# Transferable Perturbations of Deep Feature Distributions

arXiv: https://arxiv.org/abs/2004.12519 · HTML: https://mlsanity.com/paper/2004.12519/

## Key facts

- Cited by 51 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 27 Apr 2020.

## Built on by (most cited first, 30 of 51)

- [Feature Importance-aware Transferable Adversarial Attacks](https://mlsanity.com/paper/2107.14185/) (2021)
- [Advances in adversarial attacks and defenses in computer vision: A survey](https://mlsanity.com/paper/2108.00401/) (2021)
- [On Improving Adversarial Transferability of Vision Transformers](https://mlsanity.com/paper/2106.04169/) (2021)
- [Boosting the Transferability of Adversarial Attacks with Reverse Adversarial Perturbation](https://mlsanity.com/paper/2210.05968/) (2022)
- [VLATTACK: Multimodal Adversarial Attacks on Vision-Language Tasks via Pre-trained Models](https://mlsanity.com/paper/2310.04655/) (2023)
- [On Generating Transferable Targeted Perturbations](https://mlsanity.com/paper/2103.14641/) (2021)
- [A Survey on Transferability of Adversarial Examples across Deep Neural Networks](https://mlsanity.com/paper/2310.17626/) (2023)
- [A Little Robustness Goes a Long Way: Leveraging Robust Features for Targeted Transfer Attacks](https://mlsanity.com/paper/2106.02105/) (2021)
- [Boosting Transferability of Targeted Adversarial Examples via Hierarchical Generative Networks](https://mlsanity.com/paper/2107.01809/) (2021)
- [Distilling Robust and Non-Robust Features in Adversarial Examples by Information Bottleneck](https://mlsanity.com/paper/2204.02735/) (2022)
- [Enhancing the Self-Universality for Transferable Targeted Attacks](https://mlsanity.com/paper/2209.03716/) (2022)
- [Generalizable Black-Box Adversarial Attack with Meta Learning](https://mlsanity.com/paper/2301.00364/) (2023)
- [Investigating Top-k White-Box and Transferable Black-box Attack](https://mlsanity.com/paper/2204.00089/) (2022)
- [Feature Space Targeted Attacks by Statistic Alignment](https://mlsanity.com/paper/2105.11645/) (2021)
- [Attacks in Adversarial Machine Learning: A Systematic Survey from the Life-cycle Perspective](https://mlsanity.com/paper/2302.09457/) (2023)
- [Logit Margin Matters: Improving Transferable Targeted Adversarial Attack by Logit Calibration](https://mlsanity.com/paper/2303.03680/) (2023)
- [Towards Good Practices in Evaluating Transfer Adversarial Attacks](https://mlsanity.com/paper/2211.09565/) (2022)
- [Minimizing Maximum Model Discrepancy for Transferable Black-box Targeted Attacks](https://mlsanity.com/paper/2212.09035/) (2022)
- [Reliable Evaluation of Adversarial Transferability](https://mlsanity.com/paper/2306.08565/) (2023)
- [Adversarial Attacks on Foundational Vision Models](https://mlsanity.com/paper/2308.14597/) (2023)
- [Staircase Sign Method for Boosting Adversarial Attacks](https://mlsanity.com/paper/2104.09722/) (2021)
- [StyLess: Boosting the Transferability of Adversarial Examples](https://mlsanity.com/paper/2304.11579/) (2023)
- [VQAttack: Transferable Adversarial Attacks on Visual Question Answering via Pre-trained Models](https://mlsanity.com/paper/2402.11083/) (2024)
- [FaceShield: Defending Facial Image against Deepfake Threats](https://mlsanity.com/paper/2412.09921/) (2024)
- [Enhancing targeted transferability via feature space fine-tuning](https://mlsanity.com/paper/2401.02727/) (2024)
- [SoK: Pitfalls in Evaluating Black-Box Attacks](https://mlsanity.com/paper/2310.17534/) (2023)
- [Improving Transferable Targeted Attacks with Feature Tuning Mixup](https://mlsanity.com/paper/2411.15553/) (2024)
- [A Review of Adversarial Attacks in Computer Vision](https://mlsanity.com/paper/2308.07673/) (2023)
- [Exploring Transferable and Robust Adversarial Perturbation Generation from the Perspective of Network Hierarchy](https://mlsanity.com/paper/2108.07033/) (2021)
- [Comparative Evaluation of Recent Universal Adversarial Perturbations in Image Classification](https://mlsanity.com/paper/2306.11261/) (2023)

## Abstract (arXiv)

Almost all current adversarial attacks of CNN classifiers rely on information derived from the output layer of the network. This work presents a new adversarial attack based on the modeling and exploitation of class-wise and layer-wise deep feature distributions. We achieve state-of-the-art targeted blackbox transfer-based attack results for undefended ImageNet models. Further, we place a priority on explainability and interpretability of the attacking process. Our methodology affords an analysis of how adversarial attacks change the intermediate feature distributions of CNNs, as well as a measure of layer-wise and class-wise feature distributional separability/entanglement. We also conceptualize a transition from task/data-specific to model-specific features within a CNN architecture that directly impacts the transferability of adversarial examples.