Pith. sign in

REVIEW 4 major objections 5 minor 44 references

Temporal Consistency Constrained Transferable Adversarial Attacks with Background Mixup for Action Recognition

T0 review · 4 major / 5 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read The paper claims that mixing video frames with category backgrounds selected by reinforcement learning, plus a temporal gradient consistency loss, substantially improves adversarial example transferability across action recognition models.

desk verdict Background-mixup idea is fresh, but the transfer reward leaks target-model info into attack generation, so the headline transferability numbers don't support the claim as-is. read the letter →

arxiv 2505.17807 v1 pith:6NZJILK5 submitted 2025-05-23 cs.CV

Ping Li , Jianan Ni , Bo Pang This is my paper · ORCID
classification cs.CV
keywords adversarialattacktransferabilityactionrecognitionbackgroundmixuptemporalconsistencyreinforcementlearningblack-boxvideoexamples
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Adversarial examples for action recognition models typically fail to transfer when the surrogate model's decision boundary differs from the target model's. This paper proposes a transferable attack, BMTC, that instead transforms the input by mixing each clean frame with a background frame from another action category, where a reinforcement-learned Mixer chooses the background with the strongest attack reward, transfer reward, and temporal consistency. It also stabilizes the attack direction across frames with a background attack loss and a temporal gradient consistency loss. The authors report that on UCF101, Kinetics-400, and ImageNet, BMTC raises attack success rates substantially over prior methods, including against transformer-based video models. If the claim holds, an attacker with one white-box surrogate could craft video perturbations that generalize to many black-box action recognizers.

What carries the argument

Two modules carry the argument. The Background Adversarial Mixup (BAM) module builds an admixed sample $\tilde{X} = (1-\gamma) X + \gamma X_{\text{back}}$ by blending each clean frame with a background video from another category picked by a Mixer (ResNet50 feature extractor plus classification head) trained with the total reward $R_{\text{total}} = R_{\text{attack}} + \alpha_1 R_{\text{transfer}} + \alpha_2 R_{\text{tbc}}$. The Background-induced Temporal Gradient enhancement (BTG) module adds the loss $L_{\text{total}} = L_{\text{back}} + \beta L_{\text{tgc}}$, where $L_{\text{back}}$ maximizes the surrogate's confidence in the selected background category and $L_{\text{tgc}}$ is the cosine distance between gradients of neighboring adversarial frames; PGD then updates the perturbation. The admixed sample serves as the initialization, so the semantic shift toward another category's background does the attacking work, while the temporal losses keep the attack direction coherent across frames.

What would settle it

Remove the transfer reward $R_{\text{transfer}}$ from the background selection, or hold the M target models out of the reward computation entirely, and rerun the UCF101 and Kinetics-400 evaluations; if the attack success rates against those held-out models fall to the Temporal Translation baseline, the claimed black-box transfer depends on target-model queries during attack generation.

Watch

Extended reading notes

Core claim

The paper's central claim is that adversarial transferability across video models can be improved without relying on similar decision boundaries, by attacking semantics rather than just gradients. The method first fine-tunes the surrogate model to also classify backgrounds, then, for each video, an adversarial Mixer selects one background frame from each category using reinforcement learning, with rewards for attack success, cross-model transfer, and temporal background consistency; the selected backgrounds are blended into nearby frames. Adversarial example generation then maximizes a background attack loss that pushes predictions toward the chosen background category while a temporal gradient consistency loss keeps gradients of adjacent frames aligned. On UCF101, using a SlowFast-101 surrogate, the attack success rate against a TPN-50 target rises from 38.61% with Temporal Translation to 66.34% with BMTC, and similar gains are reported on Kinetics-400 and against Vision Transformer models.

Load-bearing premise

The method assumes the attacker can query the target models' predictions to select which background frames to mix, so the reported transferability advantage depends on that access rather than purely on model-agnostic input transformation.

