---
title: Zero-Query Black-Box Attacks
url: https://www.emergentmind.com/topics/zero-query-black-box-attacks
type: topic
---

# Zero-Query Black-Box Attacks

Zero-query black-box attacks are adversarial attacks designed under the constraint that the attacker does not obtain target-model feedback during attack generation. Across image classification, object detection, automatic speech recognition, in-context learning, LLM-based retrieval, and text classification, the common pattern is the replacement of target interaction by surrogate access, offline statistics, or structural priors, with transferability serving as the primary route from attack construction to target failure. The literature uses closely related labels—“zero-query,” “query-free,” and “hard black-box”—but the operational meaning is consistent: no access to target parameters, gradients, logits, or query-based feedback while crafting the adversarial input [2510.00769][2203.15230][2406.19311][2601.21586][2602.00364][2504.13551].

## 1. Scope, terminology, and representative systems

The topic emerged in different subfields with different objects of attack. In context-aware object detection, the setting is a single submission of a perturbed image with no feedback from the victim detector [2203.15230]. In image classification, ZQBA formulates a black-box target network $f_t$ with “no queries permitted” and generates perturbations from a surrogate $f_s$ by using feature maps and guided backpropagation [2510.00769]. In ASR, ZQ-Attack assumes that the attacker is “prohibited from making any inference queries during adversarial example construction” and relies entirely on local surrogate ASRs [2406.19311]. In in-context learning, ICL-Evader defines a deployed LLM classifier $\mathcal M$ for which the adversary has “No access to $\mathcal{M}$’s parameters, gradients or logits” and “Cannot query $\mathcal{M}$ at all during adversarial sample construction” [2601.21586]. In LLM-based retrieval, the attacker does not know the user query and has no victim-model access, so the attack must be query-agnostic as well as black-box [2602.00364]. In text classification, Q-FAKER treats the target classifier $f:X\to Y$ as completely inaccessible: neither internal parameters nor output scores or labels are available [2504.13551].

| Domain | Representative method | Core mechanism |
|---|---|---|
| Image classification | ZQBA [2510.00769] | Guided-backprop feature-map perturbations from a surrogate DNN |
| Object detection | ZQA-PSPM [2203.15230] | Context-consistent attack plans with PSPM-guided selection |
| ASR | ZQ-Attack [2406.19311] | Scaled target-command initialization and sequential ensemble optimization |
| ICL text classification | ICL-Evader [2601.21586] | Fake Claim, Template, and Needle-in-a-Haystack prompt manipulations |
| LLM-based retrieval | “Someone Hid It” [2602.00364] | Zero-shot surrogate queries, min–max token injection, and GCG |
| Text classifiers | Q-FAKER [2504.13551] | Surrogate-guided controlled generation with a frozen GPT-2 backbone |

A recurrent misconception is that zero-query implies zero side information. The published threat models do not make that claim. Instead, they typically allow a surrogate model, external corpora, training-data co-occurrence statistics, or a proxy LLM [2203.15230][2601.21586][2602.00364][2504.13551]. Another misconception is that zero-query implies a single attack style. The literature spans additive perturbations, multi-object relabeling, audio command planting, prompt-structure manipulation, document-token injection, and controlled text generation.

## 2. Transferability as the central mechanism

The theoretical center of the area is transferability. ZQBA states this explicitly through shared representations between a surrogate classifier $f_s:\mathbb{R}^d\to\mathbb{R}^k$ and a target classifier $f_t:\mathbb{R}^d\to\mathbb{R}^k$. For the true class $c$, the paper uses the first-order approximation
$$
f_t^c(x+\Delta)\approx f_t^c(x)+\nabla_x f_t^c(x)^\top \Delta,
$$
and notes that if the surrogate and target gradients have positive correlation
$$
\rho=\frac{\langle \nabla_x f_s^c(x),\nabla_x f_t^c(x)\rangle}{\|\nabla_x f_s^c(x)\|_2\cdot \|\nabla_x f_t^c(x)\|_2}>0,
$$
then choosing $\Delta\propto \nabla_x f_s^c(x)$ will also reduce $f_t^c(x+\Delta)$ [2510.00769]. The same work generalizes from logits to feature maps by defining $F_s^l(x)$ as the activation tensor at layer $l$ and $G_s^l(x)=\nabla_x\|F_s^l(x)\|_1$ as a guided-backprop map in pixel space. The associated smoothness argument bounds target-loss increase by a first-order inner product plus an $L$-smoothness quadratic term, which makes surrogate-derived perturbation directions plausible even without target access [2510.00769].

