ZQBA: Zero Query Black-box Adversarial Attack

2025-10-01

AI Summary

Existing black-box adversarial attacks rely on multiple queries or pre-trained diffusion models, requiring carefully designed surrogate loss functions and thus suffering from limited practicality. This paper proposes the first query-free black-box attack method: it directly generates adversarial perturbations from the source model’s deep feature maps—without any interaction with the target model, surrogate models, or diffusion model training. By injecting perturbations into intermediate feature maps, the method achieves cross-model and cross-dataset transferability. It attains state-of-the-art attack success rates on CIFAR-10, CIFAR-100, and Tiny ImageNet, significantly outperforming single-query baselines. Perturbation imperceptibility is rigorously quantified using the Structural Similarity Index (SSIM). The approach simultaneously ensures high efficiency, strong stealthiness, and plug-and-play applicability, establishing a novel paradigm for practical black-box adversarial attacks.

Technology Category

• Computer Vision: Adversarial Attacks & Robustness
• Machine Learning: Adversarial Learning & Robustness
• Multiagent Systems: Adversarial Agents

Application Category

• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems
• Search and Retrieval-Augmented AI: Web learning to rank, online learning, and counterfactual learning for ranking
• Web Mining and Content Analysis: Large pretrained models with web data

Abstract

Current black-box adversarial attacks either require multiple queries or diffusion models to produce adversarial samples that can impair the target model performance. However, these methods require training a surrogate loss or diffusion models to produce adversarial samples, which limits their applicability in real-world settings. Thus, we propose a Zero Query Black-box Adversarial (ZQBA) attack that exploits the representations of Deep Neural Networks (DNNs) to fool other networks. Instead of requiring thousands of queries to produce deceiving adversarial samples, we use the feature maps obtained from a DNN and add them to clean images to impair the classification of a target model. The results suggest that ZQBA can transfer the adversarial samples to different models and across various datasets, namely CIFAR and Tiny ImageNet. The experiments also show that ZQBA is more effective than state-of-the-art black-box attacks with a single query, while maintaining the imperceptibility of perturbations, evaluated both quantitatively (SSIM) and qualitatively, emphasizing the vulnerabilities of employing DNNs in real-world contexts. All the source code is available at https://github.com/Joana-Cabral/ZQBA.

Problem

• Develops zero-query black-box attack using DNN representations
• Transfers adversarial samples across models and datasets
• Maintains imperceptible perturbations while outperforming existing attacks

Innovation

• Zero query attack using DNN feature maps
• Transfer adversarial samples across models
• Maintain imperceptibility with single query