Consensus-based optimization for closed-box adversarial attacks and a connection to evolution strategies

Leon Bungert; Philipp Wacker; Tim Roith

REVIEW 4 major objections 6 minor 1 cited by

Consensus-based optimization for closed-box adversarial attacks and a connection to evolution strategies

T0 review · 4 major / 6 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read This paper shows that consensus hopping—a variant of consensus-based optimization—and Gaussian natural evolution strategies are equivalent to second order in the mean-field limit, both performing noisy gradient descent, and that the…

desk verdict A correct but narrow Taylor-expansion result connecting consensus hopping and NES, wrapped in an honest and useful empirical benchmark; the 'equivalence' framing overreaches, and the experiments need error bars, but the paper deserves a serious referee. read the letter →

arxiv 2506.24048 v1 pith:2IVXZLKS submitted 2025-06-30 math.OC cs.LG

Tim Roith , Leon Bungert , Philipp Wacker This is my paper · ORCID

classification math.OCcs.LG MSC 65K1068Q3265K1590C26

keywords consensus-basedoptimizationnaturalevolutionstrategiesclosed-boxadversarialattacksgradient-freemean-fieldlimitqueryefficiencyblack-box

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper tries to establish that two seemingly different gradient-free optimizers for closed-box adversarial attacks are the same algorithm underneath. It shows that consensus hopping, a variant of consensus-based optimization in which particles hop onto a consensus point and resample, is equivalent to a natural evolution strategy (NES) up to second-order error terms, provided the step sizes and noise scales are matched. The paper then argues experimentally that the original consensus-based optimizer, not just its hopping variant, is competitive: it needs far fewer queries than NES, CH, and CMA-style evolution strategies on easier attack scenarios such as targeted CIFAR-10, untargeted low-resolution ImageNet, one-pixel attacks, and an adversarially trained MNIST model, while losing on harder scenarios like targeted ImageNet and DCT attacks. If true, the result gives a theoretical bridge between two literatures and a practical hint about when ensemble consensus helps zero-order search.

What carries the argument

The load-bearing object is the exponential consensus weighting, $c(X) = \sum_n x^{(n)} e^{-\alpha f(x^{(n))}} / \sum_n e^{-\alpha f(x^{(n)})}$, together with the scaling relation that ties the noise variance to the time step. In consensus hopping the next particles are drawn as $x_{k+1}^{(n)} \sim \mathcal{N}(c(X_k), \tilde{\sigma}^2 I)$, and when $\tilde{\sigma}^2 = \tau/\alpha$ the quotient of exponential-weighted expectations becomes $-\tau\nabla f(c)$ plus second-order error; Gaussian NES samples $z^{(n)} \sim \mathcal{N}(\mu, \sigma^2 I)$ and updates $\mu_{k+1} = \mu_k + \frac{\eta\sigma}{N}\sum_n f(\mu_k + \sigma\xi^{(n)})\xi^{(n)}$, which with $\sigma^2 = \tau/\eta$ becomes $\tau\nabla f(\mu)$ plus the same order of error. The exponential map converts the maximization of $f$ into a minimization of $\exp(-\alpha f)$ whose gradient is $-\alpha \exp(-\alpha f)\nabla f$, which is exactly what the normalised consensus quotient estimates.

What would settle it

Run both algorithms with identical $N=50$ on a piecewise-linear loss such as the margin loss against a ReLU classifier on CIFAR-10, with the matched scalings $\sigma^2=\tau/\eta$ and $\tilde{\sigma}^2=\tau/\alpha$: if consensus hopping's average step direction systematically disagrees with NES's over many restarts—not merely in magnitude—the effective equivalence would fail in exactly the regime the experiments target.

Watch

Extended reading notes

Core claim

The paper's central claim is Proposition 2.1: for a twice continuously differentiable loss $f$ with bounded second derivative, the Gaussian NES update with variance $\sigma^2 = \tau/\eta$ satisfies $\eta\sigma \int f(\mu + \sigma\xi)\,\xi\,d\pi(\xi) = \tau\nabla f(\mu) + O(\sqrt{\tau^3/\eta})$, and the consensus hopping update with noise scale $\tilde{\sigma}^2 = \tau/\alpha$ satisfies $\tilde{\sigma}\, \int \exp(-\alpha f(c+\tilde{\sigma}\xi))\,\xi\,d\pi(\xi) \,/\, \int \exp(-\alpha f(c+\tilde{\sigma}\xi))\,d\pi(\xi) = -\tau\nabla f(c) + O(\sqrt{\tau^3\alpha})$. In other words, in the mean-field, small-step regime, both methods are noisy gradient descent (up to sign), so consensus hopping and Gaussian NES are equivalent to second order. The paper further claims, based on experiments across five attack spaces and four architectures, that the original CBO algorithm—the one that keeps particles drifting toward the weighted consensus point—outperforms NES, CH, and several CMA variants in query efficiency on the easier attack tasks, while underperforming them on targeted and spectral attacks.

Load-bearing premise

The proof replaces the finite particle cloud by its expectation (infinite-sample limit) and assumes the loss is twice continuously differentiable with bounded first and second derivatives, while the motivating attacks evaluate piecewise-linear ReLU losses with only 50 particles.

Editorial extensions

If this is right

NES and consensus hopping should show nearly identical query curves and success rates in any attack setting, because their gradient estimates agree up to second order; the paper observes this in every experiment.
Mean-field convergence theory developed for CBO and consensus hopping can plausibly be transferred to Gaussian NES, which until now had convergence results only for a very restricted class of objectives.
CBO's consensus drift—not just its sampling noise—is what buys query efficiency in easier settings; removing the drift ($\lambda=0$) degrades results, as the paper shows in its supplementary experiments.
For hard or high-dimensional attacks, the fixed-scale exponential averaging of CH and NES beats CBO's distance-scaled noise, so the choice between consensus and evolution strategies should depend on the difficulty of the attack landscape.
The noise-model variants (DCT noise, square noise) show that CBO's gap on structured attack spaces comes from its Gaussian isotropic noise, and that substituting the attack's native perturbation structure recovers much of the gap.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

Editorial inference: the second-order equivalence suggests an explanation for CBO's empirical edge in easy settings—the consensus point aggregates all $N$ particles' information into one gradient estimate, giving CBO a lower-variance step per query than NES, which averages the same $N$ samples but discards the weighting structure; a variance comparison per query on a smooth quadratic would test th
Editorial inference: since ReLU losses are piecewise linear, the Taylor expansion fails in principle, yet CBO still succeeds on easy attacks; this hints that a subgradient or almost-everywhere version of Proposition 2.1 may hold, and one could test it by measuring the bias of the two estimators on random perturbations of a ReLU classifier and comparing with the smooth-predicted step.
Editorial inference: the result may transfer to other exponential-weighting schemes such as Laplace or softmax consensus; if so, the same proof would connect CBO variants to information-geometric evolution strategies beyond Gaussian NES.
Editorial inference: the paper's finding that CBO beats projected gradient descent on the MNIST robust-accuracy challenge suggests consensus-based zero-order search can outperform first-order methods on non-smooth robust losses, which could matter for adversarial training pipelines that currently rely on PGD.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Tim, here's my read on Roith–Bungert–Wacker.

