Pith. sign in

REVIEW 3 major objections 7 minor 50 references

Improving Transferable Targeted Attacks with Feature Tuning Mixup

T0 review · 3 major / 7 minor · reviewed 2026-08-12 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Feature Tuning Mixup (FTM) learns attack-specific noise inside a surrogate's feature layers and shows it yields targeted adversarial examples that transfer to unseen models substantially better than clean-feature mixup, at near-baseline…

desk verdict Solid incremental attack paper with a consistent win over CFM, but the missing random-perturbation control leaves the headline mechanism under-supported. read the letter →

arxiv 2411.15553 v2 pith:XL47POS5 submitted 2024-11-23 cs.CV

Kaisheng Liang , Xuelong Dai , Yanjie Li , Dong Wang , Bin Xiao This is my paper · ORCID
classification cs.CV
keywords transferabletargetedattacksfeature-levelaugmentationlearnablefeatureperturbationsmomentum-basedstochasticupdatecleanmixupadversarialtransferabilityblack-boxImageNet
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Transferable targeted attacks ask an attacker to craft an image perturbation on a model it controls, called the surrogate, that will make a completely different, unseen model output a chosen wrong label; the difficulty is that optimizations tuned on the surrogate tend to overfit it and fail elsewhere. The paper argues that the right place to intervene is the surrogate's internal feature layers: instead of mixing in random clean features only, as the Clean Feature Mixup (CFM) baseline does, the attacker should also learn attack-specific feature perturbations that make the crafted image survive feature-level disturbance. The proposed method, Feature Tuning Mixup (FTM), pairs a min-max objective over the image and the feature perturbations with a momentum-based stochastic update, so the extra optimization costs only a single forward-backward pass per attack iteration. In the paper's experiments on CNN and transformer targets, FTM raises targeted transfer success over CFM by about three to twelve percentage points while adding roughly eleven percent to per-image computation time. If the claim holds, black-box targeted attacks become materially stronger at nearly the same cost, and feature-space tuning becomes a viable alternative to image-space augmentation for attack transferability.

What carries the argument

The load-bearing object is the learnable feature perturbation $\Delta z_{k,i}$ attached to the output of layer $k$ at attack iteration $i$, optimized by what the paper calls a momentum-based stochastic update. Each eligible layer's output is first rebalanced as $\bar{z}_{k,i} = z_{k,i} + \beta\|z_{k,i}\| \cdot \Delta z_{k,i}/(\|\Delta z_{k,i}\| + \bar{\epsilon})$, so the learned noise is scaled to the layer's typical output magnitude, and then mixed with a random clean feature under a channel-wise ratio $\alpha$ sampled from $U(0, 0.75)$; eligible layers are those whose feature maps are at most a sixteenth of the image size (for a pure ViT, all fully-connected layer outputs). The update rule initializes each perturbation from its previous-iteration value, applies a single gradient-ascent step on the adversarial loss, and stochastically updates only the layers with $\tau_k < p$ ($p=0.1$), leaving the rest unchanged. This one mechanism supplies the attack-specific optimization that distinguishes FTM from CFM, confines the extra cost to a single joint forward-backward pass, and sets how aggressively the surrogate's feature geometry is disturbed per iteration.

What would settle it

Two concrete tests would settle the claim. First, rerun the attack with the momentum chain broken: reset $\Delta z$ to zero at the start of every iteration (or initialize it with fresh random noise) while keeping the one-step update; if transfer success falls back to CFM's level, the momentum-seeded maximization, not the mere presence of learned noise, is what carries the gain. Second, test transfer to a target whose training data shares no classes (or no encoder) with ImageNet, or to an adversarially robust target model; the paper's mechanism predicts FTM's advantage over CFM should persist under such a shift, whereas if the advantage vanishes, the learned perturbations are overfit to the surrogate's feature space. A cheaper corroborating check is to double or halve the inner step count and confirm that success rises only mildly, which would indicate the one-step approximation is near the optimum the paper assumes.

