Pith. sign in

REVIEW 3 major objections 6 minor 1 cited by

With Great Backbones Comes Great Adversarial Transferability

T0 review · 3 major / 6 minor · reviewed 2026-08-10 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read This paper claims that knowing only a model's publicly shared pre-trained backbone is sufficient to craft transferable adversarial images that defeat black-box attacks and approach white-box attacks, because maximizing cosine distance in…

desk verdict Systematic grey-box study with a simple backbone attack that transfers well; the headline equivalence claim is confounded by Section 5.3 but the core finding is worth referee time. read the letter →

arxiv 2501.12275 v1 pith:ICX5NZ2V submitted 2025-01-21 cs.CV cs.AIcs.CRcs.LGcs.MA

Erik Arakelyan , Karen Hambardzumyan , Davit Papikyan , Pasquale Minervini , Albert Gordo , Isabelle Augenstein , Aram H. Markosyan This is my paper · ORCID
classification cs.CVcs.AIcs.CRcs.LGcs.MA
keywords adversarialattackstransferabilityself-supervisedlearningpre-trainedbackbonesgrey-boxbackboneattackfine-tuningmeta-informationmodelsharingsecurity
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper studies a realistic middle ground between white-box and black-box attacks: an attacker who knows the weights of the publicly shared pre-trained backbone a target model was fine-tuned from, plus possibly some fine-tuning metadata, but not the full model. It argues that this grey-box setting is far more dangerous than the field's usual black-box assumptions suggest. Across roughly 20,000 proxy-to-target transfer comparisons (21 SSL backbone families, 4 datasets, 2 tuning modes, 2 head depths, several attack types), the authors show that proxy-based attacks approach white-box effectiveness, and that a deliberately simple 'backbone attack'—projected gradient descent maximizing the cosine distance between the clean and perturbed backbone features—outperforms a 10-query Square black-box attack and rivals white-box PGD. The bottom line is that sharing pre-trained backbone weights is nearly as compromising as handing attackers all metadata about the downstream model, which makes current model-sharing practices a concrete security risk.

What carries the argument

The load-bearing mechanism is the backbone attack: a PGD loop over the frozen pre-trained feature extractor $B$, with loss $\mathcal{L}_B(x,\tilde{x})=1-\cos(B(x),B(\tilde{x}))$, a stop-gradient on the clean representation, and projection of each update onto the $\ell_\infty$ ball. A second piece of machinery is the unit of release $R(M(D,W,B(W_B),F(T,Z)))$, an index of grey-box knowledge states—backbone only, backbone plus dataset, backbone plus tuning mode, and so on—that the paper uses to generate thousands of proxy models, each simulating one knowledge state, and thereby to measure which metadata actually change transferability.

What would settle it

Train a downstream classifier on a backbone from a different pretraining paradigm, or adversarially fine-tune the backbone, and evaluate on a large domain-shifted dataset such as ImageNet; if the backbone attack's transferability falls to the level of a high-query black-box attack using $10^3$–$10^5$ queries, the claim of near-white-box effectiveness from backbone weights alone is falsified for that regime.

Watch

Extended reading notes

Core claim

The central discovery is that the backbone alone carries nearly all the information needed to attack a downstream model. Formally, an attacker with access only to the backbone $B$ perturbs an image $x$ by iterating $x_{t+1}=\operatorname{Proj}_S(x_t+\alpha\,\operatorname{sign}(\nabla_{x_t}(1-\cos(B(x_t), \operatorname{SG}(B(x))))))$, maximizing the cosine distance between clean and perturbed backbone features inside an $\ell_\infty$ ball. These perturbations transfer to classifiers fine-tuned on $B$ across four datasets, under full and last-layer-only tuning, at shallow and deep depths, with success rates that surpass the 10-query Square attack and approach white-box PGD. The authors formalize grey-box knowledge as a unit of release $R(M(D,W,B(W_B),F(T,Z)))$ and find, by ablation, that among the metadata the tuning mode matters most, the dataset second, and the head depth least; knowing just the backbone beats knowing all metadata except the weights.

Load-bearing premise

The attack assumes that maximizing cosine distance in the backbone's feature space pushes any classifier later fine-tuned on that backbone across its decision boundary, whether the classifier is fully tuned or has only a new head; the evidence covers a limited set of SSL backbones and small, relatively simple datasets, and compares against a black-box baseline capped at 10 queries.

Editorial extensions

If this is right

  • A user of a publicly released SSL backbone should assume a determined attacker can produce targeted adversarial images against a fine-tuned classifier using only the backbone weights, with no query budget.
  • Deploying a model by freezing the backbone and training only a new head is the most exposed configuration; the authors report these last-layer-tuned models are trivially exploited by transferable attacks.
  • Attack construction effort is better spent on the backbone itself than on reconstructing the target's fine-tuning dataset, mode, or head depth, since backbone-only attacks match or beat proxy attacks built with partial metadata.
  • Releasing backbone weights should be treated as disclosing a near-white-box attack surface for any downstream task built on that backbone, so model-sharing and licensing practices are part of the security perimeter.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If the backbone's feature geometry is the main carrier of vulnerability, then cheap adapters and linear probes should be as attackable as full fine-tuning in the low-data regime; this could be tested directly on the paper's checkpoints.
  • The equivalence between backbone weights and full metadata suggests adversarial directions found in feature space are aligned with downstream decision boundaries, which would imply the same backbone attack transfers across different tasks (classification, retrieval, detection) built on one backbone.
  • The paper sets the black-box query budget at 10; with budgets of $10^3$–$10^5$ queries the advantage over black-box attacks would likely shrink, so the practical risk is clearest against low-query adversaries.
  • A mitigation the paper does not test is adversarial fine-tuning or feature-space smoothing of the shared backbone before release; the paper's evaluation grid would serve as a ready-made benchmark for such defenses.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 6 minor

