mlsanityData to 7 Oct 2026

Adversarial Reprogramming Revisited

arXiv 2206.03466 ↗First posted 7 Jun 2022cs.LGcited by 10

Not on the map. Why?

Abstract (arXiv)

Adversarial reprogramming, introduced by Elsayed, Goodfellow, and Sohl-Dickstein, seeks to repurpose a neural network to perform a different task, by manipulating its input without modifying its weights. We prove that two-layer ReLU neural networks with random weights can be adversarially reprogrammed to achieve arbitrarily high accuracy on Bernoulli data models over hypercube vertices, provided the network width is no greater than its input dimension. We also substantially strengthen a recent result of Phuong and Lampert on directional convergence of gradient flow, and obtain as a corollary that training two-layer ReLU neural networks on orthogonally separable datasets can cause their adversarial reprogramming to fail. We support these theoretical results by experiments that demonstrate that, as long as batch normalisation layers are suitably initialised, even untrained networks with random weights are susceptible to adversarial reprogramming. This is in contrast to observations in several recent works that suggested that adversarial reprogramming is not possible for untrained networks to any degree of reliability.

Key facts. Cited by 10 papers in the map (data through 7 Oct 2026). Builds on 38 of its 61 references that are in the map. First posted on arXiv 7 Jun 2022.

Builds on

38 of 61 references.

References · 38

  1. 2015Deep Residual Learning for Image Recognitioncited by 51,809
  2. 2014Adam: A Method for Stochastic Optimizationcited by 36,960
  3. 2020An Image is Worth 16x16 Words: Transformers for Image Recognition at Scalecited by 29,915
  4. 2014ImageNet Large Scale Visual Recognition Challengecited by 8,441
  5. 2015Batch Normalization: Accelerating Deep Network Training by Reducing Internal Covariate Shiftcited by 6,979
  6. 2019EfficientNet: Rethinking Model Scaling for Convolutional Neural Networkscited by 6,415
  7. 2015Rethinking the Inception Architecture for Computer Visioncited by 5,451
  8. 2013Intriguing properties of neural networkscited by 5,114
  9. 2017Fashion-MNIST: a Novel Image Dataset for Benchmarking Machine Learning Algorithmscited by 4,283
  10. 2015Delving Deep into Rectifiers: Surpassing Human-Level Performance on ImageNet Classificationcited by 3,590
  11. 2016Identity Mappings in Deep Residual Networkscited by 1,960
  12. 2016Understanding deep learning requires rethinking generalizationcited by 1,657
26 more
  1. 2019Adversarial Examples Are Not Bugs, They Are Featurescited by 950
  2. 2016Universal adversarial perturbationscited by 774
  3. 2017Evasion Attacks against Machine Learning at Test Timecited by 686
  4. 2017The Implicit Bias of Gradient Descent on Separable Datacited by 649
  5. 2017Deep Neural Networks as Gaussian Processescited by 617
  6. 2017Adversarial Patchcited by 514
  7. 2018Deep Learning for Classical Japanese Literaturecited by 415
  8. 2018Adversarially Robust Generalization Requires More Datacited by 318
  9. 2019Gradient Descent Maximizes the Margin of Homogeneous Neural Networkscited by 308
  10. 2021WARP: Word-level Adversarial ReProgrammingcited by 220
  11. 2020Directional convergence and alignment in deep learningcited by 172
  12. 2018Stochastic subgradient method converges on tame functionscited by 120
  13. 2018Adversarial Reprogramming of Neural Networkscited by 115
  14. 2021Voice2Series: Reprogramming Acoustic Models for Time Series Classificationcited by 91
  15. 2020Transfer Learning without Knowing: Reprogramming Black-box Machine Learning Models with Scarce Data and Limited Resourcescited by 83
  16. 2021Gradient Descent on Two-layer Nets: Margin Maximization and Simplicity Biascited by 82
  17. 2021The Dimpled Manifold Model of Adversarial Examples in Machine Learningcited by 41
  18. 2021Cross-modal Adversarial Reprogrammingcited by 34
  19. 2022Gradient Methods Provably Converge to Non-Robust Networkscited by 27
  20. 2021A single gradient step finds adversarial examples on random two-layers neural networkscited by 26
  21. 2021Adversarial Examples in Multi-Layer Random ReLU Networkscited by 26
  22. 2016A Powerful Generative Model Using Random Weights for the Deep Image Representationcited by 14
  23. 2020Reprogramming Language Models for Molecular Representation Learningcited by 13
  24. 2021Why Adversarial Reprogramming Works, When It Fails, and How to Tell the Differencecited by 13
  25. 2022Adversarial Examples in Random Neural Networks with General Activationscited by 13
  26. 2021The Convex Geometry of Backpropagation: Neural Network Gradient Flows Converge to Extreme Points of the Dual Convex Programcited by 11

Built on by

Cited by year

Citing papers per year: 2023: 3; 2024: 3; 2025: 4.

10 papers.

  1. 2023The Expressive Power of Low-Rank Adaptationcited by 100
  2. 2023Deep Graph Reprogrammingcited by 22
  3. 2023Learning a Neuron by a Shallow ReLU Network: Dynamics and Implicit Bias for Correlated Inputscited by 16
  4. 2024Simplicity Bias of Two-Layer Networks beyond Linearly Separable Datacited by 11
  5. 2025Neural Network Reprogrammability: A Unified Theme on Model Reprogramming, Prompt Tuning, and Prompt Instructioncited by 3
  6. 2025Model Reprogramming Demystified: A Neural Tangent Kernel Perspectivecited by 2
  7. 2025Lifting Manifolds to Mitigate Pseudo-Alignment in LLM4TScited by 2
  8. 2024Memorization Capacity for Additive Fine-Tuning with Small ReLU Networkscited by 0
  9. 2024Model Hijacking Attack in Federated Learningcited by 0
  10. 2025Efficient Morphology-Aware Policy Transfer to New Embodimentscited by 0