Pith. sign in

REVIEW 4 major objections 4 minor 41 references

Two Heads Are Better Than One: Averaging along Fine-Tuning to Improve Targeted Transferability

T0 review · 4 major / 4 minor · reviewed 2026-08-10 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Targeted adversarial attacks transfer better when the final image is an average of the fine-tuning trajectory, not just its endpoint.

desk verdict A plausible and broadly evaluated incremental attack that needs a cleaner iteration-accounting before the headline gains are fully trustworthy. read the letter →

arxiv 2412.20807 v1 pith:FVLISK2I submitted 2024-12-30 cs.CV cs.AI

Hui Zeng , Sanshuai Cui , Biwei Chen , Anjie Peng This is my paper · ORCID
classification cs.CVcs.AI
keywords targetedadversarialattacktransferabilityfine-tuningtrajectoryaveragingfeaturespaceexamplelosssurfaceflatness
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper is about making targeted adversarial attacks work against models the attacker did not see. Fine-tuning an existing attack image in feature space helps, but current schemes keep only the last image. The paper proposes to keep a weighted average of the whole fine-tuning path, with recent snapshots weighted by a decay factor of 0.8. Across five baseline attacks and several source/victim model pairs, the resulting images are consistently more transferable, with the weakest baseline (cross-entropy) gaining the most. The claimed reason is that averaging pulls the attack image into a flatter, more central region of the loss surface.

What carries the argument

The load-bearing object is the exponential-decay trajectory average, Eq. (5), implemented online as $I'_{aaf,i} = \gamma I'_{aaf,i-1} + I'_{ft,i}$, after only $N_{wu}=5$ warm-up iterations. Averaging is applied to the same feature-space fine-tuning loop as FFT: an aggregate gradient combines target-class feature importance (with random patch masking and Gaussian smoothing) and source-class suppression, and each fine-tuning step maximizes the dot product between this combined gradient and the feature map. The mechanism proposed to explain the gain is that vanilla fine-tuning oscillates around the periphery of a flat region of the loss surface, while the weighted average of snapshots lands closer to the center of that region, which is more transferable.

What would settle it

Compute a quantitative flatness or centrality measure — for example, the average loss increase under random pixel perturbations, or the curvature of the logit surface — for the FFT endpoint and the AaF endpoint across many images and source models. If AaF endpoints are not systematically flatter or more central than FFT endpoints on that measure, the proposed mechanism is not supported even if transferability numbers improve.

Watch

Extended reading notes

Core claim

The paper's central claim is that the exponential moving average of adversarial images collected along the fine-tuning trajectory, computed as $I'_{aaf} = \gamma^{N_{ft}-1} I'_{ft,0} + \gamma^{N_{ft}-2} I'_{ft,1} + \cdots + I'_{ft,N_{ft}-1}$ with $\gamma=0.8$, yields an adversarial image located in a more centered region of the loss surface than the endpoint-only fine-tuning of FFT. In this centered region the image exhibits stronger transferability to held-out models. The claim is supported by consistent improvements in targeted success rate over five baseline attacks (CE, Logit, Margin, SupHigh, SU) when AaF is applied, with the largest gains on the weakest baselines; for example, transferring CE-based attacks from Dense121 to VGG16 rises from 11.3% to 50.3%.

Load-bearing premise

The method assumes that after only five warm-up fine-tuning iterations, every snapshot is a high-quality adversarial image, and that a fixed decay factor of 0.8 over their average reliably shifts the attack to a flatter, more central region of the loss surface; the only direct evidence offered is a handful of two-dimensional contour plots.

