Pith. sign in

REVIEW 4 major objections 4 minor 70 references

Disrupting Semantic and Abstract Features for Better Adversarial Transferability

T0 review · 4 major / 4 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read SAFER shows that adversarial transferability improves when the feature-importance weight matrix is computed on images disrupted in both the spatial and frequency domains, not just the semantic content.

desk verdict SAFER is a solid empirical attack paper with a novel DCT-based Self-Mix, but the published Algorithm 1 overloads mu and cannot reproduce the reported results without a fix. read the letter →

arxiv 2507.16052 v1 pith:EAKQKSTR submitted 2025-07-21 cs.CV

Yuyang Luo , Xiaosen Wang , Zhijin Ge , Yingzhe He This is my paper
classification cs.CV
keywords adversarialattacktransferabilityblack-boxfeature-levelfrequencydomainhigh-frequencyfeaturesinputtransformationImageNet
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Existing feature-level adversarial attacks compute a feature-importance weight matrix from transformed images, but the transforms they use disturb mainly semantic, low-frequency content. The paper argues this overlooks the abstract, high-frequency features (textures and edges) that CNNs lean on, and shows experimentally that perturbing the high-frequency band before computing the weight matrix raises black-box attack success. Its proposed method, SAFER, applies BlockMix (swapping blocks from another category to distort semantics) and Self-Mix (rotating the DCT spectrum and recombining it to distort abstract structure) before averaging gradients to form the weight matrix. Using that matrix in a weighted-feature objective with the momentum attack MIM, SAFER reports higher attack success rates than FIA, RPA, and NAA across CNNs, vision transformers, adversarially trained ensembles, and eight defenses. The paper's message is that transferability improves when the attacker disrupts both semantic and abstract features, not semantic features alone.

What carries the argument

SAFER's load-bearing machinery is the feature-importance weight matrix $\Delta = \frac{1}{N}\sum_{n=1}^{N} \frac{\partial J(\mathrm{BlockMix}(\mathrm{Self\text{-}Mix}(x_n, \mu, \beta)), y; \theta)}{\partial f_k(x)}$, normalized to unit norm, computed on images distorted in both the spatial and frequency domains. Self-Mix works in the DCT domain: $\mathrm{Self\text{-}Mix}(x,\mu,\beta) = D^{-1}[D(x) + \mu R(D(x),\beta)]$, where $R$ rotates the spectrum by a random angle $\beta \in [-\pi/4, \pi/4]$ and $\mu=0.4$; this primarily distorts high-frequency texture and edge structure. BlockMix randomly replaces blocks of the image in an $n_b \times n_b$ grid with blocks from another category with keep probability $p=0.9$; this distorts semantic content before Self-Mix runs. The weight matrix highlights features that stay important under both kinds of distortion, and the objective $\sum (\Delta \odot f_k(x^{\mathrm{adv}}))$ then drives the momentum attack to break those features. The paper's central pairing is a spatial-domain semantic disruptor joined with a spectral-domain abstract disruptor, and the claimed effect is stronger than either transformation alone.

What would settle it

Measure surrogate frequency sensitivity directly (e.g., zero out high-frequency DCT coefficients and record accuracy) and then compare SAFER against FIA on a model with weak high-frequency dependence; if SAFER still wins, the high-frequency mechanism is not the operative cause, and if the margin disappears, the mechanism is confirmed.

Watch

Extended reading notes

Core claim

The central discovery is that the feature-importance weight matrix for transfer attacks benefits from being computed on images whose high-frequency (abstract) content is disrupted, not just their low-frequency (semantic) content. The authors first demonstrate this with a controlled experiment that adds noise to expanding high-frequency regions of the spectrum and shows rising attack success rates on seven black-box models. They then build SAFER around two transformations: BlockMix, which replaces random blocks of the image with blocks from a different category to distort semantics, and Self-Mix, which rotates the DCT spectrum of the image by a random angle and mixes it back, perturbing high-frequency structure. The weight matrix $\Delta$ is the normalized average gradient of the loss with respect to the intermediate features of these transformed images, and the attack maximizes $\sum (\Delta \odot f_k(x^{\mathrm{adv}}))$ with MIM as the backbone. Across ImageNet experiments on CNN and ViT targets, adversarially trained ensembles, and eight defenses, SAFER consistently outperforms FIA, RPA, and NAA, with the largest margins on ViTs and defense settings.

Load-bearing premise

The method takes on faith, without measuring the surrogate models it attacks, that CNNs lean on high-frequency textures and edges for classification, so that disrupting those components exposes the features worth attacking.

