Pith. sign in

REVIEW 3 major objections 6 minor 56 references

Enhancing Adversarial Transferability via Component-Wise Transformation

T0 review · 3 major / 6 minor · reviewed 2026-08-10 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read The paper proposes a block-wise resize-and-rotate input transformation, Component-Wise Transformation (CWT), and claims it consistently raises attack success rates and stability for adversarial transfer across CNN and Transformer models…

desk verdict CWT is a plausible, well-tested variant in the block-transformation family, but the core scaling step is underspecified between prose and equations, and the stability claim outruns the tables. read the letter →

arxiv 2501.11901 v2 pith:SFBHMAE5 submitted 2025-01-21 cs.CV

Hangyu Liu , Bo Peng , Can Cui , Pengxiang Ding , Donglin Wang This is my paper · ORCID
classification cs.CV
keywords adversarialtransferabilityinputtransformationattackComponent-Wiseblack-boxblock-wiseinterpolationselectiverotationattentiondiversityImageNet
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper claims that a new input-transformation attack, Component-Wise Transformation (CWT), improves the transferability of adversarial examples between deep image classifiers by forcing one surrogate model to look at many different regions of an object. Where prior methods resize, shuffle, or rotate whole images or blocks with fixed recipes, CWT divides the image into blocks, randomly shrinks then enlarges each block (pre-interpolation plus block-wise scaling), and selectively rotates only a few blocks. On ImageNet, the authors report that CWT consistently outperforms state-of-the-art methods such as BSR in mean attack success rate and in stability (lower standard deviation) across CNN, Transformer, and defended target models. The paper's evidence for why it works is attention heatmaps: transformed images shift a single surrogate's attention across diverse object regions, matching the different regions that different target architectures would use. If the claim is right, black-box attackers get a computationally cheap transformation for crafting transferable perturbations that also holds up against several defenses.

What carries the argument

The carrying mechanism is the CWT transformation $T(x, n, N, s_{max}, k, r)$: the image is cut into $n \times n$ non-overlapping blocks; each block is shrunk by a random factor $s_{i,j}$ drawn uniformly from $[1, s_{max}]$, then enlarged by the same factor via bilinear interpolation; $k$ randomly chosen blocks are also rotated by an angle $r_{i,j}$ drawn uniformly from $(-r_{max}, r_{max})$; everything is cropped back to original shape and reassembled; and the gradient of $N$ such transformed copies is averaged inside the momentum-based attack loop. The named steps that carry the argument are pre-interpolation (the shrink before the enlarge, which the paper says removes redundant features) and selective rotation (limiting rotations to $k$ blocks to avoid the information loss of rotating everything). The ablations show attack success depends on block count, scale bound, rotation bound, number of rotated blocks, number of copies, and on the pre-interpolation step, which is what links the mechanism to the claimed effect.

What would settle it

A matched control that uses the same number of random block-wise scale-and-rotate operations but omits the pre-interpolation shrink-then-enlarge pair and the selective-rotation limit would settle the mechanism: if it matches CWT's attack success rates, attention diversification is not the operative cause.

Watch

Extended reading notes

Core claim

The central discovery is that block-wise interpolation with selective rotation, not global image transformation, decides whether an adversarial perturbation generated on one model will fool another. CWT partitions an image into a grid, applies a random shrink-then-enlarge interpolation to each block, rotates a subset of blocks by a small random angle, and averages gradients over twenty transformed copies inside MI-FGSM. The paper argues that this makes a single surrogate model attend to diverse regions of the object, so the resulting perturbation covers the regions of interest for many architectures at once. It reports that this design beats the strongest block-based baseline BSR by roughly three to five points in mean attack success rate, with lower standard deviation, across eight CNN and Transformer models and against adversarial training, high-level denoisers, randomized smoothing, and diffusion purification.

Load-bearing premise

The load-bearing premise is that the transferability gain comes from making one surrogate model attend to diverse object regions, a premise the paper supports with qualitative attention heatmaps rather than a cause-and-effect experiment.

