# Patch-wise++ Perturbation for Adversarial Targeted Attacks

arXiv: https://arxiv.org/abs/2012.15503 · HTML: https://mlsanity.com/paper/2012.15503/

## Key facts

- Cited by 19 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 31 Dec 2020.

## Built on by (most cited first, 19 of 19)

- [Frequency Domain Model Augmentation for Adversarial Attack](https://mlsanity.com/paper/2207.05382/) (2022)
- [Boosting Adversarial Transferability through Enhanced Momentum](https://mlsanity.com/paper/2103.10609/) (2021)
- [Practical Evaluation of Adversarial Robustness via Adaptive Auto Attack](https://mlsanity.com/paper/2203.05154/) (2022)
- [Beyond ImageNet Attack: Towards Crafting Adversarial Examples for Black-box Domains](https://mlsanity.com/paper/2201.11528/) (2022)
- [Natural Color Fool: Towards Boosting Black-box Unrestricted Attacks](https://mlsanity.com/paper/2210.02041/) (2022)
- [Adversarial Attacks of Vision Tasks in the Past 10 Years: A Survey](https://mlsanity.com/paper/2410.23687/) (2024)
- [Feature Space Targeted Attacks by Statistic Alignment](https://mlsanity.com/paper/2105.11645/) (2021)
- [Staircase Sign Method for Boosting Adversarial Attacks](https://mlsanity.com/paper/2104.09722/) (2021)
- [Practical No-box Adversarial Attacks with Training-free Hybrid Image Transformation](https://mlsanity.com/paper/2203.04607/) (2022)
- [Adversarial Pixel Restoration as a Pretext Task for Transferable Perturbations](https://mlsanity.com/paper/2207.08803/) (2022)
- [SoK: Pitfalls in Evaluating Black-Box Attacks](https://mlsanity.com/paper/2310.17534/) (2023)
- [Benchmarking Unified Face Attack Detection via Hierarchical Prompt Tuning](https://mlsanity.com/paper/2505.13327/) (2025)
- [DASH: A Meta-Attack Framework for Synthesizing Effective and Stealthy Adversarial Examples](https://mlsanity.com/paper/2508.13309/) (2025)
- [Improving Adversarial Robustness via Feature Pattern Consistency Constraint](https://mlsanity.com/paper/2406.08829/) (2024)
- [How to Backdoor Image Knowledge Distillation](https://mlsanity.com/paper/2504.21323/) (2025)
- [AGFT: Alignment-Guided Fine-Tuning for Zero-Shot Adversarial Robustness of Vision-Language Models](https://mlsanity.com/paper/2603.29410/) (2026)
- [On Transfer-based Universal Attacks in Pure Black-box Setting](https://mlsanity.com/paper/2504.08866/) (2025)
- [Deep learning models are vulnerable, but adversarial examples are even more vulnerable](https://mlsanity.com/paper/2511.05073/) (2025)
- [DeepDefense: Robust Learning via Layer-Wise Gradient-Feature Alignment](https://mlsanity.com/paper/2511.13749/) (2025)

## Abstract (arXiv)

Although great progress has been made on adversarial attacks for deep neural networks (DNNs), their transferability is still unsatisfactory, especially for targeted attacks. There are two problems behind that have been long overlooked: 1) the conventional setting of T iterations with the step size of ε/T to comply with the ε-constraint. In this case, most of the pixels are allowed to add very small noise, much less than ε; and 2) usually manipulating pixel-wise noise. However, features of a pixel extracted by DNNs are influenced by its surrounding regions, and different DNNs generally focus on different discriminative regions in recognition. To tackle these issues, our previous work proposes a patch-wise iterative method (PIM) aimed at crafting adversarial examples with high transferability. Specifically, we introduce an amplification factor to the step size in each iteration, and one pixel's overall gradient overflowing the ε-constraint is properly assigned to its surrounding regions by a project kernel. But targeted attacks aim to push the adversarial examples into the territory of a specific class, and the amplification factor may lead to underfitting. Thus, we introduce the temperature and propose a patch-wise++ iterative method (PIM++) to further improve transferability without significantly sacrificing the performance of the white-box attack. Our method can be generally integrated to any gradient-based attack methods. Compared with the current state-of-the-art attack methods, we significantly improve the success rate by 33.1% for defense models and 31.4% for normally trained models on average.