Summary. This paper studies adversarial attacks in a 'grey-box' setting where an attacker has access to a pre-trained backbone used to fine-tune the target image classifier but may lack other meta-information (tuning mode, depth, dataset). The authors train 352 models from 21 SSL backbones and evaluate adversarial transferability via proxy models across roughly 20,000 target–proxy pairs, comparing proxy attacks, a proposed 'backbone attack' that maximizes cosine distance in the backbone feature space via PGD, a white-box PGD/FGSM attack, and a 10-query Square black-box attack. The main claims are that the backbone attack outperforms the black-box baseline and approaches white-box performance, and that access to backbone weights alone is as effective as access to all tuning meta-information.

Significance. If the central claims were established, the paper would highlight a significant security risk in sharing pre-trained backbones, since an attacker could craft effective transferable attacks using only public weights. The paper's strengths include the large-scale empirical setup, the systematic decomposition of meta-information, and a simple, reproducible attack algorithm. However, the key equivalence claim is not supported by the current experiment, and the black-box comparison uses an unreasonably small query budget; these issues currently limit the strength of the security conclusions.

major comments (3)
  1. [Section 5.3, Figure 5] The experiment intended to compare 'knowing all meta-information but not the weights' versus 'knowing only the backbone weights' does not actually manipulate weight knowledge. In the frozen/linear-probe mode, the proxy and target models share the exact same backbone weights because the backbone is fixed to the same pretrained checkpoint; only the final linear heads differ (through different batch sizes). Thus the proxy attack has access to the target's backbone weights, so it is not a 'no weights' condition. For the full-fine-tuning mode, both models start from the same initialization and the weights drift, but the initial backbone is still shared, and the paper reports results averaged over modes. Consequently, the claim that 'possessing information about only the target model backbone is equivalent to knowing all of the training meta-information' (Section 5.3) is not established by this experiment. To test the claim, one would need a proxy with identical meta-information but a genuinely different backbone (e.g., a different random seed or a different self-supervised checkpoint), so that the proxy does not contain the target's exact backbone weights.
  2. [Section 4, black-box comparison] The black-box baseline is Square attack with only 10 queries per sample. The paper's own Related Work states that black-box methods typically require 10^3 to 10^5 queries (Section 2). With a 10-query budget, the comparison is heavily biased in favor of the backbone and proxy attacks, which use no queries. The claim that the backbone attack 'outperforms black-box attacks' (Abstract; Section 5.2) is therefore not supported against a representative black-box baseline. The authors should either report results with larger query budgets (e.g., 100, 1,000, 10,000 queries) or explicitly temper the claim to 'outperforms a 10-query Square attack.'
  3. [Section 4, attack hyperparameters] The paper states that 'standard attack hyper-parameters introduced in parallel adversarial transferability studies' are used, but it does not report the actual values (e.g., epsilon, number of steps, step size, random restarts) for FGSM, PGD, or the backbone attack. Without these values, the empirical comparisons cannot be reproduced or independently verified. This is a critical omission for a paper whose main contributions are empirical.
minor comments (6)
  1. [Section 3] There is a typographical error: 'gery-box' should be 'grey-box' in the paragraph following the definition of the unit of release.
  2. [Table 1] Table 1 contains duplicate rows for Jigsaw ResNet-50 (IN1K and IN22K appear twice) and SwAV ResNet-50 (400ep/800ep); the table should be cleaned up or the duplicates should be disambiguated with additional columns such as pretraining epochs.
  3. [Table 3] The caption for Table 3 says 'Adversarial Transferability,' but the reported values could be mistaken for model accuracies; the table should state the exact metric and the attack configuration used to produce these numbers.
  4. [Figure 5] The y-axis 'Mean Transferability Accuracy' is not defined in the text; please define it, ideally as the TSR from Equation (2) averaged over models, and specify the error bars or variance if shown.
  5. [Section 3, notation] The notation for the unit of release R is inconsistent: the model tuple has four components, but the black-box release is written with five stars, R(M(∗, ∗, ∗, ∗, ∗)); please align the notation.
  6. [Section 5.1] The 'difference' between ASR and TSR mentioned in Section 5.1 is not formally defined; please state explicitly that Figure 2 plots the difference from the white-box ASR, and specify the formula used.

