Pith. sign in

REVIEW 4 major objections 6 minor 55 references

No Query, No Access

T0 review · 4 major / 6 minor · reviewed 2026-08-15 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Text-only adversarial attacks need zero queries and can fool closed LLMs with up to 45.99% success.

desk verdict A genuinely new zero-query attack scenario that deserves referee time, but the transfer mechanism is asserted rather than tested and the headline numbers may be inflated by victim-model instability. read the letter →

arxiv 2505.07258 v2 pith:GHIZ2ELK submitted 2025-05-12 cs.CL cs.AI

Wenqiang Wang , Siyuan Liang , Yangshijie Zhang , Xiaojun Jia , Hao Lin , Xiaochun Cao This is my paper · ORCID
classification cs.CLcs.AI
keywords textualadversarialattackvictimdatazero-querypseudo-labelclusteringsubstitutemodeltransferabilityLLMsecurityblack-box
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper tries to establish that textual adversarial attacks can be mounted with almost no information about the target: no queries to it, no access to its weights or gradients, and no training data—only the victim texts themselves. The proposed framework, VDBA, embeds those texts, splits them into two clusters, and treats the clusters as pseudo-labels for training substitute binary classifiers. It then trains a hierarchy of finer substitutes and generates candidate adversarial examples with several existing attack methods, selecting the candidate with the best combination of predicted-probability shift and semantic similarity. On SST5 and Emotion, the paper reports attack success rates above 40% against small classifiers and up to 45.99% against closed LLMs such as Qwen2 and GPT-4o variants, all with zero queries during generation. If correct, this removes the standard prerequisites for black-box attacks and implies that exposed texts alone are a serious attack surface for modern NLP systems.

What carries the argument

The load-bearing mechanism is the hierarchical substitute-model family trained on pseudo-labeled shadow data. VDBA starts with a binary K-means split of the victim texts into $C_{pos}$ and $C_{neg}$, trains substitute $f_s^1$, then re-clusters the texts inside each cluster to train finer substitutes $f_s^2, f_s^3$, and so on, producing $2^0 + 2^1 + \cdots + 2^u$ models over $u$ iterations. For a victim text, every attack method $M_l$ is applied to every substitute $f_s^j$, giving $wU$ candidate perturbations; the final pick maximizes $s_i^{lj} = \alpha\,(p_{\hat y}^{f_s^j}(x_i^{lj}) - p_{\hat y}^{f_s^j}(\tilde x_i^{lj})) + \beta\,\cos(f_e(x_i), f_e(\tilde x_i^{lj}))$, subject to thresholds $\epsilon'$ on the probability drop and $\epsilon^*$ on embedding similarity. The paper's theoretical support is that more substitute models make it overwhelmingly likely that at least one transfers (Theorem 4.2), and more attack methods make it overwhelmingly likely that at least one candidate satisfies the similarity requirement (Theorem 4.3). The transfer itself relies on the claim that coarse pseudo-label boundaries are aligned with the victim's fine-grained labels, so flipping 'dog' to 'non-dog' on the substitute pushes a 'Corgi' example away from 'Corgi' in the victim.

What would settle it

Run VDBA with randomly shuffled or deliberately misaligned cluster pseudo-labels on SST5 and Emotion while keeping all other components identical; if ASR stays near the reported 40–52%, the coarse semantic boundary is not what carries the attack.

Watch

Extended reading notes

Core claim

On the paper's own terms, the central discovery is that a shadow dataset built from unlabeled victim texts can replace the substitute model that transfer attacks normally require. Two-cluster K-means on T5 embeddings produces high-level pseudo-labels, and a small transformer trained on those labels generates perturbations that flip the substitute's coarse decision; the claim is that the same perturbation also flips the victim's fine-grained label. The reported numbers are state-of-the-art on the tested setups, with VDBA reaching 52.08% ASR on SST5 with DistilBERT, 45.03% on SST5 with RoBERTa, and 45.99% on Qwen2, all at zero query cost. The same pipeline keeps working with five victim texts (ASR above 27%) and even with one victim text plus attribute-related online texts (up to 50.36% ASR), which is the paper's evidence that the attack is not an artifact of abundant data.

Load-bearing premise

The entire attack rests on the unproven claim that an example which flips a coarse pseudo-label on the substitute (dog to non-dog) will also flip the victim's fine-grained label (Corgi to something else), even though the two models were trained on different labels.

