mlsanityData to 7 Oct 2026

Towards Understanding and Boosting Adversarial Transferability from a Distribution Perspective

arXiv 2210.04213 ↗First posted 9 Oct 2022cs.CVcited by 36

Not on the map. Why?

Abstract (arXiv)

Transferable adversarial attacks against Deep neural networks (DNNs) have received broad attention in recent years. An adversarial example can be crafted by a surrogate model and then attack the unknown target model successfully, which brings a severe threat to DNNs. The exact underlying reasons for the transferability are still not completely understood. Previous work mostly explores the causes from the model perspective, e.g., decision boundary, model architecture, and model capacity. adversarial attacks against Deep neural networks (DNNs) have received broad attention in recent years. An adversarial example can be crafted by a surrogate model and then attack the unknown target model successfully, which brings a severe threat to DNNs. The exact underlying reasons for the transferability are still not completely understood. Previous work mostly explores the causes from the model perspective. Here, we investigate the transferability from the data distribution perspective and hypothesize that pushing the image away from its original distribution can enhance the adversarial transferability. To be specific, moving the image out of its original distribution makes different models hardly classify the image correctly, which benefits the untargeted attack, and dragging the image into the target distribution misleads the models to classify the image as the target class, which benefits the targeted attack. Towards this end, we propose a novel method that crafts adversarial examples by manipulating the distribution of the image. We conduct comprehensive transferable attacks against multiple DNNs to demonstrate the effectiveness of the proposed method. Our method can significantly improve the transferability of the crafted attacks and achieves state-of-the-art performance in both untargeted and targeted scenarios, surpassing the previous best method by up to 40% in some cases.

Key facts. Cited by 36 papers in the map (data through 7 Oct 2026). Builds on 61 of its 83 references that are in the map. First posted on arXiv 9 Oct 2022.

Builds on

61 of 83 references.

References · 61

  1. 2015Deep Residual Learning for Image Recognitioncited by 51,809
  2. 2020An Image is Worth 16x16 Words: Transformers for Image Recognition at Scalecited by 29,915
  3. 2019PyTorch: An Imperative Style, High-Performance Deep Learning Librarycited by 20,160
  4. 2014Very Deep Convolutional Networks for Large-Scale Image Recognitioncited by 15,267
  5. 2014ImageNet Large Scale Visual Recognition Challengecited by 8,441
  6. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  7. 2016Densely Connected Convolutional Networkscited by 6,691
  8. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  9. 2015Rethinking the Inception Architecture for Computer Visioncited by 5,451
  10. 2013Intriguing properties of neural networkscited by 5,114
  11. 2017Squeeze-and-Excitation Networkscited by 4,763
  12. 2019Generative Modeling by Estimating Gradients of the Data Distributioncited by 4,067
38 more
  1. 2016Wide Residual Networkscited by 3,057
  2. 2016Towards Evaluating the Robustness of Neural Networkscited by 2,976
  3. 2016Adversarial examples in the physical worldcited by 1,762
  4. 2016Inception-v4, Inception-ResNet and the Impact of Residual Connections on Learningcited by 1,509
  5. 2019Do ImageNet Classifiers Generalize to ImageNet?cited by 1,507
  6. 2018ImageNet-trained CNNs are biased towards texture; increasing shape bias improves accuracy and robustnesscited by 1,430
  7. 2015DeepFool: a simple and accurate method to fool deep neural networkscited by 1,315
  8. 2020Energy-based Out-of-distribution Detectioncited by 1,296
  9. 2018ShuffleNet V2: Practical Guidelines for Efficient CNN Architecture Designcited by 1,132
  10. 2016SqueezeNet: AlexNet-level accuracy with 50x fewer parameters and <0.5MB model sizecited by 1,054
  11. 2016Practical Black-Box Attacks against Machine Learningcited by 893
  12. 2018Improving Transferability of Adversarial Examples with Input Diversitycited by 591
  13. 2017One pixel attack for fooling deep neural networkscited by 579
  14. 2018Do Better ImageNet Models Transfer Better?cited by 560
  15. 2016Delving into Transferable Adversarial Examples and Black-box Attackscited by 530
  16. 2018Black-box Adversarial Attacks with Limited Queries and Informationcited by 499
  17. 2017Decision-Based Adversarial Attacks: Reliable Attacks Against Black-Box Machine Learning Modelscited by 459
  18. 2019Evading Defenses to Transferable Adversarial Examples by Translation-Invariant Attackscited by 440
  19. 2019Sliced Score Matching: A Scalable Approach to Density and Score Estimationcited by 381
  20. 2019Nesterov Accelerated Gradient and Scale Invariance for Adversarial Attackscited by 352
  21. 2021On the Importance of Gradients for Detecting Distributional Shifts in the Wildcited by 338
  22. 2020Do Adversarially Robust ImageNet Models Transfer Better?cited by 315
  23. 2019Fast AutoAugmentcited by 243
  24. 2019Efficient Decision-based Black-box Adversarial Attacks on Face Recognitioncited by 173
  25. 2020Skip Connections Matter: On the Transferability of Adversarial Examples Generated with ResNetscited by 165
  26. 2019AdvHat: Real-world adversarial attack on ArcFace Face ID systemcited by 161
  27. 2021Admix: Enhancing the Transferability of Adversarial Attackscited by 155
  28. 2017Generative Adversarial Perturbationscited by 153
  29. 2019Understanding Adversarial Attacks on Deep Learning Based Medical Image Analysis Systemscited by 151
  30. 2019Enhancing Adversarial Example Transferability with an Intermediate Level Attackcited by 139
  31. 2018Is Robustness the Cost of Accuracy? -- A Comprehensive Study on the Robustness of 18 Deep Image Classification Modelscited by 135
  32. 2021On Calibration and Out-of-domain Generalizationcited by 134
  33. 2019Cross-Domain Transferability of Adversarial Perturbationscited by 92
  34. 2020On Success and Simplicity: A Second Look at Transferable Targeted Attackscited by 89
  35. 2020Towards Transferable Adversarial Attack against Deep Face Recognitioncited by 79
  36. 2020Backpropagating Linearly Improves Transferability of Adversarial Examplescited by 79
  37. 2020A Unified Approach to Interpreting and Boosting Adversarial Transferabilitycited by 71
  38. 2021On Generating Transferable Targeted Perturbationscited by 65

