mlsanityData to 7 Oct 2026

On Generating Transferable Targeted Perturbations

arXiv 2103.14641 ↗First posted 26 Mar 2021cs.CVcited by 65

Not on the map. Why?

Abstract (arXiv)

While the untargeted black-box transferability of adversarial perturbations has been extensively studied before, changing an unseen model's decisions to a specific `targeted' class remains a challenging feat. In this paper, we propose a new generative approach for highly transferable targeted perturbations (ours). We note that the existing methods are less suitable for this task due to their reliance on class-boundary information that changes from one model to another, thus reducing transferability. In contrast, our approach matches the perturbed image `distribution' with that of the target class, leading to high targeted transferability rates. To this end, we propose a new objective function that not only aligns the global distributions of source and target images, but also matches the local neighbourhood structure between the two domains. Based on the proposed objective, we train a generator function that can adaptively synthesize perturbations specific to a given input. Our generative approach is independent of the source or target domain labels, while consistently performs well against state-of-the-art methods on a wide range of attack settings. As an example, we achieve 32.63% target transferability from (an adversarially weak) VGG19BN to (a strong) WideResNet on ImageNet val. set, which is 4× higher than the previous best generative attack and 16× better than instance-specific iterative attack. Code is available at: smallurlhttps://github.com/Muzammal-Naseer/TTP.

Key facts. Cited by 65 papers in the map (data through 7 Oct 2026). Builds on 35 of its 48 references that are in the map. First posted on arXiv 26 Mar 2021.

Builds on

35 of 48 references.

References · 35

  1. 2014Adam: A Method for Stochastic Optimizationcited by 36,960
  2. 2020A Simple Framework for Contrastive Learning of Visual Representationscited by 11,979
  3. 2014ImageNet Large Scale Visual Recognition Challengecited by 8,441
  4. 2019Momentum Contrast for Unsupervised Visual Representation Learningcited by 7,482
  5. 2015Batch Normalization: Accelerating Deep Network Training by Reducing Internal Covariate Shiftcited by 6,979
  6. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  7. 2013Intriguing properties of neural networkscited by 5,114
  8. 2016Perceptual Losses for Real-Time Style Transfer and Super-Resolutioncited by 2,678
  9. 2018ImageNet-trained CNNs are biased towards texture; increasing shape bias improves accuracy and robustnesscited by 1,430
  10. 2021Transformers in Vision: A Surveycited by 1,009
  11. 2019Adversarial Examples Are Not Bugs, They Are Featurescited by 950
  12. 2019AugMix: A Simple Data Processing Method to Improve Robustness and Uncertaintycited by 897
23 more
  1. 2016Universal adversarial perturbationscited by 774
  2. 2018Improving Transferability of Adversarial Examples with Input Diversitycited by 591
  3. 2016Delving into Transferable Adversarial Examples and Black-box Attackscited by 530
  4. 2019Evading Defenses to Transferable Adversarial Examples by Translation-Invariant Attackscited by 440
  5. 2020Do Adversarially Robust ImageNet Models Transfer Better?cited by 315
  6. 2020A Self-supervised Approach for Adversarial Robustnesscited by 180
  7. 2020Skip Connections Matter: On the Transferability of Adversarial Examples Generated with ResNetscited by 165
  8. 2017Generative Adversarial Perturbationscited by 153
  9. 2019Enhancing Adversarial Example Transferability with an Intermediate Level Attackcited by 139
  10. 2019Adversarial Examples Are a Natural Consequence of Test Error in Noisecited by 114
  11. 2018Feature Distillation: DNN-Oriented JPEG Compression Against Adversarial Examplescited by 98
  12. 2019Cross-Domain Transferability of Adversarial Perturbationscited by 92
  13. 2018Generalizable Data-free Objective for Crafting Universal Adversarial Perturbationscited by 88
  14. 2018Local Gradients Smoothing: Defense against localized adversarial attackscited by 85
  15. 2020Backpropagating Linearly Improves Transferability of Adversarial Examplescited by 79
  16. 2018Shield: Fast, Practical Defense and Vaccination for Deep Learning using JPEG Compressioncited by 74
  17. 2017Fast Feature Fool: A data independent approach to universal adversarial perturbationscited by 65
  18. 2020Perturbing Across the Feature Hierarchy to Improve Standard and Strict Blackbox Attack Transferabilitycited by 57
  19. 2017NAG: Network for Adversary Generationcited by 51
  20. 2020Transferable Perturbations of Deep Feature Distributionscited by 51
  21. 2020Yet Another Intermediate-Level Attackcited by 35
  22. 2018Ask, Acquire, and Attack: Data-free UAP Generation using Class Impressionscited by 31
  23. 2019Regional Homogeneity: Towards Learning Transferable Universal Adversarial Perturbations Against Defensescited by 22

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 5; 2022: 11; 2023: 16; 2024: 18; 2025: 12; 2026: 3.

65 papers.