The genuinely new things are the explicit CH–NES comparison and the first systematic CBO benchmark for closed-box attacks. The empirical story is coherent: in easy untargeted low-res scenarios CBO uses roughly a quarter to a third of NES's queries; in targeted ImageNet and structured attack spaces like DCT and square, CBO loses, and they say so plainly. That honesty extends to the experimental setup—they re-run DE and SimBA-DCT, flag mismatched imported baselines, and publish code. The paper is a net positive for the community.

The theory is the soft spot, and it's softer than the paper's conclusions. Proposition 2.1 is internally correct: the Taylor expansions check out under C^2, bounded derivatives, and the scalings sigma^2 = tau/eta, sigma_tilde^2 = tau/alpha. But the inference that CH is 'equivalent' to NES only holds in a mean-field, infinite-sample, smooth limit. The CH update is a self-normalized ratio; its expectation is not the ratio of expectations that the proposition analyzes. Section 2.3 hand-waves past this with 'the limit of the expected value as N→∞,' which needs uniform integrability and does not follow from the stated assumptions. And the experiments run N=50 particles on ReLU-network losses with clipping—outside the theorem's hypotheses. The empirical similarity of CH and NES may be real, but it is not established by Proposition 2.1 for the implemented algorithms. That should be fixed either by proving a finite-particle concentration bound or by explicitly framing the proposition as a heuristic.

The experiments also lack error bars or repeated-seed statistics. The main claims—CBO's query advantage in easy settings—are consistent across architectures, so I don't suspect fabrication, but a hostile referee could poke holes in any single number. The imported baselines in Tables 2 and 8 have setup mismatches that the authors themselves acknowledge in Remark 3.1.

Bottom line: the paper is a legitimate, useful benchmark with a modest theoretical contribution that is presented with more confidence than it supports. It should go to review, but the referee should push for a corrected equivalence statement and statistical validation.

Referee Report

4 major / 6 minor

Summary. The paper studies consensus-based optimization (CBO) in the context of closed-box adversarial attacks. It introduces consensus hopping (CH) as an infinite-drift limit of CBO and argues that CH is closely related to Gaussian natural evolution strategies (NES). The main theoretical result, Proposition 2.1, states that under certain smoothness and scaling assumptions, both the NES update and the CH update approximate a gradient step with error terms of order O(sqrt(tau^3/eta)) and O(sqrt(tau^3 alpha)), respectively. The paper then presents an extensive experimental study on CIFAR-10, ImageNet, and MNIST across several attack spaces (direct, low-resolution, P-pixel, spectral, square), reporting that CH and NES perform very similarly, while standard CBO outperforms NES in easier attack scenarios, but struggles in harder ones such as targeted ImageNet attacks.

Significance. If the claimed equivalence were established in the regime where the algorithms are actually deployed, the connection would be valuable: it would unify two strands of gradient-free optimization and transfer convergence results between them. The theoretical argument in Proposition 2.1 is internally correct under its explicit hypotheses, and the paper is commendable for providing a clean mean-field derivation with clearly stated scalings rather than fitting parameters to data. The experimental study is broad and covers several realistic attack spaces, and the authors are honest about scenarios where CBO fails, which lends credibility to the empirical claims. However, the gap between the theorem's assumptions (C^2 loss, infinite particle limit) and the implemented algorithms (piecewise-smooth losses, N=50 particles) is substantial, and the lack of error bars and the mixing of imported baselines weaken the force of the experimental conclusions.

major comments (4)

[Section 2.3, Proposition 2.1] The proposition relates the deterministic ratio of expectations to the gradient, but the CH algorithm actually uses the self-normalized finite-sample ratio Q_N = sigma_tilde * sum_n exp(-alpha f(c + sigma_tilde xi_n)) xi_n / sum_n exp(-alpha f(c + sigma_tilde xi_n)). The expectation of Q_N is not equal to the ratio of expectations used in the proof; the difference is a Jensen-type bias of order 1/N. The text states 'by the law of large numbers the limit of the expected value as N -> infinity' is the ratio of expectations, but this requires uniform integrability or a dominated-convergence argument that is not provided and does not follow from the stated C^2 assumption alone. Since the experiments in Section 3 use N=50 particles, the finite-sample bias is not negligible, and the claimed equivalence of CH and NES is not justified for the implemented algorithm.
[Section 3, all tables; Section 3.1 and Section 3.2] The proposition's hypotheses require f in C^2 with bounded second derivative, but the adversarial loss f(s) = l(h(T(s;x)), kappa) for ReLU networks with clipping or projection is piecewise linear and not C^2, and the low-resolution interpolation and square attack spaces introduce further nonsmoothness. The experiments therefore operate outside the theorem's scope, yet the text in Sections 3.1 and 3.4 interprets the similarity of CH and NES as 'supporting the previous connection made between the schemes' and 'as suggested by our theory.' The paper should either weaken these interpretative claims to describe an empirical observation, or extend the theory to nonsmooth losses and finite N.
[Section 4, Conclusion] The conclusion states that the paper 'showed that a variant of CBO, namely consensus hopping ... is equivalent to so-called natural evolution strategies, up to second order error terms.' This overstates Proposition 2.1, which is a statement about deterministic expectations under a specific parameter scaling; it does not establish equivalence of the stochastic algorithms in the finite-particle regime. A more accurate summary would say that the mean-field versions of the two updates have the same first-order gradient approximation under the stated scalings, with the finite-N bias and non-smoothness caveats made explicit.
[Tables 2, 3, and 5; Remark 3.1] Several baseline numbers are imported from other papers without matching experimental setups. For example, Table 2 reports DFOc-DiagonalCMA and DFOc-CMA values directly from [68], and Remark 3.1 notes that a comparison with [74] is not meaningful. Table 5 re-runs SimBA-DCT but obtains different values from the original paper, and the text attributes this to possible setup mismatches. None of the tables report error bars or multiple-seed variability, and success rates are given without confidence intervals. The claim that CBO outperforms NES 'by a large margin' in easy scenarios would be considerably stronger if the reported metrics were accompanied by variability estimates and if all baselines were re-run under the same query budgets, image sets, and projection schemes.