Editorial extensions

If this is right

  • Adversarial examples generated with BMTC transfer across architectures with different inductive biases, including CNN-based models and Vision Transformers such as VideoSwin and TimeSformer.
  • The cross-modal experiments show an attacker can use image surrogates to produce video adversarial examples, so no video surrogate is required for the method to work.
  • With only around one-tenth the FLOPs of Temporal Translation and a higher attack success rate, the method offers a practical cost-performance tradeoff for generating transferable video perturbations.
  • The attack success rate grows with the perturbation budget and iteration count until saturation, so users can adjust $\epsilon$ and $N_{\text{iter}}$ to balance imperceptibility against transferability.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • A natural stress test is to replace the target-model transfer reward with a surrogate-only proxy, such as an ensemble of augmentation views or feature-statistics diversity, and check whether the transfer gains survive without any target-model access.
  • The background mixup mechanism could be inverted for defense: training action recognizers to be invariant to background category swaps might reduce the attack surface this method exploits.
  • The reinforcement-learned background selector effectively ranks which category contexts most confuse a surrogate, a side signal that could be reused for interpretability or for targeted attacks toward specific background categories.
  • Combining the temporal gradient consistency loss with other input-transformation attacks, such as translation invariance or scale invariance, may stack gains since the two mechanisms regularize different failure modes.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper proposes BMTC (Background Mixup-induced Temporal Consistency), an adversarial attack method for action recognition models. The method has two components: a Background Adversarial Mixup (BAM) module that selects background frames from other categories via a reward-based selection mechanism, and a Background-induced Temporal Gradient enhancement (BTG) module that adds a background attack loss and a temporal gradient consistency loss. The authors report experiments on UCF101, Kinetics-400, and ImageNet, claiming large gains in attack success rate over prior transfer-based attacks such as Temporal Translation, including on transformer-based video models. The central claim is that BMTC significantly boosts the black-box transferability of adversarial examples across action and image recognition models.

Significance. If the reported transferability gains were obtained under a standard surrogate-only black-box protocol, the paper would make a useful contribution to adversarial video attacks, particularly for transformer-based recognizers. The manuscript also provides a code repository and evaluates on multiple datasets and architectures. However, the reported gains are compromised by a protocol issue: the transfer reward in Eq. (4)-(6) consumes predictions from the very models that later appear as evaluation victims in Tables 1-3 and 6. This makes the comparison with baselines not apples-to-apples and means the central transferability claim is not established by the current evidence. The paper also contains several equation-level inconsistencies that hinder reproducibility.

major comments (4)
  1. [§3.2, Eq. (4)-(6); §4.2] The transfer reward R_transfer is computed using predictions from M target models, and Section 4.2 sets M to the same NL, SlowFast, and TPN models (or the four image models) that are later used as evaluation targets in Tables 1-3 and 6. This violates the black-box transfer setting defined in Section 3.1, where the attacker has no access to the target model. During attack construction, the background-frame selection is rewarded for fooling the very models against which ASR is later measured, so part of the reported transferability is attributable to query or ensemble access to the victims. The baselines (PGD, TT, etc.) receive no such signal. Table 12 shows that varying α1 changes results materially (e.g., 62.38 to 71.28 for NL-101→SF-101), confirming the effect is not negligible. An ablation removing R_transfer, or an evaluation against held-out models not used in the reward, is required before the claim of improved transferability can be assessed; without it, the tables do not support the abstract's assertion.
  2. [§3.3, Eq. (7)] Eq. (7) does not match the prose. The text says the loss 'maximize[s] the cross-entropy loss of other categories and minimize[s] that of the background category', but the equation as written is L_back = -∑_{j≠k'-K} y_j log ŷ_j + y_{k'-K} log ŷ_{k'-K}. If y is the one-hot true label, the first term is the negative cross-entropy of the true class (when the true class is not the background class), not the cross-entropy of other categories. Combined with the PGD update in Eq. (11), the effect of the equation as written is ambiguous and at odds with the described attack direction. This makes the central loss definition unreproducible and needs to be corrected and clarified.
  3. [§3.2, Eq. (4)] The transfer reward is defined as R_transfer = (1/K) ∑_{m=1}^{M} R^m_attack, but the average should be over the M target models. Since K is the number of action categories (101 or 400) and M is 3 or 4, the normalization is off by a factor of roughly 33. This changes the effective contribution of α1 in Eq. (6), so the reported hyper-parameter ablation in Table 12 and the relative importance of R_transfer are not interpretable as stated.
  4. [Appendix B.7, Table 16] Table 16 contains entries that are inconsistent with the corresponding results in Table 1. For example, with NL-101 as the surrogate, the Ours row reports attack success rates of 9.60 and 2.57 on TPN-101 and TPN-50, while Table 1 reports 82.17 and 73.27 for the same pairs. Either the table is mis-formatted or the experiment protocol differs from the main tables; this needs clarification because it affects the validity of the defense-evaluation claims.
minor comments (5)
  1. [§4.1] The evaluation uses one randomly selected video per category with no standard deviation or repeated trials; the claim of 'significantly boosts' would be stronger with multiple seeds and variance reporting.
  2. [§3.2] The mechanism of computing three rewards and selecting the top-scoring background frame is described as 'reinforcement learning', but no policy update, value function, or RL training procedure is specified; it is a greedy reward-based selection.
  3. [Appendix B.6] The appendix contains corrupted text fragments (e.g., '/uni00000031/uni0000002f/...') that should be removed before publication.
  4. [§4.2] The weight decay is written as '1e4', which presumably should be '1e-4'.
  5. [Appendix B.3, Table 12] In the first block of Table 12, the α1 column is missing an entry for the value 0 (the header shows '0 0.1 0.3 * 0.5' but the first row starts at 0.1); please verify the formatting.