Watch

Extended reading notes

Core claim

The central claim is that targeted transfer attacks improve when the surrogate's feature space is disturbed not only by random clean features, as in Clean Feature Mixup (CFM), but by learnable perturbations optimized against the attack's own loss. FTM turns each attack iteration into a min-max problem: minimize the target-class loss over the adversarial image while maximizing it over feature perturbations added to the outputs of eligible layers. To make this tractable, the previous iteration's perturbations seed a single gradient-ascent step, and only a randomly chosen fraction of layers is updated per iteration, so the image gradient and the perturbation gradients come from one forward-backward pass. The perturbed feature is a scale-normalized blend of the layer output and the learned noise, further mixed with a random clean feature under a per-channel ratio. On the ImageNet-compatible benchmark, FTM and its two-copy ensemble FTM-E beat CFM on nearly every target model: with Inc-v3 as the surrogate, average success over ten CNN targets rises from 39.2% with CFM to 42.4% with FTM and 51.2% with FTM-E, and over five transformer targets from 8.9% to 11.5% and 15.3%; with RN-50, CNN averages rise from 74.6% to 77.4% and 79.5%. The paper also shows FTM combines with scale-invariant and Admix augmentations and with surrogate ensembles, and reports in its supplementary evaluation that FTM-E examples crafted on a ViT succeed, on average, 40.5% of the time against four commercial multimodal language models.

Load-bearing premise

The load-bearing premise is that a single gradient-ascent step per attack iteration, seeded by the previous iteration's perturbations, finds feature noise that genuinely helps the attack transfer to unseen models rather than noise that merely fits the surrogate's own feature geometry; the paper gives no convergence or generalization argument for this step. Its own ablations mark the boundary of that premise: at $p=1.0$, where every layer's perturbation is updated, the clean accuracy of the perturbed surrogate collapses to 3.8% and attack success collapses with it, so the scheme works only while the one-step updates keep the surrogate in a usable regime.

Editorial extensions

If this is right

  • On the paper's benchmark, RDI-FTM and RDI-FTM-E raise average targeted transfer success over CFM by about three to twelve percentage points, with the largest gains on the hardest targets: from Inc-v3, IR-v2 rises from 36.2% to 52.4% and Inc-v4 from 44.8% to 59.2% with the ensemble.
  • The gains extend to transformer-based targets: with RN-50 as surrogate, FTM-E lifts the average transformer success rate from 21.8% with CFM to 29.8%, and with Inc-v3 from 8.9% to 15.3%.
  • The cost stays close to the baseline: RDI-FTM needs about 1.54 seconds per image versus CFM's 1.39 seconds, far below multi-pass methods such as SI (5.95 s) or VT (7.16 s), so the improvement is nearly free relative to augmentation-heavy alternatives.
  • FTM composes with existing augmentation and ensemble techniques, reaching the paper's best reported result of 74.5% average success when RDI-SI-FTM-E is run with a surrogate that is itself an ensemble of RN-50 and Inc-v3.
  • The mechanism transfers beyond classifiers in the paper's supplementary evaluation: targeted examples crafted with RDI-FTM-E on a ViT succeed on average 40.5% of the time against four commercial multimodal language models.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If the mechanism works by tracking the direction in which the surrogate's feature geometry is most fragile, the same learned-noise recipe could strengthen non-targeted transfer attacks and universal perturbations, since that fragility direction is likely not specific to the target label; the paper does not test either setting.
  • The method's regime boundary, reported in the paper itself, suggests a testable link: the transfer gain may depend on keeping the perturbed surrogate a functional classifier, so success should correlate with the surrogate's clean accuracy under perturbation rather than with the raw magnitude of the learned noise.
  • The multimodal LLM results hint that feature-space tuning transfers across model families once a vision encoder is shared; a natural extension would test whether perturbations optimized on one vision backbone succeed against LLMs with different backbones, and whether the same idea works in text or audio feature spaces.
  • A defensive counterpart follows inversely: if the attack's leverage is the surrogate's feature geometry, then training procedures that flatten or smooth the feature space of deployed models should specifically blunt transfer-based targeted attacks, making the inner maximization in the attack's objective harder; this is an inference about defense, not something the paper evaluates.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 7 minor

Summary. FTM (Feature Tuning Mixup) extends the Clean Feature Mixup (CFM) targeted-transfer attack by adding learnable, attack-specific perturbations to intermediate layer features. The perturbations are normalized by β‖z‖, mixed with random clean features in selected layers, and updated by one-step gradient ascent with momentum and a stochastic layer-selection schedule (Eqs. 10–15, Algorithm 1). An ensemble variant FTM-E averages (or otherwise combines) two independently perturbed surrogate models. Experiments on the 1,000-image ImageNet-compatible benchmark across CNN and ViT target models report consistent success-rate gains over CFM (e.g., RDI-FTM vs. RDI-CFM: 77.4 vs. 74.6 for RN-50 source; 42.4 vs. 39.2 for Inc-v3 source; larger gains for FTM-E), with modest computational overhead. Ablations analyze the stability of β, the layer-update probability p, the clean-feature mixing range αmax, and the effect of removing clean features.

