AIM: Additional Image Guided Generation of Transferable Adversarial Attacks

Teng Li; Xingjun Ma; Yu-Gang Jiang

REVIEW 3 major objections 5 minor 42 references

AIM: Additional Image Guided Generation of Transferable Adversarial Attacks

T0 review · 3 major / 5 minor · reviewed 2026-08-10 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read The paper claims that injecting a guiding image of the target class into a generative adversarial attack via a Semantic Injection Module yields targeted adversarial examples that transfer to unseen architectures, including vision…

desk verdict Useful generative attack paper with a strong targeted result, but a broken untargeted loss (Eq. 6) and a missing TTAA baseline undercut the paper's headline claims. read the letter →

arxiv 2501.01106 v1 pith:BLOLBPLC submitted 2025-01-02 cs.CV cs.LG

Teng Li , Xingjun Ma , Yu-Gang Jiang This is my paper · ORCID

classification cs.CVcs.LG

keywords adversarialexamplestransferableattackstargetedgenerativesemanticinjectionmodulevisiontransformerscross-architecturetransferImageNet

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper argues that targeted adversarial attacks fail to transfer because the generator is trained without explicit target-class semantics, and proposes a Semantic Injection Module (SIM) that injects a guiding image of the target class into the generator's feature maps. With new contrastive logit and feature-similarity losses, the trained generator produces adversarial examples that transfer to unseen architectures, including vision transformers where prior methods scored near zero. The paper reports that this approach outperforms all compared generative and iterative baselines on every tested architecture, achieving an average targeted attack success of 24.39% across ViT models when trained on DenseNet-169. If correct, targeted black-box attacks become substantially more practical because an attacker only needs a single image of the target class as a guide.

What carries the argument

The Semantic Injection Module (SIM) is a plug-and-play component that computes per-channel scale $\alpha$ and shift $\beta$ from a resized guiding image via convolutions and applies $f^i_{\mathrm{SIM}} = (1 + \alpha^i) f^i + \beta^i$ to the generator's feature maps. For targeted attacks it is trained with a logit contrastive loss that pulls $f(x_{\mathrm{adv}})$ toward $f(x_{\mathrm{guide}})$ and a cosine-similarity loss on mid-layer features that does the same while separating from $f(x)$. These losses allow a single forward pass of the generator to produce an adversarial example conditioned on both the source image and the guide.

What would settle it

Retrain the generator with one set of random guiding images per class, then evaluate on a disjoint set of guiding images and on held-out architectures; if targeted top-1 accuracy collapses to the level of the no-SIM ablation when the guiding image is changed, the semantic-injection claim is falsified. A second test: use a target-class guiding image with unusual composition or background and check whether transferability drops.

Watch

Extended reading notes

Core claim

The central claim is that injecting the semantics of a target-class guiding image into an adversarial generator, through the Semantic Injection Module, yields adversarial examples that are both targeted and transferable to unseen architectures. The module applies an affine transformation to intermediate feature maps using scale and shift parameters computed from the guiding image, and the training objectives pull the generated adversarial example toward the guiding image in both logit space and mid-layer feature space while pushing it away from the source image. In the reported experiments, this configuration achieves higher average top-1 accuracy than all baselines across ten architectures, and is described as the first generative method to produce nontrivial targeted attacks on ViT models.

Load-bearing premise

The method depends on a single randomly chosen guiding image of the target class carrying enough class-level semantics for the attack to transfer to unseen models, and on the trained generator continuing to work when the adversary uses different guiding images at test time.