Editorial extensions

If this is right

  • Feature-level transfer attacks should compute the importance weight matrix from images distorted in the frequency domain as well as the spatial domain; the ablation shows Self-Mix alone lifts black-box attack success by 32.6 percentage points over MIM on the tested set.
  • SAFER composes cleanly with existing attack families: combining it with DIM, Admix, or SSA and with SGM, LinBP, or BPA still outperforms the corresponding baselines, indicating the two disruption ideas are additive.
  • The gains cross architecture boundaries: adversarial examples crafted on Inc-v3 reach at least 43.8% success on five vision transformers, beating the best baseline by 2.6-5.9 percentage points.
  • Against eight defense mechanisms, SAFER is the strongest feature-level attack in the comparison, including against JPEG-like and frequency-filtering defenses.
  • Performance is stable across moderate hyper-parameter ranges, with optimum transferability around mixing strength $\mu=0.4$ and keep probability $p=0.9$ when balancing normal and adversarially trained targets.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The paper borrows the 'high frequency equals abstract' premise from cited work but never measures frequency sensitivity of its own surrogate models, so a direct spectral-sensitivity measurement would separate the abstract-feature mechanism from a pure data-augmentation effect.
  • Self-Mix is essentially a rotation augmentation in DCT space; testing reflections, shifts, or learned frequency masks would reveal whether the gain comes from spectrum geometry or from any extra transformation diversity.
  • If the benefit comes from estimating feature importance under two complementary distortions, the recipe could extend to query-based attacks or multi-surrogate ensembles, potentially shrinking the white-box/black-box gap further.
  • SAFER's strong results against JPEG and feature-distillation defenses sit oddly with a purely high-frequency story, since those defenses filter high frequencies; a plausible explanation the paper does not test is that the weight matrix captures cross-frequency feature dependencies that survive filtering.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 4 minor

Summary. The paper proposes SAFER, a transfer-based adversarial attack that computes a feature-importance weight matrix from images transformed by two operations: BlockMix, which mixes spatial blocks from other-class images to disrupt semantic content, and Self-Mix, which rotates the DCT spectrum and recombines it with the original to disrupt high-frequency (abstract) content. The weight matrix is then used in an FIA-style objective with MIM as the backbone to generate adversarial examples. Experiments on ImageNet report higher attack success rates than FIA, RPA, and NAA on CNNs, ViTs, ensemble adversarially trained models, and eight defenses, and the method is shown to combine with input-transformation and architecture-related attacks. An ablation study (Table 5) shows that each transformation individually improves transferability over MIM, with the combination performing best.

Significance. If the reported effect is genuine, the paper is a useful contribution to the transfer-based black-box attack literature: it introduces a simple, training-free modification that consistently improves over established feature-level attacks, and the compatibility experiments with DIM, Admix, SSA, SGM, LinBP, and BPA demonstrate breadth. The ablation in Table 5 is a genuine strength: it shows both BlockMix and Self-Mix raise transferability individually and that combining them helps further, which directly supports the paper's central direction. The motivation is clearly stated, and the paper avoids overclaiming regarding white-box performance. However, the exact source of the reported gains is not yet established because of an internal inconsistency in Algorithm 1 and because hyperparameters are selected on the same evaluation models used in the headline comparisons. These issues must be resolved before the paper's central claim can be accepted.