minor comments (6)

[Section 2.3, after Proposition 2.1] The text reads 'perform a noisy gradient ascent or decent, respectively' — 'decent' should be 'descent.'
[Appendix B.1, Figure 5 caption] The caption says 'unpargeted attacks' — should read 'untargeted attacks.'
[Appendix B.2] The sentence 'which results in an overall higher average and mean as observed in Table 3' uses 'mean' where 'median' appears to be intended; Table 3 reports both average and median queries.
[Section 3.4] The phrase 'looses interpretability' should be 'loses interpretability.'
[Section 2.1, equation (CBO)] The definition of the consensus point uses exp(-alpha f), but the role of alpha as an inverse temperature is only explained later; a brief comment in Section 2.1 would help the reader.
[Appendix A.1] The adaptive alpha scheduler from [26] is mentioned but not fully described; a short description or reference to the exact algorithm would improve reproducibility.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: Proposition 2.1 is a self-contained Taylor-expansion result with explicit scaling assumptions, and the experimental claims are empirical.

full rationale

The central theoretical claim is Proposition 2.1, which derives that, under the stated scalings sigma^2 = tau/eta and sigma_tilde^2 = tau/alpha, the Gaussian NES and consensus-hopping updates both reduce to tau times the gradient plus error terms. The scalings are stated assumptions of the theorem, not parameters fitted to data, and the proof is a direct Taylor expansion using Gaussian moment identities. The claimed CH-NES equivalence is therefore a derived asymptotic statement rather than a definitional identity: the two estimators are different functionals (an unnormalized empirical mean vs. a self-normalized ratio) and the theorem shows only that their mean-field limits agree to leading order. The paper explicitly acknowledges the limits of this connection in Section 4: 'the concrete connection between CBO and NES still remains not fully clear, both from a theoretic and practical point of view.' The mean-field step for consensus hopping (replacing the expectation of a ratio by the ratio of expectations as N goes to infinity) is a mathematical gap for finite N and non-smooth losses, but it is not circular: it does not presuppose the conclusion. The experimental sections compare against external baselines and standard hyperparameters; the claim that CBO outperforms NES in easy scenarios is an empirical finding that could fail under re-testing, not a prediction forced by a fitted parameter. Self-citations appear mainly for implementation details (e.g., [21, Alg. 6] and [21, Alg. 9]) and are not load-bearing for the central derivation. No step in the paper reduces by construction to its own inputs, so no circularity is found.

Assumptions & free parameters 5 free parameters · 3 assumptions · 0 invented entities

The theoretical part rests on smoothness of f and Gaussian sampling; no new physical or algorithmic entities are introduced. The free parameters are algorithm hyperparameters from the literature or hand choices, not fitted to the target claim. The main unfounded assumption is the infinite-sample, smoothness regime that does not match the neural network experiments.

free parameters (5)

Inverse temperature alpha = adaptive via effective ensemble size scheduler with eta=0.1; CH fixed at alpha=10
Controls soft-min sharpness in consensus weights; chosen by scheduler or by hand, not fitted to the target result.
CBO drift time step tau = 1.3
Step size in Algorithm 4; chosen from the CBO literature, not fitted to the attack benchmarks.
CBO noise scale sigma = 1
Anisotropic noise scale in Algorithm 4; hand-chosen hyperparameter.
NES/CH and CBO learning rate eta = 0.1; 0.01 for CBO with square noise
Update step size for NES and CH and scaling parameter for CBO's alpha scheduler; not fitted to the claim.
Particle number N and mini-batch size b = N=50, b=10; N=10 for square noise case
Algorithm population sizes chosen by hand; influence query counts and performance.

assumptions (3)

domain assumption The attacked loss f is C^2 with bounded second derivative, and bounded first derivative for the CH part.
Used in Proposition 2.1 Taylor expansions; not satisfied by typical ReLU network losses.
standard math Particle samples xi are drawn from N(0, I_d).
Underlies both the Gaussian NES and CH update derivations.
domain assumption The empirical consensus update can be replaced by its expectation (N to infinity limit).
Proposition 2.1 computes expectations; finite-sample behavior relies on a law of large numbers that is not proven here.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Consensus-based optimization for closed-box adversarial attacks and a connection to evolution strategies." pith.science (2026). https://pith.science/paper/2IVXZLKS

@misc{pith2026250624048,
  author       = {Pith},
  title        = {Pith review of: Consensus-based optimization for closed-box adversarial attacks and a connection to evolution strategies},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/2IVXZLKS}},
  note         = {Machine review of arXiv:2506.24048}
}

read the original abstract

Consensus-based optimization (CBO) has established itself as an efficient gradient-free optimization scheme, with attractive mathematical properties, such as mean-field convergence results for non-convex loss functions. In this work, we study CBO in the context of closed-box adversarial attacks, which are imperceptible input perturbations that aim to fool a classifier, without accessing its gradient. Our contribution is to establish a connection between the so-called consensus hopping as introduced by Riedl et al. and natural evolution strategies (NES) commonly applied in the context of adversarial attacks and to rigorously relate both methods to gradient-based optimization schemes. Beyond that, we provide a comprehensive experimental study that shows that despite the conceptual similarities, CBO can outperform NES and other evolutionary strategies in certain scenarios.

Figures

Figures reproduced from arXiv: 2506.24048 by the authors.

**Figure 2.** Example of a 2-pixel attack on the picture depicted on the left. The two pixel added to the image [PITH_FULL_IMAGE:figures/full_fig_p011_2.png] view at source ↗

**Figure 3.** Example of a discrete cosine attack. Here in total, 28 modes are used for the attack, resulting in [PITH_FULL_IMAGE:figures/full_fig_p013_3.png] view at source ↗

Figures from the paper (7 more)

**Figure 4.** Figure 4: Example of a square attack as proposed in [ [PITH_FULL_IMAGE:figures/full_fig_p015_4.png]

**Figure 5.** Figure 5: Average queries of CBO for unpargeted attacks on ImageNet, when varying the low resolution of [PITH_FULL_IMAGE:figures/full_fig_p025_5.png]

**Figure 6.** Figure 6: Query distribution for the targeted attacks on ImageNet in the low resolution setting of [PITH_FULL_IMAGE:figures/full_fig_p026_6.png]

**Figure 7.** Figure 7: Evolution of the consensus point for CBO and CH. Here we consider the untargeted and targeted [PITH_FULL_IMAGE:figures/full_fig_p027_7.png]

**Figure 8.** Figure 8: Success rate for the P-pixel attack for different P and loss landscape of the coordinate variable. For Fig. 8b, we compute an attack with CBO and then fix the channel values of the last iterates for the visualization. On top of that, we show the evolution of the consen…

**Figure 9.** Figure 9: We perform 50 untargeted attacks on ImageNet employing (I), in the square attack scenario of [PITH_FULL_IMAGE:figures/full_fig_p028_9.png]

**Figure 10.** Figure 10: For the square noise as described in Section 3.5 a larger α improves the attack strength. existing particles can result in point that has a better objective value. But with the particles produced with, Algorithm 2 this is not clear a priori. Compared to that the algor…

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

Exploiting Structure with Anisotropic Consensus-Based Optimization
math.OC 2026-07 accept novelty 6.0 of 10

Anisotropic CBO's computational complexity depends exponentially only on the intrinsic dimension of an additively separable objective, not the ambient dimension, under aligned anisotropic noise.