Circularity Check

0 steps flagged · score 1.0 of 10

No significant circularity: the backbone and proxy attacks are empirical transfer measurements against held-out targets, with no derivation reducing to inputs.

full rationale

The paper's central results are empirical transferability measurements, not derivations. The backbone attack (Eqs. 3-4) is an explicit PGD procedure in the backbone's feature space, and its success is evaluated by the Transfer Success Rate (Eq. 2) on target models that are separate from the proxy or backbone used to generate the perturbations; no parameter is fitted to the target's labels or predictions and then renamed as a prediction. The grey-box taxonomy (Section 3) is a threat-model definition, but the finding that backbone knowledge helps is a measured outcome rather than a consequence of that definition. The only notable concern is Section 5.3, where the claim that 'knowing weights' equals 'knowing everything but the weights' is tested with proxies trained from the same SwAV ResNet-50 backbone under identical meta-information; in frozen mode those proxies retain the exact target backbone weights, so the comparison is confounded and does not cleanly realize the 'without weights' condition. This is an experimental-validity limitation, not a circularity: there is no equation in the paper by which the reported equivalence is true by construction, and the transfer rates remain genuine held-out measurements. There are no load-bearing self-citations or imported uniqueness theorems. The black-box query budget of 10 queries is a fairness limitation relative to the black-box literature, but it does not make any result definitionally forced. Overall the derivation chain is self-contained; the paper is vulnerable to evaluation-design criticism, not circular reasoning.

Assumptions & free parameters 2 free parameters · 4 assumptions · 0 invented entities

The paper introduces no new physical or conceptual entities; the grey-box setting is a threat-model definition and the backbone attack is a method. The central claims rest on empirical assumptions about transferability, representativeness of the selected backbones, and the strength of the black-box baseline.

free parameters (2)
  • black-box query budget = 10 per sample
    Section 4 states 'we allow 10 queries of the target model per sample' for the Square attack. This choice determines the black-box baseline; a larger budget would strengthen black-box and weaken the claim that backbone attacks outperform black-box.
  • PGD/FGSM and backbone attack hyperparameters = not reported
    Section 4 says 'standard attack hyper-parameters introduced in parallel adversarial transferability studies' but no numeric values are given. Epsilon, step size, and iteration count directly control attack strength and thus the reported transferability.
assumptions (4)
  • domain assumption Models fine-tuned from the same backbone share enough feature geometry for adversarial perturbations to transfer.
    This is the premise of both proxy transfer attacks (Section 3) and the backbone attack (Eq. 3-4). The paper validates it on its selected models and datasets but does not establish it as a general law.
  • domain assumption The selected self-supervised backbones (Table 1) and fine-tuning recipe (Kolesnikov et al., 2020) are representative of public model-sharing practice.
    The empirical conclusions are extrapolated from 21 families and 4 small datasets; the paper itself notes that domain-specific datasets reduce transferability.
  • ad hoc to paper A black-box attack with 10 queries per sample is a meaningful comparison point.
    The paper calls the 10-query Square attack 'strong' and 'sizeable', which is not typical in the black-box literature where budgets range from 10^3 to 10^5 queries.
  • domain assumption The source of the models (VISSL) and their SSL objectives cover the space of public backbones.
    The attack's conclusions are shown for these backbones; ViT, DeiT, and XCiT are represented only through DINO, so transformer coverage is thinner than convolutional coverage.

how reviews work

0 comments
Cite this review

Pith. "Pith review of With Great Backbones Comes Great Adversarial Transferability." pith.science (2026). https://pith.science/paper/ICX5NZ2V

@misc{pith2026250112275,
  author       = {Pith},
  title        = {Pith review of: With Great Backbones Comes Great Adversarial Transferability},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/ICX5NZ2V}},
  note         = {Machine review of arXiv:2501.12275}
}
abstract

Advances in self-supervised learning (SSL) for machine vision have improved representation robustness and model performance, giving rise to pre-trained backbones like \emph{ResNet} and \emph{ViT} models tuned with SSL methods such as \emph{SimCLR}. Due to the computational and data demands of pre-training, the utilization of such backbones becomes a strenuous necessity. However, employing these backbones may inherit vulnerabilities to adversarial attacks. While adversarial robustness has been studied under \emph{white-box} and \emph{black-box} settings, the robustness of models tuned on pre-trained backbones remains largely unexplored. Additionally, the role of tuning meta-information in mitigating exploitation risks is unclear. This work systematically evaluates the adversarial robustness of such models across $20,000$ combinations of tuning meta-information, including fine-tuning techniques, backbone families, datasets, and attack types. We propose using proxy models to transfer attacks, simulating varying levels of target knowledge by fine-tuning these proxies with diverse configurations. Our findings reveal that proxy-based attacks approach the effectiveness of \emph{white-box} methods, even with minimal tuning knowledge. We also introduce a naive "backbone attack," leveraging only the backbone to generate adversarial samples, which outperforms \emph{black-box} attacks and rivals \emph{white-box} methods, highlighting critical risks in model-sharing practices. Finally, our ablations reveal how increasing tuning meta-information impacts attack transferability, measuring each meta-information combination.

Figures

Figures reproduced from arXiv: 2501.12275 by the authors.

