mlsanityData to 7 Oct 2026

Selection of Source Images Heavily Influences the Effectiveness of Adversarial Attacks

arXiv 2106.07141 ↗First posted 14 Jun 2021cs.CV cs.CR cs.LGcited by 6

Not on the map. Why?

Abstract (arXiv)

Although the adoption rate of deep neural networks (DNNs) has tremendously increased in recent years, a solution for their vulnerability against adversarial examples has not yet been found. As a result, substantial research efforts are dedicated to fix this weakness, with many studies typically using a subset of source images to generate adversarial examples, treating every image in this subset as equal. We demonstrate that, in fact, not every source image is equally suited for this kind of assessment. To do so, we devise a large-scale model-to-model transferability scenario for which we meticulously analyze the properties of adversarial examples, generated from every suitable source image in ImageNet by making use of three of the most frequently deployed attacks. In this transferability scenario, which involves seven distinct DNN models, including the recently proposed vision transformers, we reveal that it is possible to have a difference of up to 12.5% in model-to-model transferability success, 1.01 in average L2 perturbation, and 0.03 (8/225) in average L∞ perturbation when 1,000 source images are sampled randomly among all suitable candidates. We then take one of the first steps in evaluating the robustness of images used to create adversarial examples, proposing a number of simple but effective methods to identify unsuitable source images, thus making it possible to mitigate extreme cases in experimentation and support high-quality benchmarking.

Key facts. Cited by 6 papers in the map (data through 7 Oct 2026). Builds on 55 of its 68 references that are in the map. First posted on arXiv 14 Jun 2021.

Builds on

55 of 68 references.

References · 55

  1. 2017Attention Is All You Needcited by 59,932
  2. 2015Deep Residual Learning for Image Recognitioncited by 51,809
  3. 2020An Image is Worth 16x16 Words: Transformers for Image Recognition at Scalecited by 29,915
  4. 2014Very Deep Convolutional Networks for Large-Scale Image Recognitioncited by 15,267
  5. 2014ImageNet Large Scale Visual Recognition Challengecited by 8,441
  6. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  7. 2016Densely Connected Convolutional Networkscited by 6,691
  8. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  9. 2013Intriguing properties of neural networkscited by 5,114
  10. 2017On Calibration of Modern Neural Networkscited by 4,860
  11. 2016Towards Evaluating the Robustness of Neural Networkscited by 2,976
  12. 2016Adversarial examples in the physical worldcited by 1,762
38 more
  1. 2015DeepFool: a simple and accurate method to fool deep neural networkscited by 1,315
  2. 2018Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examplescited by 1,259
  3. 2016SqueezeNet: AlexNet-level accuracy with 50x fewer parameters and <0.5MB model sizecited by 1,054
  4. 2016Universal adversarial perturbationscited by 774
  5. 2015Distillation as a Defense to Adversarial Perturbations against Deep Neural Networkscited by 675
  6. 2020On Adaptive Attacks to Adversarial Example Defensescited by 547
  7. 2017Adversarial Examples Are Not Easily Detected: Bypassing Ten Detection Methodscited by 542
  8. 2018Black-box Adversarial Attacks with Limited Queries and Informationcited by 499
  9. 2017Mitigating Adversarial Effects Through Randomizationcited by 382
  10. 2017Adversarial Examples: Attacks and Defenses for Deep Learningcited by 350
  11. 2017Defense against Adversarial Attacks Using High-Level Representation Guided Denoisercited by 329
  12. 2019Adversarial Examples Improve Image Recognitioncited by 283
  13. 2019Simple Black-box Adversarial Attackscited by 249
  14. 2018Adversarial Logit Pairingcited by 224
  15. 2017On the (Statistical) Detection of Adversarial Examplescited by 180
  16. 2020Skip Connections Matter: On the Transferability of Adversarial Examples Generated with ResNetscited by 165
  17. 2017EAD: Elastic-Net Attacks to Deep Neural Networks via Adversarial Examplescited by 154
  18. 2018AutoZOOM: Autoencoder-based Zeroth Order Optimization Method for Attacking Black-box Neural Networkscited by 137
  19. 2018Is Robustness the Cost of Accuracy? -- A Comprehensive Study on the Robustness of 18 Deep Image Classification Modelscited by 135
  20. 2018LaVAN: Localized and Visible Adversarial Noisecited by 112
  21. 2019Sparse and Imperceivable Adversarial Attackscited by 95
  22. 2017Universal Adversarial Perturbations Against Semantic Image Segmentationcited by 92
  23. 2019ColorFool: Semantic Adversarial Colorizationcited by 89
  24. 2016Adversarial Examples Detection in Deep Networks with Convolutional Filter Statisticscited by 77
  25. 2019The Odds are Odd: A Statistical Test for Detecting Adversarial Examplescited by 75
  26. 2019Towards Large yet Imperceptible Adversarial Image Perturbations with Perceptual Color Distancecited by 72
  27. 2018Structured Adversarial Attack: Towards General Implementation and Better Interpretabilitycited by 63
  28. 2018Adversarial Attacks Against Medical Deep Learning Systemscited by 61
  29. 2017Adversarial Transformation Networks: Learning to Generate Adversarial Examplescited by 60
  30. 2018Motivating the Rules of the Game for Adversarial Example Researchcited by 57
  31. 2019A New Defense Against Adversarial Images: Turning a Weakness into a Strengthcited by 49
  32. 2019Accurate, reliable and fast robustness evaluationcited by 43
  33. 2018Deep Defense: Training DNNs with Improved Adversarial Robustnesscited by 41
  34. 2018On the Robustness of the CVPR 2018 White-Box Adversarial Example Defensescited by 40
  35. 2019Provable robustness against all adversarial lp-perturbations for p≥ 1cited by 39
  36. 2019A Survey of Black-Box Adversarial Attacks on Computer Vision Modelscited by 36
  37. 2016Adversarial Diversity and Hard Positive Generationcited by 35
  38. 2019Defending against Whitebox Adversarial Attacks via Randomized Discretizationcited by 29

50 most cited of 55 All 55 (JSON)

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 1; 2022: 1; 2023: 1; 2024: 1; 2025: 1; 2026: 1.

6 papers.

  1. 2021Evaluating Adversarial Attacks on ImageNet: A Reality Check on Misclassification Classescited by 3
  2. 2022Transferability Ranking of Adversarial Examplescited by 1
  3. 2023Fine-Grained ImageNet Classification in the Wildcited by 0
  4. 2024PEAS: A Strategy for Crafting Transferable Adversarial Examplescited by 0
  5. 2025Token-Based Detection of Spurious Correlations in Vision Transformerscited by 0
  6. 2026Can Attack Difficulty Be Characterized Before Optimization? A Study of Pre-optimization Difficulty in Person-Vanishing Attackscited by 0