Editorial extensions

If this is right

Targeted transfer attacks become usable against transformer-based models, where prior generative methods achieved near-zero success.
Because SIM is plug-and-play, existing adversarial generators can be upgraded by adding the module rather than retraining from scratch.
An adversary needs only one image of the target class, not a dataset, to guide the attack, lowering the practical cost of targeted black-box attacks.
Training with random guiding images and testing with different random guiding images indicates the generator relies on class-level semantics rather than memorizing specific images.
Untargeted attacks also improve: guiding with an incorrect-class image reduces overfitting and yields better cross-domain transfer on fine-grained datasets.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

If random guiding images generalize as reported, any publicly available image of the target category could serve as the guide, making the attack easy to deploy with images gathered from the web (an implication the paper states but does not test against corrupted or adversarial guides).
The CLIP-score ablation suggests that scalar alignment with the target label is a poor proxy for guide quality; a selection strategy based on feature-space diversity or semantic purity might outperform both random and CLIP-based selection.
The untargeted version iterates over guiding images from one incorrect class; sweeping all incorrect classes would likely strengthen the attack further, at a training cost the paper explicitly leaves untested.
The method's reliance on a surrogate mid-layer feature space suggests it could be combined with existing input-diversity or frequency-domain augmentations to push transferability even higher.

Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Two things to know before you read this one. The core idea is simple and looks effective: inject semantics from an extra guiding image into an adversarial generator via SPADE-like affine layers, and train with a contrastive logit loss plus a feature-similarity loss. Targeted transfer results, especially on ViTs, are genuinely striking—24% average success on ViT models versus single digits for prior methods. If that holds up, it matters for evaluating deployed vision systems.

The paper does several things well. The SIM module is lightweight, plug-and-play, and the ablations show both losses contribute. The computational cost table is honest. The untargeted cross-domain and cross-architecture tables also show strong performance, with the method beating the included baselines clearly.

Now the soft spots, and they are not minor. Equation (6), the untargeted semantic injection loss, as printed depends only on x_guide and x—not on the generator output x_adv. It is a constant with respect to the generator parameters, so it cannot train anything. The text says it 'forces the generated adversarial examples' to move toward the semantics of the guiding class, but the math does not. Since the untargeted ablation shows L_usi has a large effect, the authors clearly implemented something else. The paper cannot be reproduced from Eq. (6), and the gap between the prose and the equation is a serious editorial flaw, not a nitpick.

The other big gap is baselines. The Related Work explicitly discusses TTAA (Wang et al., CVPR 2023), a dual-discriminator generative targeted attack, but TTAA is absent from Table 1. The paper claims 'consistently surpasses all alternative approaches across every model' and 'first to successfully conduct attacks on the ViT architecture.' Without a head-to-head against TTAA, those claims are unsupported. Maybe AIM really is better, but the reader cannot verify it. This is a simple omission to fix, but it is load-bearing for the universality claims.

A smaller issue: the targeted ablation table caption says 'lower values are preferable' when attack success should be higher-is-better. It looks like a copy-paste error, but it makes the table confusing.

The random-guiding-image concern from the reader is actually less serious than it looks, because the paper explicitly says test-time guiding images are different from training ones, so the protocol partially tests generalization.

Bottom line: the method is worth taking seriously, the targeted numbers are good enough to demand a proper comparison, and the SIM idea is a reasonable contribution to the transferable-attack literature. But the paper needs a corrected Eq. (6) and a TTAA comparison before I'd trust the conclusions. I'd send it to a serious referee; the flaws are fixable and the core is promising.

Referee Report

3 major / 5 minor

Summary. The paper proposes AIM, a generative attack framework that injects semantic information from an additional guiding image into an adversarial generator via a Semantic Injection Module (SIM). The module uses affine transformations on generator feature maps, conditioned on the guiding image, and the paper introduces new training losses for both targeted and untargeted transferable attacks. Experiments on ImageNet with ResNet-152 and DenseNet-169 surrogates evaluate transfer to ten target architectures, including ViT and Swin, reporting large gains in targeted cross-architecture attack success (e.g., 24.39% average success on ViT models versus 5.90% for TTP) and improvements in untargeted cross-domain and cross-architecture settings. The paper includes ablations on loss objectives, guiding-image selection strategies, and computational overhead, and it releases code.