50 most cited of 61 All 61 (JSON)

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2023: 17; 2024: 7; 2025: 9; 2026: 3.

36 papers.

Sort:

By area:

  1. 2023Content-based Unrestricted Adversarial Attackcited by 73
  2. 2023SA-Attack: Improving Adversarial Transferability of Vision-Language Pre-training Models via Self-Augmentationcited by 39
  3. 2023Why Does Little Robustness Help? A Further Step Towards Understanding Adversarial Transferabilitycited by 32
  4. 2023ImageNet-E: Benchmarking Neural Network Robustness via Attribute Editingcited by 30
  5. 2023Attacks in Adversarial Machine Learning: A Systematic Survey from the Life-cycle Perspectivecited by 19
  6. 2023Exploring Transferability of Multimodal Adversarial Samples for Vision-Language Pre-training Models with Contrastive Learningcited by 16
  7. 2024ASAM: Boosting Segment Anything Model with Adversarial Tuningcited by 12
  8. 2023TranSegPGD: Improving Transferability of Adversarial Examples on Semantic Segmentationcited by 10
  9. 2023Fast Propagation is Better: Accelerating Single-Step Adversarial Training via Sampling Subnetworkscited by 8
  10. 2025Improving Adversarial Transferability on Vision Transformers via Forward Propagation Refinementcited by 7
  11. 2023Evaluating Similitude and Robustness of Deep Image Denoising Models via Adversarial Attackcited by 6
  12. 2023Towards Evaluating Transfer-based Attacks Systematically, Practically, and Fairlycited by 6
24 more
  1. 2024Category-Extensible Out-of-Distribution Detection via Hierarchical Context Descriptionscited by 6
  2. 2023Transferability Bound Theory: Exploring Relationship between Adversarial Transferability and Flatnesscited by 5
  3. 2024AdvLogo: Adversarial Patch Attack against Object Detectors based on Diffusion Modelscited by 5
  4. 2023Improving Transferability of Adversarial Examples via Bayesian Attackscited by 3
  5. 2024Attacking Transformers with Feature Diversity Adversarial Perturbationcited by 3
  6. 2023Towards Deep Learning Models Resistant to Transfer-based Adversarial Attacks via Data-centric Robust Learningcited by 2
  7. 2025Multi-Target Federated Backdoor Attack Based on Feature Aggregationcited by 2
  8. 2025Concept-based Adversarial Attack: a Probabilistic Perspectivecited by 2
  9. 2023Towards the Transferable Audio Adversarial Attack via Ensemble Methodscited by 1
  10. 2023Latent Code Augmentation Based on Stable Diffusion for Data-free Substitute Attackscited by 1
  11. 2024Towards Assessing the Synthetic-to-Measured Adversarial Vulnerability of SAR ATRcited by 1
  12. 2024Learning to Learn Transferable Generative Attack for Person Re-Identificationcited by 1
  13. 2024S4ST: A Strong, Self-transferable, faSt, and Simple Scale Transformation for Transferable Targeted Attackcited by 1
  14. 2025Use as Many Surrogates as You Want: Selective Ensemble Attack to Unleash Transferability without Sacrificing Resource Efficiencycited by 1
  15. 2023Interpretable Spectrum Transformation Attacks to Speaker Recognitioncited by 0
  16. 2023Towards Generic and Controllable Attacks Against Object Detectioncited by 0
  17. 2025With Great Backbones Comes Great Adversarial Transferabilitycited by 0
  18. 2025A Knowledge-guided Adversarial Defense for Resisting Malicious Visual Manipulationcited by 0
  19. 2025Seeking Flat Minima over Diverse Surrogates for Improved Adversarial Transferability: A Theoretical Framework and Algorithmic Instantiationcited by 0
  20. 2025DP-TRAE: A Dual-Phase Merging Transferable Reversible Adversarial Example for Image Privacy Protectioncited by 0
  21. 2025A Unified Framework for Stealthy Adversarial Generation via Latent Optimization and Transferability Enhancementcited by 0
  22. 2026Devling into Adversarial Transferability on Image Classification: Review, Benchmark, and Evaluationcited by 0
  23. 2026Towards Highly Transferable Vision-Language Attack via Semantic-Augmented Dynamic Contrastive Interactioncited by 0
  24. 2026Learning with Bilevel-Minimax Optimization for Efficient and Reliable Transfer Attackscited by 0