Editorial extensions

If this is right

  • CWT's reported mean attack success rate is roughly three to five percentage points above BSR's, with a lower standard deviation, across the reported CNN and Transformer surrogate/target pairs.
  • Because CWT needs only the surrogate model's gradient and no target-model parameters, it can replace DIM, BSR, or other input transformations inside black-box transfer attacks.
  • The reported gains persist against adversarial training, the high-level denoiser, randomized smoothing, and diffusion purification, so the benefit is not confined to undefended ImageNet classifiers.
  • The ablations tie the gain to the CWT-specific choices: performance degrades when the image is treated as a single block, when more than a few blocks are rotated, when the scale factor exceeds about 1.3, or when the pre-interpolation step is removed.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Beyond the paper, the attention-diversification claim suggests a measurable design criterion for transfer attacks: transformed inputs should be chosen to maximize how much of the object a surrogate's attention map covers, and that coverage could be scored quantitatively instead of by eye.
  • Beyond the paper, the largest reported cross-architecture gains (CNN surrogates to Transformer targets) suggest that attention distance between architecture families is the operative quantity, so an experiment that varies architectural similarity in a controlled way would sharpen the hypothesis.
  • Beyond the paper, the tuned hyperparameters ($2\times2$ blocks, 1.3 max scale, 26 degrees rotation, 2 rotated blocks) were selected on ImageNet; if the mechanism is attention-driven, the optimal grid size and scale should shift with input resolution and object size, a testable prediction on other datasets.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 6 minor

Summary. The paper proposes Component-Wise Transformation (CWT), an input-transformation attack that partitions the input into n×n blocks, applies pre-interpolation downscaling followed by block-wise scaling and selective rotation, and averages gradients over N transformed copies within MI-FGSM to improve adversarial transferability. The authors evaluate on ImageNet with four CNN and four Transformer surrogate models and several defense settings, reporting mean attack success rate (ASR) improvements over BSR of about 1.1–3.7 points and lower standard deviations in most settings, and attribute the gains to diversification of the surrogate model's attention across object regions.

Significance. If the empirical results hold, CWT offers a practical, computationally cheap improvement over BSR and related block-based transformations, and the attention-diversification framing is thought-provoking. The paper's strengths include the breadth of the evaluation (eight surrogate models plus four defense settings, with consistent mean-ASR gains over the previous state of the art in most configurations) and the component ablations in Section 4.5. However, the central claims are limited by the ambiguity of the core transformation, the absence of code and error bars, the selection of hyperparameters on the same benchmark used for evaluation, and an overstated stability claim contradicted by the paper's own Table 2.

major comments (3)
  1. [3.3 (Eqs. 6–8)] The description of the two-step interpolation is internally inconsistent. The text states that after pre-interpolation (downscaling by s, Eq. 6) 'each block is scaled up using the same scaling factor s', but Eq. 8 defines the upscaled size as H'' = floor(H*s) rather than floor(H'*s) ≈ H. A reader implementing the prose with a standard two-pass resize (down by s, then up by s) obtains roughly the original size, i.e., no net zoom, whereas a reader implementing Eq. 8 obtains a net zoom by s followed by a random crop. Since the proposed mechanism and Section 3.3 explicitly motivate a zoom-in effect, and the reported gains over BSR are small (mean ASR gains of 1.1–3.7 points in Tables 1–2; 1.6 points for the ViT-B surrogate), the experimental numbers are not uniquely tied to a well-defined transformation. The authors must clarify whether H'' is H*s or H'*s and, ideally, release code to disambiguate the procedure.
  2. [Abstract and §4.3 (Table 2)] The claim that CWT 'consistently outperforms state-of-the-art methods in both attack success rates and stability' (Abstract) is contradicted by Table 2: for the ViT-B surrogate, CWT has a standard deviation of 5.1 across target models versus 4.4 for BSR, i.e., worse stability, even though the mean ASR is higher (81.9 vs 80.3). The same inversion appears in Appendix Table A3 under NRP for the ViT-B surrogate (CWT 7.7 vs BSR 6.9). The paper should either qualify the claim to 'in most settings' (as the main text already does in Sections 4.2–4.3) or provide a statistical test showing that the standard-deviation difference is not meaningful.
  3. [4.1 and 4.5] The empirical support for the central claim is weakened by the absence of error bars and by the selection of hyperparameters on the same evaluation benchmark. The final configuration (n=2, smax=1.3, r=26°, k=2, N=20) is derived from ablations in Figure 4 that optimize mean ASR on the same 1000-image ImageNet validation set used for the final comparisons. Since the differences over BSR are small (typically 1–4 points, and 1.6 points for the ViT-B surrogate), and since no repeated runs or confidence intervals are reported, it is not possible to rule out that the reported gains reflect overfitting to this particular benchmark and selection. The authors should evaluate on a separate validation/test split, report variance across multiple runs or bootstrap estimates, and ideally provide the code.
minor comments (6)
  1. [4.1] Section 4.1 states that 'all images are classified correctly by the models,' but Appendix A notes that the adversarially trained models do not achieve 100% clean accuracy; please clarify the filtering procedure.
  2. [Table A2] In the RN-101 block of Table A2, the US-MM row appears to have been copied from the RN-18 block: the surrogate column reads 99.4 with an asterisk, and the entire row is identical to the RN-18 surrogate row. This data entry error should be corrected and the corresponding mean and standard deviation recomputed.
  3. [Figure 2 caption] The Figure 2 caption states that CWT 'shifts the surrogate model's attention toward the central region of the object,' which appears to contradict the stated goal of diversifying attention across regions; please rephrase.
  4. [Appendix A] Citation [9] in the list of adversarially trained models (Geirhos et al., a texture-bias paper) seems incorrect; [38] (Tramèr et al.) is likely the intended source for the ensemble adversarially trained models.
  5. [Algorithm 1 and §4.1] Algorithm 1 and Section 4.1 use different names for the number of iterations ('T' vs. 'epoch'); align the notation.
  6. [4.5] In Section 4.5, the justification for setting r=26° is that fluctuations above 25° are 'insignificant' based on 'experimental error margins,' but no error estimates are given; please provide quantitative support or soften the claim.

