mlsanityData to 7 Oct 2026

Improving the Transferability of Adversarial Examples with Resized-Diverse-Inputs, Diversity-Ensemble and Region Fitting

arXiv 2112.06011 ↗First posted 11 Dec 2021cs.CV cs.LGcited by 37

Not on the map. Why?

Abstract (arXiv)

We introduce a three stage pipeline: resized-diverse-inputs (RDIM), diversity-ensemble (DEM) and region fitting, that work together to generate transferable adversarial examples. We first explore the internal relationship between existing attacks, and propose RDIM that is capable of exploiting this relationship. Then we propose DEM, the multi-scale version of RDIM, to generate multi-scale gradients. After the first two steps we transform value fitting into region fitting across iterations. RDIM and region fitting do not require extra running time and these three steps can be well integrated into other attacks. Our best attack fools six black-box defenses with a 93% success rate on average, which is higher than the state-of-the-art gradient-based attacks. Besides, we rethink existing attacks rather than simply stacking new methods on the old ones to get better performance. It is expected that our findings will serve as the beginning of exploring the internal relationship between attack methods. Codes are available at https://github.com/278287847/DEM.

Key facts. Cited by 37 papers in the map (data through 7 Oct 2026). Builds on 28 of its 35 references that are in the map. First posted on arXiv 11 Dec 2021.

Builds on

28 of 35 references.

References · 28

  1. 2014ImageNet Large Scale Visual Recognition Challengecited by 8,441
  2. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  3. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  4. 2015Rethinking the Inception Architecture for Computer Visioncited by 5,451
  5. 2013Intriguing properties of neural networkscited by 5,114
  6. 2016Towards Evaluating the Robustness of Neural Networkscited by 2,976
  7. 2016Identity Mappings in Deep Residual Networkscited by 1,960
  8. 2016Adversarial examples in the physical worldcited by 1,762
  9. 2016Inception-v4, Inception-ResNet and the Impact of Residual Connections on Learningcited by 1,509
  10. 2016Adversarial Machine Learning at Scalecited by 934
  11. 2017Ensemble Adversarial Training: Attacks and Defensescited by 833
  12. 2016Universal adversarial perturbationscited by 774
16 more
  1. 2017Evasion Attacks against Machine Learning at Test Timecited by 686
  2. 2018Improving Transferability of Adversarial Examples with Input Diversitycited by 591
  3. 2017Provable defenses against adversarial examples via the convex outer adversarial polytopecited by 564
  4. 2016Delving into Transferable Adversarial Examples and Black-box Attackscited by 530
  5. 2017Countering Adversarial Images using Input Transformationscited by 517
  6. 2017Decision-Based Adversarial Attacks: Reliable Attacks Against Black-Box Machine Learning Modelscited by 459
  7. 2019Evading Defenses to Transferable Adversarial Examples by Translation-Invariant Attackscited by 440
  8. 2017Mitigating Adversarial Effects Through Randomizationcited by 382
  9. 2018Defense-GAN: Protecting Classifiers Against Adversarial Attacks Using Generative Modelscited by 362
  10. 2017Defense against Adversarial Attacks Using High-Level Representation Guided Denoisercited by 329
  11. 2019HopSkipJumpAttack: A Query-Efficient Decision-Based Attackcited by 328
  12. 2018Certified Defenses against Adversarial Examplescited by 305
  13. 2017On the Robustness of Semantic Segmentation Models to Adversarial Attackscited by 126
  14. 2016Simple Black-Box Adversarial Perturbations for Deep Networkscited by 42
  15. 2018Max-Mahalanobis Linear Discriminant Analysis Networkscited by 18
  16. 2018Adversarial Attacks on Face Detectors using Neural Net based Constrained Optimizationcited by 18

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2022: 7; 2023: 13; 2024: 13; 2025: 2; 2026: 2.

37 papers.