Editorial extensions

If this is right

  • Any iterative targeted attack (CE, Logit, Margin, SupHigh, SU) can be upgraded to AaF by keeping a running average of fine-tuned snapshots, adding negligible computation.
  • The weaker the baseline attack, the larger the transferability gain from AaF; the hardest transfer scenarios benefit most.
  • Fine-tuned iterative attacks with AaF match or beat generative methods like TTP and C-GSP at low perturbation budgets ($\epsilon=8$).
  • AaF also improves transferability when the surrogate is an adversarially trained model.
  • The improvement holds across CNN architectures and extends to transformer-based victim models, though overall success rates remain low.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Trajectory averaging here plays a role analogous to stochastic weight averaging in model training; the same trick could plausibly be applied to the fine-tuning stage of other intermediate-level attacks, such as ILA, to see whether centrality gains generalize.
  • The flatness/centrality explanation is currently supported only by contour plots; a quantitative test would be to compare Hessian-based curvature or the loss increase under random perturbations for AaF versus FFT endpoints.
  • A natural testable extension is to replace the fixed decay factor with an adaptive schedule based on validation transferability, or to use geometric averaging in the perturbation space rather than the image space.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 4 minor

Summary. The paper proposes AaF (Averaging along Fine-Tuning), a fine-tuning strategy for targeted adversarial attacks that averages the adversarial example (AE) over the fine-tuning trajectory rather than using only the endpoint as in FFT. The method is integrated with five baseline attacks (CE, Logit, Margin, SH, SU) and evaluated on CNN and transformer victim models, reporting consistent improvements over ILA and FFT and competitive performance with generative attacks such as TTP and C-GSP. The authors attribute the improvement to the averaged AE being located in a 'more centered region' of the loss surface, supported by 2D logit contour plots. The code is released.

Significance. If the reported gains are valid, AaF is a simple, low-overhead method that could improve targeted transferability across a broad range of attacks and architectures, with a plausible connection to flatness/centrality of the loss landscape. The paper includes a wide empirical comparison: five baselines, four surrogate architectures, multiple CNN and transformer victims, and a robust-surrogate setting. However, two load-bearing issues currently undermine the central comparison: an inconsistency in the fine-tuning iteration budget between AaF and FFT, and an unenforced L-infinity constraint on the averaged AE. These issues must be resolved before the empirical claims can be accepted.

