Pith. sign in

REVIEW 9 cited by

Rethinking Model Ensemble in Transfer-based Adversarial Attacks

Not yet reviewed by Pith; the record is open.

Re-run · record.json Download PDF Read on arXiv ↗

This paper has not been read by Pith yet. Machine review is queued; the pith claim, tier, and objections will appear here once it completes.

SPECIMEN: schema-true, not a live event

T0 review · schema-true

One-sentence machine reading of the paper's core claim.

pith:XXXXXXXX · record.json · timestamp

arxiv 2303.09105 v2 pith:JBNN4YGY submitted 2023-03-16 cs.CV

Huanran Chen , Yichi Zhang , Yinpeng Dong , Xiao Yang , Hang Su , Jun Zhu This is my paper · ORCID
classification cs.CV
keywords adversarialmodelensemblemodelstransferabilityattacksexamplesproperties
verification ladder T0 review T1 audit T2 compute T3 formal

Signed reviews

No signed human review yet.

0 comments
read the original abstract

It is widely recognized that deep learning models lack robustness to adversarial examples. An intriguing property of adversarial examples is that they can transfer across different models, which enables black-box attacks without any knowledge of the victim model. An effective strategy to improve the transferability is attacking an ensemble of models. However, previous works simply average the outputs of different models, lacking an in-depth analysis on how and why model ensemble methods can strongly improve the transferability. In this paper, we rethink the ensemble in adversarial attacks and define the common weakness of model ensemble with two properties: 1) the flatness of loss landscape; and 2) the closeness to the local optimum of each model. We empirically and theoretically show that both properties are strongly correlated with the transferability and propose a Common Weakness Attack (CWA) to generate more transferable adversarial examples by promoting these two properties. Experimental results on both image classification and object detection tasks validate the effectiveness of our approach to improving the adversarial transferability, especially when attacking adversarially trained models. We also successfully apply our method to attack a black-box large vision-language model -- Google's Bard, showing the practical effectiveness. Code is available at \url{https://github.com/huanranchen/AdversarialAttacks}.

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 9 Pith papers

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. Learning with Bilevel-Minimax Optimization for Efficient and Reliable Transfer Attacks

    cs.LG 2026-08 conditional novelty 6.0 of 10

    BMAT couples initialization, perturbation, and surrogate adaptation in one bilevel-minimax optimization, markedly improving adversarial example transfer to unseen victims.

  2. Mitigating Object Hallucination via Robust Local Perception Search

    cs.CV 2025-06 conditional novelty 6.0 of 10

    A training-free decoding method that uses an MLLM's own local object descriptions as a reward prior, combined with CLIP similarity, to cut object hallucination, especially under adversarial image noise.

  3. Transferable Adversarial Attacks on Black-Box Vision-Language Models

    cs.CV 2025-05 conditional novelty 6.0 of 10

    Targeted, barely visible image perturbations transfer from open-source surrogate models to proprietary black-box VLLMs like GPT-4o, Claude, and Gemini, achieving high attack success on captioning, VQA, and receipt tex...

  4. ActionSink: Toward Precise Robot Manipulation with Dynamic Integration of Action Flow

    cs.CV 2025-08 unverdicted novelty 5.0 of 10

    ActionSink claims to improve robot manipulation precision by representing actions as optical flow and integrating retrieved historical flows, with a 7.9% LIBERO success-rate gain over prior SOTA.

  5. Disrupting Semantic and Abstract Features for Better Adversarial Transferability

    cs.CV 2025-07 conditional novelty 5.0 of 10

    A transfer-based adversarial attack that mixes image blocks and rotated frequency spectra improves transferability against unseen models.

  6. Adversarial Attacks against Closed-Source MLLMs via Feature Optimal Alignment

    cs.CV 2025-05 conditional novelty 5.0 of 10

    FOA-Attack aligns global and clustered local features via optimal transport with dynamic ensemble weighting to create targeted adversarial images that transfer to closed-source multimodal LLMs.

  7. FSPGD: Rethinking Black-box Attacks on Semantic Segmentation

    cs.CV 2025-02 conditional novelty 5.0 of 10

    FSPGD uses two feature-similarity losses to craft segmentation attacks that transfer across CNN and transformer models, and reports large mIoU drops on Pascal VOC and Cityscapes.

  8. Chain of Attack: On the Robustness of Vision-Language Models Against Transfer-Based Adversarial Attacks

    cs.CV 2024-11 conditional novelty 5.0 of 10

    A step-by-step multimodal 'chain of attack' improves the transferability of targeted adversarial images against open vision-language models, with a new LLM-judged success metric.

  9. Blockchain Network Analysis using Quantum Inspired Graph Neural Networks & Ensemble Models

    cs.LG 2025-08 unverdicted novelty 4.0 of 10

    The submission's abstract claims a quantum-inspired GNN with a CP-decomposition layer reaches 74.8% F2 on blockchain fraud detection, but the uploaded full text is an unrelated paper on VLM agent security.

Pith tools