mlsanityData to 7 Oct 2026

Universal Adversarial Attack on Attention and the Resulting Dataset DAmageNet

arXiv 2001.06325 ↗First posted 16 Jan 2020cs.LG stat.MLcited by 45

Not on the map. Why?

Abstract (arXiv)

Adversarial attacks on deep neural networks (DNNs) have been found for several years. However, the existing adversarial attacks have high success rates only when the information of the victim DNN is well-known or could be estimated by the structure similarity or massive queries. In this paper, we propose to Attack on Attention (AoA), a semantic property commonly shared by DNNs. AoA enjoys a significant increase in transferability when the traditional cross entropy loss is replaced with the attention loss. Since AoA alters the loss function only, it could be easily combined with other transferability-enhancement techniques and then achieve SOTA performance. We apply AoA to generate 50000 adversarial samples from ImageNet validation set to defeat many neural networks, and thus name the dataset as DAmageNet. 13 well-trained DNNs are tested on DAmageNet, and all of them have an error rate over 85%. Even with defenses or adversarial training, most models still maintain an error rate over 70% on DAmageNet. DAmageNet is the first universal adversarial dataset. It could be downloaded freely and serve as a benchmark for robustness testing and adversarial training.

Key facts. Cited by 45 papers in the map (data through 7 Oct 2026). First posted on arXiv 16 Jan 2020.

Builds on

No reference list yet.

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 6; 2022: 18; 2023: 6; 2024: 6; 2025: 7; 2026: 2.

45 papers.

Sort:

By area:

  1. 2021Adversarial Sticker: A Stealthy Attack Method in the Physical Worldcited by 92
  2. 2022Visual correspondence-based explanations improve AI robustness and human-AI team accuracycited by 37
  3. 2022Transferable Adversarial Attack based on Integrated Gradientscited by 35
  4. 2024Test-Time Backdoor Attacks on Multimodal Large Language Modelscited by 35
  5. 2022One-Pixel Shortcut: on the Learning Preference of Deep Neural Networkscited by 29
  6. 2021Delving into Data: Effectively Substitute Training for Black-box Attackcited by 27
  7. 2022Universal Adversarial Examples in Remote Sensing: Methodology and Benchmarkcited by 24
  8. 2022Enhance the Visual Representation via Discrete Adversarial Trainingcited by 23
  9. 2022Self-Ensemble Protection: Training Checkpoints Are Good Data Protectorscited by 19
  10. 2022Boosting 3D Adversarial Attacks with Attacking On Frequencycited by 18
  11. 2022Adversarial Attack on Attackers: Post-Process to Mitigate Black-Box Score-Based Query Attackscited by 18
  12. 2021Revisiting Knowledge Distillation: An Inheritance and Exploration Frameworkcited by 15
33 more
  1. 2022Transfer Attacks Revisited: A Large-Scale Empirical Study in Real Computer Vision Settingscited by 11
  2. 2025MMT-ARD: Multimodal Multi-Teacher Adversarial Distillation for Robust Vision-Language Modelscited by 11
  3. 2023Robust Natural Language Understanding with Residual Attention Debiasingcited by 10
  4. 2022Transferable Physical Attack against Object Detection with Separable Attentioncited by 6
  5. 2023Investigating Catastrophic Overfitting in Fast Adversarial Training: A Self-fitting Perspectivecited by 5
  6. 2023Adversarial Attacks and Defenses in Machine Learning-Powered Networks: A Contemporary Surveycited by 5
  7. 2023A Comprehensive Study on the Robustness of Image Classification and Object Detection in Remote Sensing: Surveying and Benchmarkingcited by 5
  8. 2023LRS: Enhancing Adversarial Transferability through Lipschitz Regularized Surrogatecited by 5
  9. 2022FG-UAP: Feature-Gathering Universal Adversarial Perturbationcited by 4
  10. 2022Be Careful with Rotation: A Uniform Backdoor Pattern for 3D Shapecited by 4
  11. 2023Hamming Similarity and Graph Laplacians for Class Partitioning and Adversarial Image Detectioncited by 4
  12. 2021Query Attack by Multi-Identity Surrogatescited by 3
  13. 2022Adversarial Fine-tune with Dynamically Regulated Adversarycited by 2
  14. 2022Dual Graphs of Polyhedral Decompositions for the Detection of Adversarial Attackscited by 2
  15. 2025Web Artifact Attacks Disrupt Vision Language Modelscited by 2
  16. 2025Boosting Adversarial Transferability via Ensemble Non-Attentioncited by 2
  17. 2021Dominant Patterns: Critical Features Hidden in Deep Neural Networkscited by 1
  18. 2022Towards Understanding and Harnessing the Effect of Image Transformation in Adversarial Detectioncited by 1
  19. 2022Improving the Robustness and Generalization of Deep Neural Network with Confidence Threshold Reductioncited by 1
  20. 2022Unifying Gradients to Improve Real-world Robustness for Deep Networkscited by 1
  21. 2024Hierarchical Invariance for Robust and Interpretable Vision Tasks at Larger Scalescited by 1
  22. 2024S4ST: A Strong, Self-transferable, faSt, and Simple Scale Transformation for Transferable Targeted Attackcited by 1
  23. 2026Universal Adversarial Attacks against Closed-Source MLLMs via Target-View Routed Meta Optimizationcited by 1
  24. 2026When Background Matters: Breaking Medical Vision Language Models by Transferable Attackcited by 1
  25. 2021Measuring the Transferability of ℓ_∞ Attacks by the ℓ2 Normcited by 0
  26. 2022Learning from Attacks: Attacking Variational Autoencoder for Improving Image Classificationcited by 0
  27. 2024Approximate Nullspace Augmented Finetuning for Robust Vision Transformerscited by 0
  28. 2024TA3: Testing Against Adversarial Attacks on Machine Learning Modelscited by 0
  29. 2024Adversarial Attacks on LiDAR-Based Tracking Across Road Users: Robustness Evaluation and Target-Aware Black-Box Methodcited by 0
  30. 2025EasyRobust: A Comprehensive and Easy-to-use Toolkit for Robust and Generalized Visioncited by 0
  31. 2025Enabling Heterogeneous Adversarial Transferability via Feature Permutation Attackscited by 0
  32. 2025Human-Imperceptible Physical Adversarial Attack for NIR Face Recognition Modelscited by 0
  33. 2025Empirical evaluation of the Frank-Wolfe methods for constructing white-box adversarial attackscited by 0