{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,2,20]],"date-time":"2026-02-20T11:48:34Z","timestamp":1771588114811,"version":"3.50.1"},"publisher-location":"New York, NY, USA","reference-count":85,"publisher":"ACM","license":[{"start":{"date-parts":[[2020,11,8]],"date-time":"2020-11-08T00:00:00Z","timestamp":1604793600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"name":"German Research Foundation (DFG)","award":["389792660 (TRR 248)"],"award-info":[{"award-number":["389792660 (TRR 248)"]}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2020,11,8]]},"DOI":"10.1145\/3368089.3409750","type":"proceedings-article","created":{"date-parts":[[2020,11,8]],"date-time":"2020-11-08T06:03:47Z","timestamp":1604815427000},"page":"800-812","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":29,"title":["DeepSearch: a simple and effective blackbox attack for deep neural networks"],"prefix":"10.1145","author":[{"given":"Fuyuan","family":"Zhang","sequence":"first","affiliation":[{"name":"MPI-SWS, Germany"}]},{"given":"Sankalan Pal","family":"Chowdhury","sequence":"additional","affiliation":[{"name":"MPI-SWS, Germany"}]},{"given":"Maria","family":"Christakis","sequence":"additional","affiliation":[{"name":"MPI-SWS, Germany"}]}],"member":"320","published-online":{"date-parts":[[2020,11,8]]},"reference":[{"key":"e_1_3_2_2_1_1","volume-title":"On the Robustness of the CVPR 2018 White-Box Adversarial Example Defenses. CoRR abs\/ 1804","author":"Athalye Anish","year":"2018"},{"key":"e_1_3_2_2_2_1","volume-title":"Wagner","author":"Athalye Anish","year":"2018"},{"key":"e_1_3_2_2_3_1","volume-title":"Barrett and Cesare Tinelli","author":"Clark","year":"2018"},{"key":"e_1_3_2_2_4_1","first-page":"2613","article-title":"Measuring Neural Net Robustness with Constraints","author":"Bastani Osbert","year":"2016","journal-title":"NIPS."},{"key":"e_1_3_2_2_5_1","volume-title":"ECCV (LNCS","author":"Bhagoji Arjun Nitin"},{"key":"e_1_3_2_2_6_1","unstructured":"Wieland Brendel Jonas Rauber and Matthias Bethge. 2018. Decision-Based Adversarial Attacks: Reliable Attacks Against Black-Box Machine Learning Models. In ICLR. OpenReview.net.  Wieland Brendel Jonas Rauber and Matthias Bethge. 2018. Decision-Based Adversarial Attacks: Reliable Attacks Against Black-Box Machine Learning Models. In ICLR. OpenReview.net."},{"key":"e_1_3_2_2_7_1","first-page":"4795","article-title":"A Unified View of Piecewise Linear Neural Network Verification","author":"Bunel Rudy","year":"2018","journal-title":"NeurIPS."},{"key":"e_1_3_2_2_8_1","volume-title":"On Evaluating Adversarial Robustness. CoRR abs\/","author":"Carlini Nicholas","year":"1902"},{"key":"e_1_3_2_2_9_1","volume-title":"Wagner","author":"Carlini Nicholas","year":"2016"},{"key":"e_1_3_2_2_10_1","volume-title":"Wagner","author":"Carlini Nicholas","year":"2017"},{"key":"e_1_3_2_2_11_1","volume-title":"Wagner","author":"Carlini Nicholas","year":"2017"},{"key":"e_1_3_2_2_12_1","first-page":"39","article-title":"Towards Evaluating the Robustness of Neural Networks","author":"Carlini Nicholas","year":"2017","journal-title":"S &P. IEEE Computer Society"},{"key":"e_1_3_2_2_13_1","first-page":"15","article-title":"ZOO: Zeroth Order Optimization Based Black-box Attacks to Deep Neural Networks Without Training Substitute Models. In AISec@CCS","author":"Chen Pin-Yu","year":"2017","journal-title":"ACM"},{"key":"e_1_3_2_2_14_1","doi-asserted-by":"crossref","unstructured":"Lori A. Clarke. 