Circularity Check

1 steps flagged · score 6.0 of 10

Reported transferability is partially constructed: the transfer reward uses predictions from the same target models later scored as victims.

  1. fitted input called prediction [Section 3.2, Eq. (4)-(6); Section 4.2 Experimental Settings; Tables 1-3 and 6]
    "To improve the transferability of adversarial example across different models, we provide the transfer reward Rtransf er to attack M black-box target models, and averages their attack rewards, i.e., Rtransf er = 1/K Σ_{m=1}^M R^m_attack ... Rtotal = Rattack + α1 × Rtransf er + α2 × Rtbc ... The model number M is 3 for video and 4 for image. ... For action recognition, we examine three CNN models ... Non-local network (NL), SlowFast (SF), and Temporal Pyramid Networks (TPN)."

    The M target models used in R_transfer are exactly the models reported as evaluation victims: NL, SF, TPN in Tables 1-3 and ResNet18/ResNet101/ResNeXt50/DenseNet121 in Table 6. R_attack = max{hat y\k} - hat y_k is a per-sample misclassification proxy, closely matching the ASR metric. During background-frame selection, R_transfer is optimized against these models' predictions, so the final adversarial example is constructed using signals from the same models on which ASR is later measured. This is target-model-dependent adaptation rather than an independent test of transferability.

full rationale

The paper's own equations and experimental settings show that the background-frame selection, a load-bearing component of the attack, is rewarded for fooling the exact models that later appear as victims in the transferability tables. Because R_transfer averages attack rewards over those target models and contributes to the total reward with weight alpha1=0.3, the reported ASR gains on those models are not purely transfer-based predictions; they include an optimization signal from the evaluation victims. This is a form of fitted-input-called-prediction circularity: the method is partially fitted to the models it then claims to transfer to. The circularity is partial rather than total: the final perturbation is still optimized through the surrogate model's gradients, and Table 12 shows meaningful performance even at alpha1=0, so the method has independent content. However, the headline claim that BMTC 'significantly boosts transferability' is not established by the main tables because the contribution of R_transfer is not isolated. No self-citation or imported-uniqueness issues were found; the concern is confined to the target-model reward in the attack-generation loop.