major comments (4)
  1. [Algorithm 1 and Section 4.1 (Hyper-parameters)] The symbol μ is overloaded. Algorithm 1 line 1 sets μ=1, line 5 passes μ as the Self-Mix mixing strength, and line 12 uses μ as the MIM momentum decay. Section 4.1 states that all feature-level attacks use a decay factor μ=1.0 and that SAFER sets the mixing strength μ=0.4. Under a literal single-variable reading these constraints are contradictory: either Self-Mix uses strength 1.0 instead of 0.4, or MIM's momentum becomes 0.4 instead of 1.0. Under a two-variable reading, the pseudocode is wrong. Because MIM's momentum directly controls gradient accumulation and is known to affect transferability, the headline comparisons in Tables 1-4 and Figures 3-4 may be confounded by an unintentional momentum change rather than by BlockMix and Self-Mix. The authors need to correct the pseudocode and/or release code to resolve this ambiguity.
  2. [Section 4.3, Fig. 5] The hyperparameters μ=0.4 and p=0.9 are selected by sweeping on the same evaluation models that later appear in the main results: Fig. 5 reports attack success rates on VGG-16, Inc-v4, IncRes-v2, Res-152, Inc-v3ens3, Inc-v3ens4, and IncRes-v2ens, and these same models are used in Tables 1-3 and Figures 3-4. Part of the reported margin over FIA, RPA, and NAA is therefore a maximum over a tuning grid on the test set, while baseline hyperparameters are taken from prior publications without equivalent tuning. This makes the comparison not fully apples-to-apples. The authors should either fix the hyperparameters a priori, use a separate validation set for selection, or clearly report the sensitivity of the final comparison to choices of μ and p.
  3. [Algorithm 1, line 6] Line 6 computes the gradient with respect to f_k(x), the feature of the original image, whereas the text in Section 3.5 and the FIA-style convention require the gradient with respect to the features of the transformed image x_SM. If taken literally, the weight matrix Δ is computed using the wrong feature map. Please correct the denominator to f_k(x_SM), or explicitly justify why the original feature map is used.
  4. [Sections 2.3 and 3.2 (Motivation)] The paper assumes that low-frequency components correspond to semantic features and high-frequency components to abstract features such as textures and edges, importing this premise from references [41, 50]. It is not directly validated for the surrogate models attacked in this paper: Fig. 2 shows only that perturbing high-frequency regions improves attack transferability, not that the specific models (e.g., Inc-v3) rely on high-frequency components for classification. This is a load-bearing interpretive claim in the Abstract and the method's rationale. The authors should either measure the frequency sensitivity of the surrogate models (for example, by band-limited perturbations or spectral attribution) or soften the 'semantic/abstract' framing to avoid overclaiming.
minor comments (4)
  1. [Equation (2)] Please clarify whether the DCT is applied per color channel and whether any normalization or handling of the DC coefficient is needed; the current notation is ambiguous for 3-channel images.
  2. [Tables 1 and 5] Table 5 reports a white-box success rate of 98.5% on Inc-v3 for the row with both BlockMix and Self-Mix, whereas Table 1 reports 97.8% for SAFER under the same source model; please explain the source of variation (e.g., stochastic BlockMix sampling) or align the two settings.
  3. [Figure 1 and Section 3.4] The caption for Figure 1 says the displayed images are 'not adversarial examples'; please clarify in the body text how these transformed images are used in the weight-matrix computation, as this is currently implicit.
  4. [Table 5 caption] The abbreviation 'w/wo' should be spelled out as 'with/without' for a formal venue.

Circularity Check

0 steps flagged · score 2.0 of 10

No circular derivation: SAFER's gains are empirical, and the only self-citations are non-load-bearing inspiration or baselines.

full rationale

The paper's central derivation is an evaluation claim, not a closed-form prediction. SAFER computes a feature-importance weight matrix as the average gradient over BlockMix/Self-Mix transformed images (Algorithm 1, lines 2-8; Eqs. 2-4) and then optimizes a weighted feature loss with MIM. There is no equation in which the reported attack success rates are fixed points of the method's construction: the method's inputs are images, labels, the source model, and hyperparameters, while the outputs are adversarial examples whose transferability is measured on held-out target models. The high-frequency/abstract-feature premise is imported from independent citations [41, 50, 58] and a motivating perturbation experiment (Fig. 2); it is not a theorem authored by the present authors, nor does it define the evaluation metric. Self-citations (Admix [45], EMI [46], BPA [47], etc.) are used as related work, inspiration, or baselines, and never as an external uniqueness theorem that forces the SAFER design. Two non-circular concerns should be weighed separately. First, Fig. 5 selects mu and p partly on the same ensemble-adversarially-trained models that later appear in Tables 1 and 3, which can inflate those specific margins. Second, Algorithm 1 reuses the symbol mu for both Self-Mix strength and MIM momentum while Section 4.1 gives different values (mu = 1.0 for baselines and mu = 0.4 for SAFER), making the exact configuration ambiguous. These are correctness and reproducibility risks, not cases where a prediction reduces to its inputs by construction, because SAFER's gains are also reported on ViTs and on normally trained CNNs that were not used for selecting mu. Under the requested standard, I find no circular step.

