mlsanityData to 7 Oct 2026

Improving Transferability of Adversarial Examples with Input Diversity

arXiv 1803.06978 ↗First posted 19 Mar 2018cs.CV cs.LG stat.MLcited by 591

Not on the map. Why?

Cited by 52 in Multimodal LLMs / vision-language models, but placed by its own abstract, which didn’t fit.

Abstract (arXiv)

Though CNNs have achieved the state-of-the-art performance on various vision tasks, they are vulnerable to adversarial examples --- crafted by adding human-imperceptible perturbations to clean images. However, most of the existing adversarial attacks only achieve relatively low success rates under the challenging black-box setting, where the attackers have no knowledge of the model structure and parameters. To this end, we propose to improve the transferability of adversarial examples by creating diverse input patterns. Instead of only using the original images to generate adversarial examples, our method applies random transformations to the input images at each iteration. Extensive experiments on ImageNet show that the proposed attack method can generate adversarial examples that transfer much better to different networks than existing baselines. By evaluating our method against top defense solutions and official baselines from NIPS 2017 adversarial competition, the enhanced attack reaches an average success rate of 73.0%, which outperforms the top-1 attack submission in the NIPS competition by a large margin of 6.6%. We hope that our proposed attack strategy can serve as a strong benchmark baseline for evaluating the robustness of networks to adversaries and the effectiveness of different defense methods in the future. Code is available at https://github.com/cihangxie/DI-2-FGSM.

Key facts. Cited by 591 papers in the map (data through 7 Oct 2026). First posted on arXiv 19 Mar 2018.

Builds on

No reference list yet.

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 96; 2022: 109; 2023: 134; 2024: 103; 2025: 93; 2026: 56.

591 papers.

Sort:

By area:

  1. 2023On Evaluating Adversarial Robustness of Large Vision-Language Modelscited by 281
  2. 2021Enhancing the Transferability of Adversarial Attacks through Variance Tuningcited by 242
  3. 2023How Robust is Google's Bard to Adversarial Image Attacks?cited by 177
  4. 2022DE-FAKE: Detection and Attribution of Fake Images Generated by Text-to-Image Generation Modelscited by 167
  5. 2021Admix: Enhancing the Transferability of Adversarial Attackscited by 155
  6. 2024Agent Smith: A Single Image Can Jailbreak One Million Multimodal LLM Agents Exponentially Fastcited by 149
  7. 2022Frequency Domain Model Augmentation for Adversarial Attackcited by 128
  8. 2021Dual Attention Suppression Attack: Generate Adversarial Camouflage in Physical Worldcited by 127
  9. 2021Advances in adversarial attacks and defenses in computer vision: A surveycited by 127
  10. 2021Feature Importance-aware Transferable Adversarial Attackscited by 125
  11. 2023Set-level Guidance Attack: Boosting Adversarial Transferability of Vision-Language Pre-training Modelscited by 106
  12. 2022Shadows can be Dangerous: Stealthy and Effective Physical-world Adversarial Attack by Natural Phenomenoncited by 101
38 more
  1. 2021Adv-Makeup: A New Imperceptible and Transferable Attack on Face Recognitioncited by 95
  2. 2023Diffusion Models for Imperceptible and Transferable Adversarial Attackcited by 93
  3. 2022Improving Adversarial Transferability via Neuron Attribution-Based Attackscited by 92
  4. 2023Rethinking Model Ensemble in Transfer-based Adversarial Attackscited by 88
  5. 2023A Comprehensive Study on Robustness of Image Classification Models: Benchmarking and Rethinkingcited by 85
  6. 2021Stochastic Variance Reduced Ensemble Adversarial Attack for Boosting the Adversarial Transferabilitycited by 84
  7. 2021Improving Transferability of Adversarial Patches on Face Recognition with Generative Modelscited by 80
  8. 2021Towards Transferable Adversarial Attacks on Vision Transformerscited by 80
  9. 2022Protecting Facial Privacy: Generating Adversarial Identity Masks via Style-robust Makeup Transfercited by 77
  10. 2021Adversarial Laser Beam: Effective Physical-World Attack to DNNs in a Blinkcited by 75
  11. 2021FCA: Learning a 3D Full-coverage Vehicle Camouflage for Multi-view Physical Adversarial Attackcited by 74
  12. 2023Content-based Unrestricted Adversarial Attackcited by 73
  13. 2021On Improving Adversarial Transferability of Vision Transformerscited by 70
  14. 2022Boosting the Transferability of Adversarial Attacks with Reverse Adversarial Perturbationcited by 67
  15. 2024JailbreakZoo: Survey, Landscapes, and Horizons in Jailbreaking Large Language and Vision-Language Modelscited by 67
  16. 2023VLATTACK: Multimodal Adversarial Attacks on Vision-Language Tasks via Pre-trained Modelscited by 66
  17. 2021On Generating Transferable Targeted Perturbationscited by 65
  18. 2023Boosting Adversarial Transferability by Block Shuffle and Rotationcited by 64
  19. 2023Structure Invariant Transformation for better Adversarial Transferabilitycited by 61
  20. 2021Adversarial Robustness Comparison of Vision Transformer and MLP-Mixer to CNNscited by 57
  21. 2021Meta Gradient Adversarial Attackcited by 55
  22. 2021CMUA-Watermark: A Cross-Model Universal Adversarial Watermark for Combating Deepfakescited by 54
  23. 2021Boosting Adversarial Transferability through Enhanced Momentumcited by 53
  24. 2022Improving the Transferability of Targeted Adversarial Examples through Object-Based Diverse Inputcited by 49
  25. 2021Adversarial Attacks On Multi-Agent Communicationcited by 48
  26. 2021Triangle Attack: A Query-efficient Decision-based Adversarial Attackcited by 48
  27. 2023Boosting Adversarial Transferability by Achieving Flat Local Maximacited by 48
  28. 2022Exploring Frequency Adversarial Attacks for Face Forgery Detectioncited by 45
  29. 2022Practical Evaluation of Adversarial Robustness via Adaptive Auto Attackcited by 44
  30. 2023A Survey on Transferability of Adversarial Examples across Deep Neural Networkscited by 43
  31. 2024AnyAttack: Towards Large-scale Self-supervised Adversarial Attacks on Vision-language Modelscited by 43
  32. 2021DeepSteal: Advanced Model Extractions Leveraging Efficient Weight Stealing in Memoriescited by 42
  33. 2022Beyond ImageNet Attack: Towards Crafting Adversarial Examples for Black-box Domainscited by 42
  34. 2022Adv-Attribute: Inconspicuous and Transferable Adversarial Attack on Face Recognitioncited by 42
  35. 2023Transferable Adversarial Attacks on Vision Transformers with Token Gradient Regularizationcited by 42
  36. 2023An Adaptive Model Ensemble Adversarial Attack for Boosting Adversarial Transferabilitycited by 42
  37. 2023Adversarial Prompt Tuning for Vision-Language Modelscited by 42
  38. 2022Data Poisoning Attacks Against Multimodal Encoderscited by 41

50 most cited of 591 All 591 (JSON)