Assumptions & free parameters 9 free parameters · 5 assumptions · 0 invented entities

The method relies on a set of hand-chosen hyperparameters and on a target-dependent reward. There are no new physical or mathematical entities. The main hidden cost is the requirement that attack generation consumes predictions from the models that later serve as victims, which is a nonstandard and potentially circular source of information.

free parameters (9)
  • mixup ratio gamma = 0.2
    Set by ablation on UCF101; the attack performance peaks at 0.2 and drops at higher values.
  • background loss weight lambda = 0.2
    Chosen empirically to balance action loss and background loss during surrogate fine-tuning.
  • transfer reward weight alpha1 = 0.3
    Ablated in Table 12; best at 0.3.
  • temporal background consistency reward weight alpha2 = 0.1
    Ablated in Table 12; best at 0.1.
  • temporal gradient consistency loss weight beta = 0.1
    Ablated in Table 9; best at 0.1.
  • step size eta = 1.6 video, 0.8 image
    Standard PGD setting tied to the epsilon and iteration count.
  • maximum perturbation epsilon = 16 video, 8 image
    Chosen as a trade-off between attack success and perceptibility, following prior video attack work.
  • iteration count Niter = 10
    Ablated in Table 8; performance saturates around 10.
  • number of target models M in transfer reward = 3 video, 4 image
    The reward uses the same models that are later used as evaluation victims.
assumptions (5)
  • standard math Projected gradient descent optimization with cross-entropy loss is a valid attack framework.
    Adopted from Madry et al. and used without proof in Eq. (11).
  • domain assumption Background category correlates with action category, so mixing a background from another category can mislead the model.
    Stated in Sec. 3.2 as the rationale for background adversarial mixup.
  • domain assumption Zero-shot video object segmentation (Isomer) extracts reliable background frames.
    The method depends on the quality of the segmentation to produce meaningful category backgrounds, stated in Sec. 3.2.
  • ad hoc to paper The reward-selection procedure is treated as reinforcement learning even though no RL training update is specified.
    Sec. 3.2 describes computing attack, transfer, and temporal consistency rewards and selecting the top-scoring background; no policy gradient or Bellman update is given.
  • ad hoc to paper Using predictions from the target models during background selection is acceptable in the black-box setting.
    Eq. (4)-(6) require access to M target model predictions to compute R_transfer, which is not the standard transfer-based black-box setting claimed in Sec. 3.1.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Temporal Consistency Constrained Transferable Adversarial Attacks with Background Mixup for Action Recognition." pith.science (2026). https://pith.science/paper/6NZJILK5

@misc{pith2026250517807,
  author       = {Pith},
  title        = {Pith review of: Temporal Consistency Constrained Transferable Adversarial Attacks with Background Mixup for Action Recognition},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/6NZJILK5}},
  note         = {Machine review of arXiv:2505.17807}
}
read the original abstract

Action recognition models using deep learning are vulnerable to adversarial examples, which are transferable across other models trained on the same data modality. Existing transferable attack methods face two major challenges: 1) they heavily rely on the assumption that the decision boundaries of the surrogate (a.k.a., source) model and the target model are similar, which limits the adversarial transferability; and 2) their decision boundary difference makes the attack direction uncertain, which may result in the gradient oscillation, weakening the adversarial attack. This motivates us to propose a Background Mixup-induced Temporal Consistency (BMTC) attack method for action recognition. From the input transformation perspective, we design a model-agnostic background adversarial mixup module to reduce the surrogate-target model dependency. In particular, we randomly sample one video from each category and make its background frame, while selecting the background frame with the top attack ability for mixup with the clean frame by reinforcement learning. Moreover, to ensure an explicit attack direction, we leverage the background category as guidance for updating the gradient of adversarial example, and design a temporal gradient consistency loss, which strengthens the stability of the attack direction on subsequent frames. Empirical studies on two video datasets, i.e., UCF101 and Kinetics-400, and one image dataset, i.e., ImageNet, demonstrate that our method significantly boosts the transferability of adversarial examples across several action/image recognition models. Our code is available at https://github.com/mlvccn/BMTC_TransferAttackVid.

Figures

Figures reproduced from arXiv: 2505.17807 by the authors.