Assumptions & free parameters 5 free parameters · 4 assumptions · 0 invented entities

The central claim rests on imported frequency-sensitivity findings and on hyperparameters tuned against the evaluation models, not on a derivation with free parameters. There are no invented entities.

free parameters (5)
  • mixing strength mu = 0.4
    Selected by sweeping mu in Fig. 5(a) on Inc-v3 and adversarially trained models, which are also evaluation targets. Algorithm 1 sets mu=1, creating an inconsistency with the reported value.
  • keep probability p = 0.9
    Selected by sweeping p in Fig. 5(b) on the same models used for evaluation; the choice maximizes attack success on the evaluation set.
  • block count n_b = 5
    Chosen without a dedicated ablation; affects how much semantic content BlockMix replaces and is a manual design choice.
  • rotation angle beta = U(-pi/4, pi/4)
    Uniform range chosen in Section 4.1; no ablation on the rotation angle is reported.
  • target layer k = Mix5b (Inc-v3)
    Selected from Fig. 6 to balance normal and adversarially trained models, following the guidance from FIA.
assumptions (4)
  • domain assumption CNNs rely more on high-frequency components for classification than on low-frequency components.
    Imported from refs [41, 50] in Section 2.3 and used in Section 3.2 to justify manipulating the high-frequency spectrum.
  • domain assumption Low-frequency components carry most semantic information, while high-frequency components carry abstract texture and edge information.
    Stated in Sections 3.2 and 3.3 based on [12, 40]; the semantic/abstract balancing argument rests on this mapping.
  • domain assumption Feature-level weight matrices computed from transformed images identify features that transfer across models.
    Inherited from FIA [49] and used in Eq. (4); SAFER changes the transformation but keeps this core objective assumption.
  • ad hoc to paper Disrupting both semantic and abstract features with balanced intensity is necessary for the best transferability.
    The balance argument in Section 3.4 is introduced for this method; it is not directly measured, only inferred from ablation improvements.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Disrupting Semantic and Abstract Features for Better Adversarial Transferability." pith.science (2026). https://pith.science/paper/EAKQKSTR

@misc{pith2026250716052,
  author       = {Pith},
  title        = {Pith review of: Disrupting Semantic and Abstract Features for Better Adversarial Transferability},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/EAKQKSTR}},
  note         = {Machine review of arXiv:2507.16052}
}
read the original abstract

Adversarial examples pose significant threats to deep neural networks (DNNs), and their property of transferability in the black-box setting has led to the emergence of transfer-based attacks, making it feasible to target real-world applications employing DNNs. Among them, feature-level attacks, where intermediate features are perturbed based on feature importance weight matrix computed from transformed images, have gained popularity. In this work, we find that existing feature-level attacks primarily manipulate the semantic information to derive the weight matrix. Inspired by several works that find CNNs tend to focus more on high-frequency components (a.k.a. abstract features, e.g., texture, edge, etc.), we validate that transforming images in the high-frequency space also improves transferability. Based on this finding, we propose a balanced approach called Semantic and Abstract FEatures disRuption (SAFER). Specifically, SAFER conducts BLOCKMIX on the input image and SELF-MIX on the frequency spectrum when computing the weight matrix to highlight crucial features. By using such a weight matrix, we can direct the attacker to disrupt both semantic and abstract features, leading to improved transferability. Extensive experiments on the ImageNet dataset also demonstrate the effectiveness of our method in boosting adversarial transferability.

Figures

Figures reproduced from arXiv: 2507.16052 by the authors.

Figure 1
Figure 1. The raw image and the transformed images for [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. Attack performance by perturbing various sizes of high-frequency components and the visualization of corresponding [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 3
Figure 3. Attack success rates (%) of various attacks when combined with three input transformation-based attacks, [PITH_FULL_IMAGE:figures/full_fig_p006_3.png] view at source ↗
Figures from the paper (6 more)
Figure 4
Figure 4. Figure 4: Attack success rates (%) of various attacks when combined with architecture-related attacks, [PITH_FULL_IMAGE:figures/full_fig_p007_4.png]
Figure 6
Figure 6. Figure 6: Hyper-parameter studies of SAFER on the different [PITH_FULL_IMAGE:figures/full_fig_p008_6.png]
Figure 7
Figure 7. Figure 7: Attack success rates (%) of various attacks when combined with three input transformation-based attacks, [PITH_FULL_IMAGE:figures/full_fig_p013_7.png]
Figure 8
Figure 8. Figure 8: Attack success rates (%) of various attacks when combined with three input transformation-based attacks, [PITH_FULL_IMAGE:figures/full_fig_p013_8.png]
Figure 9
Figure 9. Figure 9: Attack success rates (%) of various attacks when combined with three input transformation-based attacks, [PITH_FULL_IMAGE:figures/full_fig_p013_9.png]
Figure 10
Figure 10. Figure 10: Visualization of high-frequency and low-frequency components, denoted as H-Freq and L-Freq, respectively. [PITH_FULL_IMAGE:figures/full_fig_p014_10.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

