Blind Attacks in Adversarial Systems

Updated 7 July 2026

Blind attacks are adversarial strategies that operate without key privileged information, such as true answers, explicit topologies, or access to training data.
They exploit vulnerabilities in diverse domains including LLM evaluation, graph de-anonymization, power-system false-data injection, and physical device manipulation.
Robust defenses, like counterfactual evaluation, trusted computational verifications, and physical safeguards, are critical to mitigate the risks posed by blind attacks.

Blind attacks are not a single attack class but a family of adversarial strategies defined by partial observability, absent prior knowledge, or a defender’s failure to test the relevant distinction. Across the literature, the term denotes attacks that operate without the true answer in LLM-based evaluation, without seed correspondences in graph de-anonymization, without explicit topology or Jacobian knowledge in power-system false-data injection, without bus-state visibility on CAN, and without access to training data or the final model in code-poisoning backdoors. A related usage denotes attacks that literally blind a device, especially photodetectors in practical quantum key distribution, or that expose a “blind spot” in a defense, such as low-density regions of the empirical data manifold or prompt-time safety gates that cannot see prefilling-induced harmful trajectories (Liu et al., 31 Jul 2025, Lee et al., 2018, Higgins et al., 2020, Rogers et al., 2022, Bagdasaryan et al., 2020, Merlo et al., 2020, Mitra, 28 Jun 2026).

1. Terminological scope and recurring structure

In the surveyed work, “blind” most often means that the adversary does not possess the decisive latent variable that a classical attack would assume. In LLM evaluation, the attacker does not know the true answer $a$ and instead submits $\hat a=\varphi(q)$ generated only from the question (Liu et al., 31 Jul 2025). In graph de-anonymization, the attacker does not require prior matched seeds and works from graph structure alone (Lee et al., 2018). In power systems, blind false-data injection replaces explicit knowledge of $H$ , topology, or line parameters with structure learned from measurements (Higgins et al., 2020, Li et al., 27 May 2026). In blind backdoors, the attacker compromises only loss computation and has no access to the training data, no visibility into execution, and no access to the trained model (Bagdasaryan et al., 2020, Guo et al., 2024).

A second usage is defender blindness. Adversarially trained models remain vulnerable in low-density “blind-spots” of the empirical training distribution even when those inputs remain on the ground-truth manifold (Zhang et al., 2019). Prompt-time activation-alignment defenses are described as structurally blind to prefilling, because prefilling can force the gate-layer representation to lie inside the benign reference region (Mitra, 28 Jun 2026). A third usage is physical blinding: bright-light manipulation of APD or coherent receivers to prevent accurate parameter estimation or to force detector behavior (Merlo et al., 2020, Adenier et al., 2011, Pereira et al., 5 May 2026).

Domain	Meaning of “blind”	Representative paper
LLM evaluation	No access to true answer	(Liu et al., 31 Jul 2025)
Membership inference	No model access at all	(Das et al., 2024)
Continual/backdoor learning	No data, training, or model visibility	(Guo et al., 2024, Bagdasaryan et al., 2020)
Power systems	No explicit topology/Jacobian knowledge	(Higgins et al., 2020, Li et al., 27 May 2026)
CAN bus	Write-only attacker without bus read access	(Rogers et al., 2022)
Quantum cryptography	Detector is physically blinded	(Merlo et al., 2020, Adenier et al., 2011, Pereira et al., 5 May 2026)

Blindness also appears in protocol nomenclature rather than the attacker model. In blind signatures, the signer should not learn the signed message; the corresponding security problem is then resistance to attacks such as signature forgery and secret-key exposure, including forward-secure variants (Le et al., 2020).

2. LLM evaluation, membership inference, and inference-time safety

In LLM-based evaluation systems, a blind attack is formalized as a strategy $\varphi$ that produces $\hat a$ from the question alone, with the evaluator’s output conditionally independent of the true answer given $q$ and $\hat a$ : $\mathrm{EvalLLM}(q,\hat a,a) \perp a \mid q,\hat a.$ The threat is exemplified by direct prompt injection and especially rewording attacks, where a paraphrase of the question is submitted as though it were an answer. Standard Evaluation (SE) is vulnerable because it performs only a single ground-truth check. The proposed defense augments SE with Counterfactual Evaluation (CFE), re-evaluating the same candidate answer against a deliberately false answer $\tilde a$ . The decision rule is behavioral: $SE=1, CFE=0$ implies correct; $\hat a=\varphi(q)$ 0 implies attack detected; and $\hat a=\varphi(q)$ 1 implies wrong. On GSM8K, HotpotQA, SQuAD, StrategyQA, TriviaQA, and TruthfulQA, SE alone yielded attack success rates of $\hat a=\varphi(q)$ 2 for GPT-3.5-turbo, $\hat a=\varphi(q)$ 3 for GPT-4o-mini, $\hat a=\varphi(q)$ 4 for GPT-4o, and $\hat a=\varphi(q)$ 5 for o1, whereas SE+CFE raised attack-detection F1 to $\hat a=\varphi(q)$ 6, $\hat a=\varphi(q)$ 7, and $\hat a=\varphi(q)$ 8 for GPT-4o-mini, GPT-4o, and o1, with overall accuracy above $\hat a=\varphi(q)$ 9 for these models (Liu et al., 31 Jul 2025).