Sort:

By area:

  1. 2022Frequency Domain Model Augmentation for Adversarial Attackcited by 128
  2. 2023Structure Invariant Transformation for better Adversarial Transferabilitycited by 61
  3. 2022Improving the Transferability of Targeted Adversarial Examples through Object-Based Diverse Inputcited by 49
  4. 2023A Survey on Transferability of Adversarial Examples across Deep Neural Networkscited by 43
  5. 2023SA-Attack: Improving Adversarial Transferability of Vision-Language Pre-training Models via Self-Augmentationcited by 39
  6. 2024Learning to Transform Dynamically for Better Adversarial Transferabilitycited by 23
  7. 2023Improving Adversarial Transferability by Stable Diffusioncited by 22
  8. 2022TextGrad: Advancing Robustness Evaluation in NLP by Gradient-Driven Optimizationcited by 21
  9. 2023A Survey of Robustness and Safety of 2D and 3D Deep Learning Models Against Adversarial Attackscited by 19
  10. 2023Introducing Competition to Boost the Transferability of Targeted Adversarial Examples through Clean Feature Mixupcited by 17
  11. 2022Strong Transferable Adversarial Attacks via Ensembled Asymptotically Normal Distribution Learningcited by 15
  12. 2022Towards Good Practices in Evaluating Transfer Adversarial Attackscited by 14
25 more
  1. 2023Reliable Evaluation of Adversarial Transferabilitycited by 12
  2. 2024As Firm As Their Foundations: Can open-sourced foundation models be used to create adversarial examples for downstream tasks?cited by 11
  3. 2023Improving Adversarial Transferability via Model Alignmentcited by 10
  4. 2023Adversarial Attack Based on Prediction-Correctioncited by 7
  5. 2024Boosting the Transferability of Adversarial Examples via Local Mixup and Adaptive Step Sizecited by 7
  6. 2022Boosting the Adversarial Transferability of Surrogate Models with Dark Knowledgecited by 6
  7. 2023SoK: Pitfalls in Evaluating Black-Box Attackscited by 6
  8. 2023Beyond Boundaries: A Comprehensive Survey of Transferable Attacks on AI Systemscited by 6
  9. 2024Understanding Model Ensemble in Transferable Adversarial Attackcited by 6
  10. 2024Improving Transferable Targeted Attacks with Feature Tuning Mixupcited by 6
  11. 2022Adversarial Attack via Dual-Stage Network Erosioncited by 3
  12. 2024Investigating Deep Watermark Security: An Adversarial Transferability Perspectivecited by 3
  13. 2024Improving Transferable Targeted Adversarial Attack via Normalized Logit Calibration and Truncated Feature Mixingcited by 3
  14. 2024Perturbation Towards Easy Samples Improves Targeted Adversarial Transferabilitycited by 2
  15. 2025Boosting the Local Invariance for Better Adversarial Transferabilitycited by 2
  16. 2023How to choose your best allies for a transferable attack?cited by 1
  17. 2024S4ST: A Strong, Self-transferable, faSt, and Simple Scale Transformation for Transferable Targeted Attackcited by 1
  18. 2023Explainability and Robustness of Deep Visual Classification Modelscited by 0
  19. 2024Enhancing Adversarial Transferability via Information Bottleneck Constraintscited by 0
  20. 2024Transform-Dependent Adversarial Attackscited by 0
  21. 2024Enhancing Transferability of Targeted Adversarial Examples: A Self-Universal Perspectivecited by 0
  22. 2024PEAS: A Strategy for Crafting Transferable Adversarial Examplescited by 0
  23. 2025RaPA: Enhancing Transferable Targeted Attacks via Random Parameter Pruningcited by 0
  24. 2026Devling into Adversarial Transferability on Image Classification: Review, Benchmark, and Evaluationcited by 0
  25. 2026A Unified Spatial Alignment Framework for Highly Transferable Transformation-Based Attacks on Spatially Structured Taskscited by 0