Figure 1
Figure 1. The figure depicts all of the settings used to evaluate adversarial vulnerabilities given different information of the target model construction. From left to right, we simulate exhaustive varying combinations of meta-information available about the target model during adversarial attack construction. All of the created proxy models are used separately to assess adversarial transferability. classification task from … view at source ↗
Figure 2
Figure 2. The figure depicts the impact of the unavailability, i.e. difference from the target model, with each possible meta-information combination on adversarial transferability during proxy attack construction and the backbone attack. The results show the average difference from the white-box in transferability using PGD with a higher budget (left) and the segmentation w.r.t. in the target training mode (right). depth, mo… view at source ↗
Figure 3
Figure 3. The figure breaks down impact of the unavailability, i.e. difference from the target model, of each possible meta￾information combination on the change in the final decision￾making of the model. Higher JS divergence implies a bigger change in the final classification of the sample. Model variations We use 21 different models tuned from 5 architectures, 9 self-supervised objectives and 3 pre￾training datasets. A deta… view at source ↗
Figures from the paper (2 more)
Figure 4
Figure 4. Figure 4: The figure depicts the impact of the unavailability, i.e. difference from the target model, of each possible meta-information combination on adversarial transferability during proxy attack construction and the backbone attack. The results show the average transferabili…
Figure 5
Figure 5. Figure 5: The figure shows scenarios where adversaries either know all meta-information but lack the weights or have access to the backbone weights (SwaV ResNet-50) alone. Knowledge of only the backbone is highlighted as BackbonePGD. concerns, as it lowers the barrier for malici…

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. Large Language Models as Unified Multimodal Learners for Clinical Prediction

    cs.CL 2026-07 conditional novelty 4.0 of 10

    Serializing all patient data — notes, vitals, labs — into one text sequence and fine-tuning an LLM matches or beats task-specific multimodal fusion baselines on mortality, graft-failure, and triage prediction.

Reference graph

Works this paper leans on

68 extracted references · 31 canonical work pages · cited by 1 Pith paper

  1. [1]

    write newline

    " write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 global.max substring 't := if while FUNCTION format.date year duplicate empty "emp...

  2. [2]

    write newline

    " write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 global.max substring 't := if while FUNCTION format.date year duplicate empty "emp...

  3. [3]

    Xcit: Cross-covariance image transformers

    Ali, A., Touvron, H., Caron, M., Bojanowski, P., Douze, M., Joulin, A., Laptev, I., Neverova, N., Synnaeve, G., Verbeek, J., and J \' e gou, H. Xcit: Cross-covariance image transformers. In Ranzato, M., Beygelzimer, A., Dauphin, Y. N., Liang, P., and Vaughan, J. W. (eds.), Advances in Neural Information Processing Systems 34: Annual Conference on Neural I...

    work page 2021

  4. [4]

    Square attack: A query-efficient black-box adversarial attack via random search

    Andriushchenko, M., Croce, F., Flammarion, N., and Hein, M. Square attack: A query-efficient black-box adversarial attack via random search. In Vedaldi, A., Bischof, H., Brox, T., and Frahm, J. (eds.), Computer Vision - ECCV 2020 - 16th European Conference, Glasgow, UK, August 23-28, 2020, Proceedings, Part XXIII , volume 12368 of Lecture Notes in Compute...

    doi:10.1007/978-3-030-58592-1 2020

  5. [5]

    Sit: Self-supervised vision transformer

    Atito, S., Awais, M., and Kittler, J. Sit: Self-supervised vision transformer. arXiv preprint arXiv:2104.03602, 2021

    arXiv 2021

  6. [6]

    J., Kolesnikov, A., Zhai, X., and Oord, A

    Beyer, L., H \'e naff, O. J., Kolesnikov, A., Zhai, X., and Oord, A. v. d. Are we done with imagenet? arXiv preprint arXiv:2006.07159, 2020

    arXiv 2006

  7. [7]

    N., He, W., Li, B., and Song, D

    Bhagoji, A. N., He, W., Li, B., and Song, D. Practical black-box attacks on deep neural networks using efficient query mechanisms. In Ferrari, V., Hebert, M., Sminchisescu, C., and Weiss, Y. (eds.), Computer Vision - ECCV 2018 - 15th European Conference, Munich, Germany, September 8-14, 2018, Proceedings, Part XII , volume 11216 of Lecture Notes in Comput...

    work page doi:10.1007/978-3-030-01258-8 2018

  8. [8]

    Bhambri, S., Muku, S., Tulasi, A., and Buduru, A. B. A survey of black-box adversarial attacks on computer vision models. arXiv preprint arXiv:1912.01667, 2019

    arXiv 1912

Show all 68 references
  1. [9]

    Decision-based adversarial attacks: Reliable attacks against black-box machine learning models

    Brendel, W., Rauber, J., and Bethge, M. Decision-based adversarial attacks: Reliable attacks against black-box machine learning models. In 6th International Conference on Learning Representations, ICLR 2018, Vancouver, BC, Canada, April 30 - May 3, 2018, Conference Track Proce...

    2018

  2. [10]

    Efficient adaptive ensembling for image classification

    Bruno, A., Moroni, D., and Martinelli, M. Efficient adaptive ensembling for image classification. arXiv preprint arXiv:2206.07394, 2022

    2022

  3. [12]

    Membership inference attacks from first principles

    Carlini, N., Chien, S., Nasr, M., Song, S., Terzis, A., and Tram \` e r, F. Membership inference attacks from first principles. In 43rd IEEE Symposium on Security and Privacy, SP 2022, San Francisco, CA, USA, May 22-26, 2022 , pp.\ 1897--1914. IEEE , 2022. doi:10.1109/SP46214....

