mlsanityData to 7 Oct 2026

Enhancing the Transferability of Adversarial Attacks through Variance Tuning

arXiv 2103.15571 ↗First posted 29 Mar 2021cs.AIcited by 242

Not on the map. Why?

Abstract (arXiv)

Deep neural networks are vulnerable to adversarial examples that mislead the models with imperceptible perturbations. Though adversarial attacks have achieved incredible success rates in the white-box setting, most existing adversaries often exhibit weak transferability in the black-box setting, especially under the scenario of attacking models with defense mechanisms. In this work, we propose a new method called variance tuning to enhance the class of iterative gradient based attack methods and improve their attack transferability. Specifically, at each iteration for the gradient calculation, instead of directly using the current gradient for the momentum accumulation, we further consider the gradient variance of the previous iteration to tune the current gradient so as to stabilize the update direction and escape from poor local optima. Empirical results on the standard ImageNet dataset demonstrate that our method could significantly improve the transferability of gradient-based adversarial attacks. Besides, our method could be used to attack ensemble models or be integrated with various input transformations. Incorporating variance tuning with input transformations on iterative gradient-based attacks in the multi-model setting, the integrated method could achieve an average success rate of 90.1% against nine advanced defense methods, improving the current best attack performance significantly by 85.1% . Code is available at https://github.com/JHL-HUST/VT.

Key facts. Cited by 242 papers in the map (data through 7 Oct 2026). Builds on 31 of its 38 references that are in the map. First posted on arXiv 29 Mar 2021.

Builds on

31 of 38 references.

References · 31

  1. 2015Deep Residual Learning for Image Recognitioncited by 51,809
  2. 2014ImageNet Large Scale Visual Recognition Challengecited by 8,441
  3. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  4. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  5. 2015Rethinking the Inception Architecture for Computer Visioncited by 5,451
  6. 2013Intriguing properties of neural networkscited by 5,114
  7. 2016Towards Evaluating the Robustness of Neural Networkscited by 2,976
  8. 2016Adversarial examples in the physical worldcited by 1,762
  9. 2019Theoretically Principled Trade-off between Robustness and Accuracycited by 1,510
  10. 2016Inception-v4, Inception-ResNet and the Impact of Residual Connections on Learningcited by 1,509
  11. 2019Certified Adversarial Robustness via Randomized Smoothingcited by 1,324
  12. 2015DeepFool: a simple and accurate method to fool deep neural networkscited by 1,315
19 more
  1. 2018Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examplescited by 1,259
  2. 2016Adversarial Machine Learning at Scalecited by 934
  3. 2016Practical Black-Box Attacks against Machine Learningcited by 893
  4. 2017Ensemble Adversarial Training: Attacks and Defensescited by 833
  5. 2018Improving Transferability of Adversarial Examples with Input Diversitycited by 591
  6. 2016Delving into Transferable Adversarial Examples and Black-box Attackscited by 530
  7. 2017Countering Adversarial Images using Input Transformationscited by 517
  8. 2018Black-box Adversarial Attacks with Limited Queries and Informationcited by 499
  9. 2017Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networkscited by 484
  10. 2017Decision-Based Adversarial Attacks: Reliable Attacks Against Black-Box Machine Learning Modelscited by 459
  11. 2019Evading Defenses to Transferable Adversarial Examples by Translation-Invariant Attackscited by 440
  12. 2017Mitigating Adversarial Effects Through Randomizationcited by 382
  13. 2019Nesterov Accelerated Gradient and Scale Invariance for Adversarial Attackscited by 352
  14. 2017Defense against Adversarial Attacks Using High-Level Representation Guided Denoisercited by 329
  15. 2020A Self-supervised Approach for Adversarial Robustnesscited by 180
  16. 2021Admix: Enhancing the Transferability of Adversarial Attackscited by 155
  17. 2018ComDefend: An Efficient Image Compression Model to Defend Adversarial Examplescited by 104
  18. 2018Feature Distillation: DNN-Oriented JPEG Compression Against Adversarial Examplescited by 98
  19. 2019NATTACK: Learning the Distributions of Adversarial Examples for an Improved Black-Box Attack on Deep Neural Networkscited by 94

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 16; 2022: 23; 2023: 72; 2024: 61; 2025: 46; 2026: 24.

242 papers.

