mlsanityData to 7 Oct 2026

Adversarial Pixel Restoration as a Pretext Task for Transferable Perturbations

arXiv 2207.08803 ↗First posted 18 Jul 2022cs.CVcited by 6

Not on the map. Why?

Abstract (arXiv)

Transferable adversarial attacks optimize adversaries from a pretrained surrogate model and known label space to fool the unknown black-box models. Therefore, these attacks are restricted by the availability of an effective surrogate model. In this work, we relax this assumption and propose Adversarial Pixel Restoration as a self-supervised alternative to train an effective surrogate model from scratch under the condition of no labels and few data samples. Our training approach is based on a min-max scheme which reduces overfitting via an adversarial objective and thus optimizes for a more generalizable surrogate model. Our proposed attack is complimentary to the adversarial pixel restoration and is independent of any task specific objective as it can be launched in a self-supervised manner. We successfully demonstrate the adversarial transferability of our approach to Vision Transformers as well as Convolutional Neural Networks for the tasks of classification, object detection, and video segmentation. Our training approach improves the transferability of the baseline unsupervised training method by 16.4% on ImageNet val. set. Our codes & pre-trained surrogate models are available at: https://github.com/HashmatShadab/APR

Key facts. Cited by 6 papers in the map (data through 7 Oct 2026). Builds on 51 of its 58 references that are in the map. First posted on arXiv 18 Jul 2022.

Builds on

51 of 58 references.

References · 51

  1. 2015Deep Residual Learning for Image Recognitioncited by 51,809
  2. 2014Adam: A Method for Stochastic Optimizationcited by 36,960
  3. 2020An Image is Worth 16x16 Words: Transformers for Image Recognition at Scalecited by 29,915
  4. 2014Microsoft COCO: Common Objects in Contextcited by 17,498
  5. 2014Very Deep Convolutional Networks for Large-Scale Image Recognitioncited by 15,267
  6. 2020End-to-End Object Detection with Transformerscited by 7,384
  7. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  8. 2021Emerging Properties in Self-Supervised Vision Transformerscited by 6,893
  9. 2016Densely Connected Convolutional Networkscited by 6,691
  10. 2016Grad-CAM: Visual Explanations from Deep Networks via Gradient-based Localizationcited by 6,690
  11. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  12. 2015Rethinking the Inception Architecture for Computer Visioncited by 5,451
38 more
  1. 2013Intriguing properties of neural networkscited by 5,114
  2. 2018MobileNetV2: Inverted Residuals and Linear Bottleneckscited by 4,773
  3. 2017Squeeze-and-Excitation Networkscited by 4,763
  4. 2020Training data-efficient image transformers & distillation through attentioncited by 4,560
  5. 2016Wide Residual Networkscited by 3,057
  6. 2017Prototypical Networks for Few-shot Learningcited by 3,001
  7. 2016Towards Evaluating the Robustness of Neural Networkscited by 2,976
  8. 2016Adversarial examples in the physical worldcited by 1,762
  9. 2018Unsupervised Representation Learning by Predicting Image Rotationscited by 1,586
  10. 2016Unsupervised Learning of Visual Representations by Solving Jigsaw Puzzlescited by 1,379
  11. 2015DeepFool: a simple and accurate method to fool deep neural networkscited by 1,315
  12. 2018Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examplescited by 1,259
  13. 2017Visualizing the Loss Landscape of Neural Netscited by 1,126
  14. 2017The 2017 DAVIS Challenge on Video Object Segmentationcited by 942
  15. 2016Adversarial Machine Learning at Scalecited by 934
  16. 2016Practical Black-Box Attacks against Machine Learningcited by 893
  17. 2017Ensemble Adversarial Training: Attacks and Defensescited by 833
  18. 2015The Limitations of Deep Learning in Adversarial Settingscited by 784
  19. 2017ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Modelscited by 656
  20. 2018Improving Transferability of Adversarial Examples with Input Diversitycited by 591
  21. 2017Decision-Based Adversarial Attacks: Reliable Attacks Against Black-Box Machine Learning Modelscited by 459
  22. 2021Intriguing Properties of Vision Transformerscited by 446
  23. 2016Transferability in Machine Learning: from Phenomena to Black-Box Attacks using Adversarial Samplescited by 439
  24. 2019Unlabeled Data Improves Adversarial Robustnesscited by 415
  25. 2020Do Adversarially Robust ImageNet Models Transfer Better?cited by 315
  26. 2020A Self-supervised Approach for Adversarial Robustnesscited by 180
  27. 2021Admix: Enhancing the Transferability of Adversarial Attackscited by 155
  28. 2017Generative Adversarial Perturbationscited by 153
  29. 2019Enhancing Adversarial Example Transferability with an Intermediate Level Attackcited by 139
  30. 2019Cross-Domain Transferability of Adversarial Perturbationscited by 92
  31. 2021On Improving Adversarial Transferability of Vision Transformerscited by 70
  32. 2021On Generating Transferable Targeted Perturbationscited by 65
  33. 2020DaST: Data-free Substitute Training for Adversarial Attackscited by 60
  34. 2020Perturbing Across the Feature Hierarchy to Improve Standard and Strict Blackbox Attack Transferabilitycited by 57
  35. 2021A Little Robustness Goes a Long Way: Leveraging Robust Features for Targeted Transfer Attackscited by 33
  36. 2020Practical No-box Adversarial Attacks against DNNscited by 32
  37. 2017Boosting Adversarial Attacks with Momentumcited by 23
  38. 2020Patch-wise++ Perturbation for Adversarial Targeted Attackscited by 19

50 most cited of 51 All 51 (JSON)

Built on by

Cited by year

Citing papers per year: 2023: 3; 2024: 2; 2025: 1.

6 papers.

  1. 2024As Firm As Their Foundations: Can open-sourced foundation models be used to create adversarial examples for downstream tasks?cited by 11
  2. 2023Boosting Adversarial Transferability using Dynamic Cuescited by 5
  3. 2023Neural Network Training Strategy to Enhance Anomaly Detection Performance: A Perspective on Reconstruction Loss Amplificationcited by 4
  4. 2024On Evaluating Adversarial Robustness of Volumetric Medical Segmentation Modelscited by 2
  5. 2023SEDA: Self-Ensembling ViT with Defensive Distillation and Adversarial Training for robust Chest X-rays Classificationcited by 0
  6. 2025Hierarchical Self-Supervised Adversarial Training for Robust Vision Models in Histopathologycited by 0