Significance. If the results hold, the proposed SIM provides a simple, plug-and-play way to improve targeted transferability of generative adversarial attacks, especially to ViT-style architectures that are typically hard to attack. The paper's strengths include the clear architecture design, the use of held-out target models, and the ablation of guiding-image selection, which partly addresses the concern that random guiding images may not generalize (the test-time guiding images are stated to differ from training-time ones). However, the significance is currently undercut by two issues: the untargeted semantic injection loss as printed has no dependence on the generator output, and the comparison set for targeted attacks omits the closely related TTAA baseline that the paper itself identifies as a recent generative targeted attack. These issues must be addressed before the claimed superiority over 'all alternative approaches' can be accepted.

major comments (3)

[Methodology, Untargeted Attack, Eq. (6)] The untargeted semantic injection loss Lusi is printed as L(1/N) sum of Lcos(f^l(x_guide^i), f^l(x)), which depends only on the guiding images and the clean image; it does not involve the generator output x_adv. As written, this term has zero gradient with respect to the generator parameters, so it cannot train the generator. The surrounding text states that the loss 'forces the generated adversarial examples close to the semantics of a randomly chosen untarget,' which requires a term like Lcos(f^l(x_adv), f^l(x_guide)) or a contrastive expression involving x_adv. This appears to be a typo, but until corrected and the untargeted experiments are re-verified with the intended loss, the untargeted results in Tables 2 and 3 are not supported by the equations.
[Experiments, Targeted Cross-architecture Transferability, Table 1] The Related Work section explicitly describes TTAA (Wang et al., CVPR 2023) as a dual-discriminator generative targeted attack, yet Table 1 lists only PGD, DI-FGSM, CDA, GAP, TTP, and BIA, omitting TTAA. The claim that 'our methodology consistently surpasses all alternative approaches across every model' and the assertion of being 'the first to successfully conduct attacks on the ViT architecture' cannot be established without a head-to-head comparison against TTAA under identical settings (same surrogate models, target models, epsilon, and evaluation protocol). If TTAA already reports nontrivial ViT transfer success or exceeds the reported 24.39% average, the headline claims would be incorrect. The authors should add TTAA to the baseline set or provide a clear justification for its exclusion.
[Experiments, Ablation Study, Table 4] The caption of Table 4 states that in the targeted scenario 'lower values are preferable' and in the untargeted scenario 'higher values are desirable.' This is the reverse of the conventions used in Tables 1-3, where higher top-1 accuracy is better for targeted attacks and lower top-1 accuracy is better for untargeted attacks. The caption introduces confusion about how to interpret the ablation numbers, even though the row ordering (both losses together giving the best result) is still discernible. Please correct the caption to align with the evaluation metrics used elsewhere in the paper.

minor comments (5)

[Methodology, Untargeted Attack, Eq. (5)] Please clarify the optimization direction for Lufs: the text says the loss 'enforce[s] the adversarial features to be far away from the clean features,' but since cosine similarity is bounded, the reader needs to know whether the loss is minimized (driving cosine similarity down) or maximized. State the sign convention explicitly for reproducibility.
[Experiments, Experimental Setup] The paper does not report the number of test images used to compute the average top-1 accuracy in Tables 1-3, nor does it report standard deviations across multiple runs or random guiding image selections. Please specify these details so the magnitude of the reported gains can be assessed.
[Visualization of Targeted Attacks, Figure 2] The text refers to Figure 2 for Grad-CAM visualizations, but the figure content appears to be missing from the provided manuscript. Please ensure the figure is included and properly captioned.
[Ablation Study, Table 4 discussion] In the paragraph describing the ablation results, the text says 'the integration of the semantic injection loss Lufs relatively enhances performance,' but Lufs is the base feature-disruption loss, not the semantic injection loss; the semantic injection loss is Lusi. Please correct this labeling error.
[Computational Analysis, Table 6] Please clarify the units in Table 6 (e.g., whether FLOPs are in GFLOPs and whether the average time is per image or per batch) and specify the hardware used for the timing measurements, so the reported overhead can be interpreted.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the method trains on surrogate models and is evaluated on held-out target architectures; self-citations are peripheral, and the noted issues are correctness/completeness concerns, not circular reductions.