Circularity Check

1 steps flagged · score 4.0 of 10

Hyperparameters are selected by ASR on the same ImageNet benchmark used for the headline tables, partially fitting the reported advantage; no derivation-chain circularity otherwise.

  1. fitted input called prediction [Section 4.5 (Ablation Study) and Section 4.1 (Experimental Setup)]
    "All experiments are conducted using RN-101 as the surrogate model. ... Consequently, we set n = 2. ... Therefore, we set smax = 1.3 as the optimal value for our experiments. ... Therefore, we select k = 2 as the optimal value. ... we set N = 20 in our experiments. ... For our method, CWT generates 20 scaled copies per iteration, divides the image into 2x2 blocks, applies a scaling factor ranging from 1.0 to 1.3, and applies a maximum rotation angle of 26◦, selectively rotating k = 2 blocks."

    The ablation in Section 4.5 selects n, smax, r, k, and N by their effect on attack success rate over the same eight-model ImageNet benchmark (RN-101 surrogate, seven black-box target models). Those selected values are then fixed in Section 4.1 and used to produce Tables 1-2 and the claim that CWT 'consistently outperforms state-of-the-art methods in both attack success rates and stability.' Because the reported metric is the same objective used to pick the configuration, the final comparison is partly a fitted result rather than an independent prediction: the chosen hyperparameters were optimized on the evaluation set.

full rationale

The paper contains no derivation chain in the sense of a theorem or first-principles result; CWT is an empirical input-transformation attack evaluated by ASR. There are no load-bearing self-citations, no imported uniqueness theorems, and no ansatz smuggled in via citation. The only genuine circularity concern is the fitted-input pattern: the ablation study tunes all key hyperparameters on the same benchmark that later supplies the headline comparisons, so the reported superiority is partially a consequence of test-set selection rather than a neutral prediction. This is real but partial: the transformation structure is fixed and the tables are actual measurements under the chosen configuration, so the central claim retains independent empirical content; I therefore set the score at 4 rather than 6. Separate non-circular issues noted but not scored here include the internal inconsistency between Eqs. 7-8 and the 'same scaling factor' prose (a reproducibility error) and the fact that Table 2's ViT-B row shows CWT std 5.1 vs BSR 4.4, so the abstract's 'consistently ... stability' claim overstates what the tables establish.

Assumptions & free parameters 7 free parameters · 4 assumptions · 0 invented entities

CWT introduces no new entities, but its empirical gains rest on several tuned hyperparameters and on an unproven attention-diversity mechanism. The free parameters are selected by ablation on the same benchmark used for the final numbers, which is the main circularity burden.