1976. A System to Generate Test Data and Symbolically Execute Programs. TSE 2 ( 1976 ) 215-222. Issue 3.  Lori A. Clarke. 1976. A System to Generate Test Data and Symbolically Execute Programs. TSE 2 ( 1976 ) 215-222. Issue 3.","DOI":"10.1109\/TSE.1976.233817"},{"key":"e_1_3_2_2_15_1","volume-title":"The Eficacy of SHIELD Under Diferent Threat Models. CoRR abs\/","author":"Cornelius Cory","year":"1902"},{"key":"e_1_3_2_2_16_1","first-page":"238","article-title":"Abstract Interpretation: A Unified Lattice Model for Static Analysis of Programs by Construction or Approximation of Fixpoints","author":"Cousot Patrick","year":"1977","journal-title":"POPL. ACM"},{"key":"e_1_3_2_2_17_1","volume-title":"NFM (LNCS","author":"Dutta Souradeep"},{"key":"e_1_3_2_2_18_1","volume-title":"A Dual Approach to Scalable Verification of Deep Networks","author":"Dvijotham Krishnamurthy"},{"key":"e_1_3_2_2_19_1","volume-title":"ATVA (LNCS","author":"Ehlers R\u00fcdiger"},{"key":"e_1_3_2_2_20_1","volume-title":"Evaluating and Understanding the Robustness of Adversarial Logit Pairing. CoRR abs\/","author":"Engstrom Logan","year":"1807"},{"key":"e_1_3_2_2_21_1","first-page":"3","article-title":"AI2: Safety and Robustness Certification of Neural Networks with Abstract Interpretation","author":"Gehr Timon","year":"2018","journal-title":"S &P. IEEE Computer Society"},{"key":"e_1_3_2_2_22_1","first-page":"213","article-title":"DART","author":"Godefroid Patrice","year":"2005","journal-title":"Directed Automated Random Testing. In PLDI. ACM"},{"key":"e_1_3_2_2_23_1","volume-title":"Deep Learning","author":"Goodfellow Ian"},{"key":"e_1_3_2_2_24_1","unstructured":"Ian J. Goodfellow Jonathon Shlens and Christian Szegedy. 2015. Explaining and Harnessing Adversarial Examples. In ICLR.  Ian J. Goodfellow Jonathon Shlens and Christian Szegedy. 2015. Explaining and Harnessing Adversarial Examples. In ICLR."},{"key":"e_1_3_2_2_25_1","volume-title":"Barrett","author":"Gopinath Divya","year":"2018"},{"key":"e_1_3_2_2_26_1","volume-title":"Symbolic Execution for Deep Neural Networks. CoRR abs\/","author":"Gopinath Divya","year":"1807"},{"key":"e_1_3_2_2_27_1","volume-title":"Andrew Gordon Wilson, and Kilian Q. Weinberger","author":"Guo Chuan","year":"2019"},{"key":"e_1_3_2_2_28_1","first-page":"739","article-title":"DLFuzz","author":"Guo Jianmin","year":"2018","journal-title":"Diferential Fuzzing Testing of Deep Learning Systems. In ESEC\/FSE. ACM"},{"key":"e_1_3_2_2_29_1","unstructured":"Warren He James Wei Xinyun Chen Nicholas Carlini and Dawn Song. 2017. Adversarial Example Defense: Ensembles of Weak Defenses Are Not Strong. In WOOT. USENIX.  Warren He James Wei Xinyun Chen Nicholas Carlini and Dawn Song. 2017. Adversarial Example Defense: Ensembles of Weak Defenses Are Not Strong. In WOOT. USENIX."