mlsanityData to 7 Oct 2026

Beyond ImageNet Attack: Towards Crafting Adversarial Examples for Black-box Domains

arXiv 2201.11528 ↗First posted 27 Jan 2022cs.CVcited by 42

Not on the map. Why?

Abstract (arXiv)

Adversarial examples have posed a severe threat to deep neural networks due to their transferable nature. Currently, various works have paid great efforts to enhance the cross-model transferability, which mostly assume the substitute model is trained in the same domain as the target model. However, in reality, the relevant information of the deployed model is unlikely to leak. Hence, it is vital to build a more practical black-box threat model to overcome this limitation and evaluate the vulnerability of deployed models. In this paper, with only the knowledge of the ImageNet domain, we propose a Beyond ImageNet Attack (BIA) to investigate the transferability towards black-box domains (unknown classification tasks). Specifically, we leverage a generative model to learn the adversarial function for disrupting low-level features of input images. Based on this framework, we further propose two variants to narrow the gap between the source and target domains from the data and model perspectives, respectively. Extensive experiments on coarse-grained and fine-grained domains demonstrate the effectiveness of our proposed methods. Notably, our methods outperform state-of-the-art approaches by up to 7.71% (towards coarse-grained domains) and 25.91% (towards fine-grained domains) on average. Our code is available at urlhttps://github.com/qilong-zhang/Beyond-ImageNet-Attack.

Key facts. Cited by 42 papers in the map (data through 7 Oct 2026). Builds on 39 of its 58 references that are in the map. First posted on arXiv 27 Jan 2022.

Builds on

39 of 58 references.

References · 39

  1. 2015Deep Residual Learning for Image Recognitioncited by 51,809
  2. 2014Adam: A Method for Stochastic Optimizationcited by 36,960
  3. 2014Very Deep Convolutional Networks for Large-Scale Image Recognitioncited by 15,267
  4. 2014ImageNet Large Scale Visual Recognition Challengecited by 8,441
  5. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  6. 2016Densely Connected Convolutional Networkscited by 6,691
  7. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  8. 2015Rethinking the Inception Architecture for Computer Visioncited by 5,451
  9. 2013Intriguing properties of neural networkscited by 5,114
  10. 2017Squeeze-and-Excitation Networkscited by 4,763
  11. 2016Towards Evaluating the Robustness of Neural Networkscited by 2,976
  12. 2016Adversarial examples in the physical worldcited by 1,762
27 more
  1. 2013Fine-Grained Visual Classification of Aircraftcited by 1,701
  2. 2015DeepFool: a simple and accurate method to fool deep neural networkscited by 1,315
  3. 2014How transferable are features in deep neural networks?cited by 1,216
  4. 2016Adversarial Machine Learning at Scalecited by 934
  5. 2018Improving Transferability of Adversarial Examples with Input Diversitycited by 591
  6. 2016Delving into Transferable Adversarial Examples and Black-box Attackscited by 530
  7. 2017Decision-Based Adversarial Attacks: Reliable Attacks Against Black-Box Machine Learning Modelscited by 459
  8. 2016Transferability in Machine Learning: from Phenomena to Black-Box Attacks using Adversarial Samplescited by 439
  9. 2019HopSkipJumpAttack: A Query-Efficient Decision-Based Attackcited by 328
  10. 2020A Self-supervised Approach for Adversarial Robustnesscited by 180
  11. 2020Skip Connections Matter: On the Transferability of Adversarial Examples Generated with ResNetscited by 165
  12. 2021Admix: Enhancing the Transferability of Adversarial Attackscited by 155
  13. 2017Generative Adversarial Perturbationscited by 153
  14. 2019Cross-Domain Transferability of Adversarial Perturbationscited by 92
  15. 2020On Success and Simplicity: A Second Look at Transferable Targeted Attackscited by 89
  16. 2020Patch-wise Attack for Fooling Deep Neural Networkcited by 78
  17. 2021Adversarial Laser Beam: Effective Physical-World Attack to DNNs in a Blinkcited by 75
  18. 2017Adversarial Transformation Networks: Learning to Generate Adversarial Examplescited by 60
  19. 2020Perturbing Across the Feature Hierarchy to Improve Standard and Strict Blackbox Attack Transferabilitycited by 57
  20. 2017NAG: Network for Adversary Generationcited by 51
  21. 2019Enhancing Cross-task Black-Box Transferability of Adversarial Examples with Dispersion Reductioncited by 47
  22. 2020Grafit: Learning fine-grained image representations with coarse labelscited by 43
  23. 2019Curls & Whey: Boosting Black-Box Adversarial Attackscited by 37
  24. 2020Composite Adversarial Attackscited by 29
  25. 2021QAIR: Practical Query-efficient Black-Box Attacks for Image Retrievalcited by 22
  26. 2021Feature Space Targeted Attacks by Statistic Alignmentcited by 21
  27. 2020Patch-wise++ Perturbation for Adversarial Targeted Attackscited by 19

Built on by

Cited by year

Citing papers per year: 2022: 15; 2023: 11; 2024: 8; 2025: 8.