major comments (4)
  1. [Sec. IV-A, Algorithm 1, Supplementary Sec. B] The fine-tuning iteration budget is inconsistent between AaF and the FFT baseline, potentially confounding the central comparison. Main text (Sec. IV-A) sets Nft=10 and states N_wu=5 warm-up iterations, but Algorithm 1 in the supplementary has no warm-up loop. The supplementary ablation (Sec. B) says that γ=0 'reduces to the vanilla FFT method with Nft=15', implying the ablation uses 15 fine-tuning iterations, not 10. If the AaF results in Tables I and II effectively use 5 warm-up + 10 averaged = 15 total fine-tuning iterations while the FFT baseline uses only 10, then the reported gains (e.g., CE+AaF 50.3% vs CE+FFT 34.8% for Dense121→VGG16) may be attributable to extra optimization steps rather than trajectory averaging. Please clarify exactly how many fine-tuning iterations each method uses, and provide a matched-budget comparison (e.g., FFT with 15 iterations, or AaF with only 10 total iterations).
  2. [Eq. (5), Algorithm 1] The proposed AaF average does not appear to be projected back into the L-infinity ball, violating the stated threat model. The weights in Eq. (5) sum to (1 - γ^{Nft})/(1 - γ), which for Nft=10 and γ=0.8 is approximately 4.6. If each snapshot I'_ft,i lies within the allowed ε-ball, the weighted sum can be several times larger than ε. Algorithm 1's recurrence (line 7) has no clipping or projection step, and the paper does not state that the final output is clipped. If the constraint is not enforced, AaF may produce perturbations that exceed the reported budget, giving it an unfair advantage over FFT and ILA. Please add an explicit projection step (or normalize the weights so the sum equals 1) and confirm that the reported experiments respect ||I'_aaf - I||_∞ ≤ ε.
  3. [Fig. 3, Supplementary Sec. C] The mechanistic claim that AaF locates AEs in a 'more centered region' is supported only by qualitative 2D logit contour plots. The paper does not provide any quantitative measure of centrality, flatness, or the claimed trajectory behavior. To substantiate the explanation, please report quantitative metrics averaged over the test set, such as the trace of the Hessian of the logit loss, the variance of the logits in a local neighborhood, or the distance to the decision boundary, comparing FFT and AaF.
  4. [Sec. IV-A, Supplementary Fig. 1] The decaying factor γ is selected using the same victim models that appear in the main evaluation. The supplementary ablation computes transferability averaged over 'three hold-out models' and Swin, but Table I and the transformer results use those same victim models. This constitutes tuning on the evaluation set and can inflate the reported performance. Please perform the γ selection on a separate validation set of victim models, or show that the chosen γ=0.8 performs well across a range of unseen models without being selected on them.
minor comments (4)
  1. [Eq. (5) and Algorithm 1] In Algorithm 1, line 6 says 'Fine-tune I_aaf,t-1 with the optimization objective defined in (4) and obtain I'_ft,t', but the notation I'_ft,t is not explicitly defined in the loop. It would be clearer to state that I'_ft,t is the snapshot produced by one step of the fine-tuning optimization, and to specify whether it is clipped to the ε-ball.
  2. [Sec. IV-A] The sentence 'the baseline iteration number N=160 (N=200 when fine-tuning is disabled)' is ambiguous: it is not clear whether N refers to the total number of attack iterations including fine-tuning, or only to the baseline attack. Please state the total number of optimization steps for each configuration.
  3. [Supplementary Tables 1 and 2] The supplementary tables do not state which fine-tuning hyperparameters (Nft, N_wu, γ) were used for the transformer and most-difficult-target experiments. Please include these settings or refer to the main-text parameters.
  4. [Fig. 3 and Supplementary Fig. 2] The contour plots would benefit from a color scale or numeric labels on the logit contours, and from marking the original image and the target-class direction, so that the 'central region' claim is visually verifiable.

Circularity Check

0 steps flagged · score 2.0 of 10

No significant circularity: the AaF improvement is tested against external baselines and does not reduce to the FFT endpoint by construction, though gamma is tuned on the evaluation victims and the fine-tuning budget wording is inconsistent.

full rationale

The core AaF update, Eq. (5), is an exponentially weighted average of FFT snapshots; with gamma=0 it intentionally reduces to the endpoint-only FFT of the authors' prior work [11], which is a published baseline rather than an unverified premise. The central comparison is external: AaF is evaluated against ILA, FFT, TTP, and C-GSP on hold-out victim models (Tables I-III and supplementary Tables 1-2), and the reported improvements do not follow from Eq. (5) by construction. Two non-circularity caveats are noted. First, gamma=0.8 is selected from the supplementary ablation (Fig. 1) using the same hold-out models that appear in the main tables, which is a selection-on-the-test-set risk but not a definitional reduction; the gains persist across gamma in [0.4,0.8]. Second, the supplementary statement that gamma=0 reduces to vanilla FFT with Nft=15 conflicts with the main-text setting Nft=10, and Algorithm 1 omits the N_wu=5 warm-up. If AaF effectively uses 15 fine-tuning steps while the FFT baseline uses 10, part of the reported margin could be an optimization-budget artifact rather than evidence for trajectory averaging. That is an experimental confound, not a circularity. The self-citation to [11] supplies the base fine-tuning scheme but is not load-bearing for the averaging claim, which stands on external comparisons.