free parameters (7)
  • n (number of blocks) = 2
    Selected via ablation on RN-101 in Section 4.5 (Figure 4a); controls locality of transformations; n=2 is best on the same benchmark used for final evaluation.
  • smax (maximum scaling factor) = 1.3
    Ablation Section 4.5 (Figure 4b); smin is fixed at 1.0; values above 1.4 reduce ASR, so 1.3 is chosen.
  • r (maximum rotation angle) = 26 degrees
    Ablation Section 4.5 (Figure 4c); fluctuations above 25 degrees are dismissed as within error margins, so r=26 is a hand choice.
  • k (number of rotated blocks) = 2
    Ablation Section 4.5 (Figure 4d); increasing k degrades ASR on most target models, so k=2 is chosen.
  • N (number of transformed copies) = 20
    Ablation Section 4.5 (Figure 4e); larger N helps but is set to 20 for consistency with BSR and to limit compute.
  • mi_fgsm_decay_mu = 1.0
    Momentum decay factor from MI-FGSM, stated in Evaluation Settings (Section 4.1); not tuned by the authors.
  • interpolation_method = bilinear
    Chosen in Appendix B based on qualitative heatmap comparison of bilinear, bicubic, nearest-neighbor, and area interpolation; no quantitative criterion.
assumptions (4)
  • domain assumption Models trained on the same task share a latent space that gradient-based attacks can exploit
    Motivation Section 3.2 cites the Platonic representation hypothesis [16]; if false, transfer attacks in general lose their basis.
  • ad hoc to paper Diversifying the surrogate model's attention regions across transformed images improves transferability
    Central hypothesis in Sections 3.2 and 3.3, supported only by qualitative Grad-CAM figures, not by a controlled experiment.
  • domain assumption Bilinear interpolation preserves enough image semantics for gradients to remain useful
    Appendix B compares interpolation methods qualitatively; no quantitative evaluation is provided.
  • domain assumption Averaging gradients over N=20 random transformations gives a stable estimate of the expected gradient
    Equation 11; no variance or convergence analysis is provided.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Enhancing Adversarial Transferability via Component-Wise Transformation." pith.science (2026). https://pith.science/paper/SFBHMAE5

@misc{pith2026250111901,
  author       = {Pith},
  title        = {Pith review of: Enhancing Adversarial Transferability via Component-Wise Transformation},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/SFBHMAE5}},
  note         = {Machine review of arXiv:2501.11901}
}
read the original abstract

Deep Neural Networks (DNNs) are highly vulnerable to adversarial examples, which pose significant challenges in security-sensitive applications. Among various adversarial attack strategies, input transformation-based attacks have demonstrated remarkable effectiveness in enhancing adversarial transferability. However, existing methods still perform poorly across different architectures, even though they have achieved promising results within the same architecture. This limitation arises because, while models of the same architecture may focus on different regions of the object, the variation is even more pronounced across different architectures. Unfortunately, current approaches fail to effectively guide models to attend to these diverse regions. To address this issue, this paper proposes a novel input transformation-based attack method, termed Component-Wise Transformation (CWT). CWT applies interpolation and selective rotation to individual image blocks, ensuring that each transformed image highlights different target regions, thereby improving the transferability of adversarial examples. Extensive experiments on the standard ImageNet dataset show that CWT consistently outperforms state-of-the-art methods in both attack success rates and stability across CNN- and Transformer-based models.

Figures

Figures reproduced from arXiv: 2501.11901 by the authors.

Figure 1
Figure 1. There shows our CWT process for image transforma￾tion. The heatmaps generated on ResNet-18. Our method success￾fully enables a single surrogate model to focus on different regions of an object. not only affects model performance on standard test datasets but poses severe risks in high-stakes applications [6, 36, 53] such as autonomous driving and medical diagnostics. In black-box scenarios, attackers lack access to … view at source ↗
Figure 2
Figure 2. The heatmaps generated on ResNet-18 of raw image and [PITH_FULL_IMAGE:figures/full_fig_p002_2.png] view at source ↗
Figure 3
Figure 3. Demonstration of the different discriminative regions of the different models. We adopt Grad-CAM [34] to visualize the attention maps of four CNN-based models—ResNet-18, ResNext-50, ResNet-101, DenseNet-121 and two Transformer-base models￾Swin,Vit. between our approach and other methods, we also summa￾rize the distinctions between our method and DIM [50], as well as BSR [39]. 3.1. Preliminaries Given a target model … view at source ↗
Figures from the paper (2 more)
Figure 4
Figure 4. Figure 4: Attack success rates (%) of various models on the adversarial examples generated by CWT with different numbers of blocks, [PITH_FULL_IMAGE:figures/full_fig_p008_4.png]
Figure 5
Figure 5. Figure 5: Attack success rates (%) of various models on the [PITH_FULL_IMAGE:figures/full_fig_p008_5.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

56 extracted references · 34 canonical work pages

  1. [1]

    An adaptive model ensemble adversarial attack for boosting adversarial transferability

    Bin Chen, Jiali Yin, Shukai Chen, Bohao Chen, and Xi- meng Liu. An adaptive model ensemble adversarial attack for boosting adversarial transferability. In Proceedings of the IEEE/CVF International Conference on Computer Vi- sion, pages 4489–4498, 2023. 1

    work page 2023

  2. [2]

