mlsanityData to 7 Oct 2026

Adaptive Image Transformations for Transfer-based Adversarial Attack

arXiv 2111.13844 ↗First posted 27 Nov 2021cs.CVcited by 22

Not on the map. Why?

Abstract (arXiv)

Adversarial attacks provide a good way to study the robustness of deep learning models. One category of methods in transfer-based black-box attack utilizes several image transformation operations to improve the transferability of adversarial examples, which is effective, but fails to take the specific characteristic of the input image into consideration. In this work, we propose a novel architecture, called Adaptive Image Transformation Learner (AITL), which incorporates different image transformation operations into a unified framework to further improve the transferability of adversarial examples. Unlike the fixed combinational transformations used in existing works, our elaborately designed transformation learner adaptively selects the most effective combination of image transformations specific to the input image. Extensive experiments on ImageNet demonstrate that our method significantly improves the attack success rates on both normally trained models and defense models under various settings.

Key facts. Cited by 22 papers in the map (data through 7 Oct 2026). Builds on 69 of its 80 references that are in the map. First posted on arXiv 27 Nov 2021.

Builds on

69 of 80 references.

References · 69

  1. 2015Deep Residual Learning for Image Recognitioncited by 51,809
  2. 2014Adam: A Method for Stochastic Optimizationcited by 36,960
  3. 2014Very Deep Convolutional Networks for Large-Scale Image Recognitioncited by 15,267
  4. 2017Proximal Policy Optimization Algorithmscited by 14,441
  5. 2014ImageNet Large Scale Visual Recognition Challengecited by 8,441
  6. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  7. 2016Densely Connected Convolutional Networkscited by 6,691
  8. 2019EfficientNet: Rethinking Model Scaling for Convolutional Neural Networkscited by 6,415
  9. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  10. 2015Rethinking the Inception Architecture for Computer Visioncited by 5,451
  11. 2017mixup: Beyond Empirical Risk Minimizationcited by 5,155
  12. 2013Intriguing properties of neural networkscited by 5,114
38 more
  1. 2018MobileNetV2: Inverted Residuals and Linear Bottleneckscited by 4,773
  2. 2017Squeeze-and-Excitation Networkscited by 4,763
  3. 2016DeepLab: Semantic Image Segmentation with Deep Convolutional Nets, Atrous Convolution, and Fully Connected CRFscited by 3,239
  4. 2016Aggregated Residual Transformations for Deep Neural Networkscited by 2,540
  5. 2016Xception: Deep Learning with Depthwise Separable Convolutionscited by 2,320
  6. 2019RandAugment: Practical automated data augmentation with a reduced search spacecited by 2,261
  7. 2017Rethinking Atrous Convolution for Semantic Image Segmentationcited by 2,154
  8. 2016Identity Mappings in Deep Residual Networkscited by 1,960
  9. 2016Inception-v4, Inception-ResNet and the Impact of Residual Connections on Learningcited by 1,509
  10. 2020Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attackscited by 1,442
  11. 2015DeepFool: a simple and accurate method to fool deep neural networkscited by 1,315
  12. 2018Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examplescited by 1,259
  13. 2021EfficientNetV2: Smaller Models and Faster Trainingcited by 1,127
  14. 2017Learning Transferable Architectures for Scalable Image Recognitioncited by 1,097
  15. 2018CosFace: Large Margin Cosine Loss for Deep Face Recognitioncited by 968
  16. 2016Adversarial Machine Learning at Scalecited by 934
  17. 2017Ensemble Adversarial Training: Attacks and Defensescited by 833
  18. 2017Reluplex: An Efficient SMT Solver for Verifying Deep Neural Networkscited by 739
  19. 2017SphereFace: Deep Hypersphere Embedding for Face Recognitioncited by 733
  20. 2020Fast is better than free: Revisiting adversarial trainingcited by 723
  21. 2017ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Modelscited by 656
  22. 2018Improving Transferability of Adversarial Examples with Input Diversitycited by 591
  23. 2014Semantic Image Segmentation with Deep Convolutional Nets and Fully Connected CRFscited by 552
  24. 2020On Adaptive Attacks to Adversarial Example Defensescited by 547
  25. 2016Delving into Transferable Adversarial Examples and Black-box Attackscited by 530
  26. 2017Countering Adversarial Images using Input Transformationscited by 517
  27. 2018Black-box Adversarial Attacks with Limited Queries and Informationcited by 499
  28. 2017Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networkscited by 484
  29. 2017Progressive Neural Architecture Searchcited by 483
  30. 2019Evading Defenses to Transferable Adversarial Examples by Translation-Invariant Attackscited by 440
  31. 2017Mitigating Adversarial Effects Through Randomizationcited by 382
  32. 2019Nesterov Accelerated Gradient and Scale Invariance for Adversarial Attackscited by 352
  33. 2017Defense against Adversarial Attacks Using High-Level Representation Guided Denoisercited by 329
  34. 2020AdaBelief Optimizer: Adapting Stepsizes by the Belief in Observed Gradientscited by 282
  35. 2021Enhancing the Transferability of Adversarial Attacks through Variance Tuningcited by 242
  36. 2018Adversarial Risk and the Dangers of Evaluating Against Weak Attackscited by 221
  37. 2020A Self-supervised Approach for Adversarial Robustnesscited by 180
  38. 2020Skip Connections Matter: On the Transferability of Adversarial Examples Generated with ResNetscited by 165

