{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/exploring-the-space-of-black-box-attacks-on","title":"Exploring the Space of Black-box Attacks on Deep Neural Networks","arxiv_id":"1712.09491","date":"2017-12-27","proceeding":"ICLR 2018 1","authors":["Arjun Nitin Bhagoji","Warren He","Bo Li","Dawn Song"],"abstract":"Existing black-box attacks on deep neural networks (DNNs) so far have largely\nfocused on transferability, where an adversarial instance generated for a\nlocally trained model can \"transfer\" to attack other learning models. In this\npaper, we propose novel Gradient Estimation black-box attacks for adversaries\nwith query access to the target model's class probabilities, which do not rely\non transferability. We also propose strategies to decouple the number of\nqueries required to generate each adversarial sample from the dimensionality of\nthe input. An iterative variant of our attack achieves close to 100%\nadversarial success rates for both targeted and untargeted attacks on DNNs. We\ncarry out extensive experiments for a thorough comparative evaluation of\nblack-box attacks and show that the proposed Gradient Estimation attacks\noutperform all transferability based black-box attacks we tested on both MNIST\nand CIFAR-10 datasets, achieving adversarial success rates similar to well\nknown, state-of-the-art white-box attacks. We also apply the Gradient\nEstimation attacks successfully against a real-world Content Moderation\nclassifier hosted by Clarifai. Furthermore, we evaluate black-box attacks\nagainst state-of-the-art defenses. We show that the Gradient Estimation attacks\nare very effective even against these defenses.","url_abs":"http://arxiv.org/abs/1712.09491v1","url_pdf":"http://arxiv.org/pdf/1712.09491v1.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"exploring-the-space-of-black-box-attacks-on","repo_url":"https://github.com/sunblaze-ucb/blackbox-attacks","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":1,"framework":"tf","reach":{"status":"unanswered"}}],"tasks":[],"methods":[],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"syntology_url":"https://syntology.ai/paper/1712.09491","atlas_url":"https://app.syntology.ai/?focus=1712.09491","mcp":null,"developers":"https://syntology.ai/developers"},"arxiv_metadata":null,"syntology_extracted_results":null}