mlsanityData to 7 Oct 2026

Admix: Enhancing the Transferability of Adversarial Attacks

arXiv 2102.00436 ↗First posted 31 Jan 2021cs.CV cs.CRcited by 155

Not on the map. Why?

Abstract (arXiv)

Deep neural networks are known to be extremely vulnerable to adversarial examples under white-box setting. Moreover, the malicious adversaries crafted on the surrogate (source) model often exhibit black-box transferability on other models with the same learning task but having different architectures. Recently, various methods are proposed to boost the adversarial transferability, among which the input transformation is one of the most effective approaches. We investigate in this direction and observe that existing transformations are all applied on a single image, which might limit the adversarial transferability. To this end, we propose a new input transformation based attack method called Admix that considers the input image and a set of images randomly sampled from other categories. Instead of directly calculating the gradient on the original input, Admix calculates the gradient on the input image admixed with a small portion of each add-in image while using the original label of the input to craft more transferable adversaries. Empirical evaluations on standard ImageNet dataset demonstrate that Admix could achieve significantly better transferability than existing input transformation methods under both single model setting and ensemble-model setting. By incorporating with existing input transformations, our method could further improve the transferability and outperforms the state-of-the-art combination of input transformations by a clear margin when attacking nine advanced defense models under ensemble-model setting. Code is available at https://github.com/JHL-HUST/Admix.

Key facts. Cited by 155 papers in the map (data through 7 Oct 2026). Builds on 38 of its 43 references that are in the map. First posted on arXiv 31 Jan 2021.

Builds on

38 of 43 references.

References · 38

  1. 2015Deep Residual Learning for Image Recognitioncited by 51,809
  2. 2014ImageNet Large Scale Visual Recognition Challengecited by 8,441
  3. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  4. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  5. 2015Rethinking the Inception Architecture for Computer Visioncited by 5,451
  6. 2017mixup: Beyond Empirical Risk Minimizationcited by 5,155
  7. 2013Intriguing properties of neural networkscited by 5,114
  8. 2016Towards Evaluating the Robustness of Neural Networkscited by 2,976
  9. 2019CutMix: Regularization Strategy to Train Strong Classifiers with Localizable Featurescited by 2,875
  10. 2016Adversarial examples in the physical worldcited by 1,762
  11. 2019Theoretically Principled Trade-off between Robustness and Accuracycited by 1,510
  12. 2016Inception-v4, Inception-ResNet and the Impact of Residual Connections on Learningcited by 1,509
26 more
  1. 2019Certified Adversarial Robustness via Randomized Smoothingcited by 1,324
  2. 2015DeepFool: a simple and accurate method to fool deep neural networkscited by 1,315
  3. 2018Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examplescited by 1,259
  4. 2016Practical Black-Box Attacks against Machine Learningcited by 893
  5. 2017Ensemble Adversarial Training: Attacks and Defensescited by 833
  6. 2018Improving Transferability of Adversarial Examples with Input Diversitycited by 591
  7. 2016Delving into Transferable Adversarial Examples and Black-box Attackscited by 530
  8. 2017Countering Adversarial Images using Input Transformationscited by 517
  9. 2017Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networkscited by 484
  10. 2019Evading Defenses to Transferable Adversarial Examples by Translation-Invariant Attackscited by 440
  11. 2017Mitigating Adversarial Effects Through Randomizationcited by 382
  12. 2019Nesterov Accelerated Gradient and Scale Invariance for Adversarial Attackscited by 352
  13. 2017Defense against Adversarial Attacks Using High-Level Representation Guided Denoisercited by 329
  14. 2019Provably Robust Deep Learning via Adversarially Trained Smoothed Classifierscited by 328
  15. 2018Certified Defenses against Adversarial Examplescited by 305
  16. 2020A Self-supervised Approach for Adversarial Robustnesscited by 180
  17. 2020Skip Connections Matter: On the Transferability of Adversarial Examples Generated with ResNetscited by 165
  18. 2018Feature Distillation: DNN-Oriented JPEG Compression Against Adversarial Examplescited by 98
  19. 2019NATTACK: Learning the Distributions of Adversarial Examples for an Improved Black-Box Attack on Deep Neural Networkscited by 94
  20. 2020Adversarial Vertex Mixup: Toward Better Adversarially Robust Generalizationcited by 73
  21. 2017Robust Physical-World Attacks on Deep Learning Modelscited by 70
  22. 2018Learning Transferable Adversarial Examples via Ghost Networkscited by 69
  23. 2019Mixup Inference: Better Exploiting Mixup to Defend Adversarial Attackscited by 54
  24. 2017Between-class Learning for Image Classificationcited by 50
  25. 2019Interpolated Adversarial Training: Achieving Robust Neural Networks without Sacrificing Too Much Accuracycited by 49
  26. 2020Addressing Neural Network Robustness with Mixup and Targeted Labeling Adversarial Trainingcited by 10

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 7; 2022: 24; 2023: 45; 2024: 37; 2025: 29; 2026: 13.

155 papers.