Reference graph

Works this paper leans on

106 extracted references · 62 canonical work pages · cited by 1 Pith paper

[68]

Yet another but more efficient black-box adversarial attack: tiling and evolution strategies

Laurent Meunier, Jamal Atif, and Olivier Teytaud. Yet another but more efficient black-box adversarial attack: tiling and evolution strategies . 2019. arXiv: 1910.02244 (cit. on pp. 3, 10, 11, 25, 26)

work page Pith review arXiv 2019
[74]

Black-box adversarial attacks using evolution strategies

Hao Qiu, Leonardo Lucio Custode, and Giovanni Iacca. “Black-box adversarial attacks using evolution strategies”. In: Proceedings of the Genetic and Evolutionary Computation Conference Companion . 2021, pp. 1827–1833 (cit. on pp. 3, 10)

work page 2021
[1]

Discrete Cosine Transform

N. Ahmed, T. Natarajan, and K.R. Rao. “Discrete Cosine Transform”. In: IEEE Transactions on Computers C-23.1 (1974), pp. 90–93 (cit. on p. 12)

1974
[2]

Natural gradient works efficiently in learning

Shun-Ichi Amari. “Natural gradient works efficiently in learning”. In: Neural computation 10.2 (1998), pp. 251–276 (cit. on p. 4)

1998
[3]

Square attack: a query-efficient black-box adversarial attack via random search

Maksym Andriushchenko et al. “Square attack: a query-efficient black-box adversarial attack via random search”. In: European conference on computer vision . Springer. 2020, pp. 484–501 (cit. on pp. 10, 12, 15–17, 25, 26, 29)

2020
[4]

Sorting out Lipschitz function approximation

Cem Anil, James Lucas, and Roger Grosse. “Sorting out Lipschitz function approximation”. In: International conference on machine learning . PMLR. 2019, pp. 291–301 (cit. on p. 2)

2019
[5]

On the Existence of the Adversarial Bayes Classifier (Extended Version)

Pranjal Awasthi, Natalie S. Frank, and Mehryar Mohri. On the Existence of the Adversarial Bayes Classifier (Extended Version). 2023. arXiv: 2112.01694 [cs.LG] (cit. on p. 2)

work page Pith review arXiv 2023
[6]

Evolutionary computation 1: Basic algorithms and operators

Thomas B¨ ack. Evolutionary computation 1: Basic algorithms and operators . CRC press, 2018 (cit. on p. 25)

2018

Show all 106 references

[7]

A constrained consensus based optimization algorithm and its application to finance

Hyeong-Ohk Bae et al. “A constrained consensus based optimization algorithm and its application to finance”. In: Applied Mathematics and Computation 416 (2022), p. 126726 (cit. on pp. 4, 8)

2022
[8]

CBX: Python and Julia Packages for Consensus-Based Interacting Particle Meth- ods

Rafael Bailo et al. “CBX: Python and Julia Packages for Consensus-Based Interacting Particle Meth- ods”. In: Journal of Open Source Software 9.98 (2024), p. 6611 (cit. on p. 7)

2024
[9]

Constrained consensus-based optimization and numerical heuristics for the few particle regime

Jonas Beddrich et al. Constrained consensus-based optimization and numerical heuristics for the few particle regime. 2024. arXiv: 2410.10361 (cit. on pp. 4, 8)

2024
[10]

A discrete consensus-based global optimization method with noisy objective function

Stefania Bellavia and Greta Malaspina. “A discrete consensus-based global optimization method with noisy objective function”. In: Journal of Optimization Theory and Applications 206.1 (2025), pp. 1–40 (cit. on p. 4). 18

2025
[11]

Evolution strategies–a comprehensive introduction

Hans-Georg Beyer and Hans-Paul Schwefel. “Evolution strategies–a comprehensive introduction”. In: Natural computing 1 (2002), pp. 3–52 (cit. on p. 13)

2002
[12]

Exploring the space of black-box attacks on deep neural networks

Arjun Nitin Bhagoji et al. Exploring the space of black-box attacks on deep neural networks . 2017. arXiv: 1712.09491 (cit. on p. 3)

2017 arXiv
[13]

A survey of black-box adversarial attacks on computer vision models

Siddhant Bhambri et al. A survey of black-box adversarial attacks on computer vision models . 2019. arXiv: 1912.01667 (cit. on p. 2)

2019 arXiv
[14]

Consensus-based algorithms for stochastic optimization prob- lems

Sabrina Bonandin and Michael Herty. Consensus-based algorithms for stochastic optimization prob- lems. 2024. arXiv: 2404.10372 (cit. on p. 4)

2024
[15]

Constrained Consensus-Based Optimiza- tion

Giacomo Borghi, Michael Herty, and Lorenzo Pareschi. “Constrained Consensus-Based Optimiza- tion”. In: SIAM Journal on Optimization 33.1 (2023), pp. 211–236 (cit. on p. 4)

2023
[16]

A particle consensus approach to solving nonconvex- nonconcave min-max problems

Giacomo Borghi, Hui Huang, and Jinniao Qiu. A particle consensus approach to solving nonconvex- nonconcave min-max problems. 2024. arXiv: 2407.17373 (cit. on p. 4)

2024 arXiv
[17]

A mean curvature flow arising in adversarial training

Leon Bungert, Tim Laux, and Kerrek Stinson. “A mean curvature flow arising in adversarial training”. In: Journal de Math´ ematiques Pures et Appliqu´ ees192 (2024), p. 103625 (cit. on p. 2)

2024
[18]

Polarized consensus-based dynamics for optimization and sampling

Leon Bungert, Tim Roith, and Philipp Wacker. “Polarized consensus-based dynamics for optimization and sampling”. In: Mathematical Programming 211 (2025), pp. 125–155 (cit. on p. 4)