Editorial extensions

If this is right

  • Attacks no longer need model feedback: an attacker who can read the texts being classified can generate transferable adversarial examples without spending queries, which removes the main practical barrier against API-deployed models.
  • Closed LLMs are exposed through the same channel: the paper reports 27.65–45.99% ASR on GPT-4o, GPT-4o mini, and Qwen2 with no API access, suggesting that current alignment and safety training do not close this transfer path.
  • Very small text samples still support the attack: with only five victim texts the reported ASR stays above 27%, and with one victim text plus attribute-related texts it reaches 50.36% on SST5 with DistilBERT.
  • Attack strength trades against similarity: raising the number of hierarchical iterations from three to four jumps ASR (to 64.49% on SST5 with DistilBERT) but lowers semantic similarity from 0.950 to 0.916, so stronger attacks are visibly less natural.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If the coarse-boundary transfer hypothesis is correct, the same pseudo-label clustering recipe should transfer to other modalities: an image or audio model whose labels refine a coarse taxonomy should be attackable with unlabeled inputs from that taxonomy alone.
  • A direct test of the paper's core assumption is to replace the K-means pseudo-labels with random binary labels while keeping everything else fixed; if the attack success rate barely moves, the transfer comes from training any binary substitute rather than from semantic cluster alignment.
  • The paper's own adversarial-training appendix (ASR dropping from roughly 49.81% to 22.27% on SST5) points to a defense that needs no access to the attacker: training on perturbed text roughly halves this attack's effectiveness, so API providers could blunt the threat without changing their public interface.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 6 minor

Summary. The paper introduces VDBA, a textual adversarial attack that assumes access only to victim texts (no victim model queries, no gradients, no training data). The method embeds victim texts, assigns binary pseudo-labels via K-means clustering, trains substitute classifiers on the resulting shadow dataset, iteratively refines clusters to train a hierarchy of substitute models, and finally generates candidate adversarial examples with several attack methods, selecting the candidate with the best combination of predicted-probability change and semantic similarity. Experiments on SST5, Emotion, AG News, TREC6, and several closed/open LLMs report attack success rates up to 52.08% at zero query cost, substantially outperforming baselines that are allowed up to 35 accesses per text. The authors claim state-of-the-art performance in both ASR and Query metrics and conclude that even closed LLMs are vulnerable under this threat model.

Significance. If the central empirical claim holds, VDBA meaningfully expands the black-box threat model for text classification: it removes the need for model queries, training data, and substitute-model access, relying only on victim texts or topic-related texts. The paper's strengths include a clear problem formulation, experiments across multiple datasets and victim models, evaluation against several strong baselines, and an anonymous code release. The claim that victim texts alone can drive transferable attacks is interesting and potentially important for security auditing. However, the load-bearing mechanism, the High-level Attack Hypothesis (Assumption 4.1), is asserted rather than validated independently; without a control for victim-model label instability, the reported ASR numbers do not uniquely support the proposed clustering-based explanation. The lack of repeated runs or error bars and the use of the test sets for hyperparameter selection further weaken the quantitative claims. A revision that adds the missing controls and uncertainty quantification could make this a solid contribution.

