mlsanityData to 7 Oct 2026

Boosting Transferability of Targeted Adversarial Examples via Hierarchical Generative Networks

arXiv 2107.01809 ↗First posted 5 Jul 2021cs.LG cs.AIcited by 31

Not on the map. Why?

Abstract (arXiv)

Transfer-based adversarial attacks can evaluate model robustness in the black-box setting. Several methods have demonstrated impressive untargeted transferability, however, it is still challenging to efficiently produce targeted transferability. To this end, we develop a simple yet effective framework to craft targeted transfer-based adversarial examples, applying a hierarchical generative network. In particular, we contribute to amortized designs that well adapt to multi-class targeted attacks. Extensive experiments on ImageNet show that our method improves the success rates of targeted black-box attacks by a significant margin over the existing methods -- it reaches an average success rate of 29.1% against six diverse models based only on one substitute white-box model, which significantly outperforms the state-of-the-art gradient-based attack methods. Moreover, the proposed method is also more efficient beyond an order of magnitude than gradient-based methods.

Key facts. Cited by 31 papers in the map (data through 7 Oct 2026). Builds on 42 of its 59 references that are in the map. First posted on arXiv 5 Jul 2021.

Builds on

42 of 59 references.

References · 42

  1. 2014Microsoft COCO: Common Objects in Contextcited by 17,498
  2. 2014Very Deep Convolutional Networks for Large-Scale Image Recognitioncited by 15,267
  3. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  4. 2016Densely Connected Convolutional Networkscited by 6,691
  5. 2015Rethinking the Inception Architecture for Computer Visioncited by 5,451
  6. 2013Intriguing properties of neural networkscited by 5,114
  7. 2014Going Deeper with Convolutionscited by 4,231
  8. 2015FaceNet: A Unified Embedding for Face Recognition and Clusteringcited by 2,833
  9. 2016Perceptual Losses for Real-Time Style Transfer and Super-Resolutioncited by 2,678
  10. 2018Large Scale GAN Training for High Fidelity Natural Image Synthesiscited by 2,609
  11. 2016Identity Mappings in Deep Residual Networkscited by 1,960
  12. 2016Adversarial examples in the physical worldcited by 1,762
30 more
  1. 2016Inception-v4, Inception-ResNet and the Impact of Residual Connections on Learningcited by 1,509
  2. 2015DeepFool: a simple and accurate method to fool deep neural networkscited by 1,315
  3. 2018CosFace: Large Margin Cosine Loss for Deep Face Recognitioncited by 968
  4. 2017Ensemble Adversarial Training: Attacks and Defensescited by 833
  5. 2016Universal adversarial perturbationscited by 774
  6. 2017SphereFace: Deep Hypersphere Embedding for Face Recognitioncited by 733
  7. 2018Improving Transferability of Adversarial Examples with Input Diversitycited by 591
  8. 2016Delving into Transferable Adversarial Examples and Black-box Attackscited by 530
  9. 2014Learning Face Representation from Scratchcited by 451
  10. 2019Evading Defenses to Transferable Adversarial Examples by Translation-Invariant Attackscited by 440
  11. 2019Nesterov Accelerated Gradient and Scale Invariance for Adversarial Attackscited by 352
  12. 2018MobileFaceNets: Efficient CNNs for Accurate Real-Time Face Verification on Mobile Devicescited by 180
  13. 2020Skip Connections Matter: On the Transferability of Adversarial Examples Generated with ResNetscited by 165
  14. 2017Generative Adversarial Perturbationscited by 153
  15. 2019Enhancing Adversarial Example Transferability with an Intermediate Level Attackcited by 139
  16. 2018Constructing Unrestricted Adversarial Examples with Generative Modelscited by 135
  17. 2017BEGAN: Boundary Equilibrium Generative Adversarial Networkscited by 121
  18. 2018Adversarial Attacks and Defences Competitioncited by 96
  19. 2019Cross-Domain Transferability of Adversarial Perturbationscited by 92
  20. 2020On Success and Simplicity: A Second Look at Transferable Targeted Attackscited by 89
  21. 2020Patch-wise Attack for Fooling Deep Neural Networkcited by 78
  22. 2021On Generating Transferable Targeted Perturbationscited by 65
  23. 2020Understanding Adversarial Examples from the Mutual Influence of Images and Perturbationscited by 59
  24. 2020Perturbing Across the Feature Hierarchy to Improve Standard and Strict Blackbox Attack Transferabilitycited by 57
  25. 2020Transferable Perturbations of Deep Feature Distributionscited by 51
  26. 2018Ask, Acquire, and Attack: Data-free UAP Generation using Class Impressionscited by 31
  27. 2019Regional Homogeneity: Towards Learning Transferable Universal Adversarial Perturbations Against Defensescited by 22
  28. 2019Design and Interpretation of Universal Adversarial Patches in Face Detectioncited by 22
  29. 2019Benchmarking Adversarial Robustnesscited by 15
  30. 2019Once a MAN: Towards Multi-Target Attack via Learning Multi-Target Adversarial Network Oncecited by 10