Figure 1
Figure 1. Illustration of the decision boundaries of the surrogate [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. Illustration of diverse and consistent temporal attack. [PITH_FULL_IMAGE:figures/full_fig_p001_2.png] view at source ↗
Figure 3
Figure 3. Overall framework of our Background Mixup-induced Temporal Consistency (BMTC) attack method for action recognition. [PITH_FULL_IMAGE:figures/full_fig_p004_3.png] view at source ↗
Figures from the paper (2 more)
Figure 4
Figure 4. Figure 4: Examples of UCF101 (left) and Kinetics-400 (right). [PITH_FULL_IMAGE:figures/full_fig_p007_4.png]
Figure 5
Figure 5. Figure 5: Transfer attack with adversarial purification on UCF101 [PITH_FULL_IMAGE:figures/full_fig_p011_5.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

44 extracted references · 39 canonical work pages

  1. [1]

    Vivit: A video vision transformer

    [Arnab et al., 2021] Anurag Arnab, Mostafa Dehghani, Georg Heigold, Chen Sun, Mario Lucic, and Cordelia Schmid. Vivit: A video vision transformer. In Proceedings of the IEEE Inter- national Conference on Computer Vision (ICCV) , pages 6816– 6826,

    work page 2021

  2. [3]

    Quo vadis, action recognition? a new model and the kinet- ics dataset

    [Carreira and Zisserman, 2017] Jo˜ao Carreira and Andrew Zisser- man. Quo vadis, action recognition? a new model and the kinet- ics dataset. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR), pages 4724–4733,

    work page 2017

  3. [10]

    Slowfast networks for video recognition

    [Feichtenhofer et al., 2019] Christoph Feichtenhofer, Haoqi Fan, Jitendra Malik, and Kaiming He. Slowfast networks for video recognition. In Proceedings of the IEEE International Confer- ence on Computer Vision (ICCV), pages 6201–6210,

    work page 2019

  4. [11]

    Goodfellow, Jonathon Shlens, and Christian Szegedy

    [Goodfellow et al., 2015] Ian J. Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial exam- ples. In Proceedings of the International Conference on Learning Representations (ICLR),

    work page 2015

  5. [15]

    Belongie, and Ser-Nam Lim

    [Huang et al., 2019] Qian Huang, Isay Katsman, Zeqi Gu, Horace He, Serge J. Belongie, and Ser-Nam Lim. Enhancing adversar- ial example transferability with an intermediate level attack. In Proceedings of the IEEE International Conference on Computer Vision (ICCV), pages 4732–4741,

    work page 2019

  6. [16]

    Iandola, Matthew W

    [Iandola et al., 2016] Forrest N. Iandola, Matthew W. Moskewicz, Khalid Ashraf, Song Han, William J. Dally, and Kurt Keutzer. Squeezenet: Alexnet-level accuracy with 50x fewer parameters and <1mb model size. arXiv preprint, arXiv:1602.07360,

    arXiv 2016

  7. [17]

    UCF101: A dataset of 101 human actions classes from videos in the wild

    [Khurram Soomro and Shah, 2012] Amir Roshan Zamir Khur- ram Soomro and Mubarak Shah. UCF101: A dataset of 101 human actions classes from videos in the wild. arXiv preprint, arXiv:1212.0402,

    arXiv 2012

  8. [19]

    Adversarial examples in the physical world

    [Kurakin et al., 2016] Alexey Kurakin, Ian Goodfellow, and Samy Bengio. Adversarial examples in the physical world. arXiv preprint, arXiv:1607.02533,

    arXiv 2016

Show all 44 references
  1. [20]

    Robust evaluation of diffusion-based adversarial purification

    [Lee and Kim, 2023] Minjong Lee and Dongwoo Kim. Robust evaluation of diffusion-based adversarial purification. In Pro- ceedings of the IEEE International Conference on Computer Vi- sion (ICCV), pages 134–144,

    2023

  2. [21]

    Videomamba: State space model for efficient video understanding

    [Li et al., 2024] Kunchang Li, Xinhao Li, Yi Wang, Yinan He, Yali Wang, Limin Wang, and Yu Qiao. Videomamba: State space model for efficient video understanding. In Proceedings of the European Conference on Computer Vision (ECCV) , volume 15084, pages 237–255,

