Data to 14 Oct 2026

Transferable Perturbations of Deep Feature Distributions

arXiv 2004.12519 ↗First posted 27 Apr 2020cs.LG stat.MLcited by 51

Not on the map. Why?

Abstract (arXiv)

Almost all current adversarial attacks of CNN classifiers rely on information derived from the output layer of the network. This work presents a new adversarial attack based on the modeling and exploitation of class-wise and layer-wise deep feature distributions. We achieve state-of-the-art targeted blackbox transfer-based attack results for undefended ImageNet models. Further, we place a priority on explainability and interpretability of the attacking process. Our methodology affords an analysis of how adversarial attacks change the intermediate feature distributions of CNNs, as well as a measure of layer-wise and class-wise feature distributional separability/entanglement. We also conceptualize a transition from task/data-specific to model-specific features within a CNN architecture that directly impacts the transferability of adversarial examples.

Key facts. Cited by 51 papers in the map (data through 14 Oct 2026). First posted on arXiv 27 Apr 2020.

Builds on

No reference list yet.

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2021: 11; 2022: 10; 2023: 12; 2024: 9; 2025: 5; 2026: 4.

51 papers.

Sort:

By area:

2021Feature Importance-aware Transferable Adversarial Attackscited by 127
2021Advances in adversarial attacks and defenses in computer vision: A surveycited by 127
2021On Improving Adversarial Transferability of Vision Transformerscited by 70
2022Boosting the Transferability of Adversarial Attacks with Reverse Adversarial Perturbationcited by 68
2023VLATTACK: Multimodal Adversarial Attacks on Vision-Language Tasks via Pre-trained Modelscited by 68
2021On Generating Transferable Targeted Perturbationscited by 65
2023A Survey on Transferability of Adversarial Examples across Deep Neural Networkscited by 44
2021A Little Robustness Goes a Long Way: Leveraging Robust Features for Targeted Transfer Attackscited by 34
2021Boosting Transferability of Targeted Adversarial Examples via Hierarchical Generative Networkscited by 32
2022Distilling Robust and Non-Robust Features in Adversarial Examples by Information Bottleneckcited by 30
2022Enhancing the Self-Universality for Transferable Targeted Attackscited by 30
2023Generalizable Black-Box Adversarial Attack with Meta Learningcited by 29

38 more

2022Investigating Top-k White-Box and Transferable Black-box Attackcited by 26
2021Feature Space Targeted Attacks by Statistic Alignmentcited by 21
2023Attacks in Adversarial Machine Learning: A Systematic Survey from the Life-cycle Perspectivecited by 20
2023Logit Margin Matters: Improving Transferable Targeted Adversarial Attack by Logit Calibrationcited by 18
2022Towards Good Practices in Evaluating Transfer Adversarial Attackscited by 15
2022Minimizing Maximum Model Discrepancy for Transferable Black-box Targeted Attackscited by 14
2023Reliable Evaluation of Adversarial Transferabilitycited by 13
2023Adversarial Attacks on Foundational Vision Modelscited by 13
2021Staircase Sign Method for Boosting Adversarial Attackscited by 12
2023StyLess: Boosting the Transferability of Adversarial Examplescited by 11
2024VQAttack: Transferable Adversarial Attacks on Visual Question Answering via Pre-trained Modelscited by 10
2024FaceShield: Defending Facial Image against Deepfake Threatscited by 8
2024Enhancing targeted transferability via feature space fine-tuningcited by 7
2023SoK: Pitfalls in Evaluating Black-Box Attackscited by 6
2024Improving Transferable Targeted Attacks with Feature Tuning Mixupcited by 6
2023A Review of Adversarial Attacks in Computer Visioncited by 5
2021Exploring Transferable and Robust Adversarial Perturbation Generation from the Perspective of Network Hierarchycited by 4
2023Comparative Evaluation of Recent Universal Adversarial Perturbations in Image Classificationcited by 4
2025Beyond Vulnerabilities: A Survey of Adversarial Attacks as Both Threats and Defenses in Computer Vision Systemscited by 4
2021Can Targeted Adversarial Examples Transfer When the Source and Target Models Have No Label Space Overlap?cited by 3
2022Task Grouping for Multilingual Text Recognitioncited by 3
2024Investigating Deep Watermark Security: An Adversarial Transferability Perspectivecited by 3
2024Improving Transferable Targeted Adversarial Attack via Normalized Logit Calibration and Truncated Feature Mixingcited by 3
2022Adversarial Ensemble Training by Jointly Learning Label Dependencies and Member Modelscited by 2
2022Enhancing Targeted Attack Transferability via Diversified Weight Pruningcited by 2
2024Towards Scalable and Robust Model Versioningcited by 2
2024Perturbation Towards Easy Samples Improves Targeted Adversarial Transferabilitycited by 2
2025MAA: Meticulous Adversarial Attack against Vision-Language Pre-trained Modelscited by 2
2021Delving into the pixels of adversarial samplescited by 1
2022Dynamic Stochastic Ensemble with Adversarial Robust Lottery Ticket Subnetworkscited by 1
2025Boosting Adversarial Transferability via Commonality-Oriented Gradient Optimizationcited by 1
2025Adversarial Attacks on VQA-NLE: Exposing and Alleviating Inconsistencies in Visual Question Answering Explanationscited by 1
2023AutoAugment Input Transformation for Highly Transferable Targeted Attackscited by 0
2024Two Heads Are Better Than One: Averaging along Fine-Tuning to Improve Targeted Transferabilitycited by 0
2025Towards Cross-Domain Multi-Targeted Adversarial Attackscited by 0
2026Hierarchical Refinement of Universal Multimodal Attacks on Vision-Language Modelscited by 0
2026LAMP: Learning Universal Adversarial Perturbations for Multi-Image Tasks via Pre-trained Modelscited by 0
2026Devling into Adversarial Transferability on Image Classification: Review, Benchmark, and Evaluationcited by 0

50 most cited of 51 All 51 (JSON)