mlsanityData to 7 Oct 2026

Investigating Top-k White-Box and Transferable Black-box Attack

arXiv 2204.00089 ↗First posted 30 Mar 2022cs.LG cs.AI cs.CRcited by 26

Not on the map. Why?

Abstract (arXiv)

Existing works have identified the limitation of top-1 attack success rate (ASR) as a metric to evaluate the attack strength but exclusively investigated it in the white-box setting, while our work extends it to a more practical black-box setting: transferable attack. It is widely reported that stronger I-FGSM transfers worse than simple FGSM, leading to a popular belief that transferability is at odds with the white-box attack strength. Our work challenges this belief with empirical finding that stronger attack actually transfers better for the general top-k ASR indicated by the interest class rank (ICR) after attack. For increasing the attack strength, with an intuitive interpretation of the logit gradient from the geometric perspective, we identify that the weakness of the commonly used losses lie in prioritizing the speed to fool the network instead of maximizing its strength. To this end, we propose a new normalized CE loss that guides the logit to be updated in the direction of implicitly maximizing its rank distance from the ground-truth class. Extensive results in various settings have verified that our proposed new loss is simple yet effective for top-k attack. Code is available at: urlhttps://bit.ly/3uCiomP

Key facts. Cited by 26 papers in the map (data through 7 Oct 2026). Builds on 44 of its 50 references that are in the map. First posted on arXiv 30 Mar 2022.

Builds on

44 of 50 references.

References · 44

  1. 2020An Image is Worth 16x16 Words: Transformers for Image Recognition at Scalecited by 29,915
  2. 2015Distilling the Knowledge in a Neural Networkcited by 10,076
  3. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  4. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  5. 2013Intriguing properties of neural networkscited by 5,114
  6. 2016Towards Evaluating the Robustness of Neural Networkscited by 2,976
  7. 2016Adversarial examples in the physical worldcited by 1,762
  8. 2021MLP-Mixer: An all-MLP Architecture for Visioncited by 1,441
  9. 2019Class-Balanced Loss Based on Effective Number of Samplescited by 1,239
  10. 2019Adversarial Examples Are Not Bugs, They Are Featurescited by 950
  11. 2016Adversarial Machine Learning at Scalecited by 934
  12. 2017Ensemble Adversarial Training: Attacks and Defensescited by 833
32 more
  1. 2016Universal adversarial perturbationscited by 774
  2. 2015Distillation as a Defense to Adversarial Perturbations against Deep Neural Networkscited by 675
  3. 2019Adversarial Training for Free!cited by 638
  4. 2018Improving Transferability of Adversarial Examples with Input Diversitycited by 591
  5. 2016Delving into Transferable Adversarial Examples and Black-box Attackscited by 530
  6. 2018Black-box Adversarial Attacks with Limited Queries and Informationcited by 499
  7. 2019Evading Defenses to Transferable Adversarial Examples by Translation-Invariant Attackscited by 440
  8. 2019On the Efficacy of Knowledge Distillationcited by 377
  9. 2020Skip Connections Matter: On the Transferability of Adversarial Examples Generated with ResNetscited by 165
  10. 2019Enhancing Adversarial Example Transferability with an Intermediate Level Attackcited by 139
  11. 2020On Success and Simplicity: A Second Look at Transferable Targeted Attackscited by 89
  12. 2020Backpropagating Linearly Improves Transferability of Adversarial Examplescited by 79
  13. 2020Adversarial Vertex Mixup: Toward Better Adversarially Robust Generalizationcited by 73
  14. 2020A Unified Approach to Interpreting and Boosting Adversarial Transferabilitycited by 71
  15. 2020Understanding Adversarial Examples from the Mutual Influence of Images and Perturbationscited by 59
  16. 2021A Survey On Universal Adversarial Attackcited by 59
  17. 2019Black-Box Adversarial Attack with Transferable Model-based Embeddingcited by 57
  18. 2020Perturbing Across the Feature Hierarchy to Improve Standard and Strict Blackbox Attack Transferabilitycited by 57
  19. 2021Adversarial Robustness Comparison of Vision Transformer and MLP-Mixer to CNNscited by 57
  20. 2019FDA: Feature Disruptive Attackcited by 55
  21. 2020Transferable Perturbations of Deep Feature Distributionscited by 51
  22. 2018Bilateral Adversarial Training: Towards Fast Training of More Robust Models Against Adversarial Attackscited by 48
  23. 2019An Alternative Surrogate Loss for PGD-based Adversarial Testingcited by 45
  24. 2020Yet Another Intermediate-Level Attackcited by 35
  25. 2020Batch Normalization Increases Adversarial Vulnerability and Decreases Adversarial Transferability: A Non-Robust Feature Perspectivecited by 35
  26. 2018Defending Against Universal Perturbations With Shared Adversarial Trainingcited by 25
  27. 2020Double Targeted Universal Adversarial Perturbationscited by 23
  28. 2019Regional Homogeneity: Towards Learning Transferable Universal Adversarial Perturbations Against Defensescited by 22
  29. 2021Universal Adversarial Perturbations Through the Lens of Deep Steganography: Towards A Fourier Perspectivecited by 18
  30. 2020Transferable Universal Adversarial Perturbations Using Generative Modelscited by 10
  31. 2020Decision-based Universal Adversarial Attackcited by 6
  32. 2020Adversarial Fooling Beyond "Flipping the Label"cited by 5