Built on by

Cited by year

Citing papers per year: 2021: 1; 2022: 3; 2023: 10; 2024: 11; 2025: 6.

31 papers.

Sort:

By area:

  1. 2023On Evaluating Adversarial Robustness of Large Vision-Language Modelscited by 281
  2. 2024JailbreakZoo: Survey, Landscapes, and Horizons in Jailbreaking Large Language and Vision-Language Modelscited by 67
  3. 2023A Survey on Transferability of Adversarial Examples across Deep Neural Networkscited by 43
  4. 2022Towards Understanding and Boosting Adversarial Transferability from a Distribution Perspectivecited by 36
  5. 2023Improving Fast Adversarial Training with Prior-Guided Knowledgecited by 34
  6. 2023Towards Effective Adversarial Textured 3D Meshes on Physical Face Recognitioncited by 33
  7. 2023Towards Transferable Targeted 3D Adversarial Attack in the Physical Worldcited by 25
  8. 2024CLIP-Guided Generative Networks for Transferable Targeted Adversarial Attackscited by 19
  9. 2024Boosting Adversarial Transferability across Model Genus by Deformation-Constrained Warpingcited by 18
  10. 2023Exploring Transferability of Multimodal Adversarial Samples for Vision-Language Pre-training Models with Contrastive Learningcited by 16
  11. 2022Towards Good Practices in Evaluating Transfer Adversarial Attackscited by 14
  12. 2024As Firm As Their Foundations: Can open-sourced foundation models be used to create adversarial examples for downstream tasks?cited by 11
19 more
  1. 2023Towards Efficient Verification of Quantized Neural Networkscited by 10
  2. 2023LFAA: Crafting Transferable Targeted Adversarial Examples with Low-Frequency Perturbationscited by 8
  3. 2024Scaling Laws for Black box Adversarial Attackscited by 8
  4. 2023SoK: Pitfalls in Evaluating Black-Box Attackscited by 6
  5. 2023Towards Evaluating Transfer-based Attacks Systematically, Practically, and Fairlycited by 6
  6. 2024Improving Transferable Targeted Attacks with Feature Tuning Mixupcited by 6
  7. 2021Adversarial Attacks on ML Defense Models Competitioncited by 3
  8. 2024Investigating Deep Watermark Security: An Adversarial Transferability Perspectivecited by 3
  9. 2024Any Target Can be Offense: Adversarial Example Generation via Generalized Latent Infectioncited by 3
  10. 2025Boosting Generative Adversarial Transferability with Self-supervised Vision Transformer Featurescited by 3
  11. 2022Enhancing Targeted Attack Transferability via Diversified Weight Pruningcited by 2
  12. 2024Perturbation Towards Easy Samples Improves Targeted Adversarial Transferabilitycited by 2
  13. 2024S4ST: A Strong, Self-transferable, faSt, and Simple Scale Transformation for Transferable Targeted Attackcited by 1
  14. 2025Boosting Adversarial Transferability with Spatial Adversarial Alignmentcited by 1
  15. 2025Dual-Flow: Transferable Multi-Target, Instance-Agnostic Attacks via In-the-wild Cascading Flow Optimizationcited by 1
  16. 2025Adversarial Examples in Environment Perception for Automated Driving (Review)cited by 1
  17. 2024Two Heads Are Better Than One: Averaging along Fine-Tuning to Improve Targeted Transferabilitycited by 0
  18. 2025Rethinking Target Label Conditioning in Adversarial Attacks: A 2D Tensor-Guided Generative Approachcited by 0
  19. 2025Towards Cross-Domain Multi-Targeted Adversarial Attackscited by 0