70 extracted references · 64 canonical work pages

  1. [1]

    Huanran Chen, Yichi Zhang, Yinpeng Dong, and Jun Zhu. 2023. Rethinking Model Ensemble in Transfer-based Adversarial Attacks. arXiv preprint arXiv:2303.09105 (2023)

    arXiv 2023

  2. [2]

    Jordan, and Martin J

    Jianbo Chen, Michael I. Jordan, and Martin J. Wainwright. 2020. HopSkipJumpAt- tack: A Query-Efficient Decision-Based Attack. In Proceedings of the IEEE Sympo- sium on Security and Privacy

    work page 2020

  3. [3]

    Zhengsu Chen, Lingxi Xie, Jianwei Niu, Xuefeng Liu, Longhui Wei, and Qi Tian

    work page

  4. [4]

    Cohen, Elan Rosenfeld, and J

    Jeremy M. Cohen, Elan Rosenfeld, and J. Zico Kolter. 2019. Certified Adversar- ial Robustness via Randomized Smoothing. In Proceedings of the International Conference on Machine Learning

    work page 2019

  5. [5]

    Yinpeng Dong, Fangzhou Liao, Tianyu Pang, Hang Su, Jun Zhu, Xiaolin Hu, and Jianguo Li. 2018. Boosting Adversarial Attacks With Momentum. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition . 9185–9193

    work page 2018

  6. [6]

    Yinpeng Dong, Tianyu Pang, Hang Su, and Jun Zhu. 2019. Evading Defenses to Transferable Adversarial Examples by Translation-Invariant Attacks. In Proceed- ings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition

    work page 2019

  7. [7]

    Gintare Karolina Dziugaite, Zoubin Ghahramani, and Daniel M. Roy. 2016. A study of the effect of JPG compression on adversarial images.CoRR abs/1608.00853 (2016)

    arXiv 2016

  8. [8]

    Lianli Gao, Qilong Zhang, Xiaosu Zhu, Jingkuan Song, and Heng Tao Shen

    work page

Show all 70 references
  1. [9]

    Zhijin Ge, Xiaosen Wang, Fanhua Shang, Hongying Liu, and Yuanyuan Liu

  2. [10]

    arXiv preprint arXiv:2104.09722 (2021)

    Staircase Sign Method for Boosting Adversarial Attacks. arXiv preprint arXiv:2104.09722 (2021)

    2021 arXiv

  3. [11]

    Goodfellow, Jonathon Shlens, and Christian Szegedy

    Ian J. Goodfellow, Jonathon Shlens, and Christian Szegedy. 2015. Explaining and Harnessing Adversarial Examples. In Proceedings of the International Conference on Learning Representations

    2015

  4. [12]

    Frank, and Kilian Q

    Chuan Guo, Jared S. Frank, and Kilian Q. Weinberger. 2018. Low frequency adversarial perturbation. In Proceedings of the Uncertainty in Artificial Intelligence. 1127–1137

    2018

  5. [13]

    Girshick

    Ross B. Girshick. 2015. Fast R-CNN. In Proceedings of the IEEE/CVF International Conference on Computer Vision

    2015

  6. [14]

    Girshick

    Kaiming He, Georgia Gkioxari, Piotr Dollár, and Ross B. Girshick. 2017. Mask R-CNN. In Proceedings of the IEEE/CVF International Conference on Computer Vision

    2017

  7. [15]

    Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. 2016. Deep residual learning for image recognition. In Proceedings of the IEEE conference on computer vision and pattern recognition . 770–778

    2016

  8. [16]

    Yiwen Guo, Qizhang Li, and Hao Chen. 2020. Backpropagating Linearly Improves Transferability of Adversarial Examples. In Proceedings of the Advances in Neural Information Processing Systems

    2020

  9. [17]

    Belongie, and Ser-Nam Lim

    Qian Huang, Isay Katsman, Zeqi Gu, Horace He, Serge J. Belongie, and Ser-Nam Lim. 2019. Enhancing Adversarial Example Transferability With an Intermediate Level Attack. In Proceedings of the IEEE/CVF International Conference on Computer Vision. 4732–4741

    2019

  10. [18]

    Andrew Ilyas, Logan Engstrom, Anish Athalye, and Jessy Lin. 2018. Black-box Adversarial Attacks with Limited Queries and Information. In Proceedings of the International Conference on Machine Learning

    2018

  11. [19]