42 papers.

Sort:

By area:

  1. 2023Jailbreak in pieces: Compositional Adversarial Attacks on Multi-Modal Language Modelscited by 260
  2. 2022Frequency Domain Model Augmentation for Adversarial Attackcited by 128
  3. 2023Diffusion Models for Imperceptible and Transferable Adversarial Attackcited by 93
  4. 2023Structure Invariant Transformation for better Adversarial Transferabilitycited by 61
  5. 2022Practical Evaluation of Adversarial Robustness via Adaptive Auto Attackcited by 44
  6. 2022Natural Color Fool: Towards Boosting Black-box Unrestricted Attackscited by 38
  7. 2023Diversifying the High-level Features for better Adversarial Transferabilitycited by 34
  8. 2022Universal Adversarial Examples in Remote Sensing: Methodology and Benchmarkcited by 24
  9. 2022Pre-trained Adversarial Perturbationscited by 16
  10. 2022Strong Transferable Adversarial Attacks via Ensembled Asymptotically Normal Distribution Learningcited by 15
  11. 2022Towards Good Practices in Evaluating Transfer Adversarial Attackscited by 14
  12. 2022Minimizing Maximum Model Discrepancy for Transferable Black-box Targeted Attackscited by 14
30 more
  1. 2023Mutual-modality Adversarial Attack with Semantic Perturbationcited by 14
  2. 2022GAMA: Generative Adversarial Multi-Object Scene Attackscited by 13
  3. 2022Towards Lightweight Black-Box Attacks against Deep Neural Networkscited by 13
  4. 2023Less is More: Data Pruning for Faster Adversarial Trainingcited by 13
  5. 2024Prompt-Driven Contrastive Learning for Transferable Adversarial Attackscited by 9
  6. 2022Practical No-box Adversarial Attacks with Training-free Hybrid Image Transformationcited by 8
  7. 2024FACL-Attack: Frequency-Aware Contrastive Learning for Transferable Adversarial Attackscited by 8
  8. 2022Improving the Transferability of Adversarial Attacks on Face Recognition with Beneficial Perturbation Feature Augmentationcited by 7
  9. 2024Boosting the Transferability of Adversarial Examples via Local Mixup and Adaptive Step Sizecited by 7
  10. 2023SoK: Pitfalls in Evaluating Black-Box Attackscited by 6
  11. 2023Towards Evaluating Transfer-based Attacks Systematically, Practically, and Fairlycited by 6
  12. 2023Army of Thieves: Enhancing Black-Box Model Extraction via Ensemble based sample selectioncited by 6
  13. 2022Leveraging Local Patch Differences in Multi-Object Scenes for Generative Adversarial Attackscited by 5
  14. 2023Boosting Adversarial Transferability using Dynamic Cuescited by 5
  15. 2022Similarity of Neural Architectures using Adversarial Attack Transferabilitycited by 4
  16. 2025AIM: Additional Image Guided Generation of Transferable Adversarial Attackscited by 4
  17. 2025Boosting Generative Adversarial Transferability with Self-supervised Vision Transformer Featurescited by 3
  18. 2023MF-CLIP: Leveraging CLIP as Surrogate Models for No-box Adversarial Attackscited by 2
  19. 2024Adversarial Examples are Misaligned in Diffusion Model Manifoldscited by 1
  20. 2024Towards Assessing the Synthetic-to-Measured Adversarial Vulnerability of SAR ATRcited by 1
  21. 2024SoK: Analyzing Adversarial Examples: A Framework to Study Adversary Knowledgecited by 1
  22. 2024Downstream Transfer Attack: Adversarial Attacks on Downstream Models with Pre-trained Vision Transformerscited by 1
  23. 2024Learning to Learn Transferable Generative Attack for Person Re-Identificationcited by 1
  24. 2025NAT: Learning to Attack Neurons for Enhanced Adversarial Transferabilitycited by 1
  25. 2022AdvSmo: Black-box Adversarial Attack by Smoothing Linear Structure of Texturecited by 0
  26. 2025Prompt-driven Transferable Adversarial Attack on Person Re-Identification with Attribute-aware Textual Inversioncited by 0
  27. 2025Towards Cross-Domain Multi-Targeted Adversarial Attackscited by 0
  28. 2025Improving Black-Box Generative Attacks via Generator Semantic Consistencycited by 0
  29. 2025A Generative Adversarial Approach to Adversarial Attacks Guided by Contrastive Language-Image Pre-trained Modelcited by 0
  30. 2025On the Trade-Off Between Transparency and Security in Adversarial Machine Learningcited by 0