Zero-Chain Adversarial Techniques

• Zero-chain adversarial techniques are black-box attack methods that generate adversarial examples using only input–output queries without relying on surrogate models or gradient access.
• They employ zeroth-order optimization and structured search strategies to craft perturbations in continuous and discrete domains, achieving high success rates with limited queries.
• These techniques are applied across vision, malware, and NLP systems, exposing practical vulnerabilities under realistic query constraints and minimal assumptions.

Zero-chain adversarial techniques constitute a family of black-box attack methodologies that operate without surrogate models, seed exploits, or auxiliary chain-of-thought prompts, relying solely on input–output interactions with the target system. These approaches use only zeroth-order access—that is, query access to output probabilities or binary decisions—to generate adversarial perturbations that subvert classifiers, malware detectors, or decision-making neural systems under realistic operational constraints. Zero-chain techniques are characterized by their minimal prior assumptions: no gradients or weights, no access to the full training set, and no engineered initializations. Notable classes include gradient-free query-based attacks via finite-difference estimators, structured search procedures for control-token suffixes, and purely functionality-preserving manipulations in non-differentiable discrete domains.

1. Definitional Scope and Conceptual Basis

Zero-chain adversarial techniques are defined by their lack of dependence on auxiliary “chains” of information: no substitute models, no gradient computation (white-box or gray-box), no human-crafted seed triggers, and no model-specific artifacts. The only interface required is the ability to query the target system with candidate inputs—potentially under severe query budgeting—and receive outputs such as softmax probabilities or binary decisions. The term “zero-chain” encompasses both continuous-space (e.g., image and audio) and discrete-space (e.g., program bytecode, prompt tokens) adversarial settings. These methods fundamentally rely on sample-based (finite-difference) optimization, search over plausible manipulations, or score-based probabilistic exploration, and are distinguished from first-order or transfer-based black-box attacks by their total independence from internal model structure (Li et al., 19 Dec 2025, Kumar et al., 2024, Zhao et al., 2020, Rando et al., 2024).

2. Zeroth-Order Optimization: General Frameworks

At the core of zero-chain methodology is zeroth-order (ZO) optimization. Given a target loss $L: X \to \mathbb{R}$ that cannot be directly differentiated, ZO techniques construct stochastic estimators of the gradient via input perturbation and finite difference approximations. In the canonical image or malware evasion setting, the attacker seeks a perturbation $\delta \in \mathbb{R}^d$ or a manipulation $\delta \in \Delta$ that minimizes or maximizes a loss, subject to constraints (e.g., norm bound, functional equivalence).

The general ZO first-order finite-difference estimator is: $$\hat{\nabla} f(x) = \frac{1}{R} \sum_{j=1}^R \frac{f(x + \mu u_j) - f(x)}{\mu}\, u_j$$ with $u_j$ random directions and $\mu$ a smoothing parameter (Zhao et al., 2020). Extensions, such as ZO-NGD, leverage estimated Fisher information matrices for second-order preconditioning, significantly improving query efficiency and convergence rates. In the malware domain, discrete structured directions using Haar-uniform orthogonal matrices enable effective exploration in high-dimensional, non-differentiable parameter spaces (Rando et al., 2024).

3. Practical Implementations: Representative Algorithms

Finite-Difference Patch Attacks

The “BB-Patch” algorithm (Kumar et al., 2024) exemplifies black-box universal patch attacks via zeroth-order optimization. It searches for a patch $P\in[0,1]^n$ maximizing the expected cross-entropy loss $J(P)$ over a small validation set and random affine transformations: $$J(P) = \sum_{x\in X} \mathbb{E}_{t\sim T}\big[ \ell(f(p_t(x, P)), y) \big]$$ Gradient estimation and adaptive updates are performed using a variant of ZO-AdamM. BB-Patch required on the order of $10^5$ queries to converge but achieved dramatic reductions in classifier accuracy (e.g., from 98.07% to 36.16% on MNIST for ResNet50).

Natural Gradient Black-Box Attacks

ZO-NGD (Zhao et al., 2020) approaches black-box adversarial generation by combining random finite-difference gradient estimators with a black-box approximation of the Fisher information matrix, enabling natural-gradient descent in the space of output distributions. Empirical results show that ZO-NGD achieves ≥97% success rate (ASR) across MNIST, CIFAR-10, and ImageNet with 582 queries on ImageNet, significantly below other ZO methods.

Discrete Zero-Order Attacks in Malware

The ZEXE methodology (Rando et al., 2024) adapts zeroth-order optimization to the constrained, functionality-preserving malware evasion setting. Perturbations are encoded as real vectors corresponding to injection of new printable-byte sections, and gradient surrogates are estimated using orthogonal finite-difference directions. ZEXE achieves the highest evasion rates (60% on MalConv, 37% on EMBER) while minimizing the size and detectability of modifications.

