mlsanityData to 7 Oct 2026

Making Substitute Models More Bayesian Can Enhance Transferability of Adversarial Examples

arXiv 2302.05086 ↗First posted 10 Feb 2023cs.LG cs.CVcited by 32

Not on the map. Why?

Abstract (arXiv)

The transferability of adversarial examples across deep neural networks (DNNs) is the crux of many black-box attacks. Many prior efforts have been devoted to improving the transferability via increasing the diversity in inputs of some substitute models. In this paper, by contrast, we opt for the diversity in substitute models and advocate to attack a Bayesian model for achieving desirable transferability. Deriving from the Bayesian formulation, we develop a principled strategy for possible finetuning, which can be combined with many off-the-shelf Gaussian posterior approximations over DNN parameters. Extensive experiments have been conducted to verify the effectiveness of our method, on common benchmark datasets, and the results demonstrate that our method outperforms recent state-of-the-arts by large margins (roughly 19% absolute increase in average attack success rate on ImageNet), and, by combining with these recent methods, further performance gain can be obtained. Our code: https://github.com/qizhangli/MoreBayesian-attack.

Key facts. Cited by 32 papers in the map (data through 7 Oct 2026). Builds on 66 of its 75 references that are in the map. First posted on arXiv 10 Feb 2023.

Builds on

66 of 75 references.

References · 66

  1. 2015Deep Residual Learning for Image Recognitioncited by 51,809
  2. 2020An Image is Worth 16x16 Words: Transformers for Image Recognition at Scalecited by 29,915
  3. 2014Very Deep Convolutional Networks for Large-Scale Image Recognitioncited by 15,267
  4. 2021Swin Transformer: Hierarchical Vision Transformer using Shifted Windowscited by 12,082
  5. 2014ImageNet Large Scale Visual Recognition Challengecited by 8,441
  6. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  7. 2016Densely Connected Convolutional Networkscited by 6,691
  8. 2019EfficientNet: Rethinking Model Scaling for Convolutional Neural Networkscited by 6,415
  9. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  10. 2015Rethinking the Inception Architecture for Computer Visioncited by 5,451
  11. 2013Intriguing properties of neural networkscited by 5,114
  12. 2018MobileNetV2: Inverted Residuals and Linear Bottleneckscited by 4,773
38 more
  1. 2017Squeeze-and-Excitation Networkscited by 4,763
  2. 2016Overcoming catastrophic forgetting in neural networkscited by 4,718
  3. 2020Training data-efficient image transformers & distillation through attentioncited by 4,560
  4. 2015Dropout as a Bayesian Approximation: Representing Model Uncertainty in Deep Learningcited by 4,416
  5. 2016Simple and Scalable Predictive Uncertainty Estimation using Deep Ensemblescited by 3,888
  6. 2016Wide Residual Networkscited by 3,057
  7. 2016Towards Evaluating the Robustness of Neural Networkscited by 2,976
  8. 2016Aggregated Residual Transformations for Deep Neural Networkscited by 2,540
  9. 2021BEiT: BERT Pre-Training of Image Transformerscited by 2,360
  10. 2017What Uncertainties Do We Need in Bayesian Deep Learning for Computer Vision?cited by 2,335
  11. 2019Certified Adversarial Robustness via Randomized Smoothingcited by 1,324
  12. 2018Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examplescited by 1,259
  13. 2018Averaging Weights Leads to Wider Optima and Better Generalizationcited by 1,194
  14. 2018MnasNet: Platform-Aware Neural Architecture Search for Mobilecited by 937
  15. 2016Adversarial Machine Learning at Scalecited by 934
  16. 2020Fast is better than free: Revisiting adversarial trainingcited by 723
  17. 2018Improving Transferability of Adversarial Examples with Input Diversitycited by 591
  18. 2019A Simple Baseline for Bayesian Uncertainty in Deep Learningcited by 555
  19. 2016Delving into Transferable Adversarial Examples and Black-box Attackscited by 530
  20. 2015Variational Dropout and the Local Reparameterization Trickcited by 489
  21. 2017Progressive Neural Architecture Searchcited by 483
  22. 2020Bayesian Deep Learning and a Probabilistic Perspective of Generalizationcited by 480
  23. 2019Evading Defenses to Transferable Adversarial Examples by Translation-Invariant Attackscited by 440
  24. 2016Transferability in Machine Learning: from Phenomena to Black-Box Attacks using Adversarial Samplescited by 439
  25. 2019Nesterov Accelerated Gradient and Scale Invariance for Adversarial Attackscited by 352
  26. 2021What Are Bayesian Neural Network Posteriors Really Like?cited by 307
  27. 2017Stochastic Gradient Descent as Approximate Bayesian Inferencecited by 298
  28. 2019Adversarial Examples Improve Image Recognitioncited by 283
  29. 2019Searching for A Robust Neural Architecture in Four GPU Hourscited by 258
  30. 2017Concrete Dropoutcited by 227
  31. 2019Cyclical Stochastic Gradient MCMC for Bayesian Deep Learningcited by 203
  32. 2021Are Transformers More Robust Than CNNs?cited by 187
  33. 2020Efficient and Scalable Bayesian Neural Nets with Rank-1 Factorscited by 171
  34. 2016Deep Pyramidal Residual Networkscited by 163
  35. 2019Practical Deep Learning with Bayesian Principlescited by 158
  36. 2021Admix: Enhancing the Transferability of Adversarial Attackscited by 155
  37. 2019Enhancing Adversarial Example Transferability with an Intermediate Level Attackcited by 139
  38. 2018Fast and Scalable Bayesian Deep Learning by Weight-Perturbation in Adamcited by 131

