mlsanityData to 7 Oct 2026

Delving into Transferable Adversarial Examples and Black-box Attacks

arXiv 1611.02770 ↗First posted 8 Nov 2016cs.LGcited by 530

Not on the map. Why?

Cited by 32 in Multimodal LLMs / vision-language models, but placed by its own abstract, which didn’t fit.

Abstract (arXiv)

An intriguing property of deep neural networks is the existence of adversarial examples, which can transfer among different architectures. These transferable adversarial examples may severely hinder deep neural network-based applications. Previous works mostly study the transferability using small scale datasets. In this work, we are the first to conduct an extensive study of the transferability over large models and a large scale dataset, and we are also the first to study the transferability of targeted adversarial examples with their target labels. We study both non-targeted and targeted adversarial examples, and show that while transferable non-targeted adversarial examples are easy to find, targeted adversarial examples generated using existing approaches almost never transfer with their target labels. Therefore, we propose novel ensemble-based approaches to generating transferable adversarial examples. Using such approaches, we observe a large proportion of targeted adversarial examples that are able to transfer with their target labels for the first time. We also present some geometric studies to help understanding the transferable adversarial examples. Finally, we show that the adversarial examples generated using ensemble-based approaches can successfully attack Clarifai.com, which is a black-box image classification system.

Key facts. Cited by 530 papers in the map (data through 7 Oct 2026). First posted on arXiv 8 Nov 2016.

Builds on

No reference list yet.

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 122; 2022: 90; 2023: 115; 2024: 94; 2025: 66; 2026: 43.

530 papers.

Sort:

By area:

  1. 2023Jailbreaking Black Box Large Language Models in Twenty Queriescited by 1,326
  2. 2022Red Teaming Language Models with Language Modelscited by 983
  3. 2023On Evaluating Adversarial Robustness of Large Vision-Language Modelscited by 281
  4. 2021Enhancing the Transferability of Adversarial Attacks through Variance Tuningcited by 242
  5. 2023How Robust is Google's Bard to Adversarial Image Attacks?cited by 177
  6. 2021On the Robustness of Vision Transformers to Adversarial Examplescited by 167
  7. 2023Raising the Cost of Malicious AI-Powered Image Editingcited by 160
  8. 2021Admix: Enhancing the Transferability of Adversarial Attackscited by 155
  9. 2022Frequency Domain Model Augmentation for Adversarial Attackcited by 128
  10. 2021Feature Importance-aware Transferable Adversarial Attackscited by 125
  11. 2024Black-Box Access is Insufficient for Rigorous AI Auditscited by 123
  12. 2024Is LLM-as-a-Judge Robust? Investigating Universal Adversarial Attacks on Zero-shot LLM Assessmentcited by 117
38 more
  1. 2022Adversarial Texture for Fooling Person Detectors in the Physical Worldcited by 96
  2. 2021Adv-Makeup: A New Imperceptible and Transferable Attack on Face Recognitioncited by 95
  3. 2021Adversarial Sticker: A Stealthy Attack Method in the Physical Worldcited by 92
  4. 2023On the Robustness of Large Multimodal Models Against Image Adversarial Attackscited by 89
  5. 2023Rethinking Model Ensemble in Transfer-based Adversarial Attackscited by 88
  6. 2023A Comprehensive Study on Robustness of Image Classification Models: Benchmarking and Rethinkingcited by 85
  7. 2021Stochastic Variance Reduced Ensemble Adversarial Attack for Boosting the Adversarial Transferabilitycited by 84
  8. 2024A Survey of Attacks on Large Vision-Language Models: Resources, Advances, and Future Trendscited by 82
  9. 2021Towards Transferable Adversarial Attacks on Vision Transformerscited by 80
  10. 2021RobustART: Benchmarking Robustness on Architecture Design and Training Techniquescited by 78
  11. 2021Improving Adversarial Robustness via Channel-wise Activation Suppressingcited by 76
  12. 2022Boosting the Transferability of Adversarial Attacks with Reverse Adversarial Perturbationcited by 67
  13. 2024JailbreakZoo: Survey, Landscapes, and Horizons in Jailbreaking Large Language and Vision-Language Modelscited by 67
  14. 2021On Generating Transferable Targeted Perturbationscited by 65
  15. 2023Boosting Adversarial Transferability by Block Shuffle and Rotationcited by 64
  16. 2023Structure Invariant Transformation for better Adversarial Transferabilitycited by 61
  17. 2022Fingerprinting Deep Neural Networks Globally via Universal Adversarial Perturbationscited by 58
  18. 2021Adversarial Robustness Comparison of Vision Transformer and MLP-Mixer to CNNscited by 57
  19. 2021Meta Gradient Adversarial Attackcited by 55
  20. 2024Query-Based Adversarial Prompt Generationcited by 55
  21. 2021Boosting Adversarial Transferability through Enhanced Momentumcited by 53
  22. 2024Don't Say No: Jailbreaking LLM by Suppressing Refusalcited by 53
  23. 2021Model Extraction and Adversarial Transferability, Your BERT is Vulnerable!cited by 51
  24. 2021Adversarial Example Detection for DNN Models: A Review and Experimental Comparisoncited by 51
  25. 2022Improving the Transferability of Targeted Adversarial Examples through Object-Based Diverse Inputcited by 49
  26. 2021RDA: Robust Domain Adaptation via Fourier Adversarial Attackingcited by 48
  27. 2021Triangle Attack: A Query-efficient Decision-based Adversarial Attackcited by 48
  28. 2023Boosting Adversarial Transferability by Achieving Flat Local Maximacited by 48
  29. 2024Shadowcast: Stealthy Data Poisoning Attacks Against Vision-Language Modelscited by 48
  30. 2021Data Poisoning Won't Save You From Facial Recognitioncited by 45
  31. 2022A Survey of Robust Adversarial Training in Pattern Recognition: Fundamental, Theory, and Methodologiescited by 44
  32. 2022SSLGuard: A Watermarking Scheme for Self-supervised Learning Pre-trained Encoderscited by 43
  33. 2023A Survey on Transferability of Adversarial Examples across Deep Neural Networkscited by 43
  34. 2022Beyond ImageNet Attack: Towards Crafting Adversarial Examples for Black-box Domainscited by 42
  35. 2022Infrared Invisible Clothing:Hiding from Infrared Detectors at Multiple Angles in Real Worldcited by 42
  36. 2022Adv-Attribute: Inconspicuous and Transferable Adversarial Attack on Face Recognitioncited by 42
  37. 2023RoboBEV: Towards Robust Bird's Eye View Perception under Corruptionscited by 42
  38. 2023An Adaptive Model Ensemble Adversarial Attack for Boosting Adversarial Transferabilitycited by 42

50 most cited of 530 All 530 (JSON)