Sort:

By area:

  1. 2023How Robust is Google's Bard to Adversarial Image Attacks?cited by 177
  2. 2022Frequency Domain Model Augmentation for Adversarial Attackcited by 128
  3. 2021Advances in adversarial attacks and defenses in computer vision: A surveycited by 127
  4. 2022LAS-AT: Adversarial Training with Learnable Attack Strategycited by 94
  5. 2023Diffusion Models for Imperceptible and Transferable Adversarial Attackcited by 93
  6. 2023Rethinking Model Ensemble in Transfer-based Adversarial Attackscited by 88
  7. 2023A Comprehensive Study on Robustness of Image Classification Models: Benchmarking and Rethinkingcited by 85
  8. 2021Stochastic Variance Reduced Ensemble Adversarial Attack for Boosting the Adversarial Transferabilitycited by 84
  9. 2024A Survey of Attacks on Large Vision-Language Models: Resources, Advances, and Future Trendscited by 82
  10. 2021On Improving Adversarial Transferability of Vision Transformerscited by 70
  11. 2022Boosting the Transferability of Adversarial Attacks with Reverse Adversarial Perturbationcited by 67
  12. 2023Boosting Adversarial Transferability by Block Shuffle and Rotationcited by 64
38 more
  1. 2023Structure Invariant Transformation for better Adversarial Transferabilitycited by 61
  2. 2022A Large-scale Multiple-objective Method for Black-box Attack against Object Detectioncited by 55
  3. 2022Improving the Transferability of Targeted Adversarial Examples through Object-Based Diverse Inputcited by 49
  4. 2021Triangle Attack: A Query-efficient Decision-based Adversarial Attackcited by 48
  5. 2023Boosting Adversarial Transferability by Achieving Flat Local Maximacited by 48
  6. 2023A Survey on Transferability of Adversarial Examples across Deep Neural Networkscited by 43
  7. 2024AnyAttack: Towards Large-scale Self-supervised Adversarial Attacks on Vision-language Modelscited by 43
  8. 2022Adv-Attribute: Inconspicuous and Transferable Adversarial Attack on Face Recognitioncited by 42
  9. 2023Transferable Adversarial Attacks on Vision Transformers with Token Gradient Regularizationcited by 42
  10. 2023Adversarial Prompt Tuning for Vision-Language Modelscited by 42
  11. 2021Boosting Fast Adversarial Training with Learnable Adversarial Initializationcited by 40
  12. 2023SA-Attack: Improving Adversarial Transferability of Vision-Language Pre-training Models via Self-Augmentationcited by 39
  13. 2023Evading DeepFake Detectors via Adversarial Statistical Consistencycited by 37
  14. 2023Improving the Transferability of Adversarial Samples by Path-Augmented Methodcited by 36
  15. 2022Transferable Adversarial Attack based on Integrated Gradientscited by 35
  16. 2022Prior-Guided Adversarial Initialization for Fast Adversarial Trainingcited by 34
  17. 2023Diversifying the High-level Features for better Adversarial Transferabilitycited by 34
  18. 2022DISCO: Adversarial Defense with Local Implicit Functionscited by 33
  19. 2023Sibling-Attack: Rethinking Transferable Adversarial Attacks against Face Recognitioncited by 32
  20. 2022Enhancing the Self-Universality for Transferable Targeted Attackscited by 30
  21. 2022Boosting the Transferability of Adversarial Attacks with Global Momentum Initializationcited by 29
  22. 2023Generalizable Black-Box Adversarial Attack with Meta Learningcited by 29
  23. 2023Rethinking the Backward Propagation for Adversarial Transferabilitycited by 27
  24. 2024Learning to Transform Dynamically for Better Adversarial Transferabilitycited by 23
  25. 2021Adaptive Image Transformations for Transfer-based Adversarial Attackcited by 22
  26. 2023Enhancing Generalization of Universal Adversarial Perturbation through Gradient Aggregationcited by 22
  27. 2023Improving Adversarial Transferability by Stable Diffusioncited by 22
  28. 2024Adversarial Attacks of Vision Tasks in the Past 10 Years: A Surveycited by 22
  29. 2024Securely Fine-tuning Pre-trained Encoders Against Adversarial Examplescited by 21
  30. 2024Transferable Adversarial Attacks on SAM and Its Downstream Modelscited by 20
  31. 2023Attacks in Adversarial Machine Learning: A Systematic Survey from the Life-cycle Perspectivecited by 19
  32. 2023A Survey of Robustness and Safety of 2D and 3D Deep Learning Models Against Adversarial Attackscited by 19
  33. 2024CLIP-Guided Generative Networks for Transferable Targeted Adversarial Attackscited by 19
  34. 2021Context-Aware Transfer Attacks for Object Detectioncited by 18
  35. 2024Boosting Adversarial Transferability across Model Genus by Deformation-Constrained Warpingcited by 18
  36. 2023Introducing Competition to Boost the Transferability of Targeted Adversarial Examples through Clean Feature Mixupcited by 17
  37. 2023Exploring Transferability of Multimodal Adversarial Samples for Vision-Language Pre-training Models with Contrastive Learningcited by 16
  38. 2021Training Meta-Surrogate Model for Transferable Adversarial Attackcited by 15

50 most cited of 242 All 242 (JSON)