    2022

  4. [13]

    Deep clustering for unsupervised learning of visual features

    Caron, M., Bojanowski, P., Joulin, A., and Douze, M. Deep clustering for unsupervised learning of visual features. In Ferrari, V., Hebert, M., Sminchisescu, C., and Weiss, Y. (eds.), Computer Vision - ECCV 2018 - 15th European Conference, Munich, Germany, September 8-14, 2018,...

    2018 doi

  5. [14]

    Unsupervised learning of visual features by contrasting cluster assignments

    Caron, M., Misra, I., Mairal, J., Goyal, P., Bojanowski, P., and Joulin, A. Unsupervised learning of visual features by contrasting cluster assignments. In Larochelle, H., Ranzato, M., Hadsell, R., Balcan, M., and Lin, H. (eds.), Advances in Neural Information Processing Syste...

    2020

  6. [15]

    Emerging properties in self-supervised vision transformers

    Caron, M., Touvron, H., Misra, I., J \' e gou, H., Mairal, J., Bojanowski, P., and Joulin, A. Emerging properties in self-supervised vision transformers. In 2021 IEEE/CVF International Conference on Computer Vision, ICCV 2021, Montreal, QC, Canada, October 10-17, 2021 , pp.\ 9...

    2021

  7. [16]

    ZOO: zeroth order optimization based black-box attacks to deep neural networks without training substitute models

    Chen, P., Zhang, H., Sharma, Y., Yi, J., and Hsieh, C. ZOO: zeroth order optimization based black-box attacks to deep neural networks without training substitute models. In Thuraisingham, B., Biggio, B., Freeman, D. M., Miller, B., and Sinha, A. (eds.), Proceedings of the 10th...

    2017

  8. [17]

    Chen, T., Kornblith, S., Norouzi, M., and Hinton, G. E. A simple framework for contrastive learning of visual representations. In Proceedings of the 37th International Conference on Machine Learning, ICML 2020, 13-18 July 2020, Virtual Event , volume 119 of Proceedings of Mach...

    2020

  9. [18]

    Chen, T., Kornblith, S., Swersky, K., Norouzi, M., and Hinton, G. E. Big self-supervised models are strong semi-supervised learners. Advances in neural information processing systems, 33: 0 22243--22255, 2020 b

    2020

  10. [19]

    Boosting decision-based black-box adversarial attacks with random sign flip

    Chen, W., Zhang, Z., Hu, X., and Wu, B. Boosting decision-based black-box adversarial attacks with random sign flip. In Vedaldi, A., Bischof, H., Brox, T., and Frahm, J. (eds.), Computer Vision - ECCV 2020 - 16th European Conference, Glasgow, UK, August 23-28, 2020, Proceeding...

    2020 doi

  11. [20]

    Imagenet: A large-scale hierarchical image database

    Deng, J., Dong, W., Socher, R., Li, L.-J., Li, K., and Fei-Fei, L. Imagenet: A large-scale hierarchical image database. In 2009 IEEE conference on computer vision and pattern recognition, pp.\ 248--255. Ieee, 2009

    2009

  12. [21]

    Boosting adversarial attacks with momentum

    Dong, Y., Liao, F., Pang, T., Su, H., Zhu, J., Hu, X., and Li, J. Boosting adversarial attacks with momentum. In 2018 IEEE Conference on Computer Vision and Pattern Recognition, CVPR 2018, Salt Lake City, UT, USA, June 18-22, 2018 , pp.\ 9185--9193. Computer Vision Foundation ...

    2018

  13. [22]

    An image is worth 16x16 words: Transformers for image recognition at scale

    Dosovitskiy, A., Beyer, L., Kolesnikov, A., Weissenborn, D., Zhai, X., Unterthiner, T., Dehghani, M., Minderer, M., Heigold, G., Gelly, S., et al. An image is worth 16x16 words: Transformers for image recognition at scale. arXiv preprint arXiv:2010.11929, 2020

    2010 arXiv

  14. [23]

    An image is worth 16x16 words: Transformers for image recognition at scale

    Dosovitskiy, A., Beyer, L., Kolesnikov, A., Weissenborn, D., Zhai, X., Unterthiner, T., Dehghani, M., Minderer, M., Heigold, G., Gelly, S., Uszkoreit, J., and Houlsby, N. An image is worth 16x16 words: Transformers for image recognition at scale. In 9th International Conferenc...

    2021

  15. [24]

    Backbones-review: Feature extraction networks for deep learning and deep reinforcement learning approaches

    Elharrouss, O., Akbari, Y., Almaadeed, N., and Al-Maadeed, S. Backbones-review: Feature extraction networks for deep learning and deep reinforcement learning approaches. arXiv preprint arXiv:2206.08016, 2022

    2022 arXiv

  16. [25]

    Sharpness-aware minimization for efficiently improving generalization

    Foret, P., Kleiner, A., Mobahi, H., and Neyshabur, B. Sharpness-aware minimization for efficiently improving generalization. arXiv preprint arXiv:2010.01412, 2020

    2010 arXiv

  17. [26]

    Unsupervised representation learning by predicting image rotations

    Gidaris, S., Singh, P., and Komodakis, N. Unsupervised representation learning by predicting image rotations. In 6th International Conference on Learning Representations, ICLR 2018, Vancouver, BC, Canada, April 30 - May 3, 2018, Conference Track Proceedings . OpenReview.net, 2...