Assumptions & free parameters 6 free parameters · 5 assumptions · 0 invented entities

The central contribution is an empirical combination of existing components (FFT aggregate gradients, SWA-style averaging, patch masks, Gaussian smoothing). There are no new theoretical entities, but the method depends on several assumptions borrowed from prior work and on hyperparameters tuned to the evaluation setup.

free parameters (6)
  • gamma (decaying factor) = 0.8
    Selected by ablation on hold-out victim models (supplementary Fig. 1) and fixed for all main results; the optimal value varies across surrogates.
  • N_wu (warm-up iterations) = 5
    Set heuristically in Sec. III-B with no ablation; the claim that snapshots are high-quality depends on this value.
  • Nft (fine-tuning iterations) = 10
    Follows FFT [11]; trajectory length directly affects the average and the comparison.
  • beta (balance weight) = 0.2
    Taken from FFT [11] to combine target and original class gradients; not ablated here.
  • fine-tuning layer k = Mixed_6b / Conv4_3 / third block
    Fixed per architecture following [11]; layer choice determines the feature space used for the aggregate gradients.
  • mask and smoothing hyperparameters = not specified
    Patch-wise random mask from [28] and Gaussian smoothing from [29] are adopted without specifying patch size, number of masks, or smoothing sigma.
assumptions (5)
  • domain assumption AE optimization in pixel space is analogous to DNN weight optimization, so averaging tricks from weight space transfer to adversarial examples.
    Invoked in Sec. III-A to motivate AaF; no mathematical equivalence is shown.
  • domain assumption The fine-tuning trajectory snapshots after N_wu warm-up iterations are high-quality and their average lies in a flatter, more central region of the loss surface that transfers better.
    Assumed in Sec. III-B and III-C; supported only by illustrative logit plots.
  • domain assumption Aggregate gradients computed with patch-wise random masks and Gaussian smoothing capture class-related feature importance that transfers across architectures.
    Adopted from [28,29] in Sec. III-B; no analysis of how mask size or smoothing affects the central claim.
  • domain assumption Targeted success rate on the chosen ImageNet-compatible 1000 images and hold-out models is the correct and sufficient measure of transferability.
    Standard benchmark protocol in Sec. IV-A; single protocol without statistical replication.
  • domain assumption The loss-surface flatness/centrality visualized in 2D subspaces is what causes the observed transferability improvement.
    Sec. III-C and Fig. 3 present correlation, not causation; the claim is not quantified.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Two Heads Are Better Than One: Averaging along Fine-Tuning to Improve Targeted Transferability." pith.science (2026). https://pith.science/paper/FVLISK2I

@misc{pith2026241220807,
  author       = {Pith},
  title        = {Pith review of: Two Heads Are Better Than One: Averaging along Fine-Tuning to Improve Targeted Transferability},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/FVLISK2I}},
  note         = {Machine review of arXiv:2412.20807}
}
read the original abstract

With much longer optimization time than that of untargeted attacks notwithstanding, the transferability of targeted attacks is still far from satisfactory. Recent studies reveal that fine-tuning an existing adversarial example (AE) in feature space can efficiently boost its targeted transferability. However, existing fine-tuning schemes only utilize the endpoint and ignore the valuable information in the fine-tuning trajectory. Noting that the vanilla fine-tuning trajectory tends to oscillate around the periphery of a flat region of the loss surface, we propose averaging over the fine-tuning trajectory to pull the crafted AE towards a more centered region. We compare the proposed method with existing fine-tuning schemes by integrating them with state-of-the-art targeted attacks in various attacking scenarios. Experimental results uphold the superiority of the proposed method in boosting targeted transferability. The code is available at github.com/zengh5/Avg_FT.

Figures

Figures reproduced from arXiv: 2412.20807 by the authors.

Figure 1
Figure 1. Conceptual illustration of averaging along fine-tuning. The circles are snapshots along the fine-tuning trajectory, and the star denotes the barycentre of the triangle determined by three circles. The AEs are crafted against a pretrained Resnet50 model, and the loss surface is calculated with a pretrained Resnet18 [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. Overview of the proposed averaging along fine-tuning scheme [PITH_FULL_IMAGE:figures/full_fig_p002_2.png] view at source ↗
Figure 3
Figure 3. AaF leads to AEs closer to the center of high transferability. The AEs are crafted against a pretrained Res50 model, and the contours are plotted according to the logit values w.r.t. the target label based on an ensemble of target models. More examples are available in our supplementary file [PITH_FULL_IMAGE:figures/full_fig_p003_3.png] view at source ↗