major comments (4)
  1. [Section 4.1, Assumption 4.1; Section 5.3] The central mechanism of VDBA is Assumption 4.1, which states that adversarial examples generated on a substitute model trained with high-level pseudo-labels transfer to the victim model. This assumption is never tested independently of the full attack pipeline. The reported ASR could in part reflect victim-model label instability under synonym substitution rather than alignment between the pseudo-label clusters and the victim decision boundary. The paper needs a control experiment that decouples these factors, for example: (i) train substitute models with random pseudo-labels and measure the resulting ASR; and (ii) apply random synonym replacements to victim texts and measure how often the victim model changes its prediction. The paper's own ablation results in Section 5.3 and Appendix H, which find that clustering and embedding choices have a 'limited and somewhat random impact' on ASR and that one-hot embeddings lose only 1.5% ASR relative to pretrained embeddings, make this concern concrete: if the specific cluster structure were doing the work attributed to it by Assumption 4.1, one would expect clustering and embedding choices to matter more. This control is load-bearing for the paper's core claim and should be added before publication.
  2. [Section 5.1, Section 5.3, Eq. (9)] Many core hyperparameters are selected through ablations on the same test sets used to report final results. Specifically, the number of clusters K, the number of hierarchical iterations, the number of attack methods, the scaling factors alpha and beta, and the thresholds epsilon' and epsilon* are all chosen after inspecting ASR and Sim on the test sets (Section 5.1, Section 5.3, Tables 8-9, Figure 8). No validation split or cross-validation is described, and no repeated runs or error bars are reported. Because the central claim is that VDBA achieves SOTA ASR, the paper should report the variance across at least several independent runs (or across seeds) and should either fix hyperparameters using a validation set or justify why the reported configuration is not over-fit to the test data.
  3. [Theorems 4.2 and 4.3; Appendix F] Theorems 4.2 and 4.3 are order-statistics facts: as the number of substitute models or attack methods grows, the probability that the maximum of independent candidate success probabilities exceeds a fixed value approaches one. These theorems do not establish transferability from the substitute models to the victim model; they only say that under an independence assumption, more candidates are better. The proof of Theorem 4.2 in Appendix F explicitly assumes independence among the success probabilities, and Theorem 4.3 assumes 'approximate independence' among attack methods. These assumptions are not empirically checked, and even if they hold, the theorems cannot rescue Assumption 4.1. The paper should either present these results as heuristic motivation (with the independence assumptions clearly stated in the main text) or provide evidence that the candidate success probabilities are indeed independent and predictive of victim model behavior.
  4. [Section 5.4, Table 4] The claim that 'a higher number of class labels is associated with a smaller average distance and higher ASR' is not supported by the data in Table 4. Only four training datasets are compared, and they differ in domain (sentiment vs. question classification) as well as label count. Go Emotion (28 labels, 85.68% ASR) and SST5 (5 labels, 45.03% ASR) are both sentiment, but TREC6 (6 labels, 19.37% ASR) is question classification and Financial PhraseBank (3 labels, 33.76% ASR) is sentiment. These four points cannot establish a monotonic relationship between label count and ASR; the effect is confounded by domain and dataset difficulty. This claim should be removed or supported by a controlled comparison that varies label count while holding domain and data distribution fixed.
minor comments (6)
  1. [Abstract and Section 5.2] The abstract states 'achieving an ASR improvement of 52.08%', but Table 1 reports an ASR of 52.08% for SST5 with DistilBERT. The improvement over the best baseline (HQA) is about 5.97 percentage points; the wording should be corrected to 'an ASR of 52.08%' or 'an improvement of 5.97 points'.
  2. [Section 5.2 and Appendix] There are unresolved references to 'Appendix ??' and 'Section ??' in Section 5.2 and the appendix list. These placeholders should be fixed before submission.
  3. [Section 4.2, Eq. (5)] Equation (5) introduces notation ~PM and gamma-hat but is not integrated into the surrounding text; it is unclear whether it belongs to the hierarchical substitute model design or is a leftover from a prior draft. Please remove it or explain its role.
  4. [Figure 2 and Section 4] The text says 'As shown in Figure 2, DBA comprises three components' but the method is called VDBA. This typo should be corrected.
  5. [Table 2] Table 2 reports a single Sim column per dataset but has four ASR columns (two models per dataset). It should either report Sim separately for each model or explain that the reported Sim is averaged across models.
  6. [Section 5.4, LLM Attack] The LLM experiments do not report details such as the number of sampled texts, the API temperature, the number of repeated calls, or the exact version of GPT-4o and GPT-4omini. These details are needed to assess the reliability and reproducibility of the LLM attack results.

Circularity Check

1 steps flagged · score 2.0 of 10

No significant circularity: reported ASRs are measured empirically, though Theorems 4.2-4.3 are tautological order-statistics framing and Assumption 4.1 is an unverified transfer premise.

  1. other [Section 4.2, Theorem 4.2 (and Section 4.3, Theorem 4.3); proof in Appendix F/G]
    "We use Theorem 4.2 to formalize the intuition that as the number of substitute models increases, the probability that at least one adversarial example generated by these models successfully attacks the victim model also increases: Theorem 4.2. Let {p^s_1, p^s_2, ..., p^s_m} represent the success probabilities of attacking the target model... As m→∞, the probability that max{p^s_1,...,p^s_m} > p^s_i approaches 1."

    The theorem's conclusion is the elementary order-statistics fact that the maximum of m random variables stochastically dominates the maximum of a subset; the Appendix F proof uses only F(p)^m→0 and never invokes properties of hierarchical clustering, substitute-model training, or transfer. The paper then reads this theorem as showing that hierarchical substitute models 'ensure higher attack success rates.' That reading is valid only if the p^s_i are the victim-model success probabilities of the candidate adversarial examples, which is exactly the transfer claim that needs to be established (and which is merely assumed in Assumption 4.1). Thus the formal 'derivation' reduces by construction to the definition of a maximum and cannot independently support the hierarchical-design claim.

