% Key papers for Query-efficient black-box attacks (scime atlas, https://atlas.scime.ai). Authors are not included: add them from the paper pages.

@inproceedings{aaai2019_autozoom_99965,
  title = {{AutoZOOM: Autoencoder-Based Zeroth Order Optimization Method for Attacking Black-Box Neural Networks}},
  booktitle = {AAAI Conference on Artificial Intelligence (AAAI)},
  year = {2019},
  url = {https://ojs.aaai.org/index.php/AAAI/article/view/3852},
}

@inproceedings{icml2018_black_36553,
  title = {{Black-box Adversarial Attacks with Limited Queries and Information}},
  booktitle = {International Conference on Machine Learning (ICML)},
  year = {2018},
  url = {https://icml.cc/virtual/2018/poster/2426},
}

@inproceedings{iclr2019_prior_28790,
  title = {{Prior Convictions: Black-box Adversarial Attacks with Bandits and Priors}},
  booktitle = {International Conference on Learning Representations (ICLR)},
  year = {2019},
  url = {https://iclr.cc/virtual/2019/poster/851},
}

@inproceedings{neurips2019_improving_58404,
  title = {{Improving Black-box Adversarial Attacks with a Transfer-based Prior}},
  booktitle = {Advances in Neural Information Processing Systems (NeurIPS)},
  year = {2019},
  url = {https://nips.cc/virtual/2019/poster/14092},
}

@inproceedings{icml2019_simple_37742,
  title = {{Simple Black-box Adversarial Attacks}},
  booktitle = {International Conference on Machine Learning (ICML)},
  year = {2019},
  url = {https://icml.cc/virtual/2019/poster/3754},
}

@inproceedings{aaai2020_a_101881,
  title = {{A Restricted Black-Box Adversarial Framework Towards Attacking Graph Embedding Models}},
  booktitle = {AAAI Conference on Artificial Intelligence (AAAI)},
  year = {2020},
  url = {https://ojs.aaai.org/index.php/AAAI/article/view/5741},
}

@inproceedings{cvpr2020_geoda_15600,
  title = {{GeoDA: A Geometric Framework for Black-Box Adversarial Attacks}},
  booktitle = {IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR)},
  year = {2020},
}

@inproceedings{aaai2022_sparse_2764,
  title = {{Sparse-RS: A Versatile Framework for Query-Efficient Sparse Black-Box Adversarial Attacks}},
  booktitle = {AAAI Conference on Artificial Intelligence (AAAI)},
  year = {2022},
  url = {https://aaai.org/papers/06437-sparse-rs-a-versatile-framework-for-query-efficient-sparse-black-box-adversarial-attacks/},
}

@inproceedings{cvpr2019_curls_13991,
  title = {{Curls \& Whey: Boosting Black-Box Adversarial Attacks}},
  booktitle = {IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR)},
  year = {2019},
}

@inproceedings{cvpr2021_surfree_17963,
  title = {{SurFree: A Fast Surrogate-Free Black-Box Attack}},
  booktitle = {IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR)},
  year = {2021},
}

@inproceedings{aaai2021_generating_670,
  title = {{Generating Natural Language Attacks in a Hard Label Black Box Setting}},
  booktitle = {AAAI Conference on Artificial Intelligence (AAAI)},
  year = {2021},
  url = {https://aaai.org/papers/13525-generating-natural-language-attacks-in-a-hard-label-black-box-setting/},
}

@inproceedings{aaai2020_heuristic_103811,
  title = {{Heuristic Black-Box Adversarial Attacks on Video Recognition Models}},
  booktitle = {AAAI Conference on Artificial Intelligence (AAAI)},
  year = {2020},
  url = {https://ojs.aaai.org/index.php/AAAI/article/view/6918},
}

@inproceedings{iclr2020_black_29662,
  title = {{Black-Box Adversarial Attack with Transferable Model-based Embedding}},
  booktitle = {International Conference on Learning Representations (ICLR)},
  year = {2020},
  url = {https://openreview.net/forum?id=SJxhNTNYwB},
}

@inproceedings{icml2019_parsimonious_37647,
  title = {{Parsimonious Black-Box Adversarial Attacks via Efficient Combinatorial Optimization}},
  booktitle = {International Conference on Machine Learning (ICML)},
  year = {2019},
  url = {https://icml.cc/virtual/2019/poster/4042},
}