2025
[19]

Gamma-convergence of a nonlocal perimeter arising in adversarial machine learning

Leon Bungert and Kerrek Stinson. “Gamma-convergence of a nonlocal perimeter arising in adversarial machine learning”. In: Calculus of Variations and Partial Differential Equations 63.5 (2024), p. 114 (cit. on p. 2)

2024
[20]

CLIP: Cheap Lipschitz training of neural networks

Leon Bungert et al. “CLIP: Cheap Lipschitz training of neural networks”. In: International Conference on Scale Space and Variational Methods in Computer Vision . Springer. 2021, pp. 307–319 (cit. on p. 2)

2021
[21]

MirrorCBO: A consensus-based optimization method in the spirit of mirror de- scent

Leon Bungert et al. MirrorCBO: A consensus-based optimization method in the spirit of mirror de- scent. 2025. arXiv: 2501.12189 (cit. on pp. 4, 8, 23, 24)

2025 arXiv
[22]

Discrete Consensus-Based Optimization

Junhyeok Byeon, Seung-Yeal Ha, and Joong-Ho Won. Discrete Consensus-Based Optimization. 2024. arXiv: 2403.03430 (cit. on p. 4)

2024 arXiv
[23]

Towards evaluating the robustness of neural networks

Nicholas Carlini and David Wagner. “Towards evaluating the robustness of neural networks”. In: 2017 ieee symposium on security and privacy (sp) . Ieee. 2017, pp. 39–57 (cit. on pp. 2, 8)

2017
[24]

An analytical framework for consensus-based global optimization method

Jos´ e A Carrillo et al. “An analytical framework for consensus-based global optimization method”. In: Mathematical Models and Methods in Applied Sciences 28.06 (2018), pp. 1037–1066 (cit. on p. 4)

2018
[25]

A consensus-based global optimization method for high dimensional machine learning problems

Jos´ e A Carrillo et al. “A consensus-based global optimization method for high dimensional machine learning problems”. In: ESAIM: Control, Optimisation and Calculus of Variations 27 (2021), S5 (cit. on pp. 23, 24)

2021
[26]

Consensus-based sampling

Jos´ e A Carrillo et al. “Consensus-based sampling”. In: Studies in Applied Mathematics 148.3 (2022), pp. 1069–1140 (cit. on pp. 4, 23)

2022
[27]

Carrillo et al

Jos´ e A. Carrillo et al. An interacting particle consensus method for constrained global optimization
[28]

Consensus-based Optimization and En- semble Kalman Inversion for Global Optimization Problems with Constraints

Jos´ e Antonio Carrillo, Claudia Totzeck, and Urbain Vaes. “Consensus-based Optimization and En- semble Kalman Inversion for Global Optimization Problems with Constraints”. In: Modeling and Simulation for Collective Dynamics , pp. 195–230 (cit. on p. 4)
[29]

A Consensus-Based Global Optimization Method with Adaptive Momentum Estimation

Jingrun Chen, Liyao Lyu, et al. “A Consensus-Based Global Optimization Method with Adaptive Momentum Estimation”. In: Communications in Computational Physics 31.4 (2022), pp. 1296–1316 (cit. on p. 14)

2022
[30]

Zoo: Zeroth order optimization based black-box attacks to deep neural net- works without training substitute models

Pin-Yu Chen et al. “Zoo: Zeroth order optimization based black-box attacks to deep neural net- works without training substitute models”. In: Proceedings of the 10th ACM workshop on artificial intelligence and security . 2017, pp. 15–26 (cit. on pp. 25, 26)

2017
[31]

ImageNet: A large-scale hierarchical image database

Jia Deng et al. “ImageNet: A large-scale hierarchical image database”. In: 2009 IEEE conference on computer vision and pattern recognition . IEEE. 2009, pp. 248–255 (cit. on pp. 3, 9). 19

2009
[32]

There are no bit parts for sign bits in black-box attacks

Abdullah Al-Dujaili and Una-May O’Reilly. “There are no bit parts for sign bits in black-box attacks”. In: (2019). arXiv: 1902.06894 (cit. on pp. 25, 26)

2019 arXiv
[33]

Certified robustness via dynamic margin maximization and improved lipschitz regularization

Mahyar Fazlyab et al. “Certified robustness via dynamic margin maximization and improved lipschitz regularization”. In: Advances in Neural Information Processing Systems 36 (2023), pp. 34451–34464 (cit. on p. 2)

2023
[34]

Lipschitz regularized Deep Neural Networks generalize and are adversarially robust

Chris Finlay et al. Lipschitz regularized Deep Neural Networks generalize and are adversarially robust
[35]

Convergence of anisotropic consensus-based optimization in mean-field law

Massimo Fornasier, Timo Klock, and Konstantin Riedl. “Convergence of anisotropic consensus-based optimization in mean-field law”. In: International conference on the applications of evolutionary com- putation (part of evostar) . Springer. 2022, pp. 738–754 (cit. on p. 4)

2022
[36]

Consensus-based optimization methods con- verge globally

Massimo Fornasier, Timo Klock, and Konstantin Riedl. “Consensus-based optimization methods con- verge globally”. In: SIAM Journal on Optimization 34.3 (2024), pp. 2973–3004 (cit. on p. 4)

2024
[37]

A pde framework of consensus-based optimization for objectives with multiple global minimizers

Massimo Fornasier and Lukang Sun. “A pde framework of consensus-based optimization for objectives with multiple global minimizers”. In: Communications in Partial Differential Equations 50.4 (2025), pp. 493–541 (cit. on p. 4)

2025
[38]

Regularity and positivity of solutions of the Consensus-Based Optimization equation: unconditional global convergence

Massimo Fornasier and Lukang Sun. Regularity and positivity of solutions of the Consensus-Based Optimization equation: unconditional global convergence . 2025. arXiv: 2502.01434 (cit. on p. 4)

2025 arXiv
[39]

Consensus-based optimization on hypersurfaces: Well-posedness and mean- field limit

Massimo Fornasier et al. “Consensus-based optimization on hypersurfaces: Well-posedness and mean- field limit”. In: Mathematical Models and Methods in Applied Sciences (2020) (cit. on p. 4)

2020
[40]

Anisotropic Diffusion in Consensus-Based Optimization on the Sphere

Massimo Fornasier et al. “Anisotropic Diffusion in Consensus-Based Optimization on the Sphere”. In: SIAM Journal on Optimization 32 (Sept. 2022), pp. 1984–2012 (cit. on p. 4)

2022
[41]

