mlsanityData to 7 Oct 2026

A Little Robustness Goes a Long Way: Leveraging Robust Features for Targeted Transfer Attacks

arXiv 2106.02105 ↗First posted 3 Jun 2021cs.LG cs.CRcited by 33

Not on the map. Why?

Abstract (arXiv)

Adversarial examples for neural network image classifiers are known to be transferable: examples optimized to be misclassified by a source classifier are often misclassified as well by classifiers with different architectures. However, targeted adversarial examples -- optimized to be classified as a chosen target class -- tend to be less transferable between architectures. While prior research on constructing transferable targeted attacks has focused on improving the optimization procedure, in this work we examine the role of the source classifier. Here, we show that training the source classifier to be "slightly robust" -- that is, robust to small-magnitude adversarial examples -- substantially improves the transferability of class-targeted and representation-targeted adversarial attacks, even between architectures as different as convolutional neural networks and transformers. The results we present provide insight into the nature of adversarial examples as well as the mechanisms underlying so-called "robust" classifiers.

Key facts. Cited by 33 papers in the map (data through 7 Oct 2026). Builds on 72 of its 98 references that are in the map. First posted on arXiv 3 Jun 2021.

Builds on

72 of 98 references.

References · 72

  1. 2015Deep Residual Learning for Image Recognitioncited by 51,809
  2. 2021Learning Transferable Visual Models From Natural Language Supervisioncited by 33,456
  3. 2020An Image is Worth 16x16 Words: Transformers for Image Recognition at Scalecited by 29,915
  4. 2019PyTorch: An Imperative Style, High-Performance Deep Learning Librarycited by 20,160
  5. 2014Very Deep Convolutional Networks for Large-Scale Image Recognitioncited by 15,267
  6. 2014ImageNet Large Scale Visual Recognition Challengecited by 8,441
  7. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  8. 2016Densely Connected Convolutional Networkscited by 6,691
  9. 2019EfficientNet: Rethinking Model Scaling for Convolutional Neural Networkscited by 6,415
  10. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  11. 2015Rethinking the Inception Architecture for Computer Visioncited by 5,451
  12. 2013Intriguing properties of neural networkscited by 5,114
38 more
  1. 2017MobileNets: Efficient Convolutional Neural Networks for Mobile Vision Applicationscited by 3,827
  2. 2016Towards Evaluating the Robustness of Neural Networkscited by 2,976
  3. 2013Deep Inside Convolutional Networks: Visualising Image Classification Models and Saliency Mapscited by 2,348
  4. 2016Xception: Deep Learning with Depthwise Separable Convolutionscited by 2,320
  5. 2016Identity Mappings in Deep Residual Networkscited by 1,960
  6. 2020Shortcut Learning in Deep Neural Networkscited by 1,928
  7. 2016Adversarial examples in the physical worldcited by 1,762
  8. 2019Similarity of Neural Network Representations Revisitedcited by 1,695
  9. 2019Natural Adversarial Examplescited by 1,401
  10. 2019Certified Adversarial Robustness via Randomized Smoothingcited by 1,324
  11. 2015DeepFool: a simple and accurate method to fool deep neural networkscited by 1,315
  12. 2017Learning Transferable Architectures for Scalable Image Recognitioncited by 1,097
  13. 2019Adversarial Examples Are Not Bugs, They Are Featurescited by 950
  14. 2017A Closer Look at Memorization in Deep Networkscited by 936
  15. 2018Robustness May Be at Odds with Accuracycited by 873
  16. 2019Right for the Wrong Reasons: Diagnosing Syntactic Heuristics in Natural Language Inferencecited by 864
  17. 2017Ensemble Adversarial Training: Attacks and Defensescited by 833
  18. 2015The Limitations of Deep Learning in Adversarial Settingscited by 784
  19. 2017Evasion Attacks against Machine Learning at Test Timecited by 686
  20. 2018Improving Transferability of Adversarial Examples with Input Diversitycited by 591
  21. 2017Adversarial Examples Are Not Easily Detected: Bypassing Ten Detection Methodscited by 542
  22. 2016Delving into Transferable Adversarial Examples and Black-box Attackscited by 530
  23. 2021LeViT: a Vision Transformer in ConvNet's Clothing for Faster Inferencecited by 475
  24. 2019On Evaluating Adversarial Robustnesscited by 442
  25. 2019Evading Defenses to Transferable Adversarial Examples by Translation-Invariant Attackscited by 440
  26. 2016Transferability in Machine Learning: from Phenomena to Black-Box Attacks using Adversarial Samplescited by 439
  27. 2014Understanding Deep Image Representations by Inverting Themcited by 399
  28. 2020The Pitfalls of Simplicity Bias in Neural Networkscited by 349
  29. 2020Do Adversarially Robust ImageNet Models Transfer Better?cited by 315
  30. 2019High Frequency Component Helps Explain the Generalization of Convolutional Neural Networkscited by 310
  31. 2018Certified Defenses against Adversarial Examplescited by 305
  32. 2021Escaping the Big Data Paradigm with Compact Transformerscited by 261
  33. 2017Detecting Adversarial Samples from Artifactscited by 244
  34. 2017On Detecting Adversarial Perturbationscited by 232
  35. 2018Adversarial Risk and the Dangers of Evaluating Against Weak Attackscited by 221
  36. 2015Convergent Learning: Do different neural networks learn the same representations?cited by 215
  37. 2019SGD on Neural Networks Learns Functions of Increasing Complexitycited by 203
  38. 2017Generating Natural Adversarial Examplescited by 182

