mlsanityData to 14 Oct 2026

Fast Gradient Non-sign Methods

arXiv 2110.12734 ↗First posted 25 Oct 2021cs.CV cs.CR cs.LGcited by 9

Not on the map. Why?

Abstract (arXiv)

Adversarial attacks make their success in DNNs, and among them, gradient-based algorithms become one of the mainstreams. Based on the linearity hypothesis, under ℓ_∞ constraint, sign operation applied to the gradients is a good choice for generating perturbations. However, side-effects from such operation exist since it leads to the bias of direction between real gradients and perturbations. In other words, current methods contain a gap between real gradients and actual noises, which leads to biased and inefficient attacks. Therefore in this paper, based on the Taylor expansion, the bias is analyzed theoretically, and the correction of sign, i.e., Fast Gradient Non-sign Method (FGNM), is further proposed. Notably, FGNM is a general routine that seamlessly replaces the conventional sign operation in gradient-based attacks with negligible extra computational cost. Extensive experiments demonstrate the effectiveness of our methods. Specifically, for untargeted black-box attacks, ours outperform them by 27.5% at most and 9.5% on average. For targeted attacks against defense models, it is 15.1% and 12.7%. Our anonymous code is publicly available at https://github.com/yaya-cheng/FGNM

Key facts. Cited by 9 papers in the map (data through 14 Oct 2026). Builds on 35 of its 56 references that are in the map. First posted on arXiv 25 Oct 2021.

Builds on

35 of 56 references.

References · 35

  1. 2015Deep Residual Learning for Image Recognitioncited by 52,096
  2. 2014Explaining and Harnessing Adversarial Examplescited by 7,364
  3. 2016Densely Connected Convolutional Networkscited by 6,720
  4. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,415
  5. 2015Rethinking the Inception Architecture for Computer Visioncited by 5,475
  6. 2016Towards Evaluating the Robustness of Neural Networkscited by 2,998
  7. 2016Adversarial examples in the physical worldcited by 1,769
  8. 2016Inception-v4, Inception-ResNet and the Impact of Residual Connections on Learningcited by 1,512
  9. 2015DeepFool: a simple and accurate method to fool deep neural networkscited by 1,318
  10. 2016Practical Black-Box Attacks against Machine Learningcited by 903
  11. 2017Ensemble Adversarial Training: Attacks and Defensescited by 840
  12. 2018Improving Transferability of Adversarial Examples with Input Diversitycited by 599
23 more
  1. 2016Delving into Transferable Adversarial Examples and Black-box Attackscited by 536
  2. 2017Countering Adversarial Images using Input Transformationscited by 520
  3. 2017Decision-Based Adversarial Attacks: Reliable Attacks Against Black-Box Machine Learning Modelscited by 462
  4. 2019Evading Defenses to Transferable Adversarial Examples by Translation-Invariant Attackscited by 442
  5. 2017Mitigating Adversarial Effects Through Randomizationcited by 383
  6. 2019Nesterov Accelerated Gradient and Scale Invariance for Adversarial Attackscited by 355
  7. 2019HopSkipJumpAttack: A Query-Efficient Decision-Based Attackcited by 333
  8. 2017On Detecting Adversarial Perturbationscited by 232
  9. 2016A study of the effect of JPG compression on adversarial imagescited by 197
  10. 2018Stochastic Activation Pruning for Robust Adversarial Defensecited by 171
  11. 2019AdvHat: Real-world adversarial attack on ArcFace Face ID systemcited by 163
  12. 2014Towards Deep Neural Network Architectures Robust to Adversarial Examplescited by 146
  13. 2019Defensive Quantization: When Efficiency Meets Robustnesscited by 95
  14. 2020Patch-wise Attack for Fooling Deep Neural Networkcited by 78
  15. 2019PhysGAN: Generating Physical-World-Resilient Adversarial Examples for Autonomous Drivingcited by 72
  16. 2018Adv-BNN: Improved Adversarial Defense through Robust Bayesian Neural Networkcited by 69
  17. 2019Image Super-Resolution as a Defense Against Adversarial Attackscited by 65
  18. 2019Enhancing Cross-task Black-Box Transferability of Adversarial Examples with Dispersion Reductioncited by 47
  19. 2020Cooling-Shrinking Attack: Blinding the Tracker with Imperceptible Noisescited by 32
  20. 2021Feature Space Targeted Attacks by Statistic Alignmentcited by 21
  21. 2019Amora: Black-box Adversarial Morphing Attackcited by 17
  22. 2020Defending Adversarial Examples via DNN Bottleneck Reinforcementcited by 4
  23. 2019MetaAdvDet: Towards Robust Detection of Evolving Adversarial Attackscited by 3

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2022: 2; 2023: 1; 2024: 4; 2025: 1; 2026: 1.

9 papers.

  1. 2022Natural Color Fool: Towards Boosting Black-box Unrestricted Attackscited by 38
  2. 2023Enhancing Generalization of Universal Adversarial Perturbation through Gradient Aggregationcited by 22
  3. 2024Adversarial Training: A Surveycited by 6
  4. 2024Catastrophic Overfitting: A Potential Blessing in Disguisecited by 4
  5. 2024Deep Learning Model Security: Threats and Defensescited by 4
  6. 2025Beyond Vulnerabilities: A Survey of Adversarial Attacks as Both Threats and Defenses in Computer Vision Systemscited by 4
  7. 2024Advancing Generalized Transfer Attack with Initialization Derived Bilevel Optimization and Dynamic Sequence Truncationcited by 2
  8. 2026Mitigating Error Amplification in Fast Adversarial Trainingcited by 1
  9. 2022Robust DNN Surrogate Models with Uncertainty Quantification via Adversarial Trainingcited by 0