# Diversity can be Transferred: Output Diversification for White- and Black-box Attacks

arXiv: https://arxiv.org/abs/2003.06878 · HTML: https://mlsanity.com/paper/2003.06878/

## Key facts

- Cited by 4 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 15 Mar 2020.

## Built on by (most cited first, 4 of 4)

- [On Improving Adversarial Transferability of Vision Transformers](https://mlsanity.com/paper/2106.04169/) (2021)
- [Abstract Interpretation of Fixpoint Iterators with Applications to Neural Networks](https://mlsanity.com/paper/2110.08260/) (2021)
- [Guidance Through Surrogate: Towards a Generic Diagnostic Attack](https://mlsanity.com/paper/2212.14875/) (2022)
- [Towards Robust 2D Convolution for Reliable Visual Recognition](https://mlsanity.com/paper/2203.09790/) (2022)

## Abstract (arXiv)

Adversarial attacks often involve random perturbations of the inputs drawn from uniform or Gaussian distributions, e.g., to initialize optimization-based white-box attacks or generate update directions in black-box attacks. These simple perturbations, however, could be sub-optimal as they are agnostic to the model being attacked. To improve the efficiency of these attacks, we propose Output Diversified Sampling (ODS), a novel sampling strategy that attempts to maximize diversity in the target model's outputs among the generated samples. While ODS is a gradient-based strategy, the diversity offered by ODS is transferable and can be helpful for both white-box and black-box attacks via surrogate models. Empirically, we demonstrate that ODS significantly improves the performance of existing white-box and black-box attacks. In particular, ODS reduces the number of queries needed for state-of-the-art black-box attacks on ImageNet by a factor of two.