},{"key":"e_1_3_2_2_30_1","doi-asserted-by":"crossref","unstructured":"Geofrey Hinton Li Deng Dong Yu George Dahl Abdel-rahman Mohamed Navdeep Jaitly Andrew Senior Vincent Vanhoucke Patrick Nguyen Tara Sainath and Brian Kingsbury. 2012. Deep Neural Networks for Acoustic Modeling in Speech Recognition. Signal Process. Mag. 29 ( 2012 ) 82-97. Issue 6.  Geofrey Hinton Li Deng Dong Yu George Dahl Abdel-rahman Mohamed Navdeep Jaitly Andrew Senior Vincent Vanhoucke Patrick Nguyen Tara Sainath and Brian Kingsbury. 2012. Deep Neural Networks for Acoustic Modeling in Speech Recognition. Signal Process. Mag. 29 ( 2012 ) 82-97. Issue 6.","DOI":"10.1109\/MSP.2012.2205597"},{"key":"e_1_3_2_2_31_1","volume-title":"CAV (LNCS","author":"Huang Xiaowei"},{"key":"e_1_3_2_2_32_1","first-page":"2142","volume-title":"ICML (PMLR","volume":"80","author":"Ilyas Andrew","year":"2018"},{"key":"e_1_3_2_2_33_1","volume-title":"Prior Convictions: Black-box Adversarial Attacks with Bandits and Priors. In ICLR.","author":"Ilyas Andrew","year":"2019"},{"key":"e_1_3_2_2_34_1","volume-title":"Kochenderfer","author":"Katz Guy","year":"2017"},{"key":"e_1_3_2_2_35_1","volume-title":"Barrett","author":"Katz Guy","year":"2019"},{"key":"e_1_3_2_2_36_1","first-page":"1039","article-title":"Guiding Deep Learning System Testing Using Surprise Adequacy","author":"Kim Jinhan","year":"2019","journal-title":"ICSE. IEEE Computer Society\/ACM"},{"key":"e_1_3_2_2_37_1","doi-asserted-by":"crossref","unstructured":"James C. King. 1976. Symbolic Execution and Program Testing. CACM 19 ( 1976 ) 385-394. Issue 7.  James C. King. 1976. Symbolic Execution and Program Testing. CACM 19 ( 1976 ) 385-394. Issue 7.","DOI":"10.1145\/360248.360252"},{"key":"e_1_3_2_2_39_1","volume-title":"Hinton","author":"Krizhevsky Alex","year":"2017"},{"key":"e_1_3_2_2_40_1","doi-asserted-by":"crossref","unstructured":"Alexey Kurakin Ian J. Goodfellow and Samy Bengio. 2017. Adversarial Examples in the Physical World. In ICLR. OpenReview.net.  Alexey Kurakin Ian J. Goodfellow and Samy Bengio. 2017. Adversarial Examples in the Physical World. In ICLR. OpenReview.net.","DOI":"10.1201\/9781351251389-8"},{"key":"e_1_3_2_2_41_1","volume-title":"Lax and Maria Shea Terrell","author":"Peter","year":"2014"},{"key":"e_1_3_2_2_42_1","first-page":"2278","article-title":"GradientBased Learning Applied to Document Recognition","author":"LeCun Yann","year":"1998","journal-title":"Proc. IEEE. IEEE Computer Society"},{"key":"e_1_3_2_2_43_1","first-page":"89","article-title":"Structural Coverage Criteria for Neural Networks Could Be Misleading. In ICSE (NIER)","author":"Li Zenan","year":"2019","journal-title":"IEEE Computer Society\/ACM"},{"key":"e_1_3_2_2_44_1","volume-title":"Kochenderfer","author":"Liu Changliu","year":"2019"},{"key":"e_1_3_2_2_45_1","unstructured":"Alessio Lomuscio and Lalit Maganti. 2017. An Approach to Reachability Analysis for Feed-Forward ReLU Neural Networks. CoRR abs\/1706.07351 ( 2017 ).  Alessio Lomuscio and Lalit Maganti. 2017. An Approach to Reachability Analysis for Feed-Forward ReLU Neural Networks. CoRR abs\/1706.07351 ( 2017 )."