50 most cited of 72 All 72 (JSON)

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2022: 7; 2023: 8; 2024: 14; 2025: 1; 2026: 3.

33 papers.

Sort:

By area:

  1. 2024AnyAttack: Towards Large-scale Self-supervised Adversarial Attacks on Vision-language Modelscited by 43
  2. 2023Why Does Little Robustness Help? A Further Step Towards Understanding Adversarial Transferabilitycited by 32
  3. 2022What Can the Neural Tangent Kernel Tell Us About Adversarial Robustness?cited by 21
  4. 2023Attacks in Adversarial Machine Learning: A Systematic Survey from the Life-cycle Perspectivecited by 19
  5. 2023Introducing Competition to Boost the Transferability of Targeted Adversarial Examples through Clean Feature Mixupcited by 17
  6. 2022Towards Good Practices in Evaluating Transfer Adversarial Attackscited by 14
  7. 2024Breaking Barriers in Physical-World Adversarial Examples: Improving Robustness and Transferability via Robust Featurecited by 13
  8. 2022Can Adversarial Training Be Manipulated By Non-Robust Features?cited by 12
  9. 2024Robust and Transferable Backdoor Attacks Against Deep Image Compression With Selective Frequency Priorcited by 11
  10. 2022An Intermediate-level Attack Framework on The Basis of Linear Regressioncited by 9
  11. 2025When Robots Obey the Patch: Universal Transferable Patch Attacks on Vision-Language-Action Modelscited by 9
  12. 2022Boosting the Adversarial Transferability of Surrogate Models with Dark Knowledgecited by 6
21 more
  1. 2022Adversarial Pixel Restoration as a Pretext Task for Transferable Perturbationscited by 6
  2. 2023SoK: Pitfalls in Evaluating Black-Box Attackscited by 6
  3. 2023Towards Evaluating Transfer-based Attacks Systematically, Practically, and Fairlycited by 6
  4. 2024Adversarial Example Soups: Improving Transferability and Stealthiness for Freecited by 6
  5. 2023LRS: Enhancing Adversarial Transferability through Lipschitz Regularized Surrogatecited by 5
  6. 2024Exploring Adversarial Attacks against Latent Diffusion Model from the Perspective of Adversarial Transferabilitycited by 5
  7. 2024Quantum-Inspired Analysis of Neural Network Vulnerabilities: The Role of Conjugate Variables in System Attackscited by 4
  8. 2023Improving Transferability of Adversarial Examples via Bayesian Attackscited by 3
  9. 2023Going Further: Flatness at the Rescue of Early Stopping for Adversarial Example Transferabilitycited by 2
  10. 2024Towards Scalable and Robust Model Versioningcited by 2
  11. 2024Theoretical Understanding of Learning from Adversarial Perturbationscited by 2
  12. 2024RobustBlack: Challenging Black-Box Adversarial Attacks on State-of-the-Art Defensescited by 2
  13. 2022Transferability Ranking of Adversarial Examplescited by 1
  14. 2024Towards Assessing the Synthetic-to-Measured Adversarial Vulnerability of SAR ATRcited by 1
  15. 2024On the Adversarial Transferability of Generalized "Skip Connections"cited by 1
  16. 2024S4ST: A Strong, Self-transferable, faSt, and Simple Scale Transformation for Transferable Targeted Attackcited by 1
  17. 2024Boosting Adversarial Transferability for Skeleton-based Action Recognition via Exploring the Model Posterior Spacecited by 0
  18. 2024Two Heads Are Better Than One: Averaging along Fine-Tuning to Improve Targeted Transferabilitycited by 0
  19. 2026The Scissors Effect: When Resize-Based Input Diversity Helps or Hurts Transfer Attackscited by 0
  20. 2026On Success and Simplicity: A Second Look at Transferable Vision-Language Attack Pipelinecited by 0
  21. 2026Does Target Alignment Mean Target Recovery? An Evidence-Ladder Study of Adversarial Claims on Contrastive Encoderscited by 0