    Byeongho Heo, Sangdoo Yun, Dongyoon Han, Sanghyuk Chun, Junsuk Choe, and Seong Joon Oh. 2021. Rethinking Spatial Dimensions of Vision Transformers. In Proceedings of the IEEE/CVF International Conference on Computer Vision

    2021

  12. [20]

    Goodfellow, and Samy Bengio

    Alexey Kurakin, Ian J. Goodfellow, and Samy Bengio. 2017. Adversarial Machine Learning at Scale. In Proceedings of the International Conference on Learning Representations

    2017

  13. [21]

    Fangzhou Liao, Ming Liang, Yinpeng Dong, Tianyu Pang, Xiaolin Hu, and Jun Zhu. 2018. Defense Against Adversarial Attacks Using High-Level Representation Guided Denoiser. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. 1778–1787

    2018

  14. [22]

    Goodfellow, and Samy Bengio

    Alexey Kurakin, Ian J. Goodfellow, and Samy Bengio. 2017. Adversarial Examples in the Physical World. In Proceedings of the International Conference on Learning Representations (Workshops)

    2017

  15. [23]

    Yanpei Liu, Xinyun Chen, Chang Liu, and Dawn Song. 2017. Delving into Transferable Adversarial Examples and Black-box Attacks. In Proceedings of the International Conference on Learning Representations

    2017

  16. [24]

    Ze Liu, Yutong Lin, Yue Cao, Han Hu, Yixuan Wei, Zheng Zhang, Stephen Lin, and Baining Guo. 2021. Swin Transformer: Hierarchical Vision Transformer using Shifted Windows. In Proceedings of the IEEE/CVF International Conference on Computer Vision

    2021

  17. [25]

    Hopcroft

    Jiadong Lin, Chuanbiao Song, Kun He, Liwei Wang, and John E. Hopcroft. 2020. Nesterov Accelerated Gradient and Scale Invariance for Adversarial Attacks

    2020

  18. [26]

    Yuyang Long, Qilong Zhang, Boheng Zeng, Lianli Gao, Xianglong Liu, Jian Zhang, and Jingkuan Song. 2022. Frequency Domain Model Augmentation for Adversarial Attack. In Proceedings of the European Conference on Computer Vision . 549–566

    2022

  19. [27]

    Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. 2018. Towards Deep Learning Models Resistant to Adversarial Attacks. InProceedings of the International Conference on Learning Representations

    2018

  20. [28]

    Zihao Liu, Qi Liu, Tao Liu, Nuo Xu, Xue Lin, Yanzhi Wang, and Wujie Wen

  21. [29]

    Girshick, and Jian Sun

    Shaoqing Ren, Kaiming He, Ross B. Girshick, and Jian Sun. 2015. Faster R- CNN: Towards Real-Time Object Detection with Region Proposal Networks. In Proceedings of the Advances in Neural Information Processing Systems . 91–99

    2015

  22. [30]

    Yucheng Shi, Siyu Wang, and nYahong Han. 2019. Curls & Whey: Boosting Black-Box Adversarial Attacks. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition . 6519–6527

    2019

  23. [31]

    Karen Simonyan and Andrew Zisserman. 2015. Very Deep Convolutional Net- works for Large-Scale Image Recognition. In Proceedings of the International Conference on Learning Representations

    2015

  24. [32]

    Khan, Munawar Hayat, Fahad Shahbaz Khan, and Fatih Porikli

    Muzammal Naseer, Salman H. Khan, Munawar Hayat, Fahad Shahbaz Khan, and Fatih Porikli. 2020. A Self-supervised Approach for Adversarial Robustness. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. 259–268

    2020

  25. [33]

    Christian Szegedy, Vincent Vanhoucke, Sergey Ioffe, Jon Shlens, and Zbigniew Wojna. 2016. Rethinking the inception architecture for computer vision. In Proceedings of the IEEE conference on computer vision and pattern recognition . 2818–2826

    2016

  26. [34]

    Goodfellow, and Rob Fergus

    Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian J. Goodfellow, and Rob Fergus. 2014. Intriguing properties of neural networks. In Proceedings of the International Conference on Learning Representations

    2014

  27. [35]

    Hugo Touvron, Matthieu Cord, Matthijs Douze, Francisco Massa, Alexandre Sablayrolles, and Hervé Jégou. 2021. Training data-efficient image transformers & distillation through attention. In Proceedings of the International Conference on Machine Learning

    2021

  28. [36]