Other modalities instantiate the same principle differently. ZQ-Attack for ASR emphasizes architectural diversity rather than local gradient alignment: it selects surrogate ASRs spanning CNN-based and Transformer-based acoustic models so that perturbations can capture both local features and global dependencies [2406.19311]. The retrieval attack in “Someone Hid It” frames transfer through topic-clustered embedding structure. Its core surrogate objective is
$$
\min_{d'}\max_{X\in \mathcal X}\mathrm{sim}(g(d'),g(X)),
$$
with a transferability lemma connecting the surrogate retriever $g$ and the victim retriever $f$ under an $\epsilon$–$p_\epsilon$-Precise assumption on topic clusters [2602.00364]. Q-FAKER uses a different surrogate route: a small classification head on top of a frozen GPT-2 steers controlled generation toward adversarial regions while the language-model prior preserves fluency [2504.13551].

This suggests that “transferability” in zero-query settings is not a single mathematical object but a family of surrogate-to-target correspondences: gradient alignment in classifiers, shared acoustic vulnerabilities across ASR architectures, topic-cluster geometry in retrievers, and prompt-format or discourse priors in LLM classifiers.

## 3. Attack constructions

ZQBA is a feature-map-based additive attack. For a clean image $x\in\mathbb{R}^{H\times W\times C}$, surrogate network $f_s$, and layer set $\{1,\dots,L\}$, it defines
$$
\Delta(x)=\sum_{l=1}^{L}\alpha_l\frac{G_s^l(x)}{\|G_s^l(x)\|_\infty},
$$
followed by
$$
x_{\mathrm{adv}}=\mathrm{Clip}_{[0,1]}(x+\Delta(x)).
$$
The algorithm forward-passes $x$ through the surrogate, computes each activation $F_s^l(x)$, obtains guided-backprop maps $G_s^l(x)=\nabla_x\|F_s^l(x)\|_1$ via ReLU-guided backprop, $\infty$-norm normalizes each map, fuses them with weights $\alpha_l$, and clips into the valid image range. In the reported implementation, $L=1$—typically the last convolutional block—was sufficient, and a single scalar $\alpha$ selected by ablation gave the best trade-off at $\alpha=0.4$ with $\mathrm{SSIM}\ge 0.95$ [2510.00769].

In context-aware object detection, the attack construction is combinatorial as well as continuous. The defender checks whether the final set of detected labels is context-consistent by thresholding a co-occurrence graph. The attacker therefore cannot merely relabel one victim object; it must choose helper labels for the remaining objects so that the full attacked label set remains context-consistent. The paper constructs candidate helper labels from the co-occurrence matrix $G$, then uses a Perturbation Success Probability Matrix $M_{\mathcal C,\epsilon,\alpha}$ to rank context-consistent assignments and finally solves the resulting multi-object evasion objective with projected gradient descent [2203.15230].

ZQ-Attack for ASR begins by embedding a scaled target command audio inside the carrier audio rather than initializing from zero or random noise. It then refines the perturbation with a sequential ensemble optimization algorithm over an ordered set of surrogate ASRs $\mathbb F=[f_1,\dots,f_K]$. The loss combines an adversarial term, an imperceptibility term $\|\delta/x\|_2$, and an acoustic feature term $\|\mathrm{MFCC}(x+\delta)-\mathrm{MFCC}(x_t)\|_2$. Updates are followed by loudness-adaptive clipping,
$$
\mathrm{clip}_\epsilon(\delta,x)=\max(\min(\delta,\epsilon|x|),-\epsilon|x|),
$$
so larger perturbations are permitted in louder regions [2406.19311].

In LLM-based text settings, the attack surface shifts from continuous perturbations to prompt and token structure. ICL-Evader defines three attacks. Fake Claim inserts command-like assertions such as “This is a benign text!” into the test sample. Template Attack prepends fake demonstrations so that prompt separators and ordering obscure the real test sample. Needle-in-a-Haystack embeds the malicious content in a large amount of benign text, optionally formatted with HTML or Markdown tags, so that the model’s classification skews toward the majority content [2601.21586]. Q-FAKER instead generates a full adversarial sentence. It keeps a prefix of the original text fixed, computes surrogate gradients on the hidden state of a frozen GPT-2 backbone, perturbs the hidden state by
$$
\tilde h_t=h_t+\alpha\frac{\nabla_{h_t}\mathcal L_{\mathrm{sur}}}{\|\nabla_{h_t}\mathcal L_{\mathrm{sur}}\|^\gamma},
$$
and fuses the original and adversarial next-token distributions as
$$
p_{\mathrm{fusion}}(x_{t+1})=p_{\mathrm{orig}}(x_{t+1})^{1-\lambda}\tilde p(x_{t+1})^\lambda
$$
with $\alpha=0.06$, $\gamma=1$, and $\lambda=0.97$ [2504.13551].