50 most cited of 66 All 66 (JSON)

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2023: 11; 2024: 11; 2025: 5; 2026: 5.

32 papers.

Sort:

By area:

  1. 2023A Survey on Transferability of Adversarial Examples across Deep Neural Networkscited by 43
  2. 2023SA-Attack: Improving Adversarial Transferability of Vision-Language Pre-training Models via Self-Augmentationcited by 39
  3. 2023Why Does Little Robustness Help? A Further Step Towards Understanding Adversarial Transferabilitycited by 32
  4. 2023Improving Adversarial Transferability via Intermediate-level Perturbation Decaycited by 29
  5. 2024Transferable Adversarial Attacks on SAM and Its Downstream Modelscited by 20
  6. 2024Improved Generation of Adversarial Examples Against Safety-aligned LLMscited by 17
  7. 2024Mitigating the Curse of Dimensionality for Certified Robustness via Dual Randomized Smoothingcited by 15
  8. 2023Reliable Evaluation of Adversarial Transferabilitycited by 12
  9. 2023Improving Adversarial Transferability via Model Alignmentcited by 10
  10. 2023Improving the Transferability of Adversarial Examples via Direction Tuningcited by 9
  11. 2024Scaling Laws for Black box Adversarial Attackscited by 8
  12. 2024TASAR: Transfer-based Attack on Skeletal Action Recognitioncited by 7
20 more
  1. 2025Improving Adversarial Transferability on Vision Transformers via Forward Propagation Refinementcited by 7
  2. 2023Towards Evaluating Transfer-based Attacks Systematically, Practically, and Fairlycited by 6
  3. 2024Adversarial Example Soups: Improving Transferability and Stealthiness for Freecited by 6
  4. 2024Understanding Model Ensemble in Transferable Adversarial Attackcited by 6
  5. 2023LRS: Enhancing Adversarial Transferability through Lipschitz Regularized Surrogatecited by 5
  6. 2025Exploring Adversarial Transferability between Kolmogorov-arnold Networkscited by 4
  7. 2025Harnessing the Computation Redundancy in ViTs to Boost Adversarial Transferabilitycited by 4
  8. 2023Improving Transferability of Adversarial Examples via Bayesian Attackscited by 3
  9. 2023Towards Deep Learning Models Resistant to Transfer-based Adversarial Attacks via Data-centric Robust Learningcited by 2
  10. 2024Model Mimic Attack: Knowledge Distillation for Provably Transferable Adversarial Examplescited by 2
  11. 2024SoK: Analyzing Adversarial Examples: A Framework to Study Adversary Knowledgecited by 1
  12. 2025Enhancing Adversarial Transferability via Component-Wise Transformationcited by 1
  13. 2026Certified vs. Empirical Adversarial Robust-ness via Hybrid Convolutions with Attention Stochasticitycited by 1
  14. 2024Boosting Adversarial Transferability for Skeleton-based Action Recognition via Exploring the Model Posterior Spacecited by 0
  15. 2024Transferable 3D Adversarial Shape Completion using Diffusion Modelscited by 0
  16. 2025Seeking Flat Minima over Diverse Surrogates for Improved Adversarial Transferability: A Theoretical Framework and Algorithmic Instantiationcited by 0
  17. 2026Devling into Adversarial Transferability on Image Classification: Review, Benchmark, and Evaluationcited by 0
  18. 2026Contract And Conquer: How to Provably Compute Adversarial Examples for a Black-Box Model?cited by 0
  19. 2026Learning with Bilevel-Minimax Optimization for Efficient and Reliable Transfer Attackscited by 0
  20. 2026Anchoring Adversarial Trajectories to Data Manifolds: A Bilevel Transfer Optimization Frameworkcited by 0