Research map / Adversarial robustness and security / Black-box and transfer attacks
Query-efficient black-box attacks
Craft adversarial examples with limited queries via bandits, Bayesian optimization and priors.
78 accepted papers at ICML, NeurIPS, ICLR, CVPR and AAAI (2018–2026) · an approach in Black-box and transfer attacks, keyword cluster “query · black box · box adversarial”
State History Tried Checklist Preprints Who Export
Where it stands
Not enough benchmark data Fewer than four papers report the same benchmark, so there is no record to follow.
10 papers in 2023–24 and 15 in 2025–26 (at ICML, NeurIPS, ICLR, CVPR and AAAI); its share of the topic grew, from 11.2% to 12.9%.
How this is decided
A benchmark is tracked when at least four papers of this approach report their own method on the same dataset and metric in at least two different years. Its record is the best number reported up to 2024 compared with the best reported in 2025–26: still improving means at least 1% better, flat means at most 0.2% better with at least two papers from 2025–26 trying. Numbers on a different scale from the rest (a fraction among percentages) and far outliers are left out. Results come from different papers with different setups, so they are signals, not head-to-head comparisons. The share of papers is counted at ICML, NeurIPS, ICLR, CVPR and AAAI.
How it got here
Most cited paper of each year
- 2018 · Black-box Adversarial Attacks with Limited Queries and Information (ICML 2018 · 320 citations)
- 2019 · AutoZOOM: Autoencoder-Based Zeroth Order Optimization Method for Attacking Black-Box Neural Networks (AAAI 2019 · 371 citations)
- 2020 · A Restricted Black-Box Adversarial Framework Towards Attacking Graph Embedding Models (AAAI 2020 · 139 citations)
- 2021 · SurFree: A Fast Surrogate-Free Black-Box Attack (CVPR 2021 · 100 citations)
- 2022 · Sparse-RS: A Versatile Framework for Query-Efficient Sparse Black-Box Adversarial Attacks (AAAI 2022 · 103 citations)
- 2023 · SSPAttack: A Simple and Sweet Paradigm for Black-Box Hard-Label Textual Adversarial Attack (AAAI 2023 · 17 citations)
- 2024 · DifAttack: Query-Efficient Black-Box Adversarial Attack via Disentangled Feature Space (AAAI 2024 · 22 citations)
- 2025 · Mind the Gap: Detecting Black-box Adversarial Attacks in the Making through Query Update Analysis (CVPR 2025 · 5 citations)
- 2026 · Improving Black-Box Generative Attacks via Generator Semantic Consistency (ICLR 2026 · 0 citations)
Earliest papers here
- Black-box Adversarial Attacks with Limited Queries and Information (ICML 2018 · 320 citations)
- AutoZOOM: Autoencoder-Based Zeroth Order Optimization Method for Attacking Black-Box Neural Networks (AAAI 2019 · 371 citations)
- Prior Convictions: Black-box Adversarial Attacks with Bandits and Priors (ICLR 2019 · 241 citations)
What has been tried
67 papers here report 705 measured changes (a component added, removed or swapped, compared with a baseline): helped 77%, no clear effect 7%, hurt 12%, mixed 5%. Papers mostly publish changes that helped, so "helped" is over-represented.