full rationale

The paper's claimed derivation chain is self-contained. SIM is defined by Eq. (1) as an affine transformation conditioned on a resized guiding image, and the training losses in Eqs. (2)-(4) and (5)-(7) are functions of the generator output x_adv = G((x, x_guide), θ_g); none of these objectives is derived from the reported target-model accuracies. The experimental protocol follows the standard transfer-attack evaluation: the generator is trained on ResNet-152/DenseNet-169/VGG-16 surrogates and then applied to unseen architectures (VGG, ResNet, DenseNet, Inception, ViT, Swin), so the reported success rates are predictions rather than fitted values. The only self-citations (Chen et al. 2022, 2023, with coauthor Yu-Gang Jiang) support the peripheral introductory claim that adversarial examples transfer across modalities and are not load-bearing for the central method. Two genuine weaknesses exist but are not circularity: (i) the TTAA baseline is described in Related Work yet omitted from Table 1, weakening the claim that the method 'consistently surpasses all alternative approaches'; and (ii) Eq. (6) as written does not depend on x_adv, which is a correctness inconsistency in the untargeted objective rather than a circular reduction. Neither issue makes the derivation equivalent to its inputs. Hence the circularity score is 0.

Assumptions & free parameters 3 free parameters · 4 assumptions · 0 invented entities

The ledger shows the approach rests on standard empirical assumptions about feature-space transferability and on hand-chosen hyperparameters (margin, N, budgets). It introduces no new physical entities, and its learnable alpha/beta are ordinary network parameters, not free constants.

free parameters (3)

margin m = 0.2
Hand-chosen for the targeted logit contrastive loss (Eq 2); controls how far adversarial logits must stay from source-image logits.
number of guiding images N = 16
Used in the untargeted semantic injection loss (Eq 6); set to 16 without a sensitivity analysis.
perturbation budget epsilon = 16/255 targeted, 10/255 untargeted
Attack budgets set by experimental convention; different budgets across settings make cross-table comparisons indirect.

assumptions (4)

domain assumption Mid-layer features of the surrogate model are a more transferable space than logits.
The feature losses L_tfs and L_ufs rely on this; inherited from BIA/TTP rather than demonstrated in this paper.
domain assumption Affine transformation (SPADE-style) of generator feature maps can inject guiding-image semantics into the perturbation.
Equation (1) assumes the scale/shift computed from the guiding image carries class semantics into the generated adversarial example.
domain assumption A single random guiding image per target class is a sufficient semantic carrier for all test images and target models.
The targeted attack randomly selects one image of the target class during training and generation; the paper acknowledges manual selection works better (Table 5).
domain assumption The ImageNet-trained generator generalizes to unseen target domains and architectures.
Cross-domain results in Table 2 assume ImageNet perturbations transfer to CUB, Cars, and Aircraft datasets.

how reviews work

0 comments

Cite this review

Pith. "Pith review of AIM: Additional Image Guided Generation of Transferable Adversarial Attacks." pith.science (2026). https://pith.science/paper/BLOLBPLC

@misc{pith2026250101106,
  author       = {Pith},
  title        = {Pith review of: AIM: Additional Image Guided Generation of Transferable Adversarial Attacks},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/BLOLBPLC}},
  note         = {Machine review of arXiv:2501.01106}
}

read the original abstract

Transferable adversarial examples highlight the vulnerability of deep neural networks (DNNs) to imperceptible perturbations across various real-world applications. While there have been notable advancements in untargeted transferable attacks, targeted transferable attacks remain a significant challenge. In this work, we focus on generative approaches for targeted transferable attacks. Current generative attacks focus on reducing overfitting to surrogate models and the source data domain, but they often overlook the importance of enhancing transferability through additional semantics. To address this issue, we introduce a novel plug-and-play module into the general generator architecture to enhance adversarial transferability. Specifically, we propose a \emph{Semantic Injection Module} (SIM) that utilizes the semantics contained in an additional guiding image to improve transferability. The guiding image provides a simple yet effective method to incorporate target semantics from the target class to create targeted and highly transferable attacks. Additionally, we propose new loss formulations that can integrate the semantic injection module more effectively for both targeted and untargeted attacks. We conduct comprehensive experiments under both targeted and untargeted attack settings to demonstrate the efficacy of our proposed approach.