Significance. If the reported gains are robust, FTM is a simple and generally applicable enhancement for targeted transfer attacks: it is the first method to combine optimized feature-space perturbations with clean feature mixup, it works across CNN and ViT surrogates and targets, and it adds only about 10% per-image overhead over CFM (1.54s vs. 1.39s on RN-50). The authors release code, evaluate on a large model zoo (Tables 1–3 and supplementary Tables 6–9), and include additional experiments on surrogate diversity and multimodal LLM targets. The main caveat is that the evidence for the central mechanism is not yet conclusive: no control separates the optimization of the feature perturbation from the extra stochasticity it introduces, and the single-FTM margins over CFM are small relative to the binomial noise floor of the evaluation set. FTM-E's larger margins are encouraging, but the significance claim for FTM itself would be strengthened by repeated runs and a random-perturbation control.

major comments (3)
  1. [Section 3.3, Eqs. (10)–(15), and Figure 6] The paper attributes FTM's improvements to attack-specific optimized feature perturbations, but no experiment isolates the optimization step. FTM differs from CFM by adding a persistent, normalized perturbation Δz updated by gradient ascent (Eq. 15) together with a stochastic layer schedule; a control using fixed random perturbations with the same normalization and the same layer-selection schedule, but with no gradient update, would determine whether the optimization itself causes the gains or whether the improvement comes from the added stochasticity/regularization alone. The existing ablation in Figure 6 (with vs. without clean features) does not address this, because both variants use the optimized perturbation.
  2. [Section 4.2, Tables 1–3] All reported success rates are single numbers without error bars, confidence intervals, or significance tests. With 1,000 images, the binomial standard error at success rates around 40–75% is roughly 1.5–1.8 percentage points, so the single-FTM margins over CFM (e.g., 77.4 vs. 74.6 in Table 1 for RN-50 source; 42.4 vs. 39.2 for Inc-v3 source; 68.3 vs. 65.2 for RDI-FTM vs. RDI-CFM in Table 3) are close to the noise floor. FTM-E's larger margins are more convincing, but the abstract's blanket claim of 'significant improvements' for FTM itself requires repeated runs (e.g., different random seeds and layer-selection randomizations) or a statistical test.
  3. [Section 4.3, Figures 4–6] The hyperparameters β=0.01, p=0.1, and αmax=0.75 are selected via ablations on the same evaluation benchmark that is used to report the final success rates. Because the averages include the target models used for tuning, the reported absolute gains may be optimistic. A validation-based selection procedure or a sensitivity analysis on a held-out set of target models would strengthen the claim that FTM's improvement is not an artifact of tuning on the evaluation benchmark.
minor comments (7)
  1. [Eq. (11), Algorithm 1] When Δz_{k,i} is initialized to zero (Algorithm 1, line 2), the normalized term Δz_{k,i}/‖Δz_{k,i}‖ is undefined; please specify the convention (e.g., treat the term as zero when ‖Δz_{k,i}‖=0).
  2. [Section 4.2, Computational overhead] The sentence 'we report their costs in Table 2' appears to refer to the wrong table; computation times are reported in Tables 1–3 and in the supplementary tables.
  3. [Section 3.3] There is a typo in 'without increaseing additional optimization steps' ('increaseing' should be 'increasing').
  4. [Section 4.1, Settings for our FTM] For a pure ViT surrogate, 'we select the outputs of all fully-connected layers' is ambiguous because ViT blocks do not have fully-connected layers in the usual convolutional sense; please specify the exact layer selection procedure for ViT.
  5. [Figure 6 (left)] The axes of the left heatmap are not labeled; please state clearly which axis is p and which is αmax, and consider reporting the exact success-rate values in the caption or text.
  6. [Section 3.3, FTM-E] The ensemble operation in FTM-E is not defined; please specify how the two perturbed surrogate copies are combined (e.g., averaging the output logits of the two copies).
  7. [Supplementary Section A.5] The heading 'Visualization of targetd adversarial examples' contains a typo ('targetd' should be 'targeted').