@inproceedings{neurips2020_diversity_59731,
  title = {{Diversity can be Transferred: Output Diversification for White- and Black-box Attacks}},
  booktitle = {Advances in Neural Information Processing Systems (NeurIPS)},
  year = {2020},
  url = {https://nips.cc/virtual/2020/poster/17567},
}

@inproceedings{aaai2020_a_101893,
  title = {{A Frank-Wolfe Framework for Efficient and Effective Adversarial Attacks}},
  booktitle = {AAAI Conference on Artificial Intelligence (AAAI)},
  year = {2020},
  url = {https://ojs.aaai.org/index.php/AAAI/article/view/5753},
}

@inproceedings{iclr2020_query_29702,
  title = {{Query-efficient Meta Attack to Deep Neural Networks}},
  booktitle = {International Conference on Learning Representations (ICLR)},
  year = {2020},
  url = {https://openreview.net/forum?id=Skxd6gSYDS},
}

@inproceedings{cvpr2021_qair_17679,
  title = {{QAIR: Practical Query-Efficient Black-Box Attacks for Image Retrieval}},
  booktitle = {IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR)},
  year = {2021},
}

@inproceedings{neurips2020_learning_60152,
  title = {{Learning Black-Box Attackers with Transferable Priors and Query Feedback}},
  booktitle = {Advances in Neural Information Processing Systems (NeurIPS)},
  year = {2020},
  url = {https://nips.cc/virtual/2020/poster/17076},
}

@inproceedings{iclr2020_bayesopt_29495,
  title = {{BayesOpt Adversarial Attack}},
  booktitle = {International Conference on Learning Representations (ICLR)},
  year = {2020},
  url = {https://openreview.net/forum?id=Hkem-lrtvH},
}

@inproceedings{aaai2024_difattack_5687,
  title = {{DifAttack: Query-Efficient Black-Box Adversarial Attack via Disentangled Feature Space}},
  booktitle = {AAAI Conference on Artificial Intelligence (AAAI)},
  year = {2024},
  url = {https://ojs.aaai.org/index.php/AAAI/article/view/28156},
}

@inproceedings{cvpr2025_mind_26954,
  title = {{Mind the Gap: Detecting Black-box Adversarial Attacks in the Making through Query Update Analysis}},
  booktitle = {IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR)},
  year = {2025},
  url = {https://cvpr.thecvf.com/virtual/2025/poster/34322},
}

@inproceedings{aaai2025_query_10424,
  title = {{Query-efficient Attack for Black-box Image Inpainting Forensics via Reinforcement Learning}},
  booktitle = {AAAI Conference on Artificial Intelligence (AAAI)},
  year = {2025},
  url = {https://ojs.aaai.org/index.php/AAAI/article/view/34147},
}

@inproceedings{aaai2025_highly_9448,
  title = {{Highly Imperceptible Black-Box Graph Injection Attacks with Reinforcement Learning}},
  booktitle = {AAAI Conference on Artificial Intelligence (AAAI)},
  year = {2025},
  url = {https://ojs.aaai.org/index.php/AAAI/article/view/33458},
}

@inproceedings{iclr2024_understanding_35545,
  title = {{Understanding the Robustness of Randomized Feature Defense Against Query-Based Adversarial Attacks}},
  booktitle = {International Conference on Learning Representations (ICLR)},
  year = {2024},
  url = {https://iclr.cc/virtual/2024/poster/17528},
}

@inproceedings{icml2024_efficient_43769,
  title = {{Efficient Black-box Adversarial Attacks via Bayesian Optimization Guided by a Function Prior}},
  booktitle = {International Conference on Machine Learning (ICML)},
  year = {2024},
  url = {https://icml.cc/virtual/2024/poster/34683},
}

@inproceedings{icml2025_black_48312,
  title = {{Black-Box Adversarial Attacks on LLM-Based Code Completion}},
  booktitle = {International Conference on Machine Learning (ICML)},
  year = {2025},
  url = {https://icml.cc/virtual/2025/poster/44302},
}

@inproceedings{iclr2024_brusleattack_34357,
  title = {{BRUSLEATTACK: A QUERY-EFFICIENT SCORE- BASED BLACK-BOX SPARSE ADVERSARIAL ATTACK}},
  booktitle = {International Conference on Learning Representations (ICLR)},
  year = {2024},
  url = {https://iclr.cc/virtual/2024/poster/18718},
}

