mlsanityData to 7 Oct 2026

Boosting Adversarial Transferability through Enhanced Momentum

arXiv 2103.10609 ↗First posted 19 Mar 2021cs.CVcited by 53

Not on the map. Why?

Abstract (arXiv)

Deep learning models are known to be vulnerable to adversarial examples crafted by adding human-imperceptible perturbations on benign images. Many existing adversarial attack methods have achieved great white-box attack performance, but exhibit low transferability when attacking other models. Various momentum iterative gradient-based methods are shown to be effective to improve the adversarial transferability. In what follows, we propose an enhanced momentum iterative gradient-based method to further enhance the adversarial transferability. Specifically, instead of only accumulating the gradient during the iterative process, we additionally accumulate the average gradient of the data points sampled in the gradient direction of the previous iteration so as to stabilize the update direction and escape from poor local maxima. Extensive experiments on the standard ImageNet dataset demonstrate that our method could improve the adversarial transferability of momentum-based methods by a large margin of 11.1% on average. Moreover, by incorporating with various input transformation methods, the adversarial transferability could be further improved significantly. We also attack several extra advanced defense models under the ensemble-model setting, and the enhancements are remarkable with at least 7.8% on average.

Key facts. Cited by 53 papers in the map (data through 7 Oct 2026). Builds on 34 of its 47 references that are in the map. First posted on arXiv 19 Mar 2021.

Builds on

34 of 47 references.

References · 34

  1. 2015Deep Residual Learning for Image Recognitioncited by 51,809
  2. 2018BERT: Pre-training of Deep Bidirectional Transformers for Language Understandingcited by 40,204
  3. 2014ImageNet Large Scale Visual Recognition Challengecited by 8,441
  4. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  5. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  6. 2015Rethinking the Inception Architecture for Computer Visioncited by 5,451
  7. 2013Intriguing properties of neural networkscited by 5,114
  8. 2014Fully Convolutional Networks for Semantic Segmentationcited by 4,845
  9. 2016Towards Evaluating the Robustness of Neural Networkscited by 2,976
  10. 2015Fast R-CNNcited by 2,930
  11. 2016Adversarial examples in the physical worldcited by 1,762
  12. 2019Theoretically Principled Trade-off between Robustness and Accuracycited by 1,510
22 more
  1. 2016Inception-v4, Inception-ResNet and the Impact of Residual Connections on Learningcited by 1,509
  2. 2019Certified Adversarial Robustness via Randomized Smoothingcited by 1,324
  3. 2015DeepFool: a simple and accurate method to fool deep neural networkscited by 1,315
  4. 2018Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examplescited by 1,259
  5. 2016Practical Black-Box Attacks against Machine Learningcited by 893
  6. 2017Ensemble Adversarial Training: Attacks and Defensescited by 833
  7. 2015The Limitations of Deep Learning in Adversarial Settingscited by 784
  8. 2018Improving Transferability of Adversarial Examples with Input Diversitycited by 591
  9. 2016Delving into Transferable Adversarial Examples and Black-box Attackscited by 530
  10. 2017Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networkscited by 484
  11. 2019Evading Defenses to Transferable Adversarial Examples by Translation-Invariant Attackscited by 440
  12. 2017Mitigating Adversarial Effects Through Randomizationcited by 382
  13. 2019Nesterov Accelerated Gradient and Scale Invariance for Adversarial Attackscited by 352
  14. 2017Defense against Adversarial Attacks Using High-Level Representation Guided Denoisercited by 329
  15. 2019Provably Robust Deep Learning via Adversarially Trained Smoothed Classifierscited by 328
  16. 2021Admix: Enhancing the Transferability of Adversarial Attackscited by 155
  17. 2018Feature Distillation: DNN-Oriented JPEG Compression Against Adversarial Examplescited by 98
  18. 2019NATTACK: Learning the Distributions of Adversarial Examples for an Improved Black-Box Attack on Deep Neural Networkscited by 94
  19. 2020On Success and Simplicity: A Second Look at Transferable Targeted Attackscited by 89
  20. 2020Do Wider Neural Networks Really Help Adversarial Robustness?cited by 79
  21. 2018Improving the Generalization of Adversarial Training with Domain Adaptationcited by 48
  22. 2020Patch-wise++ Perturbation for Adversarial Targeted Attackscited by 19

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 4; 2022: 4; 2023: 25; 2024: 9; 2025: 7; 2026: 4.

53 papers.