    Visformer: The vision-friendly transformer

    Zhengsu Chen, Lingxi Xie, Jianwei Niu, Xuefeng Liu, Longhui Wei, and Qi Tian. Visformer: The vision-friendly transformer. In Proceedings of the IEEE/CVF international conference on computer vision, pages 589–598, 2021. 5

    work page 2021

  3. [3]

    Certified adversarial robustness via randomized smoothing

    Jeremy Cohen, Elan Rosenfeld, and Zico Kolter. Certified adversarial robustness via randomized smoothing. In inter- national conference on machine learning, pages 1310–1320. PMLR, 2019. 2, 5

    work page 2019

  4. [4]

    Boosting adversarial at- tacks with momentum

    Yinpeng Dong, Fangzhou Liao, Tianyu Pang, Hang Su, Jun Zhu, Xiaolin Hu, and Jianguo Li. Boosting adversarial at- tacks with momentum. In Proceedings of the IEEE con- ference on computer vision and pattern recognition , pages 9185–9193, 2018. 1, 3, 5

    work page 2018

  5. [5]

    An image is worth 16x16 words: Transformers for image recognition at scale

    Alexey Dosovitskiy. An image is worth 16x16 words: Transformers for image recognition at scale. arXiv preprint arXiv:2010.11929, 2020. 5

    arXiv 2010

  6. [6]

    Robust physical-world attacks on deep learning visual classification

    Kevin Eykholt, Ivan Evtimov, Earlence Fernandes, Bo Li, Amir Rahmati, Chaowei Xiao, Atul Prakash, Tadayoshi Kohno, and Dawn Song. Robust physical-world attacks on deep learning visual classification. In Proceedings of the IEEE conference on computer vision and pattern recogni- tion, pages 1625–1634, 2018. 1

    work page 2018

  7. [7]

    Transferable Adversarial Examples with Bayes Approach

    Mingyuan Fan, Cen Chen, Ximeng Liu, and Wenzhong Guo. Maskblock: Transferable adversarial examples with bayes approach. arXiv preprint arXiv:2208.06538, 2022. 2, 5

    work page Pith review arXiv 2022

  8. [8]

    Patch-wise attack for fooling deep neu- ral network

    Lianli Gao, Qilong Zhang, Jingkuan Song, Xianglong Liu, and Heng Tao Shen. Patch-wise attack for fooling deep neu- ral network. In Computer Vision–ECCV 2020: 16th Euro- pean Conference, Glasgow, UK, August 23–28, 2020, Pro- ceedings, Part XXVIII 16 , pages 307–322. Springer, 2020. 1

    work page 2020

Show all 56 references
  1. [9]

    Imagenet-trained cnns are biased towards texture; increasing shape bias improves accuracy and robustness

    Robert Geirhos, Patricia Rubisch, Claudio Michaelis, Matthias Bethge, Felix A Wichmann, and Wieland Brendel. Imagenet-trained cnns are biased towards texture; increasing shape bias improves accuracy and robustness. In Interna- tional conference on learning representations, 2018. 1

    2018

  2. [10]

    Explaining and harnessing adversarial examples

    Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6572, 2014. 1

    2014 arXiv

  3. [11]

    Scalable verified training for provably robust image classification

    Sven Gowal, Krishnamurthy Dj Dvijotham, Robert Stan- forth, Rudy Bunel, Chongli Qin, Jonathan Uesato, Relja Arandjelovic, Timothy Mann, and Pushmeet Kohli. Scalable verified training for provably robust image classification. In Proceedings of the IEEE/CVF International Confere...

    2019

  4. [12]

    Deep residual learning for image recognition

    Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In Proceed- ings of the IEEE conference on computer vision and pattern recognition, pages 770–778, 2016. 1, 5

    2016

  5. [13]

    Rethinking spa- tial dimensions of vision transformers

    Byeongho Heo, Sangdoo Yun, Dongyoon Han, Sanghyuk Chun, Junsuk Choe, and Seong Joon Oh. Rethinking spa- tial dimensions of vision transformers. In Proceedings of the IEEE/CVF international conference on computer vision, pages 11936–11945, 2021. 5

    2021

  6. [14]

    Squeeze-and-excitation net- works

    Jie Hu, Li Shen, and Gang Sun. Squeeze-and-excitation net- works. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 7132–7141, 2018. 1

    2018

  7. [15]

