mlsanityData to 7 Oct 2026

Perturbing Across the Feature Hierarchy to Improve Standard and Strict Blackbox Attack Transferability

arXiv 2004.14861 ↗First posted 29 Apr 2020cs.CR cs.LG stat.MLcited by 57

Not on the map. Why?

Abstract (arXiv)

We consider the blackbox transfer-based targeted adversarial attack threat model in the realm of deep neural network (DNN) image classifiers. Rather than focusing on crossing decision boundaries at the output layer of the source model, our method perturbs representations throughout the extracted feature hierarchy to resemble other classes. We design a flexible attack framework that allows for multi-layer perturbations and demonstrates state-of-the-art targeted transfer performance between ImageNet DNNs. We also show the superiority of our feature space methods under a relaxation of the common assumption that the source and target models are trained on the same dataset and label space, in some instances achieving a 10× increase in targeted success rate relative to other blackbox transfer methods. Finally, we analyze why the proposed methods outperform existing attack strategies and show an extension of the method in the case when limited queries to the blackbox model are allowed.

Key facts. Cited by 57 papers in the map (data through 7 Oct 2026). First posted on arXiv 29 Apr 2020.

Builds on

No reference list yet.

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 13; 2022: 15; 2023: 12; 2024: 11; 2025: 4; 2026: 2.

57 papers.

Sort:

By area:

  1. 2021On Improving Adversarial Transferability of Vision Transformerscited by 70
  2. 2022Boosting the Transferability of Adversarial Attacks with Reverse Adversarial Perturbationcited by 67
  3. 2023VLATTACK: Multimodal Adversarial Attacks on Vision-Language Tasks via Pre-trained Modelscited by 66
  4. 2021On Generating Transferable Targeted Perturbationscited by 65
  5. 2021Adversarial Robustness Comparison of Vision Transformer and MLP-Mixer to CNNscited by 57
  6. 2023A Survey on Transferability of Adversarial Examples across Deep Neural Networkscited by 43
  7. 2022Beyond ImageNet Attack: Towards Crafting Adversarial Examples for Black-box Domainscited by 42
  8. 2021A Little Robustness Goes a Long Way: Leveraging Robust Features for Targeted Transfer Attackscited by 33
  9. 2021Boosting Transferability of Targeted Adversarial Examples via Hierarchical Generative Networkscited by 31
  10. 2022Enhancing the Self-Universality for Transferable Targeted Attackscited by 30
  11. 2023Generalizable Black-Box Adversarial Attack with Meta Learningcited by 29
  12. 2022Investigating Top-k White-Box and Transferable Black-box Attackcited by 26
38 more
  1. 2021Feature Space Targeted Attacks by Statistic Alignmentcited by 21
  2. 2023Attacks in Adversarial Machine Learning: A Systematic Survey from the Life-cycle Perspectivecited by 19
  3. 2024CLIP-Guided Generative Networks for Transferable Targeted Adversarial Attackscited by 19
  4. 2023Logit Margin Matters: Improving Transferable Targeted Adversarial Attack by Logit Calibrationcited by 18
  5. 2021Adversarial Examples on Segmentation Models Can be Easy to Transfercited by 15
  6. 2022Towards Good Practices in Evaluating Transfer Adversarial Attackscited by 14
  7. 2022Minimizing Maximum Model Discrepancy for Transferable Black-box Targeted Attackscited by 14
  8. 2022Towards Lightweight Black-Box Attacks against Deep Neural Networkscited by 13
  9. 2023Adversarial Attacks on Foundational Vision Modelscited by 13
  10. 2021Staircase Sign Method for Boosting Adversarial Attackscited by 12
  11. 2023Reliable Evaluation of Adversarial Transferabilitycited by 12
  12. 2023StyLess: Boosting the Transferability of Adversarial Examplescited by 11
  13. 2024As Firm As Their Foundations: Can open-sourced foundation models be used to create adversarial examples for downstream tasks?cited by 11
  14. 2024VQAttack: Transferable Adversarial Attacks on Visual Question Answering via Pre-trained Modelscited by 10
  15. 2022When Expressivity Meets Trainability: Fewer than n Neurons Can Workcited by 8
  16. 2022Transferable Physical Attack against Object Detection with Separable Attentioncited by 6
  17. 2022Adversarial Pixel Restoration as a Pretext Task for Transferable Perturbationscited by 6
  18. 2023SoK: Pitfalls in Evaluating Black-Box Attackscited by 6
  19. 2024Improving Transferable Targeted Attacks with Feature Tuning Mixupcited by 6
  20. 2021Adversarial for Good? How the Adversarial ML Community's Values Impede Socially Beneficial Uses of Attackscited by 5
  21. 2022Leveraging Local Patch Differences in Multi-Object Scenes for Generative Adversarial Attackscited by 5
  22. 2023A Review of Adversarial Attacks in Computer Visioncited by 5
  23. 2021Can Targeted Adversarial Examples Transfer When the Source and Target Models Have No Label Space Overlap?cited by 3
  24. 2021Amicable Aid: Perturbing Images to Improve Classification Performancecited by 3
  25. 2024Investigating Deep Watermark Security: An Adversarial Transferability Perspectivecited by 3
  26. 2024Improving Transferable Targeted Adversarial Attack via Normalized Logit Calibration and Truncated Feature Mixingcited by 3
  27. 2021Adversarial Attack across Datasetscited by 2
  28. 2022Enhancing Targeted Attack Transferability via Diversified Weight Pruningcited by 2
  29. 2024Perturbation Towards Easy Samples Improves Targeted Adversarial Transferabilitycited by 2
  30. 2024Criticality Leveraged Adversarial Training (CLAT) for Boosted Performance via Parameter Efficiencycited by 2
  31. 2021Delving into the pixels of adversarial samplescited by 1
  32. 2024S4ST: A Strong, Self-transferable, faSt, and Simple Scale Transformation for Transferable Targeted Attackcited by 1
  33. 2025Adversarial Attacks on VQA-NLE: Exposing and Alleviating Inconsistencies in Visual Question Answering Explanationscited by 1
  34. 2025SEGA: A Transferable Signed Ensemble Gaussian Black-Box Attack against No-Reference Image Quality Assessment Modelscited by 1
  35. 2022Gradient Aligned Attacks via a Few Queriescited by 0
  36. 2022The Importance of Image Interpretation: Patterns of Semantic Misclassification in Real-World Adversarial Imagescited by 0
  37. 2022Carpet-bombing patch: attacking a deep network without usual requirementscited by 0
  38. 2023Explainability and Robustness of Deep Visual Classification Modelscited by 0

50 most cited of 57 All 57 (JSON)