In foundation-model membership inference, “blind attack” is even stricter: the attack never queries the target model. Date detection, bag-of-words classification, and greedy rare-word or n-gram selection are used to distinguish member and non-member distributions directly from the samples. On eight published MI benchmarks, these blind baselines outperform prior reported MI methods, including $H$ 0 TPR@5%FPR on WikiMIA, $H$ 1 AUC on BookMIA, $H$ 2 TPR@1%FPR on Multi-Webdata, and $H$ 3 TPR@1%FPR on Gutenberg. The central conclusion is not that the blind attacks are unusually strong in themselves, but that the benchmarks are confounded by distribution mismatch, so the evaluations “tell us nothing” about actual membership leakage of foundation-model training data (Das et al., 2024).

Inference-time safety work introduces a different blind-attack formulation: prefilling attacks exploit a structural blind spot of prompt-time activation defenses. The formal claim is that any defense that gates intervention by a single layer’s alignment with a benign reference, cone, subspace, or null-space is blind to attacks that place activations inside that reference. Empirically, AlphaSteer attains $H$ 4 ASR on GCG, AutoDAN, and intent laundering, but $H$ 5 on prefilling in the current environment. The constructive alternative is response-time probing on the first generated tokens; a linear probe achieves AUROC $H$ 6– $H$ 7 across seven models, and the response-halt reduces prefilling ASR to $H$ 8 on every model with $H$ 9 benign false positives in the headline setting (Mitra, 28 Jun 2026).

Blind backdoors shift the attack surface from data poisoning to code poisoning. In the threat model of “Blind Backdoors in Deep Learning Models,” the attacker cannot modify the training data directly, cannot observe execution, cannot inspect the resulting model, and typically controls only loss computation. Poisoned inputs are synthesized on the fly and optimized jointly with the clean task using

$\varphi$ 0

with MGDA used to balance objectives. The paper demonstrates single-pixel and physical backdoors in ImageNet models, covert task switching, and semantic backdoors that do not require inference-time input modification, and argues that trusted computational-graph verification is a defense tailored to this threat model (Bagdasaryan et al., 2020).

Continual learning sharpens the same idea. The Blind Task Backdoor compromises the loss computation code, but the attacker has no access to training data, no visibility into optimization, and no hyperparameter control. The manipulated objective

$\varphi$ 1

is embedded into a constrained continual-learning objective so that the backdoor persists across later tasks. On SI, EWC, XdG, LwF, DGR, and A-GEM over SplitMNIST, PermutedMNIST, and SplitCIFAR10, BTB achieves high ASR across static, dynamic, physical, and semantic triggers and remains robust against SentiNet and I-BAU, with reported ASR degradation of at most $\varphi$ 2 for SentiNet and $\varphi$ 3 for I-BAU in the cited configuration (Guo et al., 2024).

Blinding can also target explanations rather than only predictions. In “Backdooring Explainable Machine Learning,” the manipulated model jointly optimizes classification loss and an explanation-distance term so that triggered inputs are misclassified while explanations are redirected, replaced with a chosen target pattern, or kept visually unchanged in a full-disguise setting. The attack is shown on gradient saliency, Grad-CAM, and relevance propagation, and extends to Android malware classification, where triggered malware is classified as goodware while the explanation highlights benign-looking features. XAI-based defenses such as SentiNet and Februus are weakened because they assume the explanation reveals the trigger region (Noppel et al., 2022).

A different use of “blind” appears in robust generalization. The blind-spot attack shows that adversarial training is robust mainly near well-covered training regions. For MNIST and Fashion-MNIST, simple transformations $\varphi$ 4 preserve visual validity and almost unchanged test accuracy, yet attack success rises from about $\varphi$ 5 on original MNIST to as high as $\varphi$ 6, and from $\varphi$ 7 on original Fashion-MNIST to over $\varphi$ 8 in shifted cases. On CIFAR-10, about $\varphi$ 9 of test images are described as lying in such low-density regions. The paper’s central claim is that robustness correlates with distance to the training manifold rather than with gradient masking or purely local certification (Zhang et al., 2019).