Circularity Check

0 steps flagged · score 1.0 of 10

No significant circularity: FTM is an empirical attack method whose gains are measured on independent black-box target models, not derived from its own optimized quantities.

full rationale

The paper's central mechanism in Section 3.3 (Equations 10-15) is an algorithmic optimization loop, not a fitted quantity renamed as a prediction. The learnable feature perturbation Δz is updated by one-step gradient ascent on the surrogate attack loss during each attack iteration, and the adversarial image is updated with the resulting gradient; the evaluation then measures transfer success on target models that are not used in that optimization. The comparison to CFM is against an independent prior method, and the reported gains are empirical, not forced by construction. The only mild concerns are that hyperparameters β, p, and αmax are selected via ablations (Figure 4 and Figure 6) on the same ImageNet-compatible benchmark used for the main tables, and that no ablation isolates the learned perturbation from a fixed random perturbation of equal magnitude. These are experimental-design or benchmark-selection issues that affect how strongly the empirical claim is supported; they do not make the reported success rates equivalent to the method's inputs by definition. The paper's self-citations ([7], [27], [28]) appear only in related-work context and are not load-bearing for the main claim.

Assumptions & free parameters 5 free parameters · 5 assumptions · 0 invented entities

FTM introduces no new physical or architectural entity; its new ingredients are learnable feature perturbations, which are optimization variables rather than invented entities. The free parameters are all chosen by hand or by ablation on the evaluation benchmark, and the main axioms are domain assumptions inherited from transfer-attack literature plus two ad hoc algorithmic choices: the perturbation scaling in Equation (11) and the one-step momentum update for the inner maximization.

free parameters (5)
  • beta (feature perturbation scaling factor) = 0.01
    Hand-tuned; ablation in Figure 4 shows stable success rates for beta below 0.02 and a sharp drop above 0.04.
  • p (layer update probability) = 0.1
    Selected via ablation in Figure 6; larger p values degrade clean accuracy of the perturbed surrogate when clean feature mixup is used.
  • alpha_max (max clean-feature mixing ratio) = 0.75
    Selected via the grid in Figure 6 together with p; the paper reports optimal performance at p=0.1, alpha_max=0.75.
  • number of perturbed models in FTM-E = 2
    Chosen for computational cost; Figure 5 shows performance increasing with ensemble size but the paper fixes the count at 2 for all reported experiments.
  • layer selection threshold = feature map size <= 1/16 of image size
    Design choice following CFM to avoid shallow layers; a modeling decision that affects which features are perturbed.
assumptions (5)
  • domain assumption Pre-trained ImageNet models share transferable decision geometry, so surrogate-derived perturbations transfer to black-box targets.
    The entire transfer-attack framework, including the problem formulation in Section 3.1, assumes gradients from the surrogate are useful for unseen target models.
  • domain assumption The logit loss is an effective loss for targeted transfer attacks.
    Adopted from Zhao et al. (2021) and used for all methods, as stated in Section 4.1.
  • ad hoc to paper Adding a normalized feature perturbation scaled by beta preserves the surrogate's utility while disrupting the adversarial loss.
    The perturbation form in Equation (11) is a design choice validated only empirically in Figure 4, with no theoretical justification.
  • ad hoc to paper One-step gradient ascent with momentum solves the inner maximization in Equation (10).
    Section 3.3 proposes the momentum-based stochastic update but provides no convergence or optimality argument for the approximation.
  • domain assumption Random clean feature mixup suppresses adversarial effects as claimed by CFM.
    Equation (9) quotes CFM's rationale, and FTM builds on that mechanism instead of re-deriving it.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Improving Transferable Targeted Attacks with Feature Tuning Mixup." pith.science (2026). https://pith.science/paper/XL47POS5

@misc{pith2026241115553,
  author       = {Pith},
  title        = {Pith review of: Improving Transferable Targeted Attacks with Feature Tuning Mixup},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/XL47POS5}},
  note         = {Machine review of arXiv:2411.15553}
}
read the original abstract

