mlsanityData to 7 Oct 2026

Enhancing Adversarial Example Transferability with an Intermediate Level Attack

arXiv 1907.10823 ↗First posted 23 Jul 2019cs.LG cs.CR cs.CVcited by 139

Not on the map. Why?

Abstract (arXiv)

Neural networks are vulnerable to adversarial examples, malicious inputs crafted to fool trained models. Adversarial examples often exhibit black-box transfer, meaning that adversarial examples for one model can fool another model. However, adversarial examples are typically overfit to exploit the particular architecture and feature representation of a source model, resulting in sub-optimal black-box transfer attacks to other target models. We introduce the Intermediate Level Attack (ILA), which attempts to fine-tune an existing adversarial example for greater black-box transferability by increasing its perturbation on a pre-specified layer of the source model, improving upon state-of-the-art methods. We show that we can select a layer of the source model to perturb without any knowledge of the target models while achieving high transferability. Additionally, we provide some explanatory insights regarding our method and the effect of optimizing for adversarial examples using intermediate feature maps. Our code is available at https://github.com/CUVL/Intermediate-Level-Attack.

Key facts. Cited by 139 papers in the map (data through 7 Oct 2026). First posted on arXiv 23 Jul 2019.

Builds on

No reference list yet.

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 27; 2022: 21; 2023: 34; 2024: 25; 2025: 22; 2026: 10.

139 papers.

Sort:

By area:

  1. 2021Advances in adversarial attacks and defenses in computer vision: A surveycited by 127
  2. 2021Feature Importance-aware Transferable Adversarial Attackscited by 125
  3. 2022Improving Adversarial Transferability via Neuron Attribution-Based Attackscited by 92
  4. 2021On Improving Adversarial Transferability of Vision Transformerscited by 70
  5. 2022Boosting the Transferability of Adversarial Attacks with Reverse Adversarial Perturbationcited by 67
  6. 2023VLATTACK: Multimodal Adversarial Attacks on Vision-Language Tasks via Pre-trained Modelscited by 66
  7. 2021On Generating Transferable Targeted Perturbationscited by 65
  8. 2021Adversarial Attacks On Multi-Agent Communicationcited by 48
  9. 2023A Survey on Transferability of Adversarial Examples across Deep Neural Networkscited by 43
  10. 2021TRS: Transferability Reduced Ensemble via Encouraging Gradient Diversity and Model Smoothnesscited by 37
  11. 2024Chain of Attack: On the Robustness of Vision-Language Models Against Transfer-Based Adversarial Attackscited by 37
  12. 2022Towards Understanding and Boosting Adversarial Transferability from a Distribution Perspectivecited by 36
38 more
  1. 2022Transferable Adversarial Attack based on Integrated Gradientscited by 35
  2. 2023Diversifying the High-level Features for better Adversarial Transferabilitycited by 34
  3. 2021A Little Robustness Goes a Long Way: Leveraging Robust Features for Targeted Transfer Attackscited by 33
  4. 2021ModelDiff: Testing-Based DNN Similarity Comparison for Model Reuse Detectioncited by 33
  5. 2023Making Substitute Models More Bayesian Can Enhance Transferability of Adversarial Examplescited by 32
  6. 2021Boosting Transferability of Targeted Adversarial Examples via Hierarchical Generative Networkscited by 31
  7. 2023Generalizable Black-Box Adversarial Attack with Meta Learningcited by 29
  8. 2023Improving Adversarial Transferability via Intermediate-level Perturbation Decaycited by 29
  9. 2021Adversarial Attacks on Black Box Video Classifiers: Leveraging the Power of Geometric Transformationscited by 28
  10. 2023Rethinking the Backward Propagation for Adversarial Transferabilitycited by 27
  11. 2022Investigating Top-k White-Box and Transferable Black-box Attackcited by 26
  12. 2022Restricted Black-box Adversarial Attack Against DeepFake Face Swappingcited by 25
  13. 2022Universal Adversarial Examples in Remote Sensing: Methodology and Benchmarkcited by 24
  14. 2021Understanding the Robustness of Skeleton-based Action Recognition under Adversarial Attackcited by 23
  15. 2024Adversarial Attacks of Vision Tasks in the Past 10 Years: A Surveycited by 22
  16. 2024Transferable Adversarial Attacks on SAM and Its Downstream Modelscited by 20
  17. 2023Attacks in Adversarial Machine Learning: A Systematic Survey from the Life-cycle Perspectivecited by 19
  18. 2023A Survey of Robustness and Safety of 2D and 3D Deep Learning Models Against Adversarial Attackscited by 19
  19. 2023Logit Margin Matters: Improving Transferable Targeted Adversarial Attack by Logit Calibrationcited by 18
  20. 2024Boosting Adversarial Transferability across Model Genus by Deformation-Constrained Warpingcited by 18
  21. 2024Improved Generation of Adversarial Examples Against Safety-aligned LLMscited by 17
  22. 2021Training Meta-Surrogate Model for Transferable Adversarial Attackcited by 15
  23. 2021Adversarial Examples on Segmentation Models Can be Easy to Transfercited by 15
  24. 2022Strong Transferable Adversarial Attacks via Ensembled Asymptotically Normal Distribution Learningcited by 15
  25. 2022Towards Good Practices in Evaluating Transfer Adversarial Attackscited by 14
  26. 2025Intermediate Layer Classifiers for OOD generalizationcited by 14
  27. 2021Learning to Learn Transferable Attackcited by 13
  28. 2022Towards Lightweight Black-Box Attacks against Deep Neural Networkscited by 13
  29. 2023Mitigating Accuracy-Robustness Trade-off via Balanced Multi-Teacher Adversarial Distillationcited by 13
  30. 2023Reliable Evaluation of Adversarial Transferabilitycited by 12
  31. 2023StyLess: Boosting the Transferability of Adversarial Examplescited by 11
  32. 2024As Firm As Their Foundations: Can open-sourced foundation models be used to create adversarial examples for downstream tasks?cited by 11
  33. 2024Trustworthy Federated Learning: Privacy, Security, and Beyondcited by 11
  34. 2025MMT-ARD: Multimodal Multi-Teacher Adversarial Distillation for Robust Vision-Language Modelscited by 11
  35. 2022PointCAT: Contrastive Adversarial Training for Robust Point Cloud Recognitioncited by 10
  36. 2024VQAttack: Transferable Adversarial Attacks on Visual Question Answering via Pre-trained Modelscited by 10
  37. 2022An Intermediate-level Attack Framework on The Basis of Linear Regressioncited by 9
  38. 2021What Do Deep Nets Learn? Class-wise Patterns Revealed in the Input Spacecited by 8

50 most cited of 139 All 139 (JSON)