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

41 extracted references · 38 canonical work pages

  1. [1]

    Intriguing properties of neural networks,

    C. Szegedy, W. Zaremba, I. Sutskever, et al., “Intriguing properties of neural networks,” Int. Conf. on Learning Representations, 2014

    work page 2014

  2. [2]

    Towards deep learning models resistant to adversarial attacks,

    A. Madr y, A. Makelov, L. Schmidt, et al., “Towards deep learning models resistant to adversarial attacks,” Int. Conf. on Learning Representations, 2018

    work page 2018

  3. [3]

    Some methods of speeding up the convergence of iteration methods,

    B. T. Polyak. “Some methods of speeding up the convergence of iteration methods,” USSR Computational Mathemat ics & Mathematical Physics, 1964, 4(5):1–17

    work page 1964

  4. [4]

    Boosting adversarial attacks with momentum,

    Y. Dong, F. Liao, T. Pang, et al., “Boosting adversarial attacks with momentum,” IEEE/CVF conf. Computer Vision and Pattern Recognition, 2018, pp. 9185–9193

    work page 2018

  5. [5]

    Nesterov accelerated gradient and scale invariance for adversarial attacks,

    J. Lin, C. Song, K. He, et al., “Nesterov accelerated gradient and scale invariance for adversarial attacks,” Int. Conf. on Learning Representations, 2020, arXiv: 1908.06281

    arXiv 2020

  6. [6]

    Improving transferability of adversarial examples with input diversity,

    C. Xie, Z. Zhang, Y. Zhou, et al., “Improving transferability of adversarial examples with input diversity,” IEEE/CVF Conf. Computer Vision and Pattern Recognition, 2019, pp. 2725–2734

    work page 2019

  7. [7]

    Evading defenses to transferable adversarial examples by translation -invariant attacks,

    Y. Dong, T. Pang, H. Su, et al., “Evading defenses to transferable adversarial examples by translation -invariant attacks,” IEEE/CVF Conf. Computer Vision and Pattern Recognition, 2019, pp. 4307–4316

    work page 2019

  8. [8]

    Learning with pseudo- ensembles,

    P. Bachman, O. Alsharif, and D. Precup. “Learning with pseudo- ensembles,” Advances in Neural Inf. Processing Systems, 2014, pp. 3365–3373

    work page 2014

Show all 41 references
  1. [9]

    Enhancing adversarial example transferability with an intermediate level attack,

    Q. Huang, I. Katsman, Z. Gu, et al., “Enhancing adversarial example transferability with an intermediate level attack,” IEEE Int. Conf. on Computer Vision, 2019, pp. 4732–4741

    2019

  2. [10]

    Yet another intermediate -level attack,

    Q. Li, Y. Guo, and H. Chen, “Yet another intermediate -level attack,” European Conf. on Computer Vision, 2020, pp. 241–257

    2020

  3. [11]

    Enhancing targeted transferability via feature spa ce fine -tuning,

    H. Zeng, B. Chen, A. Peng, “Enhancing targeted transferability via feature spa ce fine -tuning,” IEEE Int. Conf. on Acoustics, Speech and Signal Processing, 2024, pp. 4475–4479

    2024

  4. [12]

    Averaging weights leads to wider optima and better generalization,

    P. Izmailov, D. Podoprikhin, T. Garipov, et al., “Averaging weights leads to wider optima and better generalization,” Uncertainty in Artificial Intelligence, 2018, arXiv:1803.05407

    2018 arXiv

  5. [13]

    There are many consistent explanations of unlabeled data: why you should average,

    B. Athiwaratkun M. Finzi, and P. Izmailov, et al., “There are many consistent explanations of unlabeled data: why you should average,” Int. Conf. on Learning Representations, 2019