full rationale

The central ASR claims in Tables 1-5 are empirical measurements on victim models: VDBA trains a substitute model on K-means pseudo-labels from victim texts, generates candidates with standard attack methods, selects by substitute-model probability drop and similarity, and only then queries the victim to measure ASR. No victim labels, gradients, or probabilities enter substitute-model training, and no reported ASR value is a fitted parameter renamed as a prediction. The constructed shadow dataset is not defined in terms of victim outputs, so there is no self-definitional reduction. There is no load-bearing self-citation chain or imported uniqueness theorem. The main theoretical weakness is that Theorems 4.2 and 4.3 are tautological order-statistics facts used as if they justified the hierarchical and multi-method gains; they do so only if one already assumes the candidate success probabilities are victim-transfer probabilities. Assumption 4.1 is likewise an explicit, unproven transfer hypothesis, and the ablation showing clustering and embedding methods have 'limited and somewhat random impact' (Section 5.3) raises a validity concern that the reported ASR may partly reflect victim-model instability rather than cluster-boundary transfer. Those concerns are about correctness and missing controls, not circularity. The paper also contains missing appendix pointers ('Appendix ??'), a completeness issue rather than a circular step. Overall, the empirical attack results are self-contained, and the circularity score is low despite the tautological theoretical framing.

Assumptions & free parameters 7 free parameters · 5 assumptions · 0 invented entities

The framework introduces no new physical or mathematical entities; it combines known components (K-means, substitute models, existing attack methods) with a new attack scenario. The main load-bearing assumptions are the transferability of pseudo-label boundaries and the independence assumptions used in the trivial theorems.

free parameters (7)
  • Number of clusters (K) = 2
    Chosen because ablation shows decreasing ASR for 3 and 4 clusters (Section 5.3, Figure 8). This is tuned on the victim test sets.
  • Hierarchy iterations = 3
    Selected from ablation (Table 8) to balance ASR gain and similarity drop; 4 iterations increase ASR but reduce Sim to 0.913/0.916.
  • Number of attack methods = 5
    Selected from ablation (Table 9); benefit of 7 methods is small and costs more compute.
  • Weight alpha in selection score = 3
    Set in Section 5.1; no search or validation reported.
  • Weight beta in selection score = 1
    Set in Section 5.1; no search or validation reported.
  • Probability-change threshold epsilon_prime = 0.35
    Set in Section 5.1; controls exclusion of substitute models near decision boundary.
  • Similarity threshold epsilon_star = 0.85
    Set in Section 5.1; controls semantic similarity of selected adversarial examples.
assumptions (5)
  • domain assumption High-level Attack Hypothesis (Assumption 4.1): adversarial examples generated on a substitute model trained with high-level pseudo-labels also fool the victim model.
    This transferability is the core premise; the paper asserts it with a corgi/dog example but provides no proof or independent test.
  • domain assumption K-means on text embeddings with K=2 yields pseudo-labels that correspond to some high-level class/non-class boundary useful for attacks.
    Section 4.1 uses this to build the shadow dataset; no evidence that the clusters align with victim decision boundaries.
  • ad hoc to paper Success probabilities of substitute models and attack methods are independent in Theorems 4.2 and 4.3.
    Assumed in Appendices F/G so the max-of-many argument goes through; no justification for independence.
  • domain assumption Public pre-trained embedding model T5 provides an embedding space where semantic distance reflects the victim model's class structure.
    Section 4.1 uses T5 embeddings for clustering and similarity; the paper shows one-hot also works, weakening this axiom, but it is still relied on in the main configuration.
  • domain assumption The pseudo-label substitute model trained on shadow dataset D is adequate for conducting effective adversarial attacks.
    Section 4.1 states this directly; it is essentially Assumption 4.1 restated at the model level.

how reviews work

0 comments
Cite this review

Pith. "Pith review of No Query, No Access." pith.science (2026). https://pith.science/paper/GHIZ2ELK

@misc{pith2026250507258,
  author       = {Pith},
  title        = {Pith review of: No Query, No Access},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/GHIZ2ELK}},
  note         = {Machine review of arXiv:2505.07258}
}
read the original abstract

Textual adversarial attacks mislead NLP models, including Large Language Models (LLMs), by subtly modifying text. While effective, existing attacks often require knowledge of the victim model, extensive queries, or access to training data, limiting real-world feasibility. To overcome these constraints, we introduce the \textbf{Victim Data-based Adversarial Attack (VDBA)}, which operates using only victim texts. To prevent access to the victim model, we create a shadow dataset with publicly available pre-trained models and clustering methods as a foundation for developing substitute models. To address the low attack success rate (ASR) due to insufficient information feedback, we propose the hierarchical substitution model design, generating substitute models to mitigate the failure of a single substitute model at the decision boundary. Concurrently, we use diverse adversarial example generation, employing various attack methods to generate and select the adversarial example with better similarity and attack effectiveness. Experiments on the Emotion and SST5 datasets show that VDBA outperforms state-of-the-art methods, achieving an ASR improvement of 52.08\% while significantly reducing attack queries to 0. More importantly, we discover that VDBA poses a significant threat to LLMs such as Qwen2 and the GPT family, and achieves the highest ASR of 45.99% even without access to the API, confirming that advanced NLP models still face serious security risks. Our codes can be found at https://anonymous.4open.science/r/VDBA-Victim-Data-based-Adversarial-Attack-36EC/

Figures

Figures reproduced from arXiv: 2505.07258 by the authors.