    2024

  3. [22]

    Hopcroft

    [Lin et al., 2020] Jiadong Lin, Chuanbiao Song, Kun He, Liwei Wang, and John E. Hopcroft. Nesterov accelerated gradient and scale invariance for adversarial attacks. In Proceedings of the International Conference on Learning Representations (ICLR) ,

    2020

  4. [23]

    Swin trans- former: Hierarchical vision transformer using shifted windows

    [Liu et al., 2021] Ze Liu, Yutong Lin, Yue Cao, Han Hu, Yixuan Wei, Zheng Zhang, Stephen Lin, and Baining Guo. Swin trans- former: Hierarchical vision transformer using shifted windows. In Proceedings of the IEEE International Conference on Com- puter Vision (ICCV), pages 9992–10002,

    2021

  5. [24]

    Video swin transformer

    [Liu et al., 2022] Ze Liu, Jia Ning, Yue Cao, Yixuan Wei, Zheng Zhang, Stephen Lin, and Han Hu. Video swin transformer. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR, pages 3202–3211,

    2022

  6. [26]

    Video transformer network

    [Neimark et al., 2021] Daniel Neimark, Omri Bar, Maya Zohar, and Dotan Asselmann. Video transformer network. In Proceed- ings of the IEEE International Conference on Computer Vision Workshops (ICCVW), pages 3163–3172,

    2021

  7. [27]

    Asano, Ishan Misra, Florian Metze, Christoph Feichtenhofer, Andrea Vedaldi, and Jo ˜ao F

    [Patrick et al., 2021] Mandela Patrick, Dylan Campbell, Yuki M. Asano, Ishan Misra, Florian Metze, Christoph Feichtenhofer, Andrea Vedaldi, and Jo ˜ao F. Henriques. Keeping your eye on the ball: Trajectory attention in video transformers. In Ad- vances in Neural Information Pr...

    2021

  8. [28]

    Very deep convolutional networks for large-scale im- age recognition

    [Simonyan and Zisserman, 2015] Karen Simonyan and Andrew Zisserman. Very deep convolutional networks for large-scale im- age recognition. In Proceedings of the International Conference on Learning Representations (ICLR),

    2015

  9. [29]

    Enhancing the transferability of adversarial attacks through variance tuning

    [Wang and He, 2021] Xiaosen Wang and Kun He. Enhancing the transferability of adversarial attacks through variance tuning. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR), pages 1924–1933,

    2021

  10. [30]

    Girshick, Abhinav Gupta, and Kaiming He

    [Wang et al., 2018] Xiaolong Wang, Ross B. Girshick, Abhinav Gupta, and Kaiming He. Non-local neural networks. In Proceed- ings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR), pages 7794–7803,

    2018

  11. [31]

    Rethinking the backward propagation for adversarial transfer- ability

    [Wang et al., 2023b] Xiaosen Wang, Kangheng Tong, and Kun He. Rethinking the backward propagation for adversarial transfer- ability. In Advances in Neural Information Processing Systems (NeurIPS), volume 36, pages 1905–1922,

    1905

  12. [32]

    Internvideo2

    [Wang et al., 2025] Yi Wang, Xinhao Li, Ziang Yan, Yinan He, Ji- ashuo Yu, Xiangyu Zeng, Chenting Wang, Changlian Ma, Ha- ian Huang, Jianfei Gao, et al. Internvideo2. 5: Empowering video mllms with long and rich context modeling.arXiv preprint, arXiv:2501.12386,

    2025 arXiv

  13. [33]

    Adaptive cross-modal transferable adversarial at- tacks from images to videos.IEEE Transactions on Pattern Anal- ysis and MachineIntelligence (TPAMI), 46(5):3772–3783,

    [Wei et al., 2024] Zhipeng Wei, Jingjing Chen, Zuxuan Wu, and Yu-Gang Jiang. Adaptive cross-modal transferable adversarial at- tacks from images to videos.IEEE Transactions on Pattern Anal- ysis and MachineIntelligence (TPAMI), 46(5):3772–3783,

    2024

  14. [34]

