mlsanityData to 7 Oct 2026

Spatially Transformed Adversarial Examples

arXiv 1801.02612 ↗First posted 8 Jan 2018cs.CR cs.CV stat.MLcited by 195

Not on the map. Why?

Abstract (arXiv)

Recent studies show that widely used deep neural networks (DNNs) are vulnerable to carefully crafted adversarial examples. Many advanced algorithms have been proposed to generate adversarial examples by leveraging the Lp distance for penalizing perturbations. Researchers have explored different defense methods to defend against such adversarial attacks. While the effectiveness of Lp distance as a metric of perceptual quality remains an active research area, in this paper we will instead focus on a different type of perturbation, namely spatial transformation, as opposed to manipulating the pixel values directly as in prior works. Perturbations generated through spatial transformation could result in large Lp distance measures, but our extensive experiments show that such spatially transformed adversarial examples are perceptually realistic and more difficult to defend against with existing defense systems. This potentially provides a new direction in adversarial example generation and the design of corresponding defenses. We visualize the spatial transformation based perturbation for different examples and show that our technique can produce realistic adversarial examples with smooth image deformation. Finally, we visualize the attention of deep networks with different types of adversarial examples to better understand how these examples are interpreted.

Key facts. Cited by 195 papers in the map (data through 7 Oct 2026). First posted on arXiv 8 Jan 2018.

Builds on

No reference list yet.

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 44; 2022: 55; 2023: 43; 2024: 24; 2025: 18; 2026: 11.

195 papers.

Sort:

By area:

  1. 2022Diffusion Models for Adversarial Purificationcited by 469
  2. 2024Robust Prompt Optimization for Defending Language Models Against Jailbreaking Attackscited by 150
  3. 2021Invisible for both Camera and LiDAR: Security of Multi-Sensor Fusion based Perception in Autonomous Driving Under Physical-World Attackscited by 101
  4. 2021AugMax: Adversarial Composition of Random Augmentations for Robust Trainingcited by 89
  5. 2023Robust Classification via a Single Diffusion Modelcited by 79
  6. 2023A Pilot Study of Query-Free Adversarial Attack against Stable Diffusioncited by 75
  7. 2023Content-based Unrestricted Adversarial Attackcited by 73
  8. 2022Physical Attack on Monocular Depth Estimation with Optimal Adversarial Patchescited by 57
  9. 2021SmoothMix: Training Confidence-calibrated Smoothed Classifiers for Certified Robustnesscited by 49
  10. 2022ViewFool: Evaluating the Robustness of Visual Recognition to Adversarial Viewpointscited by 48
  11. 2022A Survey of Robust Adversarial Training in Pattern Recognition: Fundamental, Theory, and Methodologiescited by 44
  12. 2022Shift-tolerant Perceptual Similarity Metriccited by 44
38 more
  1. 2023CLIP2Protect: Protecting Facial Privacy using Text-Guided Makeup via Adversarial Latent Searchcited by 42
  2. 2021On the Certified Robustness for Ensemble Models and Beyondcited by 40
  3. 2023Shared Adversarial Unlearning: Backdoor Mitigation by Unlearning Shared Adversarial Examplescited by 40
  4. 2021Pyramid Adversarial Training Improves ViT Performancecited by 39
  5. 2021TRS: Transferability Reduced Ensemble via Encouraging Gradient Diversity and Model Smoothnesscited by 37
  6. 2021TnT Attacks! Universal Naturalistic Adversarial Patches Against Deep Neural Network Systemscited by 36
  7. 2022LOT: Layer-wise Orthogonal Training on Improving ℓ2 Certified Robustnesscited by 32
  8. 2022Towards Compositional Adversarial Robustness: Generalizing Adversarial Training to Composite Semantic Perturbationscited by 26
  9. 2021Towards Defending against Adversarial Examples via Attack-Invariant Featurescited by 25
  10. 2021Exploring Adversarial Fake Images on Face Manifoldcited by 24
  11. 2021Knowledge Enhanced Machine Learning Pipeline against Diverse Adversarial Attackscited by 24
  12. 2022Removing Batch Normalization Boosts Adversarial Trainingcited by 24
  13. 2024On the Duality Between Sharpness-Aware Minimization and Adversarial Trainingcited by 24
  14. 2021Understanding the Robustness of Skeleton-based Action Recognition under Adversarial Attackcited by 23
  15. 2022GSmooth: Certified Robustness against Semantic Transformations via Generalized Randomized Smoothingcited by 23
  16. 2021Taxonomy of Machine Learning Safety: A Survey and Primercited by 22
  17. 2022Hardly Perceptible Trojan Attack against Neural Networks with Bit Flipscited by 21
  18. 2023Adv-Diffusion: Imperceptible Adversarial Face Identity Attack via Latent Diffusion Modelcited by 21
  19. 2021Robustness and Generalization via Generative Adversarial Trainingcited by 20
  20. 2023Defending against Adversarial Audio via Diffusion Modelcited by 20
  21. 2023Attacks in Adversarial Machine Learning: A Systematic Survey from the Life-cycle Perspectivecited by 19
  22. 2023A Survey of Robustness and Safety of 2D and 3D Deep Learning Models Against Adversarial Attackscited by 19
  23. 2021Removing Adversarial Noise in Class Activation Feature Spacecited by 18
  24. 2021CC-Cert: A Probabilistic Approach to Certify General Robustness of Neural Networkscited by 18
  25. 2022Attacking deep networks with surrogate-based adversarial black-box methods is easycited by 18
  26. 2024Boosting Adversarial Transferability across Model Genus by Deformation-Constrained Warpingcited by 18
  27. 2022Reverse Engineering of Imperceptible Adversarial Image Perturbationscited by 17
  28. 2023I See Dead People: Gray-Box Adversarial Attack on Image-To-Text Modelscited by 17
  29. 2022PointDP: Diffusion-driven Purification against Adversarial Attacks on 3D Point Cloud Recognitioncited by 16
  30. 2023Instruct2Attack: Language-Guided Semantic Adversarial Attackscited by 16
  31. 2021Deepfake Forensics via An Adversarial Gamecited by 15
  32. 2022On the Effectiveness of Adversarial Training against Backdoor Attackscited by 15
  33. 2024Adversarial Training on Purification (AToP): Advancing Both Robustness and Generalizationcited by 15
  34. 2022Poisons that are learned faster are more effectivecited by 14
  35. 2022Towards Good Practices in Evaluating Transfer Adversarial Attackscited by 14
  36. 2023Comparing the Robustness of Modern No-Reference Image- and Video-Quality Metrics to Adversarial Attackscited by 14
  37. 2022Towards Transferable Unrestricted Adversarial Examples with Minimum Changescited by 13
  38. 2022Adversarial Contrastive Learning via Asymmetric InfoNCEcited by 13

50 most cited of 195 All 195 (JSON)