},{"key":"e_1_3_2_2_46_1","doi-asserted-by":"publisher","DOI":"10.1109\/DSN-W.2018.00065"},{"key":"e_1_3_2_2_47_1","first-page":"120","article-title":"DeepGauge","author":"Ma Lei","year":"2018","journal-title":"Multi-Granularity Testing Criteria for Deep Learning Systems. In ASE. ACM"},{"key":"e_1_3_2_2_48_1","volume-title":"Combinatorial Testing for Deep Learning Systems. CoRR abs\/","author":"Ma Lei","year":"1806"},{"key":"e_1_3_2_2_49_1","unstructured":"Aleksander Madry Aleksandar Makelov Ludwig Schmidt Dimitris Tsipras and Adrian Vladu. 2018. Towards Deep Learning Models Resistant to Adversarial Attacks. In ICLR. OpenReview.net.  Aleksander Madry Aleksandar Makelov Ludwig Schmidt Dimitris Tsipras and Adrian Vladu. 2018. Towards Deep Learning Models Resistant to Adversarial Attacks. In ICLR. OpenReview.net."},{"key":"e_1_3_2_2_50_1","unstructured":"Seungyong Moon Gaon An and Hyun Oh Song. 2019. Parsimonious Black-Box Adversarial Attacks via Eficient Combinatorial Optimization. In ICML. PMLR.  Seungyong Moon Gaon An and Hyun Oh Song. 2019. Parsimonious Black-Box Adversarial Attacks via Eficient Combinatorial Optimization. In ICML. PMLR."},{"key":"e_1_3_2_2_51_1","first-page":"2574","article-title":"DeepFool: A Simple and Accurate Method to Fool Deep Neural Networks","author":"Moosavi-Dezfooli Seyed-Mohsen","year":"2016","journal-title":"CVPR. IEEE Computer Society"},{"key":"e_1_3_2_2_52_1","volume-title":"Simple Black-Box Adversarial Attacks on Deep Neural Networks. In CVPR Workshops. IEEE Computer Society, 1310-1318","author":"Narodytska Nina","year":"2017"},{"key":"e_1_3_2_2_53_1","volume-title":"Reading Digits in Natural Images with Unsupervised Feature Learning. In NIPS Workshop on Deep Learning and Unsupervised Feature Learning.","author":"Netzer Yuval","year":"2011"},{"key":"e_1_3_2_2_54_1","volume-title":"Goodfellow","author":"Odena Augustus","year":"2019"},{"key":"e_1_3_2_2_55_1","volume-title":"Goodfellow","author":"Papernot Nicolas","year":"2016"},{"key":"e_1_3_2_2_56_1","first-page":"506","article-title":"Practical Black-Box Attacks Against Machine Learning","author":"Papernot Nicolas","year":"2017","journal-title":"AsiaCCS. ACM"},{"key":"e_1_3_2_2_57_1","first-page":"372","article-title":"The Limitations of Deep Learning in Adversarial Settings. In EuroS&P","author":"Papernot Nicolas","year":"2016","journal-title":"IEEE Computer Society"},{"key":"e_1_3_2_2_58_1","first-page":"1","article-title":"DeepXplore","author":"Pei Kexin","year":"2017","journal-title":"Automated Whitebox Testing of Deep Learning Systems. In SOSP. ACM"},{"key":"e_1_3_2_2_59_1","volume-title":"CAV (LNCS","author":"Pulina Luca"},{"key":"e_1_3_2_2_60_1","unstructured":"Aditi Raghunathan Jacob Steinhardt and Percy Liang. 2018. Certified Defenses Against Adversarial Examples. In ICLR. OpenReview.net.  Aditi Raghunathan Jacob Steinhardt and Percy Liang. 2018. Certified Defenses Against Adversarial Examples. In ICLR. OpenReview.net."},{"key":"e_1_3_2_2_61_1","doi-asserted-by":"crossref","unstructured":"Olga Russakovsky Jia Deng Hao Su Jonathan Krause Sanjeev Satheesh Sean Ma Zhiheng Huang Andrej Karpathy Aditya Khosla Michael Bernstein Alexander C. Berg and Fei-Fei Li. 2015. ImageNet Large Scale Visual Recognition Challenge. IJCV ( 2015 ) 211-252.  