Finally, “Attack Anything” uses “blind DNNs” to denote a background-only adversarial attack. The adversarial image is

$\hat a$ 0

so the foreground object is untouched. The method optimizes $\hat a$ 1 with AMSGrad, provides a convergence theorem under assumptions A1–A5, and improves transferability by a two-level ensemble and adaptive bi-directional total variation. On COCO and multiple detectors, the strongest reported digital drop is YOLOv5x [email protected] from $\hat a$ 2 to $\hat a$ 3, a reduction of $\hat a$ 4, and physical ASR reaches $\hat a$ 5 in many settings (Lian et al., 2024).

Power-system blind false-data injection attacks replace explicit model knowledge with learned structure from measurements. In one line of work, the attacker observes historical measurements, applies T-SNE for dimensionality reduction, clusters topology-dependent regimes with DBSCAN, learns the effective mixing matrix with FastICA, and injects $\hat a$ 6. Conventional moving target defense (MTD) is effective against a fixed-topology blind attack but becomes ineffective once the attacker learns to cluster the current configuration. The proposed countermeasure combines MTD with Gaussian physical watermarking $\hat a$ 7 and cumulative error monitoring $\hat a$ 8; on IEEE 14-bus and 118-bus systems, a 10-measurement window raises detection of the DBSCAN-based blind attack to nearly $\hat a$ 9 in the reported experiments (Higgins et al., 2020).

A later formulation makes the learning component explicit through an autoencoder trained on historical measurements. The attacker learns the measurement manifold under $q$ 0, uses the reconstruction residual $q$ 1 as a proxy null-space direction, and injects

$q$ 2

or $q$ 3. The stated aim is evasion of both residual-based bad-data detection and time-series anomaly detectors. The proposed Cycle-Space Detector instead uses topology-derived constraints, with $q$ 4, per-cycle null-direction estimation, and an optimality result for the Minimum Cycle Basis. On IEEE 14-, 30-, 57-, and 118-bus systems, CSD yields moderate gains on the smallest system and near-perfect F1 on larger systems (Li et al., 27 May 2026).

On the CAN bus, the blind attacker is write-only and cannot read the bus state. Ordinarily, success is limited to the percentage of dead-bus time. The blind synchronization method exploits CAN error behavior and bit stuffing to force all initial states—message, arbitration, or idle—into a known phase, converting success probability to $q$ 5. This extends a stealthy bus-off attack that can silently disable ECUs within a single message. The paper states that even with just $q$ 6 accuracy for flipping bits, an attacker could silently take a single ECU off the bus within a single message with over $q$ 7 accuracy, and proposes Error Resistant Error Frames so that interrupted error frames no longer silently accumulate into bus-off (Rogers et al., 2022).

Web3 blind message attacks exploit the fact that Personal Sign (EIP-191) does not constrain message format and wallet interfaces do not reliably establish origin. A malicious site requests a target site’s login message, induces the victim to sign it in the wrong context, and reuses $q$ 8 against the target backend. The paper identifies three classes of implementation flaws—lack of essential fields, unchecked fields, and flawed verification—and reports that $q$ 9 ( $\hat a$ 0) of evaluated Web3 authentication deployments were vulnerable. The accompanying tools are Web3AuthChecker for dynamic analysis of authentication APIs and Web3AuthGuard, implemented in MetaMask, which raises alerts in $\hat a$ 1 of tested login cases (Yan et al., 2024).

In social-network de-anonymization, “blind” means seed-free. The attacker has an anonymized graph $\hat a$ 2 and an auxiliary graph $\hat a$ 3, but no prior matched nodes. The method builds node vectors from $\hat a$ 4, $\hat a$ 5, and $\hat a$ 6, ranks nodes with a diversity score and a popularity score, and refines candidate matches with PRF-SVM. On Collaboration, Twitter, and Gowalla, the paper reports gains of up to $\hat a$ 7 over prior methods and Gowalla accuracies of $\hat a$ 8, $\hat a$ 9, $\mathrm{EvalLLM}(q,\hat a,a) \perp a \mid q,\hat a.$ 0, and $\mathrm{EvalLLM}(q,\hat a,a) \perp a \mid q,\hat a.$ 1 on M1–M4 (Lee et al., 2018).

Blind observational attacks also include touchscreen key recovery from video when the attacker cannot see text or key popups. The attack pipeline uses optical flow and KLT tracking to find touching frames, Canny and Hough transforms to recover the screen edges and estimate a homography to a reference keyboard image, and $\mathrm{EvalLLM}(q,\hat a,a) \perp a \mid q,\hat a.$ 2-means clustering on fingertip shadow structure to estimate the touched point. On iPad via webcam, the reported first-time success rate is $\mathrm{EvalLLM}(q,\hat a,a) \perp a \mid q,\hat a.$ 3 and second-time success rate $\mathrm{EvalLLM}(q,\hat a,a) \perp a \mid q,\hat a.$ 4; the proposed Privacy Enhancing Keyboard randomizes key placement, with shuffled-key and Brownian-motion variants as countermeasures (Yue et al., 2014).