Deep neural networks (DNNs) exhibit vulnerability to adversarial examples that can transfer across different DNN models. A particularly challenging problem is developing transferable targeted attacks that can mislead DNN models into predicting specific target classes. While various methods have been proposed to enhance attack transferability, they often incur substantial computational costs while yielding limited improvements. Recent clean feature mixup methods use random clean features to perturb the feature space but lack optimization for disrupting adversarial examples, overlooking the advantages of attack-specific perturbations. In this paper, we propose Feature Tuning Mixup (FTM), a novel method that enhances targeted attack transferability by combining both random and optimized noises in the feature space. FTM introduces learnable feature perturbations and employs an efficient stochastic update strategy for optimization. These learnable perturbations facilitate the generation of more robust adversarial examples with improved transferability. We further demonstrate that attack performance can be enhanced through an ensemble of multiple FTM-perturbed surrogate models. Extensive experiments on the ImageNet-compatible dataset across various DNN models demonstrate that our method achieves significant improvements over state-of-the-art methods while maintaining low computational cost.

Figures

Figures reproduced from arXiv: 2411.15553 by the authors.

Figure 1
Figure 1. Effectiveness and efficiency of targeted attacks. Av￾erage attack success rates on 14 black-box models, along with the computation time required to generate an adversarial example. Our methods demonstrate superior performance with low compu￾tational cost, surpassing state-of-the-art methods. ferability properties: adversarial examples generated using one white-box model can successfully fool other black-box models w… view at source ↗
Figure 2
Figure 2. Overview of our FTM attack. In the forward pass, the learnable perturbations are added to the output features. Only a small [PITH_FULL_IMAGE:figures/full_fig_p002_2.png] view at source ↗
Figure 4
Figure 4. Attack success rates with different mixing ratio [PITH_FULL_IMAGE:figures/full_fig_p007_4.png] view at source ↗
Figures from the paper (5 more)
Figure 3
Figure 3. Figure 3: Targeted attack success rates (%) based on the number [PITH_FULL_IMAGE:figures/full_fig_p007_3.png]
Figure 5
Figure 5. Figure 5: Attack performance and computational costs with differ [PITH_FULL_IMAGE:figures/full_fig_p008_5.png]
Figure 6
Figure 6. Figure 6: Left: Attack success rates vs. p and αmax. Right: Attack success rates vs. p with/without clean features; The blue line is the success rates when the clean features from CFM are integrated with our FTM, while the orange line represents only using our learnable perturba…
Figure 7
Figure 7. Figure 7: Visualization of targeted adversarial examples generated by different attack methods. The surrogate model used for attack [PITH_FULL_IMAGE:figures/full_fig_p014_7.png]
Figure 8
Figure 8. Figure 8: Visualization of targeted adversarial examples generated by different attack methods. The surrogate model used for attack [PITH_FULL_IMAGE:figures/full_fig_p015_8.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

50 extracted references · 44 canonical work pages

  1. [1]

    Decision-based adversarial attacks: Reliable attacks against black-box machine learning models

    Wieland Brendel, Jonas Rauber, and Matthias Bethge. Decision-based adversarial attacks: Reliable attacks against black-box machine learning models. In ICLR, 2018. 2

    work page 2018

  2. [2]

    Improving the transferabil- ity of targeted adversarial examples through object-based di- verse input

    Junyoung Byun, Seungju Cho, Myung-Joon Kwon, Hee- Seon Kim, and Changick Kim. Improving the transferabil- ity of targeted adversarial examples through object-based di- verse input. In CVPR, 2022. 1, 3, 5, 6

    work page 2022

  3. [3]

    Introducing competition to boost the transferability of targeted adversarial examples through clean feature mixup

    Junyoung Byun, Myung-Joon Kwon, Seungju Cho, Yoonji Kim, and Changick Kim. Introducing competition to boost the transferability of targeted adversarial examples through clean feature mixup. In CVPR, 2023. 1, 3, 4, 5, 6

    work page 2023

  4. [4]

    Towards evaluating the robustness of neural networks

    Nicholas Carlini and David Wagner. Towards evaluating the robustness of neural networks. In IEEE Symposium on Secu- rity and Privacy (SP), 2017. 2

    work page 2017

  5. [5]

    Xception: Deep learning with depthwise separable convolutions

    Francois Chollet. Xception: Deep learning with depthwise separable convolutions. In CVPR, 2017. 6

    work page 2017

  6. [6]