Figure 1
Figure 1. Comparison of victim data-based, query-based, and transfer-based attacks. Query-based attacks generate adversarial examples by querying the victim model for feedback. Transfer￾based attacks use substitute models trained on the victim’s dataset to craft transferable adversarial examples. Victim data-based at￾tacks cluster unlabeled victim texts to create a shadow dataset, training a binary classifier to generate adve… view at source ↗
Figure 2
Figure 2. The overview of the Victim Data-based Attack (VDBA). In Cluster-Guided Shadow Dataset Synthesis, VDBA utilizes an embedding model to vectorize victim texts, followed by binary clustering to generate pseudo-labels, thus creating the shadow dataset. In Hierarchical Substitute Model Design, VDBA further clusters texts with identical labels, hierarchically training a new substitute model. This approach provides a broade… view at source ↗
Figure 4
Figure 4. The overview of Hierarchical Substitution Model De￾sign. For the first iteration of VDBA, all victim texts are employed to train the substitute model f s 1 . For the second iteration, the victim texts with the positive cluster label Cpos are employed to train the substitute model f s 2 , the victim texts with the negative cluster label Cneg are employed to train the substitute model f s 3 . Following this process, w… view at source ↗
Figures from the paper (4 more)
Figure 5
Figure 5. Figure 5: The overview of Diverse Adversarial Example Gener￾ation. The left figure depicts the generation of six candidate adver￾sarial samples using two attack methods (M1, M2) and three sub￾stitute models (f s 1, f s 2,f s 3). According to Equation 9, x˜ 11 i and x˜ 21 i are e…
Figure 6
Figure 6. Figure 6: The ASR of VDBA with and without the defense method. “W” indicates the VDBA with the defense method. And “W/O” indicates the VDBA without the defense method. effectively target closed-source LLMs with minimal access to victim texts. Attack results under defense method.…
Figure 7
Figure 7. Figure 7: Experiment results under different clustering vectorization method. M1 and M2 represent DistilBERT and RoBERTa models for SST5, while M3 and M4 represent DistilBERT and RoBERTa models for Emotion. “Avg” denotes the mean score of ASR and similarity. The impact of cluste…
Figure 8
Figure 8. Figure 8: The ASR for different cluster numbers. Fewer clusters imply better ASR [PITH_FULL_IMAGE:figures/full_fig_p017_8.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

55 extracted references · 42 canonical work pages

  1. [1]

    An, J., Ding, W., and Lin, C. Chatgpt. tackle the growing carbon footprint of generative AI, 615: 0 586, 2023

    work page 2023

  2. [2]

    and Biecek, P

    Baniecki, H. and Biecek, P. Adversarial attacks and defenses in explainable artificial intelligence: A survey. Information Fusion, pp.\ 102303, 2024

    work page 2024

  3. [3]

    Less is more: Fewer interpretable region via submodular subset selection

    Chen, R., Zhang, H., Liang, S., Li, J., and Cao, X. Less is more: Fewer interpretable region via submodular subset selection. arXiv preprint arXiv:2402.09164, 2024

    arXiv 2024

  4. [4]

    Goemotions: A dataset of fine-grained emotions

    Demszky, D. Goemotions: A dataset of fine-grained emotions. In ACL, 2020

    work page 2020

  5. [5]

    Deng, Z., Zhang, L., Vodrahalli, K., Kawaguchi, K., and Zou, J. Y. Adversarial training helps transfer learning via better representations. NeurIPS, 34: 0 25179--25191, 2021

    work page 2021

  6. [6]

    Hotflip: White-box adversarial examples for text classification

    Ebrahimi, J., Rao, A., Lowd, D., and Dou, D. Hotflip: White-box adversarial examples for text classification. In ACL, pp.\ 31--36, 2018

    work page 2018

  7. [7]

    A survey of text classification with transformers: How wide? how large? how long? how accurate? how expensive? how safe? IEEE Access, 2024

    Fields, J., Chovanec, K., and Madiraju, P. A survey of text classification with transformers: How wide? how large? how long? how accurate? how expensive? how safe? IEEE Access, 2024

    work page 2024

  8. [8]