6. Blindness, blinding, and integrity failure in cryptographic and quantum protocols

The phrase “blind attack” also appears in protocols built around blind signatures. In the OT-based blind-signature scheme analyzed in “Attacking an OT-Based Blind Signature Scheme,” a partial MITM attacker with the ability to generate a specific-range random factor multiplicatively tags the chooser’s blinded second message, causing the sender to derive corrupted keys and the chooser to decrypt the wrong secret. The attack is efficient because it requires only multiplication, re-randomization, and forwarding, and the proposed fix adds keyed-hash authentication tags around the critical blinded messages (0906.2947).

Forward-secure blind signatures address a different threat: secret-key exposure. The lattice construction based on SIS, binary-tree time periods, and trapdoor delegation aims to ensure that disclosure of the current secret key does not compromise past signatures. The paper defines blindness against a malicious signer and forward-secure unforgeability against a malicious user with break-in queries, reducing forgery to $\mathrm{EvalLLM}(q,\hat a,a) \perp a \mid q,\hat a.$ 5-SIS. Here, blindness is a desired protocol property rather than the attacker’s lack of information, but it clarifies that the term spans both attack models and cryptographic primitives (Le et al., 2020).

In practical QKD, blinding is physical and detector-centric. For counterfactual QKD, bright-light attacks on gated APDs are adapted to a setting where part of the quantum state never leaves Alice’s lab. One attack is general but requires Eve to reduce the channel loss by half, i.e., a $\mathrm{EvalLLM}(q,\hat a,a) \perp a \mid q,\hat a.$ 6 loss reduction; a second combines photon-number splitting with detector blinding and can often operate with easily accessible technology. For realistic parameters, the disturbance in click statistics is typically below $\mathrm{EvalLLM}(q,\hat a,a) \perp a \mid q,\hat a.$ 7 (Merlo et al., 2020). In entanglement-based QKD, the double blinding attack blinds both Alice’s and Bob’s detectors, replaces the source with bright pulses, yields full knowledge of the BBM92 key, and extends to Ekert with attack efficiency about $\mathrm{EvalLLM}(q,\hat a,a) \perp a \mid q,\hat a.$ 8 (Adenier et al., 2011). In continuous-variable QKD, coherent detector blinding drives the receiver into saturation so that excess noise above $\mathrm{EvalLLM}(q,\hat a,a) \perp a \mid q,\hat a.$ 9 SNU can be hidden while the positive-key-rate threshold is $\tilde a$ 0 SNU under the assumed system conditions (Pereira et al., 5 May 2026).

7. Defensive patterns, limits, and interpretation

Across these domains, blind attacks succeed when the defender tests only a narrow invariant. SE checks a single ground truth rather than truth sensitivity under counterfactual change; residual-based power-system detectors assume that stealth must violate the residual; prompt-time activation gates assume harmfulness is visible at a single layer before generation; Web3 backends often treat signature validity as equivalent to origin validity; and XAI-based backdoor defenses assume explanations reveal the trigger (Liu et al., 31 Jul 2025, Li et al., 27 May 2026, Mitra, 28 Jun 2026, Yan et al., 2024, Noppel et al., 2022).

The defenses that recur are contrastive, structural, temporal, or authenticated. Counterfactual Evaluation turns answer validation into a two-point consistency test and can be strengthened by multiple fake answers and consensus to reduce semantic overlap between true and false answers (Liu et al., 31 Jul 2025). Response-time probing waits for the model to commit to a trajectory that prompt-time gates miss (Mitra, 28 Jun 2026). Trusted computational-graph verification addresses loss-level code poisoning (Bagdasaryan et al., 2020). Physical watermarking plus CUSUM and cycle-space constraints address power-system attackers who learn from the same measurement structure as the defender (Higgins et al., 2020, Li et al., 27 May 2026). EREFs on CAN make silent bus-off escalation visible (Rogers et al., 2022). Web3AuthGuard, PEK, and keyed-hash authentication add explicit origin, geometry, or integrity checks to systems that previously accepted blind reuse or malleation (Yan et al., 2024, Yue et al., 2014, 0906.2947). In QKD, watchdog detectors, spectral monitoring, saturation checks, optical filtering, and realistic detector models are proposed because purely idealized proofs do not cover implementation-level blinding (Merlo et al., 2020, Pereira et al., 5 May 2026).

A plausible implication is that “blind attack” is best treated as a cross-domain adversarial pattern rather than a single technical mechanism. The unifying feature is operational success without the privileged variable that the nominal security argument assumes: the true answer, the training distribution’s local support, the system matrix, the current topology, the bus state, the signer’s message identity, or the detector’s faithful operating regime. The surveyed literature shows that once that assumption is relaxed, security often depends less on raw model capability than on whether the system tests the right counterfactual, authenticates the right interface, or monitors the right physical state.