    Twins: Revisiting the design of spatial attention in vision transformers

    Xiangxiang Chu, Zhi Tian, Yuqing Wang, Bo Zhang, Haib- ing Ren, Xiaolin Wei, Huaxia Xia, and Chunhua Shen. Twins: Revisiting the design of spatial attention in vision transformers. In NeurIPS, 2021. 6

    work page 2021

  7. [7]

    Advdiff: Generating unrestricted adversarial examples using diffusion models

    Xuelong Dai, Kaisheng Liang, and Bin Xiao. Advdiff: Generating unrestricted adversarial examples using diffusion models. In ECCV, 2024. 2

    2024

  8. [8]

    Leavitt, Ari S

    St ´ephane d’Ascoli, Hugo Touvron, Matthew L. Leavitt, Ari S. Morcos, Giulio Biroli, and Levent Sagun. Convit: Im- proving vision transformers with soft convolutional induc- tive biases. In ICML, 2021. 6

    work page 2021

Show all 50 references
  1. [9]

    Boosting adversarial at- tacks with momentum

    Yinpeng Dong, Fangzhou Liao, Tianyu Pang, Hang Su, Jun Zhu, Xiaolin Hu, and Jianguo Li. Boosting adversarial at- tacks with momentum. In CVPR, 2018. 1, 2, 3, 4, 6

    2018

  2. [10]

    Evading defenses to transferable adversarial examples by translation-invariant attacks

    Yinpeng Dong, Tianyu Pang, Hang Su, and Jun Zhu. Evading defenses to transferable adversarial examples by translation-invariant attacks. In CVPR, 2019. 1, 3, 6

    2019

  3. [11]

    An image is worth 16x16 words: Transformers for image recognition at scale

    Alexey Dosovitskiy, Lucas Beyer, Alexander Kolesnikov, Dirk Weissenborn, Xiaohua Zhai, Thomas Unterthiner, Mostafa Dehghani, Matthias Minderer, Georg Heigold, Syl- vain Gelly, Jakob Uszkoreit, and Neil Houlsby. An image is worth 16x16 words: Transformers for image recognition ...

    2021

  4. [12]

    Robust physical-world attacks on deep learning visual classification

    Kevin Eykholt, Ivan Evtimov, Earlence Fernandes, Bo Li, Amir Rahmati, Chaowei Xiao, Atul Prakash, Tadayoshi Kohno, and Dawn Song. Robust physical-world attacks on deep learning visual classification. In CVPR, 2018. 2

    2018

  5. [13]

    Goodfellow, Jonathon Shlens, and Christian Szegedy

    Ian J. Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. In ICLR,

  6. [14]

    Levit: a vision transformer in convnet’s clothing for faster inference

    Benjamin Graham, Alaaeldin El-Nouby, Hugo Touvron, Pierre Stock, Armand Joulin, Herv ´e J ´egou, and Matthijs Douze. Levit: a vision transformer in convnet’s clothing for faster inference. In ICCV, 2021. 6

    2021

  7. [15]

    Deep residual learning for image recognition

    Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In CVPR,

  8. [16]

    Rethinking spa- tial dimensions of vision transformers

    Byeongho Heo, Sangdoo Yun, Dongyoon Han, Sanghyuk Chun, Junsuk Choe, and Seong Joon Oh. Rethinking spa- tial dimensions of vision transformers. In ICCV, 2021. 6

    2021

  9. [17]

    Densely connected convolutional net- works

    Gao Huang, Zhuang Liu, Laurens Van Der Maaten, and Kil- ian Q Weinberger. Densely connected convolutional net- works. In CVPR, 2017. 6

    2017

  10. [18]

    Belongie, and Ser-Nam Lim

    Qian Huang, Isay Katsman, Zeqi Gu, Horace He, Serge J. Belongie, and Ser-Nam Lim. Enhancing adversarial example transferability with an intermediate level attack. In ICCV,

  11. [19]

    Adversar- ial examples are not bugs, they are features

    Andrew Ilyas, Shibani Santurkar, Dimitris Tsipras, Logan Engstrom, Brandon Tran, and Aleksander Madry. Adversar- ial examples are not bugs, they are features. In NeurIPS,

  12. [20]