    2018

  18. [27]

    G., and Goldstein, T

    Goldblum, M., Souri, H., Ni, R., Shu, M., Prabhu, V., Somepalli, G., Chattopadhyay, P., Ibrahim, M., Bardes, A., Hoffman, J., Chellappa, R., Wilson, A. G., and Goldstein, T. Battle of the backbones: A large-scale comparison of pretrained models across computer vision tasks. In...

    2023

  19. [28]

    Battle of the backbones: A large-scale comparison of pretrained models across computer vision tasks

    Goldblum, M., Souri, H., Ni, R., Shu, M., Prabhu, V., Somepalli, G., Chattopadhyay, P., Ibrahim, M., Bardes, A., Hoffman, J., et al. Battle of the backbones: A large-scale comparison of pretrained models across computer vision tasks. Advances in Neural Information Processing S...

    2024

  20. [29]

    J., Pouget - Abadie, J., Mirza, M., Xu, B., Warde - Farley, D., Ozair, S., Courville, A

    Goodfellow, I. J., Pouget - Abadie, J., Mirza, M., Xu, B., Warde - Farley, D., Ozair, S., Courville, A. C., and Bengio, Y. Generative adversarial networks. CoRR, abs/1406.2661, 2014. URL http://arxiv.org/abs/1406.2661

    2014 arXiv

  21. [30]

    J., Shlens, J., and Szegedy, C

    Goodfellow, I. J., Shlens, J., and Szegedy, C. Explaining and harnessing adversarial examples. In Bengio, Y. and LeCun, Y. (eds.), 3rd International Conference on Learning Representations, ICLR 2015, San Diego, CA, USA, May 7-9, 2015, Conference Track Proceedings , 2015. URL h...

    2015 arXiv

  22. [31]

    Self-supervised pretraining of visual features in the wild

    Goyal, P., Caron, M., Lefaudeux, B., Xu, M., Wang, P., Pai, V., Singh, M., Liptchinsky, V., Misra, I., Joulin, A., et al. Self-supervised pretraining of visual features in the wild. arXiv preprint arXiv:2103.01988, 2021 a

    2021 arXiv

  23. [32]

    Goyal, P., Duval, Q., Reizenstein, J., Leavitt, M., Xu, M., Lefaudeux, B., Singh, M., Reis, V., Caron, M., Bojanowski, P., Joulin, A., and Misra, I. Vissl. https://github.com/facebookresearch/vissl, 2021 b

    2021

  24. [33]

    A survey on vision transformer

    Han, K., Wang, Y., Chen, H., Chen, X., Guo, J., Liu, Z., Tang, Y., Xiao, A., Xu, C., Xu, Y., et al. A survey on vision transformer. IEEE transactions on pattern analysis and machine intelligence, 45 0 (1): 0 87--110, 2022

    2022

  25. [34]

    Deep residual learning for image recognition

    He, K., Zhang, X., Ren, S., and Sun, J. Deep residual learning for image recognition. In 2016 IEEE Conference on Computer Vision and Pattern Recognition, CVPR 2016, Las Vegas, NV, USA, June 27-30, 2016 , pp.\ 770--778. IEEE Computer Society, 2016. doi:10.1109/CVPR.2016.90. URL...

    2016 doi

  26. [35]

    Black-box adversarial attacks with limited queries and information

    Ilyas, A., Engstrom, L., Athalye, A., and Lin, J. Black-box adversarial attacks with limited queries and information. In Dy, J. G. and Krause, A. (eds.), Proceedings of the 35th International Conference on Machine Learning, ICML 2018, Stockholmsm \" a ssan, Stockholm, Sweden, ...

    2018

  27. [36]

    and Tian, Y

    Jing, L. and Tian, Y. Self-supervised visual feature learning with deep neural networks: A survey. IEEE transactions on pattern analysis and machine intelligence, 43 0 (11): 0 4037--4058, 2020

    2020

  28. [37]

    and Tian, Y

    Jing, L. and Tian, Y. Self-supervised visual feature learning with deep neural networks: A survey. IEEE Trans. Pattern Anal. Mach. Intell. , 43 0 (11): 0 4037--4058, 2021. doi:10.1109/TPAMI.2020.2992393. URL https://doi.org/10.1109/TPAMI.2020.2992393

    2021

  29. [38]

    and Elovici, Y

    Katzir, Z. and Elovici, Y. Who's afraid of adversarial transferability? CoRR, abs/2105.00433, 2021. URL https://arxiv.org/abs/2105.00433

    2021 arXiv

  30. [39]

    Big transfer (bit): General visual representation learning

    Kolesnikov, A., Beyer, L., Zhai, X., Puigcerver, J., Yung, J., Gelly, S., and Houlsby, N. Big transfer (bit): General visual representation learning. In European conference on computer vision, pp.\ 491--507. Springer, 2020

    2020

  31. [40]

    Learning multiple layers of features from tiny images

    Krizhevsky, A., Hinton, G., et al. Learning multiple layers of features from tiny images. 2009

    2009

  32. [41]

    Krizhevsky, A., Sutskever, I., and Hinton, G. E. Imagenet classification with deep convolutional neural networks. In Bartlett, P. L., Pereira, F. C. N., Burges, C. J. C., Bottou, L., and Weinberger, K. Q. (eds.), Advances in Neural Information Processing Systems 25: 26th Annua...