Sort:

By area:

  1. 2023Rethinking Model Ensemble in Transfer-based Adversarial Attackscited by 88
  2. 2021On Improving Adversarial Transferability of Vision Transformerscited by 70
  3. 2022Boosting the Transferability of Adversarial Attacks with Reverse Adversarial Perturbationcited by 67
  4. 2023A Survey on Transferability of Adversarial Examples across Deep Neural Networkscited by 43
  5. 2022Towards Understanding and Boosting Adversarial Transferability from a Distribution Perspectivecited by 36
  6. 2023Why Does Little Robustness Help? A Further Step Towards Understanding Adversarial Transferabilitycited by 32
  7. 2021Boosting Transferability of Targeted Adversarial Examples via Hierarchical Generative Networkscited by 31
  8. 2022Enhancing the Self-Universality for Transferable Targeted Attackscited by 30
  9. 2023Towards Transferable Targeted 3D Adversarial Attack in the Physical Worldcited by 25
  10. 2021Closer Look at the Transferability of Adversarial Examples: How They Fool Different Models Differentlycited by 22
  11. 2023Attacks in Adversarial Machine Learning: A Systematic Survey from the Life-cycle Perspectivecited by 19
  12. 2024CLIP-Guided Generative Networks for Transferable Targeted Adversarial Attackscited by 19
38 more
  1. 2023Logit Margin Matters: Improving Transferable Targeted Adversarial Attack by Logit Calibrationcited by 18
  2. 2023Exploring Transferability of Multimodal Adversarial Samples for Vision-Language Pre-training Models with Contrastive Learningcited by 16
  3. 2025One Surrogate to Fool Them All: Universal, Transferable, and Targeted Adversarial Attacks with CLIPcited by 15
  4. 2022Towards Good Practices in Evaluating Transfer Adversarial Attackscited by 14
  5. 2022Minimizing Maximum Model Discrepancy for Transferable Black-box Targeted Attackscited by 14
  6. 2021Staircase Sign Method for Boosting Adversarial Attackscited by 12
  7. 2024AdvI2I: Adversarial Image Attack on Image-to-Image Diffusion modelscited by 10
  8. 2024Prompt-Driven Contrastive Learning for Transferable Adversarial Attackscited by 9
  9. 2024FACL-Attack: Frequency-Aware Contrastive Learning for Transferable Adversarial Attackscited by 8
  10. 2024Enhancing targeted transferability via feature space fine-tuningcited by 7
  11. 2022Adversarial Pixel Restoration as a Pretext Task for Transferable Perturbationscited by 6
  12. 2023SoK: Pitfalls in Evaluating Black-Box Attackscited by 6
  13. 2023Towards Evaluating Transfer-based Attacks Systematically, Practically, and Fairlycited by 6
  14. 2025Simulations of Common Unsupervised Domain Adaptation Algorithms for Image Classificationcited by 6
  15. 2022Scale-free and Task-agnostic Attack: Generating Photo-realistic Adversarial Patterns with Patch Quilting Generatorcited by 5
  16. 2023Boosting Adversarial Transferability using Dynamic Cuescited by 5
  17. 2023A Comprehensive Study on the Robustness of Image Classification and Object Detection in Remote Sensing: Surveying and Benchmarkingcited by 5
  18. 2022Low-Mid Adversarial Perturbation against Unauthorized Face Recognition Systemcited by 4
  19. 2025AIM: Additional Image Guided Generation of Transferable Adversarial Attackscited by 4
  20. 2025No Query, No Accesscited by 4
  21. 2022Generative Poisoning Using Random Discriminatorscited by 3
  22. 2023Rethinking Mixup for Improving the Adversarial Transferabilitycited by 3
  23. 2024Investigating Deep Watermark Security: An Adversarial Transferability Perspectivecited by 3
  24. 2022Enhancing Targeted Attack Transferability via Diversified Weight Pruningcited by 2
  25. 2023Self-supervised Adaptive Pre-training of Multilingual Speech Models for Language and Dialect Identificationcited by 2
  26. 2024Perturbation Towards Easy Samples Improves Targeted Adversarial Transferabilitycited by 2
  27. 2026Rendering-Aware Bayesian 3D Gaussian Splatting with Native Uncertainty and Adaptive Complexity Controlcited by 2
  28. 2022Guidance Through Surrogate: Towards a Generic Diagnostic Attackcited by 1
  29. 2024S4ST: A Strong, Self-transferable, faSt, and Simple Scale Transformation for Transferable Targeted Attackcited by 1
  30. 2025Dual-Flow: Transferable Multi-Target, Instance-Agnostic Attacks via In-the-wild Cascading Flow Optimizationcited by 1
  31. 2025Democratic Training Against Universal Adversarial Perturbationscited by 1
  32. 2025Adversarial Universal Stickers: Universal Perturbation Attacks on Traffic Sign using Stickerscited by 1
  33. 2021Signal Transformer: Complex-valued Attention and Meta-Learning for Signal Recognitioncited by 0
  34. 2023Enhancing Multilingual Speech Recognition through Language Prompt Tuning and Frame-Level Language Adaptercited by 0
  35. 2023GMTR: Graph Matching Transformerscited by 0
  36. 2023DarkShot: Lighting Dark Images with Low-Compute and High-Qualitycited by 0
  37. 2024TRLS: A Time Series Representation Learning Framework via Spectrogram for Medical Signal Processingcited by 0
  38. 2024TEN-GUARD: Tensor Decomposition for Backdoor Attack Detection in Deep Neural Networkscited by 0

50 most cited of 65 All 65 (JSON)