Figures

Figures reproduced from arXiv: 2501.01106 by the authors.

**Figure 2.** Illustration of attention shift. We use Grad-CAM [PITH_FULL_IMAGE:figures/full_fig_p006_2.png] view at source ↗

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

42 extracted references · 28 canonical work pages

[1]

, " * write output.state after.block = add.period write newline

ENTRY address archivePrefix author booktitle chapter edition editor eid eprint howpublished institution isbn journal key month note number organization pages publisher school series title type volume year label extra.label sort.label short.list INTEGERS output.state before.all mid.sentence after.sentence after.block FUNCTION init.state.consts #0 'before.a...
[2]

write newline

" write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 global.max substring 't := if while FUNCTION word.in bbl.in capitalize " " * FUNCT...
[3]

Aich, A.; Ta, C.-K.; Gupta, A.; Song, C.; Krishnamurthy, S.; Asif, S.; and Roy-Chowdhury, A. 2022. Gama: Generative adversarial multi-object scene attacks. NeurIPS, 35: 36914--36930

work page 2022
[4]

Baluja, S.; and Fischer, I. 2017. Adversarial transformation networks: Learning to generate adversarial examples. arXiv preprint arXiv:1703.09387

arXiv 2017
[5]

Chen, K.; Wei, Z.; Chen, J.; Wu, Z.; and Jiang, Y.-G. 2022. Attacking video recognition models with bullet-screen comments. In AAAI, volume 36, 312--320

work page 2022
[6]

Chen, K.; Wei, Z.; Chen, J.; Wu, Z.; and Jiang, Y.-G. 2023. GCMA: Generative Cross-Modal Transferable Adversarial Attacks from Images to Videos. In ACM MM, 698--708

work page 2023
[7]

Chen, Y.; Bai, Y.; Zhang, W.; and Mei, T. 2019. Destruction and construction learning for fine-grained image recognition. In CVPR, 5157--5166

work page 2019
[8]

Deng, J.; Dong, W.; Socher, R.; Li, L.-J.; Li, K.; and Fei-Fei, L. 2009. Imagenet: A large-scale hierarchical image database. In CVPR, 248--255

work page 2009

Show all 42 references

[9]

Dosovitskiy, A.; Beyer, L.; Kolesnikov, A.; Weissenborn, D.; Zhai, X.; Unterthiner, T.; Dehghani, M.; Minderer, M.; Heigold, G.; Gelly, S.; et al. 2020. An image is worth 16x16 words: Transformers for image recognition at scale. arXiv preprint arXiv:2010.11929

2020 arXiv
[10]

J.; Shlens, J.; and Szegedy, C

Goodfellow, I. J.; Shlens, J.; and Szegedy, C. 2015. Explaining and Harnessing Adversarial Examples. arXiv preprint arXiv:1412.6572

2015 arXiv
[11]

He, K.; Zhang, X.; Ren, S.; and Sun, J. 2016. Deep residual learning for image recognition. In CVPR, 770--778

2016
[12]

Hochreiter, S.; and Schmidhuber, J. 1997. Long short-term memory. Neural computation, 9(8): 1735--1780

1997
[13]

Hu, J.; Shen, L.; and Sun, G. 2018. Squeeze-and-excitation networks. In CVPR, 7132--7141

2018
[14]

Huang, G.; Liu, Z.; Van Der Maaten, L.; and Weinberger, K. Q. 2017. Densely connected convolutional networks. In CVPR, 4700--4708

2017
[15]

Krause, J.; Stark, M.; Deng, J.; and Fei-Fei, L. 2013. 3d object representations for fine-grained categorization. In ICCV workshops, 554--561

2013
[16]

Krizhevsky, A.; Sutskever, I.; and Hinton, G. E. 2012. Imagenet classification with deep convolutional neural networks. NeurIPS, 25

2012
[17]

J.; and Bengio, S

Kurakin, A.; Goodfellow, I. J.; and Bengio, S. 2018. Adversarial examples in the physical world. In Artificial intelligence safety and security, 99--112

2018
[18]