50 most cited of 69 All 69 (JSON)

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2022: 3; 2023: 6; 2024: 7; 2025: 4; 2026: 2.

22 papers.

Sort:

  1. 2023Structure Invariant Transformation for better Adversarial Transferabilitycited by 61
  2. 2022Towards Compositional Adversarial Robustness: Generalizing Adversarial Training to Composite Semantic Perturbationscited by 26
  3. 2024Learning to Transform Dynamically for Better Adversarial Transferabilitycited by 23
  4. 2022Towards Good Practices in Evaluating Transfer Adversarial Attackscited by 14
  5. 2023AutoLoRa: A Parameter-Free Automated Robust Fine-Tuning Frameworkcited by 9
  6. 2023Fast Propagation is Better: Accelerating Single-Step Adversarial Training via Sampling Subnetworkscited by 8
  7. 2022Improving the Transferability of Adversarial Attacks on Face Recognition with Beneficial Perturbation Feature Augmentationcited by 7
  8. 2024Rethinking Impersonation and Dodging Attacks on Face Recognition Systemscited by 7
  9. 2023SoK: Pitfalls in Evaluating Black-Box Attackscited by 6
  10. 2024Adversarial Example Soups: Improving Transferability and Stealthiness for Freecited by 6
  11. 2024Boosting Adversarial Transferability with Low-Cost Optimization via Maximin Expected Flatnesscited by 6
  12. 2023Semantic-Aware Adversarial Training for Reliable Deep Hashing Retrievalcited by 5
10 more
  1. 2025No Query, No Accesscited by 4
  2. 2023Rethinking Mixup for Improving the Adversarial Transferabilitycited by 3
  3. 2024On the Adversarial Transferability of Generalized "Skip Connections"cited by 1
  4. 2024S4ST: A Strong, Self-transferable, faSt, and Simple Scale Transformation for Transferable Targeted Attackcited by 1
  5. 2025NAT: Learning to Attack Neurons for Enhanced Adversarial Transferabilitycited by 1
  6. 2024Enhancing Transferability of Targeted Adversarial Examples: A Self-Universal Perspectivecited by 0
  7. 2025Temporal Consistency Constrained Transferable Adversarial Attacks with Background Mixup for Action Recognitioncited by 0
  8. 2025Enhancing Adversarial Transferability through Block Stretch and Shrinkcited by 0
  9. 2026Devling into Adversarial Transferability on Image Classification: Review, Benchmark, and Evaluationcited by 0
  10. 2026A Unified Spatial Alignment Framework for Highly Transferable Transformation-Based Attacks on Spatially Structured Taskscited by 0