    2019

  6. [14]

    Transferable perturbations of deep feature distributions,

    N. Inkawhich, K. J. Liang, L. Carin, and Y. Chen, “Transferable perturbations of deep feature distributions,” Int. Conf. on Learning Representations, 2020

    2020

  7. [15]

    On generating transferable targeted perturbations,

    M. Naseer, S. Khan, M. Hayat, et al., “On generating transferable targeted perturbations,” IEEE Int. Conf. on Computer Vision , 2021, pp. 7688–7697

    2021

  8. [16]

    Boosting transferability of targeted adversarial examples via hierarchical generative network,

    X. Yang, Y. Dong, T. Pang, et al., “Boosting transferability of targeted adversarial examples via hierarchical generative network,” Euro. Conf. on Computer Vision, 2022, pp. 725–742

    2022

  9. [17]

    LFAA: crafting transferable targeted adversarial examples with low-frequency perturbations,

    K. Wang J. Shi, and W. Wang, “LFAA: crafting transferable targeted adversarial examples with low-frequency perturbations,” the 26th Euro. Conf. on Artificial Intelligence . 2023, pp. 2483 – 2490

    2023

  10. [18]

    Towards evaluating the robustness of neural networks,

    N. Carlini and David Wagner, “Towards evaluating the robustness of neural networks,” IEEE Symposium on Security and Privacy, 2017, pp. 39–57

    2017

  11. [19]

    Towards transferable targeted attack,

    M. Li, C. Deng, T. Li, et al., “Towards transferable targeted attack,” IEEE/CVF Conf. on Computer Vision and Pattern Recognition, 2020, pp. 638–646

    2020

  12. [20]

    On success and simplicity: a second look at transferable targeted attacks,

    Z. Zhao, Z. Liu, and M. Larson, “On success and simplicity: a second look at transferable targeted attacks,” Advances in Neural Information Processing Systems, 2021, 34: 6115–6128

    2021

  13. [21]

    Enhancing targeted transferability via suppressing high-confidence labels,

    H. Zeng, T. Zhang, B. Chen, et al., “Enhancing targeted transferability via suppressing high-confidence labels,” Int. Conf. on Image Processing, 2023, pp. 3309–3313

    2023

  14. [22]

    Logit margin matters: Improving transferable targeted adversarial attack by logit calibration,

    J. Weng, Z. Luo, Z. Zhong, et al. , “Logit margin matters: Improving transferable targeted adversarial attack by logit calibration,” IEEE Trans. Inf. For. and Sec, 2023, 18: 3561–3574

    2023

  15. [23]

    Enhancing the self -universality for transferable t argeted attacks,

    Z. Wei, J. Chen, Z. Wu, et al., “Enhancing the self -universality for transferable t argeted attacks,” IEEE/CVF Conf. Computer Vision and Pattern Recognition, 2023, pp. 12281–12290

    2023

  16. [24]

    Feature space perturbations yield more transferable adversarial examples

    N. Inkawhich, W. Wen, H. Li, et al., “Feature space perturbations yield more transferable adversarial examples” IEEE/CVF Conf. Computer Vision and Pattern Recognition, 2019, pp. 7059–7067

    2019

  17. [25]

    Introducing competition to boost the transferability of targeted adversarial examples through clean feature mixup,

    J. Byun, M. Kwon, S. Cho, et al., “Introducing competition to boost the transferability of targeted adversarial examples through clean feature mixup,” IEEE/CVF Conf. on Computer Vision and Pattern Recognition, 2023, pp. 24648–24657

    2023

  18. [26]

    Conditional generative adversarial nets

    M. Mirza and S. Osindero, “Conditional generative adversarial nets” arXiv: 1411.1784, 2014

    2014 arXiv

  19. [27]

    Delving into transferable adversarial examples and black -box attacks,

    Y. Liu, X. Chen, C. Liu, and D. Song, “Delving into transferable adversarial examples and black -box attacks,” Int. Conf. on Learning Representations, 2017

