apply TTTS with the depth probability heuristic | No attack (50 datasets) · AUC | 0.714 ± 0.04 -> 0.773 ± 0.05 | Helped | TTTS: Tree Test Time Simulation for Enhancing Decision Tree Robustness against Adversarial Examples (AAAI 2024 · 8 citations) |
| Replace the RL agent with a random agent | Llama2-7b-chat and GPT-3.5-turbo testing sets · GPT-Judge | Hurt | When LLM Meets DRL: Advancing Jailbreaking Efficiency via DRL-guided Search (NeurIPS 2024 · 6 citations) | |
| Use the median-based ADB search instead of midpoint search | ImageNet test, six target models · average queries | 237.3 -> 197.6 (VGG19); 769.3 -> 685.6 (ResNet50); 461.3 -> 418.3 (Inception-V3); 768.4 -> 651.9 (ViT-B32); 485.7 -> 457 | Helped | ADBA: Approximation Decision Boundary Approach for Black-Box Adversarial Attacks (AAAI 2025 · 5 citations) |
| train the prompter with SFT and DPO instead of SFT only | Mind2Web test, all domains (GPT-4V backend) · ASR | 69.5% -> 97.5% | Helped | AdvAgent: Controllable Blackbox Red-teaming on Web Agents (ICML 2025 · 1 citation) |
What reviewers will expect
Datasets and baselines named in the 5 papers of this approach from 2024–2026 that have a full-text summary. Leaving out the common ones is a frequent review question.
Baselines
- GCG · 2 of 5 papers
Recent preprints
Loading recent arXiv preprints…
Use it
Download BibTeX of 23 key papersOpen the topic in the interactive map
Get alerts. Describe your idea in scime atlas and save it (free scime account): you get a weekly email when new preprints land close to it.
Related approaches
Same keyword cluster
- Robustness benchmarks and defenses (89 papers)
- Query-efficient black-box attacks (78 papers)
- Data-free substitute training (49 papers)
Elsewhere in the topic
- Transferable adversarial examples (86 papers)
- Transfer attacks on face recognition (48 papers)
- Transfer attacks on vision transformers (9 papers)
Benchmark numbers, ablations and baseline numbers are extracted by AI from each paper's full text and can be wrong; the paper is the authority. Data: results index of 2026-11-02, citation counts from OpenAlex (2026-10-09).