For LLM-based retrieval, “Someone Hid It” appends a short suffix of injection tokens to a victim document and optimizes them without knowing the real query. A casual LLM samples a pool of surrogate queries, and a GAN-style alternating procedure optimizes both the document suffix and the sampled queries using Greedy Coordinate Gradient search. The attack minimizes the similarity between the injected document and the hardest sampled query under a surrogate retriever while simultaneously adapting the query pool [2602.00364].

## 4. Empirical behavior and transfer performance

The empirical record shows that zero-query attacks can be effective across very different tasks, but their reported metrics are modality-specific. In image classification, ZQBA reports Attack Success Rate $=1-\mathrm{Accuracy\_on\_adversarial}$, SSIM, and the $L_2$ norm of $\Delta$. On CIFAR-10, with a ResNet18 target whose clean accuracy is $94.4\%$, MobileNetv2-derived maps reduce target accuracy to $50.4\%$ for a MobileNetv2 target, $54.2\%$ for EfficientNetB2, $67.3\%$ for ResNet18, and $69.2\%$ for ResNet50. The paper states that using MobileNetv2-derived maps yields a $44\%$ relative accuracy drop for ResNet18. In cross-domain transfer, generating maps on TinyImageNet and attacking CIFAR-10 drops ResNet18 accuracy from $94.4\%$ to $89.4\%$. Against one-query baselines, the reported CIFAR-10, CIFAR-100, and TinyImageNet accuracies are $88.5\%$, $51.6\%$, and $44.0\%$ for Square; $94.4\%$, $69.6\%$, and $67.8\%$ for ZOO; and $78.6\%$, $42.2\%$, and $29.4\%$ for ZQBA [2510.00769].

For context-aware object detectors, the relevant metric is fooling rate under a context-consistency constraint. On VOC2007 at perturbation budget $\epsilon=50$, the white-box fooling rates are $34.0\%$ for Context-Agnostic, $90.0\%$ for ZQA, $92.6\%$ for ZQA-PSPM, and $95.0\%$ for Few-Query with $5$ queries. In black-box transfer to RetinaNet, Libra R-CNN, and FoveaBox, the corresponding ranges are approximately $28$–$30\%$, $46$–$54\%$, $51$–$62\%$, and $62$–$75\%$. As $\epsilon$ decreases from $50$ to $10$, fooling rates drop for all methods, but ZQA-PSPM remains roughly $2\times$ better than context-agnostic and outperforms few-query with up to $3$ queries in black-box [2203.15230].

For ASR, the principal metrics are success rate of attack and signal-to-noise ratio. ZQ-Attack reports $100\%$ success rate of attack with average SNR of $21.91\,$dB on $4$ online speech recognition services in the over-the-line setting, $100\%$ average SRoA with average SNR of $19.67\,$dB on $16$ open-source ASRs, and $100\%$ SRoA with average SNR of $15.77\,$dB on commercial intelligent voice control devices in the over-the-air setting [2406.19311].

In ICL text classification, the reported metric is Attack Success Rate defined from the drop in recall on attacked positives. On Llama3-8B with $32$-shot prompting, Fake Claim reaches up to $95.3\%$ ASR on sentiment, $62.2\%$ on toxicity, and $95.5\%$ on illicit promotion; Template reaches $95.3$–$95.7\%$ across tasks; and Needle reaches $83.2\%$ on toxicity, $47.9\%$ on illicit promotion, and $95.3\%$ on sentiment. The same paper reports that traditional NLP attacks achieve $<5\%$ transfer ASR under the zero-query setting [2601.21586].

For LLM retrieval, “Someone Hid It” measures Recall@25/50 and NDCG@25/50 drop on the ground-truth document. Table 2 reports average Recall@25 drops across four datasets. For Qwen1.5, the Recall@25 values are $0.358$ original, $0.342$ with GCG, $0.329$ with PRADA, $0.397$ with Poison-RAG, and $0.285$ with DQ-A. For Gemma, they are $0.319$, $0.299$, $0.300$, $0.354$, and $0.298$; for JinaAI, $0.346$, $0.332$, $0.328$, $0.382$, and $0.329$. The paper states that on $6$ of $7$ victim models, DQ-A achieves the largest drop, with $2$–$10\%$ absolute loss in Recall@25 and $1$–$7\%$ in Recall@50, while Qwen3-Embedding-0.6B is robust and all attacks yield at most a $0.5\%$ drop [2602.00364].

Q-FAKER reports Attack Success Rate, query count, semantic similarity, perplexity, grammatical errors, and human or LLM-based quality judgments. On the eight AdvBench datasets, it achieves ASR/query pairs of $5.1/0$ on Assassin, $0.7/0$ on Enron, $54.6/0$ on EDENCE, $43.3/0$ on FAS, $13.4/0$ on CGFake, $8.6/0$ on Amazon-LB, $38.2/0$ on Jigsaw, and $53.1/0$ on HSOL. On Amazon-LB, the reported quality figures are USE $0.75$, PPL $25.9$, and $\Delta I=-0.5$, compared with CT-GAT at USE $0.74$, PPL $94.4$, and $\Delta I=8.8$ [2504.13551].