    Adversarial attacks on deep models for financial transaction records

    Fursov, I., Morozov, M., Kaploukhaya, N., Kovtun, E., Rivera-Castro, R., Gusev, G., Babaev, D., Kireev, I., Zaytsev, A., and Burnaev, E. Adversarial attacks on deep models for financial transaction records. In Proceedings of the 27th ACM SIGKDD Conference on Knowledge Discovery & Data Mining, pp.\ 2868--2878, 2021

    work page 2021

Show all 55 references
  1. [9]

    and Ramakrishnan, G

    Garg, S. and Ramakrishnan, G. Bae: Bert-based adversarial examples for text classification. In EMNLP, pp.\ 6174--6181, 2020

    2020

  2. [10]

    Improving open data web api documentation through interactivity and natural language generation

    Gonz \'a lez-Mora, C., Barros, C., Garrig \'o s, I., Zubcoff, J., Lloret, E., and Maz \'o n, J.-N. Improving open data web api documentation through interactivity and natural language generation. Computer Standards & Interfaces, 83: 0 103657, 2023

    2023

  3. [11]

    Bfs2adv: Black-box adversarial attack towards hard-to-attack short texts

    Han, X., Li, Q., Cao, H., Han, L., Wang, B., Bao, X., Han, Y., and Wang, W. Bfs2adv: Black-box adversarial attack towards hard-to-attack short texts. CS, pp.\ 103817, 2024

    2024

  4. [12]

    Fasttextdodger: Decision-based adversarial attack against black-box nlp models with extremely high efficiency

    Hu, X., Liu, G., Zheng, B., Zhao, L., Wang, Q., Zhang, Y., and Du, M. Fasttextdodger: Decision-based adversarial attack against black-box nlp models with extremely high efficiency. TIFS, 2024

    2024

  5. [13]

    Cogmorph: Cognitive morphing attacks for text-to-image models

    Jing, Z., Ying, Z., Wang, L., Liang, S., Liu, A., Liu, X., and Tao, D. Cogmorph: Cognitive morphing attacks for text-to-image models. arXiv preprint arXiv:2501.11815, 2025

    2025 arXiv

  6. [14]

    A hybrid style transfer with whale optimization algorithm model for textual adversarial attack

    Kang, Y., Zhao, J., Yang, X., Fan, B., and Xie, W. A hybrid style transfer with whale optimization algorithm model for textual adversarial attack. NCA, 36: 0 4263--4280, 2024

    2024

  7. [15]

    and Lee, S

    Kwon, H. and Lee, S. Ensemble transfer attack targeting text classification systems. Computers & Security, 117: 0 102695, 2022

    2022

  8. [16]

    Efficient adversarial attacks for visual object tracking

    Liang, S., Wei, X., Yao, S., and Cao, X. Efficient adversarial attacks for visual object tracking. In Computer Vision--ECCV 2020: 16th European Conference, Glasgow, UK, August 23--28, 2020, Proceedings, Part XXVI 16, 2020

    2020

  9. [17]

    A large-scale multiple-objective method for black-box attack against object detection

    Liang, S., Li, L., Fan, Y., Jia, X., Li, J., Wu, B., and Cao, X. A large-scale multiple-objective method for black-box attack against object detection. In European Conference on Computer Vision, 2022 a

    2022

  10. [18]

    Imitated detectors: Stealing knowledge of black-box object detectors

    Liang, S., Liu, A., Liang, J., Li, L., Bai, Y., and Cao, X. Imitated detectors: Stealing knowledge of black-box object detectors. In Proceedings of the 30th ACM International Conference on Multimedia, pp.\ 4839--4847, 2022 b

    2022

  11. [19]

    Parallel rectangle flip attack: A query-based black-box attack against object detection

    Liang, S., Wu, B., Fan, Y., Wei, X., and Cao, X. Parallel rectangle flip attack: A query-based black-box attack against object detection. arXiv preprint arXiv:2201.08970, 2022 c

    2022 arXiv

  12. [20]

    Badclip: Dual-embedding guided backdoor attack on multimodal contrastive learning

    Liang, S., Zhu, M., Liu, A., Wu, B., Cao, X., and Chang, E.-C. Badclip: Dual-embedding guided backdoor attack on multimodal contrastive learning. arXiv preprint arXiv:2311.12075, 2023

    2023 arXiv

  13. [21]

    Revisiting backdoor attacks against large vision-language models

    Liang, S., Liang, J., Pang, T., Du, C., Liu, A., Chang, E.-C., and Cao, X. Revisiting backdoor attacks against large vision-language models. arXiv preprint arXiv:2406.18844, 2024

    2024 arXiv

  14. [22]

    Using adversarial attacks to reveal the statistical bias in machine reading comprehension models

    Lin, J., Zou, J., and Ding, N. Using adversarial attacks to reveal the statistical bias in machine reading comprehension models. In ACL-IJCNLP, pp.\ 333--342, 2021

    2021

  15. [23]