    Feature space perturbations yield more transferable adversarial examples

    Nathan Inkawhich, Wei Wen, Hai (Helen) Li, and Yiran Chen. Feature space perturbations yield more transferable adversarial examples. In CVPR, 2019. 3

    2019

  13. [21]

    Liang, Lawrence Carin, and Yi- ran Chen

    Nathan Inkawhich, Kevin J. Liang, Lawrence Carin, and Yi- ran Chen. Transferable perturbations of deep feature distri- butions. In ICLR, 2020. 3

    2020

  14. [22]

    Liang, Binghui Wang, Matthew Inkawhich, Lawrence Carin, and Yiran Chen

    Nathan Inkawhich, Kevin J. Liang, Binghui Wang, Matthew Inkawhich, Lawrence Carin, and Yiran Chen. Perturbing across the feature hierarchy to improve standard and strict blackbox attack transferability. In NeurIPS, 2020. 3

    2020

  15. [23]

    Goodfellow, and Samy Bengio

    Alexey Kurakin, Ian J. Goodfellow, and Samy Bengio. Ad- versarial examples in the physical world. In ICLR (Work- shop), 2017. 1, 3

    2017

  16. [24]

    Towards transferable targeted attack

    Maosen Li, Cheng Deng, Tengjiao Li, Junchi Yan, Xinbo Gao, and Heng Huang. Towards transferable targeted attack. In CVPR, 2020. 3

    2020

  17. [25]

    Yet another intermediate-level attack

    Qizhang Li, Yiwen Guo, and Hao Chen. Yet another intermediate-level attack. In ECCV, 2020. 3

    2020

  18. [26]

    Physical-world optical adversarial attacks on 3d face recognition

    Yanjie Li, Yiquan Li, Xuelong Dai, Songtao Guo, and Bin Xiao. Physical-world optical adversarial attacks on 3d face recognition. In CVPR, 2023. 2

    2023

  19. [27]

    UV-attack: Physical-world adversarial attacks on person detection via dynamic-NeRF-based UV mapping

    Yanjie Li, Kaisheng Liang, and Bin Xiao. UV-attack: Physical-world adversarial attacks on person detection via dynamic-NeRF-based UV mapping. In ICLR, 2025. 2

    2025

  20. [28]

    Styless: Boosting the trans- ferability of adversarial examples

    Kaisheng Liang and Bin Xiao. Styless: Boosting the trans- ferability of adversarial examples. In CVPR, 2023. 2

    2023

  21. [29]

    Hopcroft

    Jiadong Lin, Chuanbiao Song, Kun He, Liwei Wang, and John E. Hopcroft. Nesterov accelerated gradient and scale invariance for adversarial attacks. In ICLR, 2020. 1, 3, 6

    2020

  22. [30]

    Delving into transferable adversarial examples and black- box attacks

    Yanpei Liu, Xinyun Chen, Chang Liu, and Dawn Song. Delving into transferable adversarial examples and black- box attacks. In ICLR, 2017. 3, 7

    2017

  23. [31]

    Towards deep learning models resistant to adversarial attacks

    Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. In ICLR, 2018. 1, 2, 5

    2018

  24. [32]

    On generating trans- ferable targeted perturbations

    Muzammal Naseer, Salman Khan, Munawar Hayat, Fa- had Shahbaz Khan, and Fatih Porikli. On generating trans- ferable targeted perturbations. In ICCV, 2021. 3

    2021

  25. [33]

    Boosting the transferability of ad- versarial attacks with reverse adversarial perturbation

    Zeyu Qin, Yanbo Fan, Yi Liu, Li Shen, Yong Zhang, Jue Wang, and Baoyuan Wu. Boosting the transferability of ad- versarial attacks with reverse adversarial perturbation. In NeurIPS, 2022. 3, 8

    2022

  26. [34]

    Mobilenetv2: Inverted residuals and linear bottlenecks

    Mark Sandler, Andrew Howard, Menglong Zhu, Andrey Zh- moginov, and Liang-Chieh Chen. Mobilenetv2: Inverted residuals and linear bottlenecks. In CVPR, 2018. 6 9

    2018

  27. [35]

    Very deep convo- lutional networks for large-scale image recognition

    Karen Simonyan and Andrew Zisserman. Very deep convo- lutional networks for large-scale image recognition. InICLR,

  28. [36]