Sort:

By area:

  1. 2021Enhancing the Transferability of Adversarial Attacks through Variance Tuningcited by 242
  2. 2022Frequency Domain Model Augmentation for Adversarial Attackcited by 128
  3. 2021Stochastic Variance Reduced Ensemble Adversarial Attack for Boosting the Adversarial Transferabilitycited by 84
  4. 2022Boosting the Transferability of Adversarial Attacks with Reverse Adversarial Perturbationcited by 67
  5. 2023Boosting Adversarial Transferability by Block Shuffle and Rotationcited by 64
  6. 2023Structure Invariant Transformation for better Adversarial Transferabilitycited by 61
  7. 2021Boosting Adversarial Transferability through Enhanced Momentumcited by 53
  8. 2021Triangle Attack: A Query-efficient Decision-based Adversarial Attackcited by 48
  9. 2023Boosting Adversarial Transferability by Achieving Flat Local Maximacited by 48
  10. 2023A Survey on Transferability of Adversarial Examples across Deep Neural Networkscited by 43
  11. 2024AnyAttack: Towards Large-scale Self-supervised Adversarial Attacks on Vision-language Modelscited by 43
  12. 2022Beyond ImageNet Attack: Towards Crafting Adversarial Examples for Black-box Domainscited by 42
38 more
  1. 2023SA-Attack: Improving Adversarial Transferability of Vision-Language Pre-training Models via Self-Augmentationcited by 39
  2. 2024One Perturbation is Enough: On Generating Universal Adversarial Perturbations against Vision-Language Pre-training Modelscited by 39
  3. 2022Unleashing the Power of Visual Prompting At the Pixel Levelcited by 37
  4. 2022Towards Understanding and Boosting Adversarial Transferability from a Distribution Perspectivecited by 36
  5. 2023Improving the Transferability of Adversarial Samples by Path-Augmented Methodcited by 36
  6. 2022Transferable Adversarial Attack based on Integrated Gradientscited by 35
  7. 2024Boosting Transferability in Vision-Language Attacks via Diversification along the Intersection Region of Adversarial Trajectorycited by 35
  8. 2023Diversifying the High-level Features for better Adversarial Transferabilitycited by 34
  9. 2022DISCO: Adversarial Defense with Local Implicit Functionscited by 33
  10. 2023Making Substitute Models More Bayesian Can Enhance Transferability of Adversarial Examplescited by 32
  11. 2024Universal Adversarial Perturbations for Vision-Language Pre-trained Modelscited by 31
  12. 2022Enhancing the Self-Universality for Transferable Targeted Attackscited by 30
  13. 2022Boosting the Transferability of Adversarial Attacks with Global Momentum Initializationcited by 29
  14. 2023Improving Adversarial Transferability via Intermediate-level Perturbation Decaycited by 29
  15. 2023Rethinking the Backward Propagation for Adversarial Transferabilitycited by 27
  16. 2024Learning to Transform Dynamically for Better Adversarial Transferabilitycited by 23
  17. 2021Adaptive Image Transformations for Transfer-based Adversarial Attackcited by 22
  18. 2023Improving Adversarial Transferability by Stable Diffusioncited by 22
  19. 2024Adversarial Attacks of Vision Tasks in the Past 10 Years: A Surveycited by 22
  20. 2024Transferable Adversarial Attacks on SAM and Its Downstream Modelscited by 20
  21. 2023Attacks in Adversarial Machine Learning: A Systematic Survey from the Life-cycle Perspectivecited by 19
  22. 2024Semantic-Aligned Adversarial Evolution Triangle for High-Transferability Vision-Language Attackcited by 18
  23. 2023Introducing Competition to Boost the Transferability of Targeted Adversarial Examples through Clean Feature Mixupcited by 17
  24. 2024Towards Transferable Attacks Against Vision-LLMs in Autonomous Driving with Typographycited by 17
  25. 2022Strong Transferable Adversarial Attacks via Ensembled Asymptotically Normal Distribution Learningcited by 15
  26. 2023Practical Deep Dispersed Watermarking with Synchronization and Fusioncited by 15
  27. 2022Towards Good Practices in Evaluating Transfer Adversarial Attackscited by 14
  28. 2022Foiling Explanations in Deep Neural Networkscited by 14
  29. 2022Minimizing Maximum Model Discrepancy for Transferable Black-box Targeted Attackscited by 14
  30. 2022Towards Transferable Unrestricted Adversarial Examples with Minimum Changescited by 13
  31. 2023Improving the Transferability of Adversarial Examples with Arbitrary Style Transfercited by 13
  32. 2021Staircase Sign Method for Boosting Adversarial Attackscited by 12
  33. 2022Imperceptible Adversarial Attack via Invertible Neural Networkscited by 12
  34. 2023Reliable Evaluation of Adversarial Transferabilitycited by 12
  35. 2024Bag of Tricks to Boost Adversarial Transferabilitycited by 12
  36. 2023StyLess: Boosting the Transferability of Adversarial Examplescited by 11
  37. 2024OSLO: One-Shot Label-Only Membership Inference Attackscited by 11
  38. 2024On the Robustness of Kolmogorov-Arnold Networks: An Adversarial Perspectivecited by 11

50 most cited of 155 All 155 (JSON)