@inproceedings{neurips2024_amnesia_71867,
  title = {{Amnesia as a Catalyst for Enhancing Black Box Pixel Attacks in Image Classification and Object Detection}},
  booktitle = {Advances in Neural Information Processing Systems (NeurIPS)},
  year = {2024},
  url = {https://neurips.cc/virtual/2024/poster/95435},
}

@inproceedings{neurips2025_the_76865,
  title = {{The Cost of Compression: Tight Quadratic Black-Box Attacks on Sketches for \$ell\_2\$ Norm Estimation}},
  booktitle = {Advances in Neural Information Processing Systems (NeurIPS)},
  year = {2025},
  url = {https://openreview.net/forum?id=Nk61RqtN9y},
}

@inproceedings{neurips2025_transferbench_79938,
  title = {{TransferBench: Benchmarking Ensemble-based Black-box Transfer Attacks}},
  booktitle = {Advances in Neural Information Processing Systems (NeurIPS)},
  year = {2025},
  url = {https://openreview.net/forum?id=uT0A1pjBqu},
}

@inproceedings{iclr2025_boosting_83756,
  title = {{Boosting Ray Search Procedure of Hard-label Attacks with Transfer-based Priors}},
  booktitle = {International Conference on Learning Representations (ICLR)},
  year = {2025},
  url = {https://iclr.cc/virtual/2025/poster/28063},
}

@inproceedings{iclr2026_improving_88060,
  title = {{Improving Black-Box Generative Attacks via Generator Semantic Consistency}},
  booktitle = {International Conference on Learning Representations (ICLR)},
  year = {2026},
  url = {https://openreview.net/forum?id=ibXhUapwcz},
}

@inproceedings{cvpr2026_seba_96341,
  title = {{SEBA: Sample-Efficient Black-Box Attacks on Visual Reinforcement Learning}},
  booktitle = {IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR)},
  year = {2026},
  url = {https://openaccess.thecvf.com/content/CVPR2026/html/Huang_SEBA_Sample-Efficient_Black-Box_Attacks_on_Visual_Reinforcement_Learning_CVPR_2026_paper.html},
}

@inproceedings{aaai2026_hogvul_100067,
  title = {{HogVul: Black-box Adversarial Code Generation Framework Against LM-based Vulnerability Detectors}},
  booktitle = {AAAI Conference on Artificial Intelligence (AAAI)},
  year = {2026},
  url = {https://ojs.aaai.org/index.php/AAAI/article/view/37118},
}

@inproceedings{aaai2026_improving_105255,
  title = {{Improving the Convergence Rate of Ray Search Optimization for Query-Efficient Hard-Label Attacks}},
  booktitle = {AAAI Conference on Artificial Intelligence (AAAI)},
  year = {2026},
  url = {https://ojs.aaai.org/index.php/AAAI/article/view/38127},
}

@inproceedings{aaai2026_adversarial_107824,
  title = {{Adversarial Attack on Black-Box Multi-Agent by Adaptive Perturbation}},
  booktitle = {AAAI Conference on Artificial Intelligence (AAAI)},
  year = {2026},
  url = {https://ojs.aaai.org/index.php/AAAI/article/view/40176},
}

@inproceedings{icml2024_towards_43353,
  title = {{Towards Efficient Training and Evaluation of Robust Models against \$l\_0\$ Bounded Adversarial Perturbations}},
  booktitle = {International Conference on Machine Learning (ICML)},
  year = {2024},
  url = {https://icml.cc/virtual/2024/poster/35099},
}

@inproceedings{icml2025_ttba_48992,
  title = {{TtBA: Two-third Bridge Approach for Decision-Based Adversarial Attack}},
  booktitle = {International Conference on Machine Learning (ICML)},
  year = {2025},
  url = {https://icml.cc/virtual/2025/poster/43631},
}

@inproceedings{neurips2024_ask_70908,
  title = {{Ask, Attend, Attack: An Effective Decision-Based Black-Box Targeted Attack for Image-to-Text Models}},
  booktitle = {Advances in Neural Information Processing Systems (NeurIPS)},
  year = {2024},
  url = {https://neurips.cc/virtual/2024/poster/96292},
}