mlsanityData to 14 Oct 2026

Evading Defenses to Transferable Adversarial Examples by Translation-Invariant Attacks

arXiv 1904.02884 ↗First posted 5 Apr 2019cs.CV cs.CR cs.LGcited by 442

Not on the map. Why?

Cited by 26 in Multimodal LLMs / vision-language models, but placed by its own abstract, which didn’t fit.

Abstract (arXiv)

Deep neural networks are vulnerable to adversarial examples, which can mislead classifiers by adding imperceptible perturbations. An intriguing property of adversarial examples is their good transferability, making black-box attacks feasible in real-world applications. Due to the threat of adversarial attacks, many methods have been proposed to improve the robustness. Several state-of-the-art defenses are shown to be robust against transferable adversarial examples. In this paper, we propose a translation-invariant attack method to generate more transferable adversarial examples against the defense models. By optimizing a perturbation over an ensemble of translated images, the generated adversarial example is less sensitive to the white-box model being attacked and has better transferability. To improve the efficiency of attacks, we further show that our method can be implemented by convolving the gradient at the untranslated image with a pre-defined kernel. Our method is generally applicable to any gradient-based attack method. Extensive experiments on the ImageNet dataset validate the effectiveness of the proposed method. Our best attack fools eight state-of-the-art defenses at an 82% success rate on average based only on the transferability, demonstrating the insecurity of the current defense techniques.

Key facts. Cited by 442 papers in the map (data through 14 Oct 2026). First posted on arXiv 5 Apr 2019.

Builds on

No reference list yet.

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2021: 75; 2022: 66; 2023: 115; 2024: 78; 2025: 72; 2026: 36.

442 papers.

Sort:

By area:

  1. 2023On Evaluating Adversarial Robustness of Large Vision-Language Modelscited by 284
  2. 2021Enhancing the Transferability of Adversarial Attacks through Variance Tuningcited by 244
  3. 2021Trustworthy AI: From Principles to Practicescited by 207
  4. 2023How Robust is Google's Bard to Adversarial Image Attacks?cited by 183
  5. 2021Admix: Enhancing the Transferability of Adversarial Attackscited by 156
  6. 2022Frequency Domain Model Augmentation for Adversarial Attackcited by 130
  7. 2021Dual Attention Suppression Attack: Generate Adversarial Camouflage in Physical Worldcited by 127
  8. 2021Feature Importance-aware Transferable Adversarial Attackscited by 127
  9. 2021Advances in adversarial attacks and defenses in computer vision: A surveycited by 127
  10. 2022Shadows can be Dangerous: Stealthy and Effective Physical-world Adversarial Attack by Natural Phenomenoncited by 101
  11. 2021Adv-Makeup: A New Imperceptible and Transferable Attack on Face Recognitioncited by 97
  12. 2023Diffusion Models for Imperceptible and Transferable Adversarial Attackcited by 94
38 more
  1. 2022Improving Adversarial Transferability via Neuron Attribution-Based Attackscited by 93
  2. 2023Rethinking Model Ensemble in Transfer-based Adversarial Attackscited by 89
  3. 2023A Comprehensive Study on Robustness of Image Classification Models: Benchmarking and Rethinkingcited by 85
  4. 2021Stochastic Variance Reduced Ensemble Adversarial Attack for Boosting the Adversarial Transferabilitycited by 84
  5. 2021Improving Transferability of Adversarial Patches on Face Recognition with Generative Modelscited by 80
  6. 2021Towards Transferable Adversarial Attacks on Vision Transformerscited by 80
  7. 2022Parallel Rectangle Flip Attack: A Query-based Black-box Attack against Object Detectioncited by 79
  8. 2023Robust Classification via a Single Diffusion Modelcited by 79
  9. 2022Protecting Facial Privacy: Generating Adversarial Identity Masks via Style-robust Makeup Transfercited by 78
  10. 2023Content-based Unrestricted Adversarial Attackcited by 73
  11. 2022Boosting the Transferability of Adversarial Attacks with Reverse Adversarial Perturbationcited by 68
  12. 2023VLATTACK: Multimodal Adversarial Attacks on Vision-Language Tasks via Pre-trained Modelscited by 68
  13. 2021On Generating Transferable Targeted Perturbationscited by 65
  14. 2023Boosting Adversarial Transferability by Block Shuffle and Rotationcited by 64
  15. 2023Structure Invariant Transformation for better Adversarial Transferabilitycited by 62
  16. 2021Meta Gradient Adversarial Attackcited by 55
  17. 2022A Large-scale Multiple-objective Method for Black-box Attack against Object Detectioncited by 55
  18. 2021Boosting Adversarial Transferability through Enhanced Momentumcited by 54
  19. 2022Improving the Transferability of Targeted Adversarial Examples through Object-Based Diverse Inputcited by 50
  20. 2023Boosting Adversarial Transferability by Achieving Flat Local Maximacited by 48
  21. 2024AnyAttack: Towards Large-scale Self-supervised Adversarial Attacks on Vision-language Modelscited by 46
  22. 2022Exploring Frequency Adversarial Attacks for Face Forgery Detectioncited by 45
  23. 2022Practical Evaluation of Adversarial Robustness via Adaptive Auto Attackcited by 44
  24. 2023A Survey on Transferability of Adversarial Examples across Deep Neural Networkscited by 44
  25. 2022Adv-Attribute: Inconspicuous and Transferable Adversarial Attack on Face Recognitioncited by 43
  26. 2023CLIP2Protect: Protecting Facial Privacy using Text-Guided Makeup via Adversarial Latent Searchcited by 43
  27. 2022Simultaneously Optimizing Perturbations and Positions for Black-box Adversarial Patch Attackscited by 42
  28. 2023Transferable Adversarial Attacks on Vision Transformers with Token Gradient Regularizationcited by 42
  29. 2023An Adaptive Model Ensemble Adversarial Attack for Boosting Adversarial Transferabilitycited by 42
  30. 2021LiBRe: A Practical Bayesian Approach to Adversarial Detectioncited by 40
  31. 2021Boosting Fast Adversarial Training with Learnable Adversarial Initializationcited by 40
  32. 2021Harnessing Perceptual Adversarial Patches for Crowd Countingcited by 39
  33. 2023Image Shortcut Squeezing: Countering Perturbative Availability Poisons with Compressioncited by 39
  34. 2023SA-Attack: Improving Adversarial Transferability of Vision-Language Pre-training Models via Self-Augmentationcited by 39
  35. 2022Query-Efficient Black-box Adversarial Attacks Guided by a Transfer-based Priorcited by 38
  36. 2022Natural Color Fool: Towards Boosting Black-box Unrestricted Attackscited by 38
  37. 2021Improving the Transferability of Adversarial Examples with Resized-Diverse-Inputs, Diversity-Ensemble and Region Fittingcited by 37
  38. 2022Towards Understanding and Boosting Adversarial Transferability from a Distribution Perspectivecited by 37

50 most cited of 442 All 442 (JSON)