mlsanityData to 7 Oct 2026

Nesterov Accelerated Gradient and Scale Invariance for Adversarial Attacks

arXiv 1908.06281 ↗First posted 17 Aug 2019cs.LG cs.CR stat.MLcited by 352

Not on the map. Why?

Cited by 23 in Multimodal LLMs / vision-language models, but placed by its own abstract, which didn’t fit.

Abstract (arXiv)

Deep learning models are vulnerable to adversarial examples crafted by applying human-imperceptible perturbations on benign inputs. However, under the black-box setting, most existing adversaries often have a poor transferability to attack other defense models. In this work, from the perspective of regarding the adversarial example generation as an optimization process, we propose two new methods to improve the transferability of adversarial examples, namely Nesterov Iterative Fast Gradient Sign Method (NI-FGSM) and Scale-Invariant attack Method (SIM). NI-FGSM aims to adapt Nesterov accelerated gradient into the iterative attacks so as to effectively look ahead and improve the transferability of adversarial examples. While SIM is based on our discovery on the scale-invariant property of deep learning models, for which we leverage to optimize the adversarial perturbations over the scale copies of the input images so as to avoid "overfitting" on the white-box model being attacked and generate more transferable adversarial examples. NI-FGSM and SIM can be naturally integrated to build a robust gradient-based attack to generate more transferable adversarial examples against the defense models. Empirical results on ImageNet dataset demonstrate that our attack methods exhibit higher transferability and achieve higher attack success rates than state-of-the-art gradient-based attacks.

Key facts. Cited by 352 papers in the map (data through 7 Oct 2026). First posted on arXiv 17 Aug 2019.

Builds on

No reference list yet.

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 43; 2022: 37; 2023: 94; 2024: 84; 2025: 69; 2026: 25.

352 papers.

Sort:

By area:

  1. 2021Enhancing the Transferability of Adversarial Attacks through Variance Tuningcited by 242
  2. 2023How Robust is Google's Bard to Adversarial Image Attacks?cited by 177
  3. 2021Admix: Enhancing the Transferability of Adversarial Attackscited by 155
  4. 2022Towards Adversarial Attack on Vision-Language Pre-training Modelscited by 142
  5. 2022Frequency Domain Model Augmentation for Adversarial Attackcited by 128
  6. 2021Advances in adversarial attacks and defenses in computer vision: A surveycited by 127
  7. 2021Feature Importance-aware Transferable Adversarial Attackscited by 125
  8. 2023Set-level Guidance Attack: Boosting Adversarial Transferability of Vision-Language Pre-training Modelscited by 106
  9. 2023Diffusion Models for Imperceptible and Transferable Adversarial Attackcited by 93
  10. 2022Improving Adversarial Transferability via Neuron Attribution-Based Attackscited by 92
  11. 2023Rethinking Model Ensemble in Transfer-based Adversarial Attackscited by 88
  12. 2023A Comprehensive Study on Robustness of Image Classification Models: Benchmarking and Rethinkingcited by 85
38 more
  1. 2021Stochastic Variance Reduced Ensemble Adversarial Attack for Boosting the Adversarial Transferabilitycited by 84
  2. 2021Towards Transferable Adversarial Attacks on Vision Transformerscited by 80
  3. 2021RobustART: Benchmarking Robustness on Architecture Design and Training Techniquescited by 78
  4. 2022Protecting Facial Privacy: Generating Adversarial Identity Masks via Style-robust Makeup Transfercited by 77
  5. 2021On Improving Adversarial Transferability of Vision Transformerscited by 70
  6. 2022Boosting the Transferability of Adversarial Attacks with Reverse Adversarial Perturbationcited by 67
  7. 2023Boosting Adversarial Transferability by Block Shuffle and Rotationcited by 64
  8. 2023Structure Invariant Transformation for better Adversarial Transferabilitycited by 61
  9. 2022T-SEA: Transfer-based Self-Ensemble Attack on Object Detectioncited by 59
  10. 2021Meta Gradient Adversarial Attackcited by 55
  11. 2021Boosting Adversarial Transferability through Enhanced Momentumcited by 53
  12. 2022Improving the Transferability of Targeted Adversarial Examples through Object-Based Diverse Inputcited by 49
  13. 2023Boosting Adversarial Transferability by Achieving Flat Local Maximacited by 48
  14. 2022Practical Evaluation of Adversarial Robustness via Adaptive Auto Attackcited by 44
  15. 2023A Survey on Transferability of Adversarial Examples across Deep Neural Networkscited by 43
  16. 2024AnyAttack: Towards Large-scale Self-supervised Adversarial Attacks on Vision-language Modelscited by 43
  17. 2023Transferable Adversarial Attacks on Vision Transformers with Token Gradient Regularizationcited by 42
  18. 2021Boosting Fast Adversarial Training with Learnable Adversarial Initializationcited by 40
  19. 2021Harnessing Perceptual Adversarial Patches for Crowd Countingcited by 39
  20. 2023SA-Attack: Improving Adversarial Transferability of Vision-Language Pre-training Models via Self-Augmentationcited by 39
  21. 2021Imperceptible Transfer Attack and Defense on 3D Point Cloud Classificationcited by 36
  22. 2022Towards Understanding and Boosting Adversarial Transferability from a Distribution Perspectivecited by 36
  23. 2023Improving the Transferability of Adversarial Samples by Path-Augmented Methodcited by 36
  24. 2023OT-Attack: Enhancing Adversarial Transferability of Vision-Language Models via Optimal Transport Optimizationcited by 36
  25. 2022Transferable Adversarial Attack based on Integrated Gradientscited by 35
  26. 2024Boosting Transferability in Vision-Language Attacks via Diversification along the Intersection Region of Adversarial Trajectorycited by 35
  27. 2022Prior-Guided Adversarial Initialization for Fast Adversarial Trainingcited by 34
  28. 2023Diversifying the High-level Features for better Adversarial Transferabilitycited by 34
  29. 2021Exploring Misclassifications of Robust Neural Networks to Enhance Adversarial Attackscited by 33
  30. 2023Making Substitute Models More Bayesian Can Enhance Transferability of Adversarial Examplescited by 32
  31. 2023Sibling-Attack: Rethinking Transferable Adversarial Attacks against Face Recognitioncited by 32
  32. 2021Boosting Transferability of Targeted Adversarial Examples via Hierarchical Generative Networkscited by 31
  33. 2024Universal Adversarial Perturbations for Vision-Language Pre-trained Modelscited by 31
  34. 2022Enhancing the Self-Universality for Transferable Targeted Attackscited by 30
  35. 2022Boosting the Transferability of Adversarial Attacks with Global Momentum Initializationcited by 29
  36. 2023Generalizable Black-Box Adversarial Attack with Meta Learningcited by 29
  37. 2023Improving Adversarial Transferability via Intermediate-level Perturbation Decaycited by 29
  38. 2023Rethinking the Backward Propagation for Adversarial Transferabilitycited by 27

50 most cited of 352 All 352 (JSON)