# Enhancing Cross-task Black-Box Transferability of Adversarial Examples with Dispersion Reduction

arXiv: https://arxiv.org/abs/1911.11616 · HTML: https://mlsanity.com/paper/1911.11616/

## Key facts

- Cited by 47 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 22 Nov 2019.

## Built on by (most cited first, 30 of 47)

- [Feature Importance-aware Transferable Adversarial Attacks](https://mlsanity.com/paper/2107.14185/) (2021)
- [Advances in adversarial attacks and defenses in computer vision: A survey](https://mlsanity.com/paper/2108.00401/) (2021)
- [Diffusion Models for Imperceptible and Transferable Adversarial Attack](https://mlsanity.com/paper/2305.08192/) (2023)
- [Parallel Rectangle Flip Attack: A Query-based Black-box Attack against Object Detection](https://mlsanity.com/paper/2201.08970/) (2022)
- [VLATTACK: Multimodal Adversarial Attacks on Vision-Language Tasks via Pre-trained Models](https://mlsanity.com/paper/2310.04655/) (2023)
- [Improving the Transferability of Targeted Adversarial Examples through Object-Based Diverse Input](https://mlsanity.com/paper/2203.09123/) (2022)
- [An Image Is Worth 1000 Lies: Adversarial Transferability across Prompts on Vision-Language Models](https://mlsanity.com/paper/2403.09766/) (2024)
- [A Survey on Transferability of Adversarial Examples across Deep Neural Networks](https://mlsanity.com/paper/2310.17626/) (2023)
- [Beyond ImageNet Attack: Towards Crafting Adversarial Examples for Black-box Domains](https://mlsanity.com/paper/2201.11528/) (2022)
- [CLIP-Guided Generative Networks for Transferable Targeted Adversarial Attacks](https://mlsanity.com/paper/2407.10179/) (2024)
- [Survey on Adversarial Attack and Defense for Medical Image Analysis: Methods and Challenges](https://mlsanity.com/paper/2303.14133/) (2023)
- [Pre-trained Adversarial Perturbations](https://mlsanity.com/paper/2210.03372/) (2022)
- [As Firm As Their Foundations: Can open-sourced foundation models be used to create adversarial examples for downstream tasks?](https://mlsanity.com/paper/2403.12693/) (2024)
- [VQAttack: Transferable Adversarial Attacks on Visual Question Answering via Pre-trained Models](https://mlsanity.com/paper/2402.11083/) (2024)
- [Black-box Adversarial Attacks in Autonomous Vehicle Technology](https://mlsanity.com/paper/2101.06092/) (2021)
- [Fast Gradient Non-sign Methods](https://mlsanity.com/paper/2110.12734/) (2021)
- [Practical No-box Adversarial Attacks with Training-free Hybrid Image Transformation](https://mlsanity.com/paper/2203.04607/) (2022)
- [Cross-Task Attack: A Self-Supervision Generative Framework Based on Attention Shift](https://mlsanity.com/paper/2407.13700/) (2024)
- [Prompt-Driven Contrastive Learning for Transferable Adversarial Attacks](https://mlsanity.com/paper/2407.20657/) (2024)
- [Cross-Modal Transferable Image-to-Video Attack on Video Quality Metrics](https://mlsanity.com/paper/2501.08415/) (2025)
- [FACL-Attack: Frequency-Aware Contrastive Learning for Transferable Adversarial Attacks](https://mlsanity.com/paper/2407.20653/) (2024)
- [SoK: Pitfalls in Evaluating Black-Box Attacks](https://mlsanity.com/paper/2310.17534/) (2023)
- [Exploring Transferable and Robust Adversarial Perturbation Generation from the Perspective of Network Hierarchy](https://mlsanity.com/paper/2108.07033/) (2021)
- [General Adversarial Defense Against Black-box Attacks via Pixel Level and Feature Level Distribution Alignments](https://mlsanity.com/paper/2212.05387/) (2022)
- [Enhancing Cross-Prompt Transferability in Vision-Language Models through Contextual Injection of Target Tokens](https://mlsanity.com/paper/2406.13294/) (2024)
- [AIM: Additional Image Guided Generation of Transferable Adversarial Attacks](https://mlsanity.com/paper/2501.01106/) (2025)
- [Can Targeted Adversarial Examples Transfer When the Source and Target Models Have No Label Space Overlap?](https://mlsanity.com/paper/2103.09916/) (2021)
- [Detect & Reject for Transferability of Black-box Adversarial Attacks Against Network Intrusion Detection Systems](https://mlsanity.com/paper/2112.12095/) (2021)
- [Adversarial Attacks on Speech Recognition Systems for Mission-Critical Applications: A Survey](https://mlsanity.com/paper/2202.10594/) (2022)
- [Adversarial Attack across Datasets](https://mlsanity.com/paper/2110.07718/) (2021)

## Abstract (arXiv)

Neural networks are known to be vulnerable to carefully crafted adversarial examples, and these malicious samples often transfer, i.e., they remain adversarial even against other models. Although great efforts have been delved into the transferability across models, surprisingly, less attention has been paid to the cross-task transferability, which represents the real-world cybercriminal's situation, where an ensemble of different defense/detection mechanisms need to be evaded all at once. In this paper, we investigate the transferability of adversarial examples across a wide range of real-world computer vision tasks, including image classification, object detection, semantic segmentation, explicit content detection, and text detection. Our proposed attack minimizes the ``dispersion'' of the internal feature map, which overcomes existing attacks' limitation of requiring task-specific loss functions and/or probing a target model. We conduct evaluation on open source detection and segmentation models as well as four different computer vision tasks provided by Google Cloud Vision (GCV) APIs, to show how our approach outperforms existing attacks by degrading performance of multiple CV tasks by a large margin with only modest perturbations linf=16.