    2012

  33. [42]

    J., and Bengio, S

    Kurakin, A., Goodfellow, I. J., and Bengio, S. Adversarial examples in the physical world. In 5th International Conference on Learning Representations, ICLR 2017, Toulon, France, April 24-26, 2017, Workshop Track Proceedings . OpenReview.net, 2017. URL https://openreview.net/f...

    2017

  34. [43]

    NATTACK: learning the distributions of adversarial examples for an improved black-box attack on deep neural networks

    Li, Y., Li, L., Wang, L., Zhang, T., and Gong, B. NATTACK: learning the distributions of adversarial examples for an improved black-box attack on deep neural networks. In Chaudhuri, K. and Salakhutdinov, R. (eds.), Proceedings of the 36th International Conference on Machine Le...

    2019

  35. [44]

    A., M \" u ller, R., and Bertinetto, L

    Lord, N. A., M \" u ller, R., and Bertinetto, L. Attacking deep networks with surrogate-based adversarial black-box methods is easy. In The Tenth International Conference on Learning Representations, ICLR 2022, Virtual Event, April 25-29, 2022 . OpenReview.net, 2022. URL https...

    2022

  36. [45]

    Towards deep learning models resistant to adversarial attacks

    Madry, A., Makelov, A., Schmidt, L., Tsipras, D., and Vladu, A. Towards deep learning models resistant to adversarial attacks. In 6th International Conference on Learning Representations, ICLR 2018, Vancouver, BC, Canada, April 30 - May 3, 2018, Conference Track Proceedings . ...

    2018

  37. [46]

    L., Pardo, J., Pardo, L., and Pardo, M

    Men \'e ndez, M. L., Pardo, J., Pardo, L., and Pardo, M. The jensen-shannon divergence. Journal of the Franklin Institute, 334 0 (2): 0 307--318, 1997

    1997

  38. [47]

    and van der Maaten, L

    Misra, I. and van der Maaten, L. Self-supervised learning of pretext-invariant representations. In 2020 IEEE/CVF Conference on Computer Vision and Pattern Recognition, CVPR 2020, Seattle, WA, USA, June 13-19, 2020 , pp.\ 6706--6716. Computer Vision Foundation / IEEE , 2020. do...

    2020

  39. [48]

    Moon, S., An, G., and Song, H. O. Parsimonious black-box adversarial attacks via efficient combinatorial optimization. In Chaudhuri, K. and Salakhutdinov, R. (eds.), Proceedings of the 36th International Conference on Machine Learning, ICML 2019, 9-15 June 2019, Long Beach, Ca...

    2019

  40. [49]

    Deepfool: A simple and accurate method to fool deep neural networks

    Moosavi - Dezfooli, S., Fawzi, A., and Frossard, P. Deepfool: A simple and accurate method to fool deep neural networks. In 2016 IEEE Conference on Computer Vision and Pattern Recognition, CVPR 2016, Las Vegas, NV, USA, June 27-30, 2016 , pp.\ 2574--2582. IEEE Computer Society...

    2016 doi

  41. [50]

    and Kasiviswanathan, S

    Narodytska, N. and Kasiviswanathan, S. P. Simple black-box adversarial perturbations for deep networks. CoRR, abs/1612.06299, 2016. URL http://arxiv.org/abs/1612.06299

    2016 arXiv

  42. [51]

    S., and Porikli, F

    Naseer, M., Ranasinghe, K., Khan, S., Khan, F. S., and Porikli, F. On improving adversarial transferability of vision transformers. In The Tenth International Conference on Learning Representations, ICLR 2022, Virtual Event, April 25-29, 2022 . OpenReview.net, 2022. URL https:...

    2022

  43. [52]

    and Deng, J

    Newell, A. and Deng, J. How useful is self-supervised pretraining for visual tasks? In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp.\ 7345--7354, 2020

    2020

  44. [53]

    and Zisserman, A

    Nilsback, M.-E. and Zisserman, A. Automated flower classification over a large number of classes. In 2008 Sixth Indian Conference on Computer Vision, Graphics & Image Processing, pp.\ 722--729. IEEE, 2008

    2008

  45. [54]

    and Favaro, P

    Noroozi, M. and Favaro, P. Unsupervised learning of visual representations by solving jigsaw puzzles. In Leibe, B., Matas, J., Sebe, N., and Welling, M. (eds.), Computer Vision - ECCV 2016 - 14th European Conference, Amsterdam, The Netherlands, October 11-14, 2016, Proceedings...

    2016 doi

  46. [55]

    D., Goodfellow, I

    Papernot, N., McDaniel, P. D., Goodfellow, I. J., Jha, S., Celik, Z. B., and Swami, A. Practical black-box attacks against machine learning. In Karri, R., Sinanoglu, O., Sadeghi, A., and Yi, X. (eds.), Proceedings of the 2017 ACM on Asia Conference on Computer and Communicatio...