Nicol´ as Garc ´ ıa Trillos et al.CB2O: Consensus-Based Bi-Level Optimization. 2024. arXiv: 2411.13394 (cit. on p. 4)

2024 arXiv
[42]

Defending against diverse attacks in federated learning through consensus- based bi-level optimization

Nicol´ as Garc ´ ıa Trillos et al. “Defending against diverse attacks in federated learning through consensus- based bi-level optimization”. In: Philosophical Transactions A 383.2298 (2025), p. 20240235 (cit. on p. 4)

2025
[43]

Exponential natural evolution strategies

Tobias Glasmachers et al. “Exponential natural evolution strategies”. In: Proceedings of the 12th annual conference on Genetic and evolutionary computation . 2010, pp. 393–400 (cit. on p. 3)

2010
[44]

Explaining and harnessing adversarial examples

Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. 2014. arXiv: 1412.6572 (cit. on pp. 1, 2, 24)

2014 arXiv
[45]

Mean-field particle swarm optimization

Sara Grassi et al. “Mean-field particle swarm optimization”. In: Modeling and Simulation for Collective Dynamics. World Scientific, 2023, pp. 127–193 (cit. on p. 4)

2023
[46]

Simple black-box adversarial attacks

Chuan Guo et al. “Simple black-box adversarial attacks”. In: International Conference on Machine Learning. PMLR. 2019, pp. 2484–2493 (cit. on pp. 12–14)

2019
[47]

The CMA evolution strategy: a comparing review

Nikolaus Hansen. “The CMA evolution strategy: a comparing review”. In: Towards a new evolutionary computation: Advances in the estimation of distribution algorithms (2006), pp. 75–102 (cit. on p. 10)

2006
[48]

Completely derandomized self-adaptation in evolution strategies

Nikolaus Hansen and Andreas Ostermeier. “Completely derandomized self-adaptation in evolution strategies”. In: Evolutionary computation 9.2 (2001), pp. 159–195 (cit. on pp. 3, 5)

2001
[49]

Delving deep into rectifiers: Surpassing human-level performance on ImageNet clas- sification

Kaiming He et al. “Delving deep into rectifiers: Surpassing human-level performance on ImageNet clas- sification”. In: Proceedings of the IEEE international conference on computer vision . 2015, pp. 1026– 1034 (cit. on pp. 9, 10)

2015
[50]

Micro-Macro Decomposition of Particle Swarm Optimization Meth- ods

Michael Herty and Sara Veneruso. Micro-Macro Decomposition of Particle Swarm Optimization Meth- ods. 2025. arXiv: 2501.10306 (cit. on p. 4)

2025 arXiv
[51]

Consensus-based optimization for saddle point prob- lems

Hui Huang, Jinniao Qiu, and Konstantin Riedl. “Consensus-based optimization for saddle point prob- lems”. In: SIAM Journal on Control and Optimization 62.2 (2024), pp. 1093–1121 (cit. on p. 4)

2024
[52]

Training certifiably robust neural networks with efficient local lipschitz bounds

Yujia Huang et al. “Training certifiably robust neural networks with efficient local lipschitz bounds”. In: Advances in Neural Information Processing Systems 34 (2021), pp. 22745–22757 (cit. on p. 2). 20

2021
[53]

Evoba: An evolution strategy as a strong baseline for black-box adversarial attacks

Andrei Ilie, Marius Popescu, and Alin Stefanescu. “Evoba: An evolution strategy as a strong baseline for black-box adversarial attacks”. In: International Conference on Neural Information Processing . Springer. 2021, pp. 188–200 (cit. on p. 3)

2021
[54]

Prior convictions: Black-box adversarial attacks with bandits and priors

Andrew Ilyas, Logan Engstrom, and Aleksander Madry. Prior convictions: Black-box adversarial attacks with bandits and priors . 2018 (cit. on pp. 10, 25, 26)

2018
[55]

Black-box adversarial attacks with limited queries and information

Andrew Ilyas et al. “Black-box adversarial attacks with limited queries and information”. In: In- ternational conference on machine learning . PMLR. 2018, pp. 2137–2146 (cit. on pp. 3–5, 7, 9, 24, 25)

2018
[56]

The discrete cosine transform (DCT): theory and application

Syed Ali Khayam. “The discrete cosine transform (DCT): theory and application”. In: Michigan State University 114.1 (2003), p. 31 (cit. on p. 12)

2003
[57]

Convergence analysis of the discrete consensus-based optimization algorithm with random batch interactions and heterogeneous noises

Dongnam Ko et al. “Convergence analysis of the discrete consensus-based optimization algorithm with random batch interactions and heterogeneous noises”. In: Mathematical Models and Methods in Applied Sciences 32.06 (2022), pp. 1071–1107 (cit. on p. 4)

2022
[58]

One weird trick for parallelizing convolutional neural networks

Alex Krizhevsky. “One weird trick for parallelizing convolutional neural networks”. In: arXiv preprint arXiv:1404.5997 (2014) (cit. on p. 12)

2014 arXiv
[59]

Learning multiple layers of features from tiny images

Alex Krizhevsky and Geoffrey Hinton. Learning multiple layers of features from tiny images . Tech. rep. University of Toronto, 2009 (cit. on p. 3)

2009
[60]

ImageNet classification with deep convo- lutional neural networks

Alex Krizhevsky, Ilya Sutskever, and Geoffrey E Hinton. “ImageNet classification with deep convo- lutional neural networks”. In: Advances in neural information processing systems 25 (2012) (cit. on p. 12)

2012
[61]

Gradient-based learning applied to document recognition

Yann LeCun et al. “Gradient-based learning applied to document recognition”. In: Proceedings of the IEEE 86.11 (1998), pp. 2278–2324 (cit. on p. 17)

1998
[62]

Visualizing the loss landscape of neural nets

Hao Li et al. “Visualizing the loss landscape of neural nets”. In: Advances in neural information processing systems 31 (2018) (cit. on pp. 26, 27)

2018
[63]

Nattack: Learning the distributions of adversarial examples for an improved black- box attack on deep neural networks

Yandong Li et al. “Nattack: Learning the distributions of adversarial examples for an improved black- box attack on deep neural networks”. In:International Conference on Machine Learning. PMLR. 2019, pp. 3866–3876 (cit. on p. 3)

2019
[64]

Stein variational gradient descent: A general purpose bayesian inference algorithm

Qiang Liu and Dilin Wang. “Stein variational gradient descent: A general purpose bayesian inference algorithm”. In: Advances in neural information processing systems 29 (2016) (cit. on p. 4)

2016
[65]