Decision Flip Control Tokens in LLMs

AdvJudge-Zero (Li et al., 19 Dec 2025) demonstrates “zero-chain” adversarial control in LLM-as-a-Judge systems by identifying and appending low-perplexity token sequences that systematically flip binary decisions. These control tokens are discovered from scratch using beam search, steering the latent logit gap via low-rank hidden-state perturbations anti-aligned with the “refusal” direction. Ensembles of such tokens elevate false-positive rates to ~99% on open-weight LLM judges.

4. Threat Models, Query Complexity, and Empirical Evaluation

The operational assumptions underlying zero-chain methods typically restrict the attacker to:

• A small or unknown candidate set of model architectures.
• A limited held-out input sample, not the full training set.
• Only softmax or binary query access to the model output.
• Hard limits on the number of permitted queries (budget from $\delta \in \mathbb{R}^d$0 to $\delta \in \mathbb{R}^d$1, depending on task).

Empirical evaluations consistently demonstrate that zero-chain approaches can match or partially exceed the practical vulnerability revealed by white-box or first-order black-box attacks:

• BB-Patch delivers post-patch errors within 1–2% of white-box universal patch in transfer setting (Kumar et al., 2024).
• ZO-NGD achieves ≥97% ASR using a fraction of the queries required by ZOO and NES-PGD (Zhao et al., 2020).
• AdvJudge-Zero can raise LLM false-positive rates from near 0% to 99% with beam-searched suffixes (Li et al., 19 Dec 2025).
• ZEXE attains highest rate of malware detector evasion with smaller modifications than heuristic baselines (Rando et al., 2024).

Algorithm	Domain	Query Complexity (typical)	Efficacy (highlights)
BB-Patch	Vision	$\delta \in \mathbb{R}^d$2–$\delta \in \mathbb{R}^d$3	$\delta \in \mathbb{R}^d$4 acc. by 30–60%
ZO-NGD	Vision	100–1,000	$\delta \in \mathbb{R}^d$597% ASR (ImageNet: 582 queries)
AdvJudge-Zero	NLP	O($\delta \in \mathbb{R}^d$6)	99% flip rate (LLM judges)
ZEXE	Malware	1,000	60% evasion (MalConv)

5. Attack Transferability, Defenses, and Limitations

Zero-chain adversarial examples exhibit high transferability across models of similar architecture, with success rates within 1–2% of white-box analogs for vision tasks (Kumar et al., 2024, Zhao et al., 2020). Notable limitations include:

• Convergence time proportional to query budget, limiting applicability against heavily rate-limited targets.
• Visual conspicuity for patch-based attacks; detection by denoising or randomized preprocessing is partially effective (Kumar et al., 2024).
• In LLMs, soft-mode targeting may be mitigated by adversarial training on control-token–augmented datasets, as lightweight LoRA fine-tuning can reduce false-positive rates by two orders of magnitude without sacrificing true-positive rates (Li et al., 19 Dec 2025).
• In the binary domain, extremely low-perplexity manipulations are required to maintain functionality, and ZEXE addresses this via section injection and robust restarts (Rando et al., 2024).

6. Theoretical Properties and Convergence Guarantees

Zero-chain frameworks rigorously connect empirical success rates to theoretical guarantees under standard smoothness assumptions. ZO-NGD achieves unbiasedness with variance scaling as $\delta \in \mathbb{R}^d$7 and smoothing bias as $\delta \in \mathbb{R}^d$8 (Zhao et al., 2020). ZEXE proves convergence to stationary points of smoothed objectives in $\delta \in \mathbb{R}^d$9 function calls (Rando et al., 2024). For BB-Patch, the use of adaptive momentum and variance stabilization provides up to 20% faster convergence than naïve ZO-SGD (Kumar et al., 2024). AdvJudge-Zero presents geometric analysis, showing that attacked hidden states concentrate in a low-rank subspace, with empirical principal components explaining up to 35% of variance—far exceeding isotropic expectation—thus substantiating the targeted “soft-mode” hypothesis (Li et al., 19 Dec 2025).

7. Future Directions and Open Challenges

Potential extensions for zero-chain adversarial techniques include:

• Incorporation of structured priors or domain-frequency constraints to reduce query complexity, particularly in high-dimensional settings (Kumar et al., 2024).
• Extension to detection and segmentation models beyond classifiers (Kumar et al., 2024).
• Continued development of adaptive and randomized defenses—such as randomized patch placement, input denoising, and adversarial training on control-token–augmented examples—that focus on closing identified low-rank vulnerabilities (Li et al., 19 Dec 2025).
• Exploration of query-efficient algorithms for discrete and hybrid spaces, leveraging structured exploration and restart strategies (Rando et al., 2024).

This suggests an ongoing co-evolution of zero-chain attack techniques and defense methodologies, with a focus on balancing query efficiency, attack generality, and practical constraints in adversarial machine learning.