    Densely connected convolutional net- works

    Gao Huang, Zhuang Liu, Laurens Van Der Maaten, and Kil- ian Q Weinberger. Densely connected convolutional net- works. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 4700–4708, 2017. 5

    2017

  8. [16]

    The platonic representation hypothesis

    Minyoung Huh, Brian Cheung, Tongzhou Wang, and Phillip Isola. The platonic representation hypothesis. arXiv preprint arXiv:2405.07987, 2024. 3

    2024 arXiv

  9. [17]

    Ad- versarial examples in the physical world

    Alexey Kurakin, Ian J Goodfellow, and Samy Bengio. Ad- versarial examples in the physical world. In Artificial in- telligence safety and security , pages 99–112. Chapman and Hall/CRC, 2018. 1

    2018

  10. [18]

    Making substitute models more bayesian can enhance transferability of adversarial examples

    Qizhang Li, Yiwen Guo, Wangmeng Zuo, and Hao Chen. Making substitute models more bayesian can enhance transferability of adversarial examples. arXiv preprint arXiv:2302.05086, 2023. 1

    2023 arXiv

  11. [19]

    Defense against adversarial attacks using high-level representation guided denoiser

    Fangzhou Liao, Ming Liang, Yinpeng Dong, Tianyu Pang, Xiaolin Hu, and Jun Zhu. Defense against adversarial attacks using high-level representation guided denoiser. In Proceed- ings of the IEEE conference on computer vision and pattern recognition, pages 1778–1787, 2018. 2, 5

    2018

  12. [20]

    Nesterov accelerated gradient and scale invariance for adversarial attacks

    Jiadong Lin, Chuanbiao Song, Kun He, Liwei Wang, and John E Hopcroft. Nesterov accelerated gradient and scale invariance for adversarial attacks. arXiv preprint arXiv:1908.06281, 2019. 1, 2, 5

    1908 arXiv

  13. [21]

    Delving into transferable adversarial examples and black- box attacks

    Yanpei Liu, Xinyun Chen, Chang Liu, and Dawn Song. Delving into transferable adversarial examples and black- box attacks. arXiv preprint arXiv:1611.02770, 2016. 1

    2016 arXiv

  14. [22]

    Swin transformer: Hierarchical vision transformer using shifted windows

    Ze Liu, Yutong Lin, Yue Cao, Han Hu, Yixuan Wei, Zheng Zhang, Stephen Lin, and Baining Guo. Swin transformer: Hierarchical vision transformer using shifted windows. In Proceedings of the IEEE/CVF international conference on computer vision, pages 10012–10022, 2021. 5

    2021

  15. [23]

    Fully convolutional networks for semantic segmentation

    Jonathan Long, Evan Shelhamer, and Trevor Darrell. Fully convolutional networks for semantic segmentation. In Pro- ceedings of the IEEE conference on computer vision and pat- tern recognition, pages 3431–3440, 2015. 1

    2015

  16. [24]

    Improving adversarial transferability via model alignment

    Avery Ma, Amir-massoud Farahmand, Yangchen Pan, Philip Torr, and Jindong Gu. Improving adversarial transferability via model alignment. In European Conference on Computer Vision, pages 74–92. Springer, 2025. 1

    2025

  17. [25]

    Towards deep learning models resis- tant to adversarial attacks

    Aleksander Madry. Towards deep learning models resis- tant to adversarial attacks. arXiv preprint arXiv:1706.06083,

    arXiv

  18. [26]

    A self-supervised approach for adversarial robustness

    Muzammal Naseer, Salman Khan, Munawar Hayat, Fa- had Shahbaz Khan, and Fatih Porikli. A self-supervised approach for adversarial robustness. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 262–271, 2020. 2, 1

    2020

  19. [27]

    Diffusion models for adversarial purification

    Weili Nie, Brandon Guo, Yujia Huang, Chaowei Xiao, Arash Vahdat, and Anima Anandkumar. Diffusion models for adversarial purification. arXiv preprint arXiv:2205.07460 ,

    arXiv

  20. [28]

    Size matters: large objects capture atten- tion in visual search

    Michael J Proulx. Size matters: large objects capture atten- tion in visual search. PloS one, 5(12):e15293, 2010. 4

    2010

  21. [29]

    Cer- tified defenses against adversarial examples

    Aditi Raghunathan, Jacob Steinhardt, and Percy Liang. Cer- tified defenses against adversarial examples. arXiv preprint arXiv:1801.09344, 2018. 2

    2018 arXiv

  22. [30]

