# Yet Another Intermediate-Level Attack

arXiv: https://arxiv.org/abs/2008.08847 · HTML: https://mlsanity.com/paper/2008.08847/

## Key facts

- Cited by 35 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 20 Aug 2020.

## Built on by (most cited first, 30 of 35)

- [Advances in adversarial attacks and defenses in computer vision: A survey](https://mlsanity.com/paper/2108.00401/) (2021)
- [RobustART: Benchmarking Robustness on Architecture Design and Training Techniques](https://mlsanity.com/paper/2109.05211/) (2021)
- [On Generating Transferable Targeted Perturbations](https://mlsanity.com/paper/2103.14641/) (2021)
- [Making Substitute Models More Bayesian Can Enhance Transferability of Adversarial Examples](https://mlsanity.com/paper/2302.05086/) (2023)
- [Improving Adversarial Transferability via Intermediate-level Perturbation Decay](https://mlsanity.com/paper/2304.13410/) (2023)
- [Investigating Top-k White-Box and Transferable Black-box Attack](https://mlsanity.com/paper/2204.00089/) (2022)
- [Adversarial Attacks of Vision Tasks in the Past 10 Years: A Survey](https://mlsanity.com/paper/2410.23687/) (2024)
- [Transferable Adversarial Attacks on SAM and Its Downstream Models](https://mlsanity.com/paper/2410.20197/) (2024)
- [CLIP-Guided Generative Networks for Transferable Targeted Adversarial Attacks](https://mlsanity.com/paper/2407.10179/) (2024)
- [Improved Generation of Adversarial Examples Against Safety-aligned LLMs](https://mlsanity.com/paper/2405.20778/) (2024)
- [Towards Good Practices in Evaluating Transfer Adversarial Attacks](https://mlsanity.com/paper/2211.09565/) (2022)
- [Fast Adversarial Training with Smooth Convergence](https://mlsanity.com/paper/2308.12857/) (2023)
- [Learning to Learn Transferable Attack](https://mlsanity.com/paper/2112.06658/) (2021)
- [StyLess: Boosting the Transferability of Adversarial Examples](https://mlsanity.com/paper/2304.11579/) (2023)
- [Attacking Perceptual Similarity Metrics](https://mlsanity.com/paper/2305.08840/) (2023)
- [An Intermediate-level Attack Framework on The Basis of Linear Regression](https://mlsanity.com/paper/2203.10723/) (2022)
- [GNP Attack: Transferable Adversarial Examples via Gradient Norm Penalty](https://mlsanity.com/paper/2307.04099/) (2023)
- [Enhancing targeted transferability via feature space fine-tuning](https://mlsanity.com/paper/2401.02727/) (2024)
- [SoK: Pitfalls in Evaluating Black-Box Attacks](https://mlsanity.com/paper/2310.17534/) (2023)
- [Towards Evaluating Transfer-based Attacks Systematically, Practically, and Fairly](https://mlsanity.com/paper/2311.01323/) (2023)
- [Improving Transferable Targeted Attacks with Feature Tuning Mixup](https://mlsanity.com/paper/2411.15553/) (2024)
- [BlackDAN: A Black-Box Multi-Objective Approach for Effective and Contextual Jailbreaking of Large Language Models](https://mlsanity.com/paper/2410.09804/) (2024)
- [Exploring Transferable and Robust Adversarial Perturbation Generation from the Perspective of Network Hierarchy](https://mlsanity.com/paper/2108.07033/) (2021)
- [Can Targeted Adversarial Examples Transfer When the Source and Target Models Have No Label Space Overlap?](https://mlsanity.com/paper/2103.09916/) (2021)
- [Improving Transferability of Adversarial Examples via Bayesian Attacks](https://mlsanity.com/paper/2307.11334/) (2023)
- [Dual-Flow: Transferable Multi-Target, Instance-Agnostic Attacks via In-the-wild Cascading Flow Optimization](https://mlsanity.com/paper/2502.02096/) (2025)
- [NAT: Learning to Attack Neurons for Enhanced Adversarial Transferability](https://mlsanity.com/paper/2508.16937/) (2025)
- [A Perceptual Distortion Reduction Framework: Towards Generating Adversarial Examples with High Perceptual Quality and Attack Success Rate](https://mlsanity.com/paper/2105.00278/) (2021)
- [Gradient Aligned Attacks via a Few Queries](https://mlsanity.com/paper/2205.09518/) (2022)
- [AED-PADA:Improving Generalizability of Adversarial Example Detection via Principal Adversarial Domain Adaptation](https://mlsanity.com/paper/2404.12635/) (2024)

## Abstract (arXiv)

The transferability of adversarial examples across deep neural network (DNN) models is the crux of a spectrum of black-box attacks. In this paper, we propose a novel method to enhance the black-box transferability of baseline adversarial examples. By establishing a linear mapping of the intermediate-level discrepancies (between a set of adversarial inputs and their benign counterparts) for predicting the evoked adversarial loss, we aim to take full advantage of the optimization procedure of multi-step baseline attacks. We conducted extensive experiments to verify the effectiveness of our method on CIFAR-100 and ImageNet. Experimental results demonstrate that it outperforms previous state-of-the-arts considerably. Our code is at https://github.com/qizhangli/ila-plus-plus.