Olga Russakovsky Jia Deng Hao Su Jonathan Krause Sanjeev Satheesh Sean Ma Zhiheng Huang Andrej Karpathy Aditya Khosla Michael Bernstein Alexander C. Berg and Fei-Fei Li. 2015. ImageNet Large Scale Visual Recognition Challenge. IJCV ( 2015 ) 211-252.","DOI":"10.1007\/s11263-015-0816-y"},{"key":"e_1_3_2_2_62_1","unstructured":"Tim Salimans Jonathan Ho Xi Chen and Ilya Sutskever. 2017. Evolution Strategies as a Scalable Alternative to Reinforcement Learning. CoRR abs\/1703.03864 ( 2017 ).  Tim Salimans Jonathan Ho Xi Chen and Ilya Sutskever. 2017. Evolution Strategies as a Scalable Alternative to Reinforcement Learning. CoRR abs\/1703.03864 ( 2017 )."},{"key":"e_1_3_2_2_63_1","first-page":"85","article-title":"Towards Improved Testing for Deep Learning. In ICSE (NIER)","author":"Sekhon Jasmine","year":"2019","journal-title":"IEEE Computer Society\/ACM"},{"key":"e_1_3_2_2_64_1","first-page":"263","article-title":"CUTE","author":"Sen Koushik","year":"2005","journal-title":"A Concolic Unit Testing Engine for C. In ESEC\/FSE. ACM"},{"key":"e_1_3_2_2_65_1","volume-title":"Bypassing Feature Squeezing by Increasing Adversary Strength. CoRR abs\/","author":"Sharma Yash","year":"1803"},{"key":"e_1_3_2_2_66_1","volume-title":"Vechev","author":"Singh Gagandeep","year":"2019"},{"key":"e_1_3_2_2_67_1","doi-asserted-by":"crossref","unstructured":"James C. Spall. 1992. Multivariate Stochastic Approximation Using a Simultaneous Perturbation Gradient Approximation. TAC 37 ( 1992 ) 332-341. Issue 3.  James C. Spall. 1992. Multivariate Stochastic Approximation Using a Simultaneous Perturbation Gradient Approximation. TAC 37 ( 1992 ) 332-341. Issue 3.","DOI":"10.1109\/9.119632"},{"key":"e_1_3_2_2_68_1","volume-title":"Introduction to Stochastic Search and Optimization","author":"Spall James C."},{"key":"e_1_3_2_2_69_1","volume-title":"Testing Deep Neural Networks. CoRR abs\/","author":"Sun Youcheng","year":"1803"},{"key":"e_1_3_2_2_70_1","first-page":"109","article-title":"Concolic Testing for Deep Neural Networks","author":"Sun Youcheng","year":"2018","journal-title":"ASE. ACM"},{"key":"e_1_3_2_2_71_1","first-page":"2818","article-title":"Rethinking the Inception Architecture for Computer Vision","author":"Szegedy Christian","year":"2016","journal-title":"CVPR. IEEE Computer Society"},{"key":"e_1_3_2_2_72_1","unstructured":"Christian Szegedy Wojciech Zaremba Ilya Sutskever Joan Bruna Dumitru Erhan Ian J. Goodfellow and Rob Fergus. 2014. Intriguing Properties of Neural Networks. In ICLR.  Christian Szegedy Wojciech Zaremba Ilya Sutskever Joan Bruna Dumitru Erhan Ian J. Goodfellow and Rob Fergus. 2014. Intriguing Properties of Neural Networks. In ICLR."},{"key":"e_1_3_2_2_73_1","first-page":"303","article-title":"DeepTest","author":"Tian Yuchi","year":"2018","journal-title":"Automated Testing of Deep-Neural-Network-Driven Autonomous Cars. In ICSE. ACM"},{"key":"e_1_3_2_2_74_1","unstructured":"Vincent Tjeng Kai Y. Xiao and Russ Tedrake. 2019. Evaluating Robustness of Neural Networks with Mixed Integer Programming. In ICLR. OpenReview.net.  Vincent Tjeng Kai Y. Xiao and Russ Tedrake. 