    Yolov3: An incremental improvement

    Joseph Redmon. Yolov3: An incremental improvement. arXiv preprint arXiv:1804.02767, 2018. 1

    2018 arXiv

  23. [31]

    Faster r-cnn: Towards real-time object detection with region proposal networks

    Shaoqing Ren, Kaiming He, Ross Girshick, and Jian Sun. Faster r-cnn: Towards real-time object detection with region proposal networks. IEEE transactions on pattern analysis and machine intelligence, 39(6):1137–1149, 2016. 1

    2016

  24. [32]

    U- net: Convolutional networks for biomedical image segmen- tation

    Olaf Ronneberger, Philipp Fischer, and Thomas Brox. U- net: Convolutional networks for biomedical image segmen- tation. In Medical image computing and computer-assisted intervention–MICCAI 2015: 18th international conference, Munich, Germany, October 5-9, 2015, proceedings, pa...

    2015

  25. [33]

    Learning transferable adversarial perturbations

    Mathieu Salzmann et al. Learning transferable adversarial perturbations. Advances in Neural Information Processing Systems, 34:13950–13962, 2021. 1

    2021

  26. [34]

    Grad-cam: Why did you say that? arXiv preprint arXiv:1611.07450, 2016

    Ramprasaath R Selvaraju, Abhishek Das, Ramakrishna Vedantam, Michael Cogswell, Devi Parikh, and Dhruv Ba- tra. Grad-cam: Why did you say that? arXiv preprint arXiv:1611.07450, 2016. 3

    2016 arXiv

  27. [35]

    Adversarial training for free! Advances in neural information processing systems , 32, 2019

    Ali Shafahi, Mahyar Najibi, Mohammad Amin Ghiasi, Zheng Xu, John Dickerson, Christoph Studer, Larry S Davis, Gavin Taylor, and Tom Goldstein. Adversarial training for free! Advances in neural information processing systems , 32, 2019. 2, 5

    2019

  28. [36]

    Accessorize to a crime: Real and stealthy attacks on state-of-the-art face recognition

    Mahmood Sharif, Sruti Bhagavatula, Lujo Bauer, and Michael K Reiter. Accessorize to a crime: Real and stealthy attacks on state-of-the-art face recognition. In Proceedings of the 2016 acm sigsac conference on computer and commu- nications security, pages 1528–1540, 2016. 1

    2016

  29. [37]

    Intriguing properties of neural networks

    C Szegedy. Intriguing properties of neural networks. arXiv preprint arXiv:1312.6199, 2013. 1

    2013 arXiv

  30. [38]

    Ensemble adversarial training: Attacks and defenses

    Florian Tram `er, Alexey Kurakin, Nicolas Papernot, Ian Goodfellow, Dan Boneh, and Patrick McDaniel. Ensemble adversarial training: Attacks and defenses. arXiv preprint arXiv:1705.07204, 2017. 1

    2017 arXiv

  31. [39]

    Boosting adversarial transferability by block shuffle and rotation

    Kunyu Wang, Xuanran He, Wenxuan Wang, and Xiaosen Wang. Boosting adversarial transferability by block shuffle and rotation. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 24336– 24346, 2024. 2, 3, 5

    2024

  32. [40]

    Boost adversarial transferability by uniform scale and mix mask method.arXiv preprint arXiv:2311.12051, 2023

    Tao Wang, Zijian Ying, Qianmu Li, et al. Boost adversarial transferability by uniform scale and mix mask method.arXiv preprint arXiv:2311.12051, 2023. 2, 5

    2023 arXiv

  33. [41]

    Enhancing the transferability of adversarial attacks through variance tuning

    Xiaosen Wang and Kun He. Enhancing the transferability of adversarial attacks through variance tuning. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 1924–1933, 2021. 1

    1924

  34. [42]

    Admix: Enhancing the transferability of adversarial attacks

    Xiaosen Wang, Xuanran He, Jingdong Wang, and Kun He. Admix: Enhancing the transferability of adversarial attacks. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 16158–16167, 2021. 2, 5

    2021

  35. [43]

    Multi-stage optimization based adversarial training

    Xiaosen Wang, Chuanbiao Song, Liwei Wang, and Kun He. Multi-stage optimization based adversarial training. arXiv preprint arXiv:2106.15357, 2021. 2

    2021 arXiv

  36. [44]

    Struc- ture invariant transformation for better adversarial transfer- ability

    Xiaosen Wang, Zeliang Zhang, and Jianping Zhang. Struc- ture invariant transformation for better adversarial transfer- ability. In Proceedings of the IEEE/CVF International Con- ference on Computer Vision, pages 4607–4619, 2023. 2