    Christian Szegedy, Sergey Ioffe, Vincent Vanhoucke, and Alexander A Alemi

  29. [38]

    Goodfellow, Dan Boneh, and Patrick D

    Florian Tramèr, Alexey Kurakin, Nicolas Papernot, Ian J. Goodfellow, Dan Boneh, and Patrick D. McDaniel. 2018. Ensemble Adversarial Training: Attacks and De- fenses. In Proceedings of the International Conference on Learning Representations

    2018

  30. [39]

    Vikas Verma, Alex Lamb, Christopher Beckham, Amir Najafi, Ioannis Mitliagkas, David Lopez-Paz, and Yoshua Bengio. 2019. Manifold Mixup: Better Representa- tions by Interpolating Hidden States. InProceedings of the International Conference on Machine Learning

    2019

  31. [40]

    Gregory K. Wallace. 1991. The JPEG Still Picture Compression Standard.Commun. ACM (1991)

    1991

  32. [41]

    Hugo Touvron, Matthieu Cord, Alexandre Sablayrolles, Gabriel Synnaeve, and Hervé Jégou. 2021. Going deeper with Image Transformers. In Proceedings of the IEEE/CVF International Conference on Computer Vision

    2021

  33. [42]

    Jiafeng Wang, Zhaoyu Chen, Kaixun Jiang, Dingkang Yang, Lingyi Hong, Yan Wang, and Wenqiang Zhang. 2022. Boosting the Transferability of Adversarial Attacks with Global Momentum Initialization. arXiv preprint arXiv:2211.11236 (2022)

    2022 arXiv

  34. [43]

    Kunyu Wang, Xuanran He, Wenxuan Wang, and Xiaosen Wang. 2023. Boost- ing Adversarial Transferability by Block Shuffle and Rotation. arXiv preprint arXiv:2308.10299 (2023)

    2023 arXiv

  35. [44]

    Xiaosen Wang and Kun He. 2021. Enhancing the Transferability of Adversarial Attacks Through Variance Tuning. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition . 1924–1933

    2021

  36. [45]

    Xiaosen Wang, Xuanran He, Jingdong Wang, and Kun He. 2021. Admix: Enhanc- ing the Transferability of Adversarial Attacks. In Proceedings of the IEEE/CVF International Conference on Computer Vision . 16138–16147

    2021

  37. [46]

    Haohan Wang, Xindi Wu, Zeyi Huang, and Eric P. Xing. 2020. High-Frequency Component Helps Explain the Generalization of Convolutional Neural Networks. MM ’25, October 27–31, 2025, Dublin, Ireland Luo et al. In Proceedings of the IEEE/CVF Conference on Computer Vision and Patte...

    2020

  38. [47]

    Xiaosen Wang, Kangheng Tong, and Kun He. 2023. Rethinking the Backward Propagation for Adversarial Transferability. In Proceedings of the Advances in Neural Information Processing Systems

    2023

  39. [48]

    Xiaosen Wang, Zeliang Zhang, and Jianping Zhang. 2023. Structure Invari- ant Transformation for better Adversarial Transferability. In Proceedings of the IEEE/CVF International Conference on Computer Vision . 4607–4619

    2023

  40. [49]

    Zhibo Wang, Hengchang Guo, Zhifei Zhang, Wenxin Liu, Zhan Qin, and Kui Ren

  41. [50]

    Zifan Wang, Yilin Yang, Ankit Shrivastava, Varun Rawal, and Zihao Ding

  42. [51]

    Xiaosen Wang, Jiadong Lin, Han Hu, Jingdong Wang, and Kun He. 2021. Boosting Adversarial Transferability through Enhanced Momentum. In Proceedings of the British Machine Vision Conference . 272

    2021

  43. [52]

    Hai Wu, Chenglu Wen, Wei Li, Xin Li, Ruigang Yang, and Cheng Wang. 2023. Transformation-Equivariant 3D Object Detection for Autonomous Driving. In Proceedings of the AAAI Conference on Artificial Intelligence . 2795–2802

    2023

  44. [53]

    Penghao Wu, Li Chen, Hongyang Li, Xiaosong Jia, Junchi Yan, and Yu Qiao. 2023. Policy Pre-training for Autonomous Driving via Self-supervised Geometric Mod- eling. In Proceedings of the International Conference on Learning Representations

    2023

  45. [54]

    Lyu, and Yu-Wing Tai

    Weibin Wu, Yuxin Su, Xixian Chen, Shenglin Zhao, Irwin King, Michael R. Lyu, and Yu-Wing Tai. 2020. Boosting the Transferability of Adversarial Samples via Attention. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. 1158–1167