    Girshick, Piotr Doll ´ar, Zhuowen Tu, and Kaiming He

    [Xie et al., 2017] Saining Xie, Ross B. Girshick, Piotr Doll ´ar, Zhuowen Tu, and Kaiming He. Aggregated residual transforma- tions for deep neural networks. In Proceedings of the IEEE Con- ference on Computer Vision and Pattern Recognition (CVPR) , pages 5987–5995,

    2017

  15. [35]

    Improving trans- ferability of adversarial examples with input diversity

    [Xie et al., 2019] Cihang Xie, Zhishuai Zhang, Yuyin Zhou, Song Bai, Jianyu Wang, Zhou Ren, and Alan L Yuille. Improving trans- ferability of adversarial examples with input diversity. In Pro- ceedings of the IEEE conference on computer vision and pattern recognition (CVPR), p...

    2019

  16. [36]

    ILA-DA: improving transferability of intermediate level attack with data augmentation

    [Yan et al., 2023] Chiu Wai Yan, Tsz-Him Cheung, and Dit-Yan Yeung. ILA-DA: improving transferability of intermediate level attack with data augmentation. In Proceedings of the Interna- tional Conference on Learning Representations (ICLR),

    2023

  17. [37]

    Temporal pyramid network for action recognition

    [Yang et al., 2020] Ceyuan Yang, Yinghao Xu, Jianping Shi, Bo Dai, and Bolei Zhou. Temporal pyramid network for action recognition. In Proceedings of the IEEE Conference on Com- puter Vision and Pattern Recognition (CVPR) , pages 588–597,

    2020

  18. [38]

    Adaptive image transformations for transfer-based adversarial at- tack

    [Yuan et al., 2022] Zheng Yuan, Jie Zhang, and Shiguang Shan. Adaptive image transformations for transfer-based adversarial at- tack. In Proceedings of the European Conference on Computer Vision (ECCV), volume 13665, pages 1–17,

    2022

  19. [39]

    Isomer: Isomerous transformer for zero-shot video object segmentation

    [Yuan et al., 2023] Yichen Yuan, Yifan Wang, Lijun Wang, Xiaoqi Zhao, Huchuan Lu, Yu Wang, Weibo Su, and Lei Zhang. Isomer: Isomerous transformer for zero-shot video object segmentation. In Proceedings of the IEEE International Conference on Com- puter Vision (ICCV), pages 966–976,

    2023

  20. [40]

    Dauphin, and David Lopez-Paz

    [Zhang et al., 2018] Hongyi Zhang, Moustapha Ciss ´e, Yann N. Dauphin, and David Lopez-Paz. Mixup: Beyond empirical risk minimization. In Proceedings of the International Conference on Learning Representations (ICLR),

    2018

  21. [41]

    [Zhang et al., 2022] Jianping Zhang, Weibin Wu, Jen-tse Huang, Yizhan Huang, Wenxuan Wang, Yuxin Su, and Michael R. Lyu. Improving adversarial transferability via neuron attribution- based attacks. In Proceedings of the IEEE Conference on Com- puter Vision and Pattern Recognit...

    2022

  22. [42]

    [Zhang et al., 2023] Jianping Zhang, Jen-tse Huang, Wenxuan Wang, Yichen Li, Weibin Wu, Xiaosen Wang andYuxin Su, and Michael R. Lyu. Improving the transferability of adversar- ial samples by path-augmented method. In Proceedings of the IEEE Conference on Computer Vision and P...