    2017

  20. [28]

    Enhancing the transferability of adversarial examples with random patch,

    Y. Zhang, Y. Tan, T. Chen, et al., “Enhancing the transferability of adversarial examples with random patch,” Int. Joint Conf. on Artificial Intelligence, 2022, pp. 1672–1678

    2022

  21. [29]

    Patch -wise attack for fooling deep neural network,

    L. Gao, Q. Zhang, J. Song, et al., “Patch -wise attack for fooling deep neural network,” Euro. Conf. on Computer Vision, 2020, pp. 307–322

    2020

  22. [30]

    Deep residual learning for image recognition,

    K. He, X. Zhang, S. Ren, et al., “Deep residual learning for image recognition,” IEEE/CVF Conf. Computer Vision and Pattern Recognition, 2016, pp. 770–778

    2016

  23. [31]

    Rethinking the inception architecture for computer vision,

    C. Szegedy, V. Vanhoucke, S. Ioffe, et al ., “Rethinking the inception architecture for computer vision,” IEEE/CVF Conf. Computer Vision and Pattern Recognition, 2016, pp. 2818–2826

    2016

  24. [32]

    Densely connected convolutional networks,

    G. Huang, Z. Liu, V. Laurens, and K. Q. Weinberger, “Densely connected convolutional networks,” IEEE/CVF Conf. Computer Vision and Pattern Recognition, 2017, pp. 2261–2269

    2017

  25. [33]

    Very deep convolutional networks for large -scale image recognition,

    K. Simonyan, A. Zisserman, “Very deep convolutional networks for large -scale image recognition,” Int. Conf. on Learning Representations, 2015

    2015

  26. [34]

    Adversarial exam ples in the physical world,

    A. Kurakin, I. Goodfellow, S. Bengio, “Adversarial exam ples in the physical world,” Int. Conf. on Learning Representations ,

  27. [35]

    https://github.com/cleverhans-lab/cleverhans/tree/master/clever hans_v3.1.0/examples/nips17_adversarial_competition/dataset

  28. [36]

    Swin transformer: Hierarchical vision transformer using shifted windows,

    Z. Liu, Y. Lin, Y. Gao, et al., “Swin transformer: Hierarchical vision transformer using shifted windows,” IEEE Int. Conf. on Computer Vision, 2021, pp.10012–10022

    2021

  29. [37]

    An image is worth 16x16 words: Transformers for image recognition at scale,

    A. Dosovitskiy, L. Beyer, A. Kolesnikov, et al ., “An image is worth 16x16 words: Transformers for image recognition at scale,” Int. Conf. on Learning Representations, 2021

    2021

  30. [38]

    Rethinking spatial dimensions of vision transformers,

    B. Heo, S. Yun, D. Han, et al., “Rethinking spatial dimensions of vision transformers,” IEEE Int. Conf. on Computer Vision, 2021, pp. 11916–11925

    2021

  31. [39]

    Visformer: The vision-friendly transformer,

    Z. Chen, L. Xie, J. Niu, et al., “Visformer: The vision-friendly transformer,” IEEE Int. Conf. on Computer Vision , 2021, pp. 569–578

    2021

  32. [40]

    A little robustness goes a long way: Leveraging robust features for targeted transfer attacks,

    J. M. Springer, M. Mitchell, G. T. Kenyon, “A little robustness goes a long way: Leveraging robust features for targeted transfer attacks,” the 35th Conf. on Neural Inform ation Processing Systems, 2021. pp. 9759–9773.  The supplementary document consists of six parts of cont...

    2021

  33. [41]

    The target label for all samples is ‘hippopotamus.’ The perturbations introduced by TTP are more suspicious under human inspection , while th ose introduced by the iterative methods resemble noise. Fig. 2. The logit plane of AEs with different fine-tuning schemes.The baseline ...

Pith tools

Reviewed August 10, 2026 · model on record in the stance chip above.