Ablations in recent papers
| What was changed | Measured on | Result | Effect | Paper |
|---|---|---|---|---|
| Add the DF module to the autoencoder | ImageNet untargeted attacks · ASR | 84/96/92/100 -> 100/100/100/100 | Helped | DifAttack: Query-Efficient Black-Box Adversarial Attack via Disentangled Feature Space (AAAI 2024 · 22 citations) |
| increase the injected-node budget from one to five nodes | Cora · misclassification rate | approximately 60%; below 10% | Helped | Highly Imperceptible Black-Box Graph Injection Attacks with Reinforcement Learning (AAAI 2025 · 2 citations) |
| Randomize layer 12 only instead of layer 4 only | CIFAR10, Square · robustness | 52.5 -> 63.0 | Helped | Understanding the Robustness of Randomized Feature Defense Against Query-Based Adversarial Attacks (ICLR 2024 · 2 citations) |
| Optimize the initialized attack string | CWE-022 Path Traversal · vulnerability rate | 65% -> 96% | Helped | Black-Box Adversarial Attacks on LLM-Based Code Completion (ICML 2025 · 1 citation) |
| Replace fixed λ=1 with adaptive λ* | CIFAR-10, ResNet-50 · ASR | 99.9% -> 100.0% | Helped | Efficient Black-box Adversarial Attacks via Bayesian Optimization Guided by a Function Prior (ICML 2024 · 1 citation) |
| increase the number of surrogate priors from 1 to 5 | ImageNet, ResNet-101, Swin Transformer, and GC ViT untargeted @10K queries · mean ℓ2 distortion | 3.019 -> 1.951; 9.254 -> 3.467; 6.899 -> 2.893 | Helped | Boosting Ray Search Procedure of Hard-label Attacks with Transfer-based Priors (ICLR 2025 · 0 citations) |
| Replace starting image from target class with random synthetic color image as initialization | CIFAR-10 targeted, 1.0% sparsity · ASR | 68.21% vs 62.68% | Helped | BRUSLEATTACK: A QUERY-EFFICIENT SCORE- BASED BLACK-BOX SPARSE ADVERSARIAL ATTACK (ICLR 2024 · 0 citations) |
| Add memory to the Remember process | ImageNet-1K classification · attack success rate | Helped | Amnesia as a Catalyst for Enhancing Black Box Pixel Attacks in Image Classification and Object Detection (NeurIPS 2024 · 0 citations) | |
| Combine target-class count and confidence-change weights rather than using only minimum target-class probability change | ImageNet, ResNet-50, top-2 targeted initial-boundary estimation · median l2 perturbation | 12.17 -> 12.12 | Helped | GSBA$^K$: $top$-$K$ Geometric Score-based Black-box Attack (ICLR 2025) |
| Decompose the perturbation as δ=p⊙m | CIFAR-10, k=20 · robust accuracy | 49.4 -> 58.0 | Hurt | Towards Efficient Training and Evaluation of Robust Models against $l_0$ Bounded Adversarial Perturbations (ICML 2024) |
| Add Attend attention heatmap to reduce the search space | Flick30k, ε=25; VIT-GPT2 · METEOR | 0.541±0.25 -> 0.696±0.21 | Helped | Ask, Attend, Attack: An Effective Decision-Based Black-Box Targeted Attack for Image-to-Text Models (NeurIPS 2024) |
What reviewers will expect
Datasets and baselines named in the 9 papers of this approach from 2025–2026 that have a full-text summary. Leaving out the common ones is a frequent review question.
Datasets
- ImageNet · 5 of 9 papers
- CIFAR-10 · 3 of 9 papers
- Tiny-ImageNet · 2 of 9 papers
Baselines
- HSJA · 2 of 9 papers
- TA · 2 of 9 papers
- CGBA · 2 of 9 papers
Recent preprints
Loading recent arXiv preprints…
Who publishes on it
Institutions on the most papers of this approach since 2023 (of 25 papers; from OpenAlex and the papers' affiliations).
- Dalian University of Technology · 2 papers
- Pennsylvania State University · 2 papers
- Zhejiang Lab · 2 papers
- University of California, Berkeley · 2 papers
Use it
Download BibTeX of 40 key papersOpen the topic in the interactive map
Get alerts. Describe your idea in scime atlas and save it (free scime account): you get a weekly email when new preprints land close to it.
Related approaches
Same keyword cluster
- Robustness benchmarks and defenses (89 papers)
- Data-free substitute training (49 papers)
- Decision-based boundary attacks (24 papers)
Elsewhere in the topic
- Transferable adversarial examples (86 papers)
- Transfer attacks on face recognition (48 papers)
- Transfer attacks on vision transformers (9 papers)
Benchmark numbers, ablations and baseline numbers are extracted by AI from each paper's full text and can be wrong; the paper is the authority. Data: results index of 2026-11-02, citation counts from OpenAlex (2026-10-09).