    2017

  47. [56]

    M., Vedaldi, A., Zisserman, A., and Jawahar, C

    Parkhi, O. M., Vedaldi, A., Zisserman, A., and Jawahar, C. Cats and dogs. In 2012 IEEE conference on computer vision and pattern recognition, pp.\ 3498--3505. IEEE, 2012

    2012

  48. [57]

    S., and Manikandan, V

    Porkodi, V., Sivaram, M., Mohammed, A. S., and Manikandan, V. Survey on white-box attacks and solutions. Asian Journal of Computer Science and Technology, 7 0 (3): 0 28--32, 2018

    2018

  49. [58]

    Poursaeed, O., Katsman, I., Gao, B., and Belongie, S. J. Generative adversarial perturbations. In 2018 IEEE Conference on Computer Vision and Pattern Recognition, CVPR 2018, Salt Lake City, UT, USA, June 18-22, 2018 , pp.\ 4422--4431. Computer Vision Foundation / IEEE Computer...

    2018

  50. [59]

    Training meta-surrogate model for transferable adversarial attack

    Qin, Y., Xiong, Y., Yi, J., and Hsieh, C. Training meta-surrogate model for transferable adversarial attack. In Williams, B., Chen, Y., and Neville, J. (eds.), Thirty-Seventh AAAI Conference on Artificial Intelligence, AAAI 2023, Thirty-Fifth Conference on Innovative Applicati...

    2023 doi

  51. [60]

    Analysis of variance (anova)

    St, L., Wold, S., et al. Analysis of variance (anova). Chemometrics and intelligent laboratory systems, 6 0 (4): 0 259--272, 1989

    1989

  52. [61]

    J., and Fergus, R

    Szegedy, C., Zaremba, W., Sutskever, I., Bruna, J., Erhan, D., Goodfellow, I. J., and Fergus, R. Intriguing properties of neural networks. In Bengio, Y. and LeCun, Y. (eds.), 2nd International Conference on Learning Representations, ICLR 2014, Banff, AB, Canada, April 14-16, 2...

    2014 arXiv

  53. [62]

    A., Friedland, G., Elizalde, B., Ni, K., Poland, D., Borth, D., and Li, L

    Thomee, B., Shamma, D. A., Friedland, G., Elizalde, B., Ni, K., Poland, D., Borth, D., and Li, L. YFCC100M: the new data in multimedia research. Commun. ACM , 59 0 (2): 0 64--73, 2016. doi:10.1145/2812802. URL https://doi.org/10.1145/2812802

    2016 doi

  54. [63]

    Training data-efficient image transformers & distillation through attention

    Touvron, H., Cord, M., Douze, M., Massa, F., Sablayrolles, A., and J \' e gou, H. Training data-efficient image transformers & distillation through attention. In Meila, M. and Zhang, T. (eds.), Proceedings of the 38th International Conference on Machine Learning, ICML 2021, 18...

    2021

  55. [64]

    H., and Echizen, I

    Waseda, F., Nishikawa, S., Le, T., Nguyen, H. H., and Echizen, I. Closer look at the transferability of adversarial examples: How they fool different models differently. In IEEE/CVF Winter Conference on Applications of Computer Vision, WACV 2023, Waikoloa, HI, USA, January 2-7...

    2023

  56. [65]

    X., and Lin, D

    Wu, Z., Xiong, Y., Yu, S. X., and Lin, D. Unsupervised feature learning via non-parametric instance discrimination. In 2018 IEEE Conference on Computer Vision and Pattern Recognition, CVPR 2018, Salt Lake City, UT, USA, June 18-22, 2018 , pp.\ 3733--3742. Computer Vision Found...

    2018

  57. [66]

    Coca: Contrastive captioners are image-text foundation models

    Yu, J., Wang, Z., Vasudevan, V., Yeung, L., Seyedhosseini, M., and Wu, Y. Coca: Contrastive captioners are image-text foundation models. arXiv preprint arXiv:2205.01917, 2022

    2022 arXiv

  58. [67]

    Zhang, R., Isola, P., and Efros, A. A. Colorful image colorization. In Leibe, B., Matas, J., Sebe, N., and Welling, M. (eds.), Computer Vision - ECCV 2016 - 14th European Conference, Amsterdam, The Netherlands, October 11-14, 2016, Proceedings, Part III , volume 9907 of Lectur...

    2016 doi

  59. [68]

    Toward understanding and boosting adversarial transferability from a distribution perspective

    Zhu, Y., Chen, Y., Li, X., Chen, K., He, Y., Tian, X., Zheng, B., Chen, Y., and Huang, Q. Toward understanding and boosting adversarial transferability from a distribution perspective. IEEE Trans. Image Process. , 31: 0 6487--6501, 2022. doi:10.1109/TIP.2022.3211736. URL https...

    2022

  60. [69]

    and Asano, Y

    Ziegler, A. and Asano, Y. M. Self-supervised learning of object parts for semantic segmentation. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp.\ 14502--14511, 2022

    2022

Pith tools

Reviewed August 10, 2026 · model on record in the stance chip above.