    2023

  23. [43]

    Boosting adversarial transferability via gradient relevance attack

    [Zhu et al., 2023] Hegui Zhu, Yuchen Ren, Xiaoyan Sui, Lianping Yang, and Wuming Jiang. Boosting adversarial transferability via gradient relevance attack. In Proceedings of the IEEE Inter- national Conference on Computer Vision (ICCV) , pages 4718– 4727,

    2023

  24. [44]

    Learning to transform dynami- cally for better adversarial transferability

    [Zhu et al., 2024] Rongyi Zhu, Zeliang Zhang, Zhuo Liu, Chen- liang Xu, and Susan Liang. Learning to transform dynami- cally for better adversarial transferability. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR), pages 24273–24283, 2024

    2024

  25. [2009]

    Boosting adver- sarial attacks with momentum

    [Dong et al., 2018] Yinpeng Dong, Fangzhou Liao, Tianyu Pang, Hang Su, Jun Zhu, Xiaolin Hu, and Jianguo Li. Boosting adver- sarial attacks with momentum. In Proceedings of the IEEE Con- ference on Computer Vision and Pattern Recognition (CVPR) , pages 9185–9193,

    2018

  26. [2012]

    [Krizhevsky et al., 2012] Alex Krizhevsky, Ilya Sutskever, and Ge- offrey E. Hinton. Imagenet classification with deep convolutional neural networks. In Advances in Neural Information Processing Systems (NeurIPS), pages 1106–1114,

    2012

  27. [2015]

    Mamba: Linear-time sequence modeling with selective state spaces

    [Gu and Dao, 2024] Albert Gu and Tri Dao. Mamba: Linear-time sequence modeling with selective state spaces. arXiv preprint, arXiv:2312.00752,

    2024 arXiv

  28. [2016]

    Weinberger

    [Huang et al., 2017] Gao Huang, Zhuang Liu, Laurens van der Maaten, and Kilian Q. Weinberger. Densely connected convo- lutional networks. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR), pages 2261– 2269,

    2017

  29. [2017]

    GCMA: generative cross-modal transferable adversarial attacks from images to videos

    [Chen et al., 2023] Kai Chen, Zhipeng Wei andJingjing Chen, Zux- uan Wu, and Yu-Gang Jiang. GCMA: generative cross-modal transferable adversarial attacks from images to videos. In Pro- ceedings of the 31st ACM International Conference on Multime- dia (ACM MM), pages 698–708,

    2023

  30. [2018]

    Evading defenses to transferable adversarial examples by translation-invariant attacks

    [Dong et al., 2019] Yinpeng Dong, Tianyu Pang, Hang Su, and Jun Zhu. Evading defenses to transferable adversarial examples by translation-invariant attacks. In Proceedings of the IEEE confer- ence on computer vision and pattern recognition (CVPR) , pages 4312–4321,

    2019

  31. [2019]

    Multiscale vision transformers

    [Fan et al., 2021] Haoqi Fan, Bo Xiong, Karttikeya Mangalam, Yanghao Li, Zhicheng Yan, Jitendra Malik, and Christoph Fe- ichtenhofer. Multiscale vision transformers. In Proceedings of the IEEE International Conference on Computer Vision (ICCV), pages 6824–6835,

    2021

  32. [2020]

    Imagenet: A large-scale hierarchical im- age database

    [Deng et al., 2009] Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. Imagenet: A large-scale hierarchical im- age database. In Proceedings of the IEEE Conference on Com- puter Vision and Pattern Recognition (CVPR) , pages 248–255,

    2009

  33. [2021]

    Is space-time attention all you need for video un- derstanding? In Proceedings of the 38th International Confer- ence on Machine Learning (ICML), volume 139, pages 813–824,

    [Bertasius et al., 2021] Gedas Bertasius, Heng Wang, and Lorenzo Torresani. Is space-time attention all you need for video un- derstanding? In Proceedings of the 38th International Confer- ence on Machine Learning (ICML), volume 139, pages 813–824,

    2021

  34. [2022]

    Towards deep learning models resistant to adversarial attacks

    [Madry et al., 2018] Aleksander Madry, Aleksandar Makelov, Lud- wig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. In Proceed- ings of the International Conference on Learning Representa- tions (ICLR),

    2018

  35. [2023]

    Re- liable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks

    [Croce and Hein, 2020] Francesco Croce and Matthias Hein. Re- liable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks. In Proceedings of the 37th Inter- national Conference on Machine Learning (ICML), volume 119, pages 2206–2216,

    2020

  36. [2024]

    Deep residual learning for image recognition

    [He et al., 2016] Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In Pro- ceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR), pages 770–778,

    2016

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.