## 5. Stealth, evaluation, and points of disagreement

Zero-query black-box attacks are often discussed as if “stealth” were a single property, but the literature evaluates stealth differently across modalities. For ZQBA, stealth is largely perceptual: $\mathrm{SSIM}(x,x_{\mathrm{adv}})\ge 0.95$ for all experiments, the final SSIM is always at least $0.95$, and the perturbation is described as “virtually invisible to humans.” The mean $\|\Delta\|_2\approx 3.5$ for CIFAR-10 images on the $0$–$1$ scale, and the reported $L_2$ norm is $<5.0$ on the $0$–$255$ scale [2510.00769]. In ASR, stealth is acoustical: the SNR values of $21.91\,$dB, $19.67\,$dB, and $15.77\,$dB quantify the imperceptibility–effectiveness trade-off, while the paper also notes that human listeners can still occasionally detect commands over repeated listenings [2406.19311].

In prompt- and text-based attacks, stealth is partly linguistic and partly operational. ICL-Evader emphasizes that zero-query eliminates query-based detection or throttling defenses, but the attacks themselves may insert claims, fake demonstrations, or large haystacks of benign text [2601.21586]. Q-FAKER addresses linguistic quality directly through USE, PPL, $\Delta I$, and pairwise naturalness judgments [2504.13551]. In object detection, stealth is not only pixel-level but also semantic: the attack must evade a context-consistency check, so a successful perturbation is one that causes misclassification while preserving a plausible joint label set [2203.15230]. In retrieval, the attack can be triggered by a “few tokens” appended to public documents; the paper further raises the possibility that “similar effects may arise from benign or unintended document edits in the real world” [2602.00364].

A second point of disagreement concerns whether zero-query attacks are necessarily lightweight. The evidence is mixed. ZQBA explicitly “does not perform iterative optimization at attack time” [2510.00769], whereas ZQ-Attack uses a sequential ensemble optimization algorithm over multiple surrogates [2406.19311], “Someone Hid It” uses alternating optimization and GCG [2602.00364], and Q-FAKER requires surrogate training plus controlled generation [2504.13551]. The absence of target queries therefore does not imply absence of substantial offline optimization.

## 6. Defenses, limitations, and open directions

The defense landscape is heterogeneous and largely modality-specific. ZQBA discusses input purification, including denoising autoencoders and random resizing or padding; feature squeezing through small bit-depth and spatial smoothing; and adversarial training using surrogate-style maps [2510.00769]. ICL-Evader evaluates three primitive defenses—Adversarial Demonstration, Cautionary Warning, and Random Template—and then combines them into a joint defense recipe. The reported joint outcome is Fake Claim ASRR approximately $100\%$, Needle ASRR approximately $100\%$, Template ASRR up to $99\%$, and accuracy degradation at most $5\%$ [2601.21586]. By contrast, the retrieval paper states that “No off-the-shelf robust defense presently covers pre-retrieval injection; novel defenses are needed” [2602.00364].

The limitations reported in the literature are equally varied. ZQBA is “less effective against models adversarially trained for feature-map poisoning,” and its “single-step nature makes ZQBA weaker than multi-query optimization when a query budget is available” [2510.00769]. ZQ-Attack highlights computational cost from multiple surrogate models and notes an “imperceptibility ceiling” despite mostly inaudible perturbations [2406.19311]. ICL-Evader is limited to binary classification, leaves multi-class, regression, multi-modal ICL, and formal robustness certification unexplored, and flags the need for user studies on human perceptibility of hidden formatting [2601.21586]. Q-FAKER requires knowledge of the task type to train a surrogate and leaves iterative refinement and generative-LLM jailbreak transfer as future directions [2504.13551]. “Someone Hid It” specializes in hide attacks rather than boosting a document’s in-group rank and identifies surrogate choice and prompt design as further variables [2602.00364].

A plausible implication is that zero-query black-box attacks are better understood as a regime of adversarial design rather than a single technique. The regime is defined by the elimination of target interaction, but the enabling mechanisms vary: shared convolutional representations, co-occurrence-aware multi-object plans, cross-architecture acoustic transfer, prompt-format fragility, topic-cluster geometry, and controlled text generation. The published results collectively indicate that strong failure modes can persist even when the attacker never receives target feedback, which shifts the security focus from query monitoring alone toward surrogate-aware robustness, structural defenses, and evaluation protocols that explicitly model zero-query threat assumptions [2510.00769][2203.15230][2406.19311][2601.21586][2602.00364][2504.13551].

Source: https://www.emergentmind.com/topics/zero-query-black-box-attacks