    2023

  37. [45]

    Better diffusion models further improve adversarial training

    Zekai Wang, Tianyu Pang, Chao Du, Min Lin, Weiwei Liu, and Shuicheng Yan. Better diffusion models further improve adversarial training. InInternational Conference on Machine Learning, pages 36246–36263. PMLR, 2023. 2

    2023

  38. [46]

    Boosting adversarial transfer- ability with learnable patch-wise masks

    Xingxing Wei and Shiji Zhao. Boosting adversarial transfer- ability with learnable patch-wise masks. IEEE Transactions on Multimedia, 2023. 2

    2023

  39. [47]

    Towards transferable adversarial attacks on vision transformers

    Zhipeng Wei, Jingjing Chen, Micah Goldblum, Zuxuan Wu, Tom Goldstein, and Yu-Gang Jiang. Towards transferable adversarial attacks on vision transformers. In Proceedings of the AAAI Conference on Artificial Intelligence, pages 2668– 2676, 2022. 1

    2022

  40. [48]

    Skip connections matter: On the transferabil- ity of adversarial examples generated with resnets

    Dongxian Wu, Yisen Wang, Shu-Tao Xia, James Bailey, and Xingjun Ma. Skip connections matter: On the transferabil- ity of adversarial examples generated with resnets. arXiv preprint arXiv:2002.05990, 2020. 1

    2002 arXiv

  41. [49]

    Feature denoising for improving ad- versarial robustness

    Cihang Xie, Yuxin Wu, Laurens van der Maaten, Alan L Yuille, and Kaiming He. Feature denoising for improving ad- versarial robustness. In Proceedings of the IEEE/CVF con- ference on computer vision and pattern recognition , pages 501–509, 2019. 2

    2019

  42. [50]

    Improving transferabil- ity of adversarial examples with input diversity

    Cihang Xie, Zhishuai Zhang, Yuyin Zhou, Song Bai, Jianyu Wang, Zhou Ren, and Alan L Yuille. Improving transferabil- ity of adversarial examples with input diversity. In Proceed- ings of the IEEE/CVF conference on computer vision and pattern recognition, pages 2730–2739, 2019. ...

    2019

  43. [51]

    Aggregated residual transformations for deep neural networks

    Saining Xie, Ross Girshick, Piotr Doll ´ar, Zhuowen Tu, and Kaiming He. Aggregated residual transformations for deep neural networks. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 1492–1500,

  44. [52]

    Stochastic variance reduced ensemble adver- sarial attack for boosting the adversarial transferability

    Yifeng Xiong, Jiadong Lin, Min Zhang, John E Hopcroft, and Kun He. Stochastic variance reduced ensemble adver- sarial attack for boosting the adversarial transferability. In Proceedings of the IEEE/CVF conference on computer vi- sion and pattern recognition, pages 14983–14992, 2022. 1

    2022

  45. [53]

    Natural color fool: Towards boosting black-box unrestricted attacks

    Shengming Yuan, Qilong Zhang, Lianli Gao, Yaya Cheng, and Jingkuan Song. Natural color fool: Towards boosting black-box unrestricted attacks. Advances in Neural Informa- tion Processing Systems, 35:7546–7560, 2022. 1

    2022

  46. [54]

    Improving the transferability of adversarial samples by path- augmented method

    Jianping Zhang, Jen-tse Huang, Wenxuan Wang, Yichen Li, Weibin Wu, Xiaosen Wang, Yuxin Su, and Michael R Lyu. Improving the transferability of adversarial samples by path- augmented method. In Proceedings of the IEEE/CVF Con- ference on Computer Vision and Pattern Recognition,...

    2023

  47. [55]

    Mllms know where to look: Training-free per- ception of small visual details with multimodal llms

    Jiarui Zhang, Mahyar Khayatkhoei, Prateek Chhikara, and Filip Ilievski. Mllms know where to look: Training-free per- ception of small visual details with multimodal llms. arXiv preprint arXiv:2502.17422, 2025. 4

    2025 arXiv

  48. [56]

    Learning to transform dynamically for better adversarial transferability

    Rongyi Zhu, Zeliang Zhang, Susan Liang, Zhuo Liu, and Chenliang Xu. Learning to transform dynamically for better adversarial transferability. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages 24273–24283, 2024. 2 Enhancing Adversarial...

    2024

Pith tools

Reviewed August 10, 2026 · model on record in the stance chip above.