LeCun, Y.; Bottou, L.; Bengio, Y.; and Haffner, P. 1998. Gradient-based learning applied to document recognition. Proceedings of the IEEE, 86(11): 2278--2324

1998
[19]

Li, M.; Deng, C.; Li, T.; Yan, J.; Gao, X.; and Huang, H. 2020. Towards transferable targeted attack. In CVPR, 641--649

2020
[20]

Li, Z.; Wang, W.; Li, J.; Chen, K.; and Zhang, S. 2024. UCG: A Universal Cross-Domain Generator for Transferable Adversarial Examples. IEEE TIFS

2024
[21]

Li, Z.; Wu, W.; Su, Y.; Zheng, Z.; and Lyu, M. R. 2023. CDTA: a cross-domain transfer-based attack with contrastive learning. In AAAI, volume 37 of 2, 1530--1538

2023
[22]

Liu, Z.; Lin, Y.; Cao, Y.; Hu, H.; Wei, Y.; Zhang, Z.; Lin, S.; and Guo, B. 2021. Swin transformer: Hierarchical vision transformer using shifted windows. In ICCV, 10012--10022

2021
[23]

Lu, Y.; Jia, Y.; Wang, J.; Li, B.; Chai, W.; Carin, L.; and Velipasalar, S. 2020. Enhancing cross-task black-box transferability of adversarial examples with dispersion reduction. In CVPR, 940--949

2020
[24]

Madry, A.; Makelov, A.; Schmidt, L.; Tsipras, D.; and Vladu, A. 2017. Towards deep learning models resistant to adversarial attacks. arXiv preprint arXiv:1706.06083

2017 arXiv
[25]

S.; and Porikli, F

Naseer, M.; Khan, S.; Hayat, M.; Khan, F. S.; and Porikli, F. 2021. On generating transferable targeted perturbations. In ICCV, 7708--7717

2021
[26]

M.; Khan, S

Naseer, M. M.; Khan, S. H.; Khan, M. H.; Shahbaz Khan, F.; and Porikli, F. 2019. Cross-domain transferability of adversarial perturbations. NeurIPS, 32

2019
[27]

Nilsback, M.-E.; and Zisserman, A. 2008. Automated flower classification over a large number of classes. In Indian conference on computer vision, graphics & image processing, 722--729

2008
[28]

Park, T.; Liu, M.-Y.; Wang, T.-C.; and Zhu, J.-Y. 2019. Semantic image synthesis with spatially-adaptive normalization. In CVPR, 2337--2346

2019
[29]

Poursaeed, O.; Katsman, I.; Gao, B.; and Belongie, S. 2018. Generative adversarial perturbations. In CVPR, 4422--4431

2018
[30]

W.; Hallacy, C.; Ramesh, A.; Goh, G.; Agarwal, S.; Sastry, G.; Askell, A.; Mishkin, P.; Clark, J.; et al

Radford, A.; Kim, J. W.; Hallacy, C.; Ramesh, A.; Goh, G.; Agarwal, S.; Sastry, G.; Askell, A.; Mishkin, P.; Clark, J.; et al. 2021. Learning transferable visual models from natural language supervision. In ICML, 8748--8763

2021
[31]

Redmon, J.; Divvala, S.; Girshick, R.; and Farhadi, A. 2016. You only look once: Unified, real-time object detection. In CVPR, 779--788

2016
[32]

Rombach, R.; Blattmann, A.; Lorenz, D.; Esser, P.; and Ommer, B. 2022. High-resolution image synthesis with latent diffusion models. In CVPR, 10684--10695

2022
[33]

R.; Cogswell, M.; Das, A.; Vedantam, R.; Parikh, D.; and Batra, D

Selvaraju, R. R.; Cogswell, M.; Das, A.; Vedantam, R.; Parikh, D.; and Batra, D. 2017. Grad-cam: Visual explanations from deep networks via gradient-based localization. In ICCV, 618--626

2017
[34]

Simonyan, K.; and Zisserman, A. 2014. Very deep convolutional networks for large-scale image recognition. arXiv preprint arXiv:1409.1556