Sort:

By area:

  1. 2023Rethinking Model Ensemble in Transfer-based Adversarial Attackscited by 88
  2. 2022Boosting the Transferability of Adversarial Attacks with Reverse Adversarial Perturbationcited by 67
  3. 2023Boosting Adversarial Transferability by Block Shuffle and Rotationcited by 64
  4. 2023Structure Invariant Transformation for better Adversarial Transferabilitycited by 61
  5. 2021Triangle Attack: A Query-efficient Decision-based Adversarial Attackcited by 48
  6. 2023Boosting Adversarial Transferability by Achieving Flat Local Maximacited by 48
  7. 2023Transferable Adversarial Attacks on Vision Transformers with Token Gradient Regularizationcited by 42
  8. 2023An Adaptive Model Ensemble Adversarial Attack for Boosting Adversarial Transferabilitycited by 42
  9. 2023Improving the Transferability of Adversarial Samples by Path-Augmented Methodcited by 36
  10. 2023Diversifying the High-level Features for better Adversarial Transferabilitycited by 34
  11. 2022Enhancing the Self-Universality for Transferable Targeted Attackscited by 30
  12. 2022Boosting the Transferability of Adversarial Attacks with Global Momentum Initializationcited by 29
38 more
  1. 2023Rethinking the Backward Propagation for Adversarial Transferabilitycited by 27
  2. 2024Learning to Transform Dynamically for Better Adversarial Transferabilitycited by 23
  3. 2021Adaptive Image Transformations for Transfer-based Adversarial Attackcited by 22
  4. 2023Attacks in Adversarial Machine Learning: A Systematic Survey from the Life-cycle Perspectivecited by 19
  5. 2022Towards Good Practices in Evaluating Transfer Adversarial Attackscited by 14
  6. 2024Prompt-Agnostic Adversarial Perturbation for Customized Diffusion Modelscited by 14
  7. 2023Improving the Transferability of Adversarial Examples with Arbitrary Style Transfercited by 13
  8. 2023Black-box Targeted Adversarial Attack on Segment Anything (SAM)cited by 13
  9. 2024Bag of Tricks to Boost Adversarial Transferabilitycited by 12
  10. 2023Boosting Adversarial Transferability with Learnable Patch-wise Maskscited by 8
  11. 2023PubDef: Defending Against Transfer Attacks From Public Modelscited by 7
  12. 2024Calibration Attacks: A Comprehensive Study of Adversarial Attacks on Model Confidencecited by 7
  13. 2021Adaptive Perturbation for Adversarial Attackcited by 6
  14. 2023SoK: Pitfalls in Evaluating Black-Box Attackscited by 6
  15. 2023Towards Evaluating Transfer-based Attacks Systematically, Practically, and Fairlycited by 6
  16. 2024Unsegment Anything by Simulating Deformationcited by 6
  17. 2024Boosting Adversarial Transferability with Low-Cost Optimization via Maximin Expected Flatnesscited by 6
  18. 2021Exploring Transferable and Robust Adversarial Perturbation Generation from the Perspective of Network Hierarchycited by 4
  19. 2023Boost Adversarial Transferability by Uniform Scale and Mix Mask Methodcited by 4
  20. 2025Harnessing the Computation Redundancy in ViTs to Boost Adversarial Transferabilitycited by 4
  21. 2023Improving Adversarial Transferability with Scheduled Step Size and Dual Examplecited by 3
  22. 2023Benchmarking Adversarial Robustness of Compressed Deep Learning Modelscited by 3
  23. 2023Rethinking Mixup for Improving the Adversarial Transferabilitycited by 3
  24. 2025Information-Geometric Inverse Distillation for Enhancing Adversarial Transferabilitycited by 2
  25. 2025Boosting the Local Invariance for Better Adversarial Transferabilitycited by 2
  26. 2023Semantic Adversarial Attacks on Face Recognition through Significant Attributescited by 1
  27. 2023How to choose your best allies for a transferable attack?cited by 1
  28. 2023Generating Visually Realistic Adversarial Patchcited by 1
  29. 2024On the Adversarial Transferability of Generalized "Skip Connections"cited by 1
  30. 2025Disrupting Semantic and Abstract Features for Better Adversarial Transferabilitycited by 1
  31. 2025ViT-EnsembleAttack: Augmenting Ensemble Models for Stronger Adversarial Transferability in Vision Transformerscited by 1
  32. 2023Generating Transferable and Stealthy Adversarial Patch via Attention-guided Adversarial Inpaintingcited by 0
  33. 2023The Ultimate Combo: Boosting Adversarial Example Transferability by Composing Data Augmentationscited by 0
  34. 2024Looking From the Future: Multi-order Iterations Can Enhance Adversarial Attack Transferabilitycited by 0
  35. 2024Theoretical Corrections and the Leveraging of Reinforcement Learning to Enhance Triangle Attackcited by 0
  36. 2025Seeking Flat Minima over Diverse Surrogates for Improved Adversarial Transferability: A Theoretical Framework and Algorithmic Instantiationcited by 0
  37. 2025Optimizing the Adversarial Perturbation with a Momentum-based Adaptive Matrixcited by 0
  38. 2026Hierarchical Refinement of Universal Multimodal Attacks on Vision-Language Modelscited by 0

50 most cited of 53 All 53 (JSON)