2019. Evaluating Robustness of Neural Networks with Mixed Integer Programming. In ICLR. OpenReview.net."},{"key":"e_1_3_2_2_75_1","first-page":"5032","article-title":"Adversarial Risk and the Dangers of Evaluating Against Weak Attacks. In ICML (PMLR, Vol. 80 )","author":"Uesato Jonathan","year":"2018","journal-title":"PMLR"},{"key":"e_1_3_2_2_76_1","first-page":"1599","article-title":"Formal Security Analysis of Neural Networks Using Symbolic Intervals. In Security","author":"Wang Shiqi","year":"2018","journal-title":"USENIX"},{"key":"e_1_3_2_2_77_1","first-page":"5273","article-title":"Towards Fast Computation of Certified Robustness for ReLU Networks. In ICML (PMLR, Vol. 80 )","author":"Weng Tsui-Wei","year":"2018","journal-title":"PMLR"},{"key":"e_1_3_2_2_78_1","volume-title":"TACAS (LNCS","author":"Wicker Matthew"},{"key":"e_1_3_2_2_79_1","first-page":"5283","article-title":"Provable Defenses Against Adversarial Examples via the Convex Outer Adversarial Polytope. In ICML (PMLR, Vol. 80 )","author":"Wong Eric","year":"2018","journal-title":"PMLR"},{"key":"e_1_3_2_2_80_1","volume-title":"Johnson","author":"Xiang Weiming","year":"2017"},{"key":"e_1_3_2_2_81_1","volume-title":"Johnson","author":"Xiang Weiming","year":"2018"},{"key":"e_1_3_2_2_82_1","first-page":"146","article-title":"DeepHunter","author":"Xie Xiaofei","year":"2019","journal-title":"In ISSTA. ACM"},{"key":"e_1_3_2_2_83_1","doi-asserted-by":"crossref","unstructured":"Sergey Zagoruyko and Nikos Komodakis. 2016. Wide Residual Networks. In BMVC.  Sergey Zagoruyko and Nikos Komodakis. 2016. Wide Residual Networks. In BMVC.","DOI":"10.5244\/C.30.87"},{"key":"e_1_3_2_2_84_1","volume-title":"Sankalan Pal Chowdhury, and Maria Christakis","author":"Zhang Fuyuan","year":"2020"},{"key":"e_1_3_2_2_85_1","volume-title":"Machine Learning Testing: Survey, Landscapes and Horizons. CoRR abs\/","author":"Zhang Jie M.","year":"1906"},{"key":"e_1_3_2_2_86_1","first-page":"132","article-title":"DeepRoad","author":"Zhang Mengshi","year":"2018","journal-title":"In ASE. ACM"}],"event":{"name":"ESEC\/FSE '20: 28th ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering","location":"Virtual Event USA","acronym":"ESEC\/FSE '20","sponsor":["SIGSOFT ACM Special Interest Group on Software Engineering"]},"container-title":["Proceedings of the 28th ACM Joint Meeting on European Software Engineering Conference and Symposium on the Foundations of Software Engineering"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3368089.3409750","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3368089.3409750","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,17]],"date-time":"2025-06-17T22:01:57Z","timestamp":1750197717000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3368089.3409750"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2020,11,8]]},"references-count":85,"alternative-id":["10.1145\/3368089.3409750","10.1145\/3368089"],"URL":"https:\/\/doi.org\/10.1145\/3368089.3409750","relation":{},"subject":[],"published":{"date-parts":[[2020,11,8]]},"assertion":[{"value":"2020-11-08","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}