2014 arXiv
[35]

Szegedy, C.; Zaremba, W.; Sutskever, I.; Bruna, J.; Erhan, D.; Goodfellow, I.; and Fergus, R. 2013. Intriguing properties of neural networks. arXiv preprint arXiv:1312.6199

2013 arXiv
[36]

N.; Kaiser, .; and Polosukhin, I

Vaswani, A.; Shazeer, N.; Parmar, N.; Uszkoreit, J.; Jones, L.; Gomez, A. N.; Kaiser, .; and Polosukhin, I. 2017. Attention is all you need. NeurIPS, 30

2017
[37]

Wah, C.; Branson, S.; Welinder, P.; Perona, P.; and Belongie, S. 2011. The caltech-ucsd birds-200-2011 dataset. Technical Report CNS-TR-2011-001, California Institute of Technology

2011
[38]

Wang, Z.; Yang, H.; Feng, Y.; Sun, P.; Guo, H.; Zhang, Z.; and Ren, K. 2023. Towards transferable targeted adversarial examples. In CVPR, 20534--20543

2023
[39]

Xie, C.; Zhang, Z.; Zhou, Y.; Bai, S.; Wang, J.; Ren, Z.; and Yuille, A. L. 2019. Improving transferability of adversarial examples with input diversity. In CVPR, 2730--2739

2019
[40]

Yang, H.; Jeong, J.; and Yoon, K.-J. 2024. FACL-Attack: Frequency-Aware Contrastive Learning for Transferable Adversarial Attacks. In AAAI, volume 38 of 6, 6494--6502

2024
[41]

Zhang, Q.; Li, X.; Chen, Y.; Song, J.; Gao, L.; He, Y.; and Xue, H. 2022. Beyond imagenet attack: Towards crafting adversarial examples for black-box domains. arXiv preprint arXiv:2201.11528

2022 arXiv
[42]

Zhu, J.-Y.; Park, T.; Isola, P.; and Efros, A. A. 2017. Unpaired image-to-image translation using cycle-consistent adversarial networks. In ICCV, 2223--2232

2017

Pith tools

Reviewed August 10, 2026 · model on record in the stance chip above.

[1] [1]

, " * write output.state after.block = add.period write newline

ENTRY address archivePrefix author booktitle chapter edition editor eid eprint howpublished institution isbn journal key month note number organization pages publisher school series title type volume year label extra.label sort.label short.list INTEGERS output.state before.all mid.sentence after.sentence after.block FUNCTION init.state.consts #0 'before.a...

[2] [2]

write newline

" write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 global.max substring 't := if while FUNCTION word.in bbl.in capitalize " " * FUNCT...

[3] [3]

Aich, A.; Ta, C.-K.; Gupta, A.; Song, C.; Krishnamurthy, S.; Asif, S.; and Roy-Chowdhury, A. 2022. Gama: Generative adversarial multi-object scene attacks. NeurIPS, 35: 36914--36930

work page 2022

[4] [4]

Baluja, S.; and Fischer, I. 2017. Adversarial transformation networks: Learning to generate adversarial examples. arXiv preprint arXiv:1703.09387

arXiv 2017

[5] [5]

Chen, K.; Wei, Z.; Chen, J.; Wu, Z.; and Jiang, Y.-G. 2022. Attacking video recognition models with bullet-screen comments. In AAAI, volume 36, 312--320

work page 2022

[6] [6]

Chen, K.; Wei, Z.; Chen, J.; Wu, Z.; and Jiang, Y.-G. 2023. GCMA: Generative Cross-Modal Transferable Adversarial Attacks from Images to Videos. In ACM MM, 698--708

work page 2023

[7] [7]

Chen, Y.; Bai, Y.; Zhang, W.; and Mei, T. 2019. Destruction and construction learning for fine-grained image recognition. In CVPR, 5157--5166

work page 2019

[8] [8]

Deng, J.; Dong, W.; Socher, R.; Li, L.-J.; Li, K.; and Fei-Fei, L. 2009. Imagenet: A large-scale hierarchical image database. In CVPR, 248--255

work page 2009