Towards deep learning models resistant to adversarial attacks

Aleksander Madry et al. Towards deep learning models resistant to adversarial attacks . 2017. arXiv: 1706.06083 (cit. on pp. 2, 17)

2017 arXiv
[66]

MNIST Challenge

MadryLab. MNIST Challenge . https://github.com/MadryLab/mnist_challenge . Accessed: 2025- 05-26. 2018 (cit. on p. 17)

2025
[67]

Back in black: A comparative evaluation of recent state-of-the-art black-box attacks

Kaleel Mahmood et al. “Back in black: A comparative evaluation of recent state-of-the-art black-box attacks”. In: IEEE Access 10 (2021), pp. 998–1019 (cit. on p. 2)

2021
[69]

Parsimonious black-box adversarial attacks via efficient combinatorial optimization

Seungyong Moon, Gaon An, and Hyun Oh Song. “Parsimonious black-box adversarial attacks via efficient combinatorial optimization”. In: International conference on machine learning. PMLR. 2019, pp. 4636–4645 (cit. on pp. 10, 25, 26)

2019
[70]

Information-geometric optimization algorithms: A unifying picture via invariance principles

Yann Ollivier et al. “Information-geometric optimization algorithms: A unifying picture via invariance principles”. In: Journal of Machine Learning Research 18.18 (2017), pp. 1–65 (cit. on p. 7)

2017
[71]

Practical black-box attacks against machine learning

Nicolas Papernot et al. “Practical black-box attacks against machine learning”. In: Proceedings of the 2017 ACM on Asia conference on computer and communications security . 2017, pp. 506–519 (cit. on p. 2)

2017
[72]

PyTorch: An Imperative Style, High-Performance Deep Learning Library

Adam Paszke et al. PyTorch: An Imperative Style, High-Performance Deep Learning Library . 2019. arXiv: 1912.01703 [cs.LG] (cit. on p. 10). 21

2019 arXiv
[73]

A consensus-based model for global optimization and its mean-field limit

Ren´ e Pinnau et al. “A consensus-based model for global optimization and its mean-field limit”. In: Mathematical Models and Methods in Applied Sciences 27.01 (Jan. 2017), pp. 183–204.issn: 1793-6314 (cit. on p. 3)

2017
[75]

Rapin and O

J. Rapin and O. Teytaud. Nevergrad - A gradient-free optimization platform . https://GitHub.com/ FacebookResearch/Nevergrad. 2018 (cit. on pp. 8, 9, 12)

2018
[76]

Evolutionsstrategien

Ingo Rechenberg. “Evolutionsstrategien”. In: Simulationsmethoden in der Medizin und Biologie: Work- shop, Hannover, 29. Sept.–1. Okt. 1977 . Springer. 1978, pp. 83–114 (cit. on pp. 3, 13)

1977
[77]

Leveraging memory effects and gradient information in consensus-based optimi- sation: On global convergence in mean-field law

Konstantin Riedl. “Leveraging memory effects and gradient information in consensus-based optimi- sation: On global convergence in mean-field law”. In: European Journal of Applied Mathematics 35.4 (2024), pp. 483–514 (cit. on p. 4)

2024
[78]

Mathematical Foundations of Interacting Multi-Particle Systems for Optimiza- tion

Konstantin Riedl. “Mathematical Foundations of Interacting Multi-Particle Systems for Optimiza- tion”. PhD thesis. Technische Universit¨ at M¨ unchen, 2024 (cit. on p. 4)

2024
[79]

Gradient is All You Need? 2023

Konstantin Riedl et al. Gradient is All You Need? 2023. arXiv: 2306.09778 [cs.LG] (cit. on pp. 1, 3, 5, 7, 17)

2023
[80]

Evolution strategies as a scalable alternative to reinforcement learning

Tim Salimans et al. Evolution strategies as a scalable alternative to reinforcement learning . 2017. arXiv: 1703.03864 (cit. on p. 3)

2017 arXiv
[81]

Natural evolution strategies converge on sphere functions

Tom Schaul. “Natural evolution strategies converge on sphere functions”. In: Proceedings of the 14th annual conference on Genetic and evolutionary computation . 2012, pp. 329–336 (cit. on p. 7)

2012
[82]

Soft prompt threats: Attacking safety alignment and unlearning in open-source llms through the embedding space

Leo Schwinn et al. “Soft prompt threats: Attacking safety alignment and unlearning in open-source llms through the embedding space”. In:Advances in Neural Information Processing Systems37 (2024), pp. 9086–9116 (cit. on p. 18)

2024
[83]

Accessorize to a crime: Real and stealthy attacks on state-of-the-art face recognition

Mahmood Sharif et al. “Accessorize to a crime: Real and stealthy attacks on state-of-the-art face recognition”. In: Proceedings of the 2016 acm sigsac conference on computer and communications security. 2016, pp. 1528–1540 (cit. on p. 3)

2016
[84]

Simple and efficient hard label black-box adversarial attacks in low query budget regimes

Satya Narayan Shukla et al. “Simple and efficient hard label black-box adversarial attacks in low query budget regimes”. In: Proceedings of the 27th ACM SIGKDD conference on knowledge discovery & data mining . 2021, pp. 1461–1469 (cit. on pp. 10, 13)

2021
[85]

Very deep convolutional networks for large-scale image recognition

Karen Simonyan and Andrew Zisserman. Very deep convolutional networks for large-scale image recognition. 2014. arXiv: 1409.1556 (cit. on p. 10)

2014 arXiv
[86]

Evolutionary algorithms and their applications to engineering problems

Adam Slowik and Halina Kwasnicka. “Evolutionary algorithms and their applications to engineering problems”. In: Neural Computing and Applications 32 (2020), pp. 12363–12379 (cit. on pp. 3, 9)

2020
[87]

One pixel attack for fooling deep neural networks

Jiawei Su, Danilo Vasconcellos Vargas, and Kouichi Sakurai. “One pixel attack for fooling deep neural networks”. In: IEEE Transactions on Evolutionary Computation 23.5 (2019), pp. 828–841 (cit. on pp. 10, 12)

2019
[88]

Sok: Pitfalls in evaluating black-box attacks

Fnu Suya et al. “Sok: Pitfalls in evaluating black-box attacks”. In: 2024 IEEE Conference on Secure and Trustworthy Machine Learning (SaTML) . IEEE. 2024, pp. 387–407 (cit. on p. 2)

2024
[89]

Intriguing properties of neural networks

Christian Szegedy et al. Intriguing properties of neural networks . 2013. arXiv: 1312.6199 (cit. on pp. 1, 2)

2013 arXiv
[90]