    Rethinking the in- ception architecture for computer vision

    Christian Szegedy, Vincent Vanhoucke, Sergey Ioffe, Jonathon Shlens, and Zbigniew Wojna. Rethinking the in- ception architecture for computer vision. In CVPR, 2016. 6

    2016

  29. [37]

    Christian Szegedy, Sergey Ioffe, Vincent Vanhoucke, and Alexander A. Alemi. Inception-v4, inception-resnet and the impact of residual connections on learning. In AAAI, 2017. 6

    2017

  30. [38]

    Mingxing Tan and Quoc V . Le. Efficientnet: Rethinking model scaling for convolutional neural networks. In ICML,

  31. [39]

    Enhancing the transferability of adversarial attacks through variance tuning

    Xiaosen Wang and Kun He. Enhancing the transferability of adversarial attacks through variance tuning. In CVPR, 2021. 1, 3, 6

    2021

  32. [40]

    Admix: Enhancing the transferability of adversarial attacks

    Xiaosen Wang, Xuanran He, Jingdong Wang, and Kun He. Admix: Enhancing the transferability of adversarial attacks. In ICCV, 2021. 1, 3, 6

    2021

  33. [41]

    Feature importance-aware transfer- able adversarial attacks

    Zhibo Wang, Hengchang Guo, Zhifei Zhang, Wenxin Liu, Zhan Qin, and Kui Ren. Feature importance-aware transfer- able adversarial attacks. In ICCV, 2021. 3

    2021

  34. [42]

    Towards trans- ferable targeted adversarial examples

    Zhibo Wang, Hongshan Yang, Yunhe Feng, Peng Sun, Hengchang Guo, Zhifei Zhang, and Kui Ren. Towards trans- ferable targeted adversarial examples. In CVPR, 2023. 3

    2023

  35. [43]

    Enhancing the self-universality for transferable tar- geted attacks

    Zhipeng Wei, Jingjing Chen, Zuxuan Wu, and Yu-Gang Jiang. Enhancing the self-universality for transferable tar- geted attacks. In CVPR, 2023. 1, 3, 5, 6

    2023

  36. [44]

    Skip connections matter: On the transferability of adversarial examples generated with resnets

    Dongxian Wu, Yisen Wang, Shu-Tao Xia, James Bailey, and Xingjun Ma. Skip connections matter: On the transferability of adversarial examples generated with resnets. In ICLR,

  37. [45]

    Im- proving the transferability of adversarial samples with adver- sarial transformations

    Weibin Wu, Yuxin Su, Michael R Lyu, and Irwin King. Im- proving the transferability of adversarial samples with adver- sarial transformations. In CVPR, 2021. 3

    2021

  38. [46]

    Cihang Xie, Zhishuai Zhang, Yuyin Zhou, Song Bai, Jianyu Wang, Zhou Ren, and Alan L. Yuille. Improving transferabil- ity of adversarial examples with input diversity. In CVPR,

  39. [47]

    Boosting transferability of targeted adversarial exam- ples via hierarchical generative networks

    Xiao Yang, Yinpeng Dong, Tianyu Pang, Hang Su, and Jun Zhu. Boosting transferability of targeted adversarial exam- ples via hierarchical generative networks. In ECCV, 2022. 3

    2022

  40. [48]

    Improv- ing adversarial transferability via neuron attribution-based attacks

    Jianping Zhang, Weibin Wu, Jen-tse Huang, Yizhan Huang, Wenxuan Wang, Yuxin Su, and Michael R Lyu. Improv- ing adversarial transferability via neuron attribution-based attacks. In CVPR, 2022. 3

    2022

  41. [49]

    On suc- cess and simplicity: A second look at transferable targeted attacks

    Zhengyu Zhao, Zhuoran Liu, and Martha Larson. On suc- cess and simplicity: A second look at transferable targeted attacks. In NeurIPS, 2021. 1, 3, 5, 6

    2021

  42. [50]

    Is this image a photo of {target label}? Yes or No?

    Junhua Zou, Zhisong Pan, Junyang Qiu, Xin Liu, Ting Rui, and Wei Li. Improving the transferability of adversarial ex- amples with resized-diverse-inputs, diversity-ensemble and region fitting. In ECCV, 2020. 3, 6 10 Supplementary Material for Improving Transferable Targeted At...

    2020

Pith tools

Reviewed August 12, 2026 · model on record in the stance chip above.