    Sspattack: a simple and sweet paradigm for black-box hard-label textual adversarial attack

    Liu, H., Xu, Z., Zhang, X., Xu, X., Zhang, F., Ma, F., Chen, H., Yu, H., and Zhang, X. Sspattack: a simple and sweet paradigm for black-box hard-label textual adversarial attack. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 37, pp.\ 13228--13235, 2023

    2023

  16. [24]

    Hqa-attack: Toward high quality black-box hard-label adversarial attack on text

    Liu, H., Xu, Z., Zhang, X., Zhang, F., Ma, F., Chen, H., Yu, H., and Zhang, X. Hqa-attack: Toward high quality black-box hard-label adversarial attack on text. NeurIPS, 36, 2024

    2024

  17. [25]

    Least squares quantization in pcm

    Lloyd, S. Least squares quantization in pcm. ieee transac-tions on information theory, 28, 129-137, 1982

    1982

  18. [26]

    Ct-gat: Cross-task generative adversarial attack based on transferability

    Lv, M., Dai, C., Li, K., Zhou, W., and Hu, S. Ct-gat: Cross-task generative adversarial attack based on transferability. In The 2023 Conference on Empirical Methods in Natural Language Processing, 2023

    2023

  19. [27]

    Cross-entropy loss functions: Theoretical analysis and applications

    Mao, A., Mohri, M., and Zhong, Y. Cross-entropy loss functions: Theoretical analysis and applications. In International conference on Machine learning, pp.\ 23803--23828. PMLR, 2023

    2023

  20. [28]

    A., and Malki, K

    Mohamad-Hani, T., Jamal, A., Khalid, A., Temsah, A. A., and Malki, K. H. Openai o1-preview vs. chatgpt in healthcare: A new frontier in medical ai reasoning. Cureus, 16 0 (10), 2024

    2024

  21. [29]

    S., and Porikli, F

    Naseer, M., Khan, S., Hayat, M., Khan, F. S., and Porikli, F. On generating transferable targeted perturbations. In ICCV, pp.\ 7688--7697. IEEE, 2021

    2021

  22. [30]

    Chatgpt: Gpt-4, 2023

    OpenAI. Chatgpt: Gpt-4, 2023. URL https://openai.com/chatgpt. Accessed: 2024-10-01

    2023

  23. [31]

    and Lee, L

    Pang, B. and Lee, L. Seeing stars: Exploiting class relationships for sentiment categorization with respect to rating scales. In Proceedings of the ACL, 2005

    2005

  24. [32]

    Crafting adversarial input sequences for recurrent neural networks

    Papernot, N., McDaniel, P., Swami, A., and Harang, R. Crafting adversarial input sequences for recurrent neural networks. In MILCOM, pp.\ 49--54, 2016

    2016

  25. [33]

    Review of artificial intelligence adversarial attack and defense technologies

    Qiu, S., Liu, Q., Zhou, S., and Wu, C. Review of artificial intelligence adversarial attack and defense technologies. Applied Sciences, 9 0 (5): 0 909, 2019

    2019

  26. [34]

    W., Hallacy, C., Ramesh, A., Goh, G., Agarwal, S., Sastry, G., Askell, A., Mishkin, P., Clark, J., et al

    Radford, A., Kim, J. W., Hallacy, C., Ramesh, A., Goh, G., Agarwal, S., Sastry, G., Askell, A., Mishkin, P., Clark, J., et al. Learning transferable visual models from natural language supervision. In ICML, pp.\ 8748--8763, 2021

    2021

  27. [35]

    Raffel, C., Shazeer, N., Roberts, A., Lee, K., Narang, S., Matena, M., Zhou, Y., Li, W., and Liu, P. J. Exploring the limits of transfer learning with a unified text-to-text transformer. Journal of machine learning research, 21: 0 1--67, 2020

    2020

  28. [36]

    Generating natural language adversarial examples through probability weighted word saliency

    Ren, S., Deng, Y., He, K., and Che, W. Generating natural language adversarial examples through probability weighted word saliency. In ACL, pp.\ 1085--1097, 2019

    2019

  29. [37]

    A., Gonzalez, J., and Escalera, S

    Rodr \' guez, P., Bautista, M. A., Gonzalez, J., and Escalera, S. Beyond one-hot encoding: Lower dimensional target embedding. Image and Vision Computing, 75: 0 21--31, 2018

    2018

  30. [38]

    T., Huang, Y.-C., Wu, J., and Chen, Y.-S

    Saravia, E., Liu, H.-C. T., Huang, Y.-C., Wu, J., and Chen, Y.-S. Carer: Contextualized affect representations for emotion recognition. In Proceedings of the 2018 Conference on Empirical Methods in Natural Language Processing, pp.\ 3687--3697, 2018