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2022: 2; 2023: 13; 2024: 6; 2025: 2; 2026: 3.

26 papers.

Sort:

By area:

  1. 2023A Survey on Transferability of Adversarial Examples across Deep Neural Networkscited by 43
  2. 2023SA-Attack: Improving Adversarial Transferability of Vision-Language Pre-training Models via Self-Augmentationcited by 39
  3. 2023Evaluating the Robustness of Text-to-image Diffusion Models against Real-world Attackscited by 24
  4. 2022Towards Good Practices in Evaluating Transfer Adversarial Attackscited by 14
  5. 2023Black-box Targeted Adversarial Attack on Segment Anything (SAM)cited by 13
  6. 2023Reliable Evaluation of Adversarial Transferabilitycited by 12
  7. 2023Improving Adversarial Transferability via Model Alignmentcited by 10
  8. 2023TranSegPGD: Improving Transferability of Adversarial Examples on Semantic Segmentationcited by 10
  9. 2024Practical Region-level Attack against Segment Anything Modelscited by 9
  10. 2026Universal Image Immunization against Diffusion-based Image Editing via Semantic Injectioncited by 7
  11. 2023Patch of Invisibility: Naturalistic Physical Black-Box Adversarial Attacks on Object Detectorscited by 5
  12. 2023Class-Conditioned Transformation for Enhanced Robust Image Classificationcited by 5
14 more
  1. 2023Attack-SAM: Towards Attacking Segment Anything Model With Adversarial Examplescited by 5
  2. 2023A Comprehensive Study on the Robustness of Image Classification and Object Detection in Remote Sensing: Surveying and Benchmarkingcited by 5
  3. 2024Benchmarking Transferable Adversarial Attackscited by 5
  4. 2025Exploring Adversarial Transferability between Kolmogorov-arnold Networkscited by 4
  5. 2024Investigating Deep Watermark Security: An Adversarial Transferability Perspectivecited by 3
  6. 2024Perturbation Towards Easy Samples Improves Targeted Adversarial Transferabilitycited by 2
  7. 2024Transferable Adversarial Attacks against ASRcited by 2
  8. 2023Fuzziness-tuned: Improving the Transferability of Adversarial Examplescited by 1
  9. 2022Gradient Aligned Attacks via a Few Queriescited by 0
  10. 2023QuadAttack: A Quadratic Programming Approach to Ordered Top-K Attackscited by 0
  11. 2024Looking From the Future: Multi-order Iterations Can Enhance Adversarial Attack Transferabilitycited by 0
  12. 2025Scalable and Precise Patch Robustness Certification for Deep Learning Models with Top-k Predictionscited by 0
  13. 2026MORE: Multi-Objective Adversarial Attacks on Speech Recognitioncited by 0
  14. 2026GENADA: efficient generative time series adversarial attack frameworkcited by 0