Rethinking the inception architecture for computer vision

Christian Szegedy et al. “Rethinking the inception architecture for computer vision”. In: Proceedings of the IEEE conference on computer vision and pattern recognition . 2016, pp. 2818–2826 (cit. on p. 10)

2016
[91]

An optimal transport approach for computing adversarial training lower bounds in multiclass classification

Nicolas Garcia Trillos et al. “An optimal transport approach for computing adversarial training lower bounds in multiclass classification”. In: Journal of Machine Learning Research 25.393 (2024), pp. 1– 45 (cit. on p. 2). 22

2024
[92]

The multimarginal optimal transport formu- lation of adversarial multiclass classification

Nicol´ as Garc ´ ıa Trillos, Matt Jacobs, and Jakwang Kim. “The multimarginal optimal transport formu- lation of adversarial multiclass classification”. In: Journal of machine learning research 24.45 (2023), pp. 1–56 (cit. on p. 2)

2023
[93]

Black-Box Adversarial Attacks on Deep Neural Networks: A Survey

Chenxu Wang et al. “Black-Box Adversarial Attacks on Deep Neural Networks: A Survey”. In: 2022 4th International Conference on Data Intelligence and Security (ICDIS) . 2022, pp. 88–93 (cit. on p. 2)

2022
[94]

Mathematical Analysis of the PDE Model for the Consensus- based Optimization

Jinhuan Wang, Keyu Li, and Hui Huang. Mathematical Analysis of the PDE Model for the Consensus- based Optimization. 2025. arXiv: 2504.10990 (cit. on p. 4)

2025 arXiv
[95]

Adversarial flows: A gradient flow characterization of adversarial attacks

Lukas Weigand, Tim Roith, and Martin Burger. Adversarial flows: A gradient flow characterization of adversarial attacks . 2024. arXiv: 2406.05376 [cs.LG] (cit. on pp. 2, 17, 24)

2024
[96]

Natural evolution strategies

Daan Wierstra et al. “Natural evolution strategies”. In: The Journal of Machine Learning Research 15.1 (2014), pp. 949–980 (cit. on pp. 3–5)

2014
[97]

Generating adversarial examples with adversarial networks

Chaowei Xiao et al. Generating adversarial examples with adversarial networks . 2018. arXiv: 1801. 02610 (cit. on p. 17)

2018
[98]

Fast Evolutionary Programming

Xin Yao and Yong Liu. “Fast Evolutionary Programming.” In: Evolutionary programming 3 (1996), pp. 451–460 (cit. on pp. 12, 25)

1996
[99]

Rethinking lipschitz neural networks and certified robustness: A boolean func- tion perspective

Bohang Zhang et al. “Rethinking lipschitz neural networks and certified robustness: A boolean func- tion perspective”. In: Advances in neural information processing systems 35 (2022), pp. 19398–19413 (cit. on p. 2)

2022
[100]

Towards query-efficient black-box adversary with zeroth-order natural gradient de- scent

Pu Zhao et al. “Towards query-efficient black-box adversary with zeroth-order natural gradient de- scent”. In: Proceedings of the AAAI Conference on Artificial Intelligence. Vol. 34. 04. 2020, pp. 6909– 6916 (cit. on pp. 25, 26)

2020
[101]

BlackboxBench: A Comprehensive Benchmark of Black-box Adversarial Attacks

Meixi Zheng et al. BlackboxBench: A Comprehensive Benchmark of Black-box Adversarial Attacks
[102]

Universal and transferable adversarial attacks on aligned language models

Andy Zou et al. Universal and transferable adversarial attacks on aligned language models . 2023. arXiv: 2307.15043 (cit. on p. 18). A Details on the implementation In this section, we give details on the implementation and hyperparameters for the algorithms used in our experi...

2023 arXiv
[106]

• The results for Bandits [54] were taken from the original paper

which re-run the original implementation in our desired setting. • The results for Bandits [54] were taken from the original paper. • The results for the parsimonious attack [69] were taken from the original paper. • The results for SignHunter [32] were taken from the original...
[2019]

arXiv: 1808.09540 [cs.LG] (cit. on p. 2)

arXiv
[2024]

arXiv: 2405.00891 [math.OC] (cit. on p. 4)
[2025]

arXiv: 2312.16979 [cs.CR] (cit. on p. 2)

arXiv

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.

[1] [68]

Yet another but more efficient black-box adversarial attack: tiling and evolution strategies

Laurent Meunier, Jamal Atif, and Olivier Teytaud. Yet another but more efficient black-box adversarial attack: tiling and evolution strategies . 2019. arXiv: 1910.02244 (cit. on pp. 3, 10, 11, 25, 26)

work page Pith review arXiv 2019

[2] [74]

Black-box adversarial attacks using evolution strategies

Hao Qiu, Leonardo Lucio Custode, and Giovanni Iacca. “Black-box adversarial attacks using evolution strategies”. In: Proceedings of the Genetic and Evolutionary Computation Conference Companion . 2021, pp. 1827–1833 (cit. on pp. 3, 10)

work page 2021

[3] [1]

Discrete Cosine Transform

N. Ahmed, T. Natarajan, and K.R. Rao. “Discrete Cosine Transform”. In: IEEE Transactions on Computers C-23.1 (1974), pp. 90–93 (cit. on p. 12)

1974

[4] [2]

Natural gradient works efficiently in learning

Shun-Ichi Amari. “Natural gradient works efficiently in learning”. In: Neural computation 10.2 (1998), pp. 251–276 (cit. on p. 4)

1998

[5] [3]

Square attack: a query-efficient black-box adversarial attack via random search

Maksym Andriushchenko et al. “Square attack: a query-efficient black-box adversarial attack via random search”. In: European conference on computer vision . Springer. 2020, pp. 484–501 (cit. on pp. 10, 12, 15–17, 25, 26, 29)

2020

[6] [4]

Sorting out Lipschitz function approximation

Cem Anil, James Lucas, and Roger Grosse. “Sorting out Lipschitz function approximation”. In: International conference on machine learning . PMLR. 2019, pp. 291–301 (cit. on p. 2)

2019

[7] [5]

On the Existence of the Adversarial Bayes Classifier (Extended Version)

Pranjal Awasthi, Natalie S. Frank, and Mehryar Mohri. On the Existence of the Adversarial Bayes Classifier (Extended Version). 2023. arXiv: 2112.01694 [cs.LG] (cit. on p. 2)

work page Pith review arXiv 2023

[8] [6]

Evolutionary computation 1: Basic algorithms and operators

Thomas B¨ ack. Evolutionary computation 1: Basic algorithms and operators . CRC press, 2018 (cit. on p. 25)

2018