    2020

  46. [55]

    In Proceedings of the IEEE/CVF International Conference on Computer Vision

    Feature Importance-aware Transferable Adversarial Attacks. In Proceedings of the IEEE/CVF International Conference on Computer Vision

  47. [56]

    Cihang Xie, Zhishuai Zhang, Yuyin Zhou, Song Bai, Jianyu Wang, Zhou Ren, and Alan L. Yuille. 2019. Improving Transferability of Adversarial Examples With Input Diversity. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition

    2019

  48. [57]

    Weilin Xu, David Evans, and Yanjun Qi. 2018. Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networks. In Network and Distributed System Security Symposium

    2018

  49. [58]

    Dongxian Wu, Yisen Wang, Shu-Tao Xia, James Bailey, and Xingjun Ma. 2020. Skip Connections Matter: On the Transferability of Adversarial Examples Gen- erated with ResNets. In Proceedings of the International Conference on Learning Representations

    2020

  50. [59]

    Longhui Yu, Yifan Zhang, Lanqing Hong, Fei Chen, and Zhenguo Li. 2022. Dual- Curriculum Teacher for Domain-Inconsistent Object Detection in Autonomous Driving. In Proceedings of the British Machine Vision Conference

    2022

  51. [60]

    Sangdoo Yun, Dongyoon Han, Sanghyuk Chun, Seong Joon Oh, Youngjoon Yoo, and Junsuk Choe. 2019. CutMix: Regularization Strategy to Train Strong Classifiers With Localizable Features. In Proceedings of the IEEE/CVF International Conference on Computer Vision

    2019

  52. [61]

    Dauphin, and David Lopez-Paz

    Hongyi Zhang, Moustapha Cissé, Yann N. Dauphin, and David Lopez-Paz. 2018. mixup: Beyond Empirical Risk Minimization. In Proceedings of the International Conference on Learning Representations

    2018

  53. [62]

    Cihang Xie, Jianyu Wang, Zhishuai Zhang, Zhou Ren, and Alan L. Yuille. 2018. Mitigating Adversarial Effects Through Randomization. In Proceedings of the International Conference on Learning Representations

    2018

  54. [63]

    Yaoyuan Zhang, Yu-an Tan, Tian Chen, Xinrui Liu, Quanxin Zhang, and Yuanzhang Li. 2022. Enhancing the Transferability of Adversarial Examples with Random Patch. In Proceedings of the International Joint Conference on Artifi- cial Intelligence

    2022

  55. [64]

    Wen Zhou, Xin Hou, Yongjun Chen, Mengyun Tang, Xiangqi Huang, Xiang Gan, and Yong Yang. 2018. Transferable Adversarial Perturbations. In Proceedings of the European Conference on Computer Vision . 471–486. Disrupting Semantic and Abstract Features for Better Adversarial Transf...

    2018

  56. [65]

    Dong Yin, Raphael Gontijo Lopes, Jonathon Shlens, Ekin Dogus Cubuk, and Justin Gilmer. 2019. A Fourier Perspective on Model Robustness in Computer Vision. In Proceedings of the Advances in Neural Information Processing Systems . 13255–13265

    2019

  57. [69]

    Jianping Zhang, Weibin Wu, Jen-tse Huang, Yizhan Huang, Wenxuan Wang, Yuxin Su, and Michael R. Lyu. 2022. Improving Adversarial Transferability via Neuron Attribution-based Attacks. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition

    2022

  58. [2017]

    In Proceedings of the AAAI Conference on Artificial Intelligence

    Inception-v4, inception-resnet and the impact of residual connections on learning. In Proceedings of the AAAI Conference on Artificial Intelligence

  59. [2019]

    In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition

    Feature Distillation: DNN-Oriented JPEG Compression Against Adversarial Examples. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition

  60. [2020]

    arXiv preprint arXiv:2005.03141 (2020)

    Towards Frequency-Based Explanation for Robust CNN. arXiv preprint arXiv:2005.03141 (2020)

    2020 arXiv

  61. [2021]

    In Proceedings of the IEEE/CVF International Conference on Computer Vision

    Visformer: The Vision-friendly Transformer. In Proceedings of the IEEE/CVF International Conference on Computer Vision

  62. [2023]

    In Proceedings of the Advances in Neural Information Processing Systems

    Boosting Adversarial Transferability by Achieving Flat Local Maxima. In Proceedings of the Advances in Neural Information Processing Systems

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.