    2018

  31. [39]

    D., Ng, A

    Socher, R., Perelygin, A., Wu, J., Chuang, J., Manning, C. D., Ng, A. Y., and Potts, C. Recursive deep models for semantic compositionality over a sentiment treebank. In Proceedings of the 2013 Conference on Empirical Methods in Natural Language Processing, pp.\ 1631--1642, 2013

    2013

  32. [40]

    Text classification via large language models

    Sun, X., Li, X., Li, J., Wu, F., Guo, S., Zhang, T., and Wang, G. Text classification via large language models. In Findings of the Association for Computational Linguistics: EMNLP 2023, pp.\ 8990--9005, 2023

    2023

  33. [41]

    A tutorial on spectral clustering

    Von Luxburg, U. A tutorial on spectral clustering. Statistics and computing, 17: 0 395--416, 2007

    2007

  34. [42]

    Voorhees, E. M. and Harman, D. Overview of the sixth text retrieval conference (trec-6). Information Processing & Management, 36 0 (1): 0 3--35, 2000

    2000

  35. [43]

    A modified word saliency-based adversarial attack on text classification models

    Waghela, H., Rakshit, S., and Sen, J. A modified word saliency-based adversarial attack on text classification models. arXiv preprint arXiv:2403.11297, 2024

    2024 arXiv

  36. [44]

    Punctuation-level attack: Single-shot and single punctuation can fool text models

    Wang, W., Du, C., Wang, T., Zhang, K., Luo, W., Ma, L., Liu, W., and Cao, X. Punctuation-level attack: Single-shot and single punctuation can fool text models. In NeurIPS, 2023

    2023

  37. [45]

    Transferable adversarial attacks for image and video object detection

    Wei, X., Liang, S., Chen, N., and Cao, X. Transferable adversarial attacks for image and video object detection. arXiv preprint arXiv:1811.12641, 2018

    2018 arXiv

  38. [46]

    R., and King, I

    Wu, W., Su, Y., Lyu, M. R., and King, I. Improving the transferability of adversarial samples with adversarial transformations. In CVPR, pp.\ 9020--9029. IEEE, 2021

    2021

  39. [47]

    Leap: Efficient and automated test method for nlp software

    Xiao, M., Xiao, Y., Dong, H., Ji, S., and Zhang, P. Leap: Efficient and automated test method for nlp software. In 2023 38th IEEE/ACM International Conference on Automated Software Engineering (ASE), pp.\ 1136--1148. IEEE, 2023

    2023

  40. [48]

    Qwen2 technical report

    Yang, A., Yang, B., Hui, B., Zheng, B., Yu, B., Zhou, C., Li, C., Li, C., Liu, D., Huang, F., et al. Qwen2 technical report. arXiv preprint arXiv:2407.10671, 2024

    2024 arXiv

  41. [49]

    Jailbreak vision language models via bi-modal adversarial prompt

    Ying, Z., Liu, A., Zhang, T., Yu, Z., Liang, S., Liu, X., and Tao, D. Jailbreak vision language models via bi-modal adversarial prompt. arXiv preprint arXiv:2406.04031, 2024

    2024 arXiv

  42. [50]

    Adaptive image transformations for transfer-based adversarial attack

    Yuan, Z., Zhang, J., and Shan, S. Adaptive image transformations for transfer-based adversarial attack. In ECCV, pp.\ 1--17. Springer, 2022

    2022

  43. [51]

    Word-level textual adversarial attacking as combinatorial optimization

    Zang, Y., Qi, F., Yang, C., Liu, Z., Zhang, M., Liu, Q., and Sun, M. Word-level textual adversarial attacking as combinatorial optimization. In ACL, pp.\ 6066--6080, 2020

    2020

  44. [52]

    Birch: an efficient data clustering method for very large databases

    Zhang, T., Ramakrishnan, R., and Livny, M. Birch: an efficient data clustering method for very large databases. ACM sigmod record, 25 0 (2): 0 103--114, 1996

    1996

  45. [53]

    J., and LeCun, Y

    Zhang, X., Zhao, J. J., and LeCun, Y. Character-level convolutional networks for text classification. In NIPS, 2015

    2015

  46. [54]

    Limeattack: Local explainable method for textual hard-label adversarial attack

    Zhu, H., Zhao, Q., Shang, W., Wu, Y., and Liu, K. Limeattack: Local explainable method for textual hard-label adversarial attack. In AAAI, volume 38, pp.\ 19759--19767, 2024

    2024

  47. [55]

    write newline

    " write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 gl...

Pith tools

Reviewed August 15, 2026 · model on record in the stance chip above.