mlsanityData to 14 Oct 2026

Diversifying the High-level Features for better Adversarial Transferability

arXiv 2304.10136 ↗First posted 20 Apr 2023cs.CVcited by 34

Not on the map. Why?

Abstract (arXiv)

Given the great threat of adversarial attacks against Deep Neural Networks (DNNs), numerous works have been proposed to boost transferability to attack real-world applications. However, existing attacks often utilize advanced gradient calculation or input transformation but ignore the white-box model. Inspired by the fact that DNNs are over-parameterized for superior performance, we propose diversifying the high-level features (DHF) for more transferable adversarial examples. In particular, DHF perturbs the high-level features by randomly transforming the high-level features and mixing them with the feature of benign samples when calculating the gradient at each iteration. Due to the redundancy of parameters, such transformation does not affect the classification performance but helps identify the invariant features across different models, leading to much better transferability. Empirical evaluations on ImageNet dataset show that DHF could effectively improve the transferability of existing momentum-based attacks. Incorporated into the input transformation-based attacks, DHF generates more transferable adversarial examples and outperforms the baselines with a clear margin when attacking several defense models, showing its generalization to various attacks and high effectiveness for boosting transferability. Code is available at https://github.com/Trustworthy-AI-Group/DHF.

Key facts. Cited by 34 papers in the map (data through 14 Oct 2026). Builds on 59 of its 76 references that are in the map. First posted on arXiv 20 Apr 2023.

Builds on

59 of 76 references.

References · 59

  1. 2015Deep Residual Learning for Image Recognitioncited by 52,096
  2. 2020An Image is Worth 16x16 Words: Transformers for Image Recognition at Scalecited by 30,186
  3. 2015U-Net: Convolutional Networks for Biomedical Image Segmentationcited by 19,713
  4. 2014Very Deep Convolutional Networks for Large-Scale Image Recognitioncited by 15,364
  5. 2021Swin Transformer: Hierarchical Vision Transformer using Shifted Windowscited by 12,139
  6. 2014Explaining and Harnessing Adversarial Examplescited by 7,364
  7. 2016Densely Connected Convolutional Networkscited by 6,720
  8. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,415
  9. 2015Rethinking the Inception Architecture for Computer Visioncited by 5,475
  10. 2013Intriguing properties of neural networkscited by 5,155
  11. 2017MobileNets: Efficient Convolutional Neural Networks for Mobile Vision Applicationscited by 3,845
  12. 2016Adversarial examples in the physical worldcited by 1,769
38 more
  1. 2016Inception-v4, Inception-ResNet and the Impact of Residual Connections on Learningcited by 1,512
  2. 2019Certified Adversarial Robustness via Randomized Smoothingcited by 1,340
  3. 2017Ensemble Adversarial Training: Attacks and Defensescited by 840
  4. 2019Deep Double Descent: Where Bigger Models and More Data Hurtcited by 672
  5. 2017ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Modelscited by 666
  6. 2018Improving Transferability of Adversarial Examples with Input Diversitycited by 599
  7. 2016Delving into Transferable Adversarial Examples and Black-box Attackscited by 536
  8. 2017Countering Adversarial Images using Input Transformationscited by 520
  9. 2018Black-box Adversarial Attacks with Limited Queries and Informationcited by 501
  10. 2017Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networkscited by 486
  11. 2017Decision-Based Adversarial Attacks: Reliable Attacks Against Black-Box Machine Learning Modelscited by 462
  12. 2019Evading Defenses to Transferable Adversarial Examples by Translation-Invariant Attackscited by 442
  13. 2019HAWQ: Hessian AWare Quantization of Neural Networks with Mixed-Precisioncited by 402
  14. 2017Mitigating Adversarial Effects Through Randomizationcited by 383
  15. 2019Nesterov Accelerated Gradient and Scale Invariance for Adversarial Attackscited by 355
  16. 2017Defense against Adversarial Attacks Using High-Level Representation Guided Denoisercited by 329
  17. 2018Feature Denoising for Improving Adversarial Robustnesscited by 314
  18. 2018Certified Defenses against Adversarial Examplescited by 306
  19. 2020ZeroQ: A Novel Zero Shot Quantization Frameworkcited by 269
  20. 2019HAWQ-V2: Hessian Aware trace-Weighted Quantization of Neural Networkscited by 261
  21. 2018Generating Adversarial Examples with Adversarial Networkscited by 258
  22. 2021Enhancing the Transferability of Adversarial Attacks through Variance Tuningcited by 244
  23. 2016Wider or Deeper: Revisiting the ResNet Model for Visual Recognitioncited by 184
  24. 2017Computer Vision for Autonomous Vehicles: Problems, Datasets and State of the Artcited by 182
  25. 2020A Self-supervised Approach for Adversarial Robustnesscited by 180
  26. 2020Skip Connections Matter: On the Transferability of Adversarial Examples Generated with ResNetscited by 167
  27. 2021Admix: Enhancing the Transferability of Adversarial Attackscited by 156
  28. 2018Scalable Methods for 8-bit Training of Neural Networkscited by 142
  29. 2019Enhancing Adversarial Example Transferability with an Intermediate Level Attackcited by 140
  30. 2022Frequency Domain Model Augmentation for Adversarial Attackcited by 130
  31. 2021Feature Importance-aware Transferable Adversarial Attackscited by 127
  32. 2018Transferable Adversarial Attacks for Image and Video Object Detectioncited by 109
  33. 2020QEBA: Query-Efficient Boundary-Based Blackbox Attackcited by 104
  34. 2018Feature Distillation: DNN-Oriented JPEG Compression Against Adversarial Examplescited by 99
  35. 2017Deep MANTA: A Coarse-to-fine Many-Task Network for joint 2D and 3D vehicle analysis from monocular imagecited by 95
  36. 2019NATTACK: Learning the Distributions of Adversarial Examples for an Improved Black-Box Attack on Deep Neural Networkscited by 94
  37. 2022Improving Adversarial Transferability via Neuron Attribution-Based Attackscited by 93
  38. 2018Learning Transferable Adversarial Examples via Ghost Networkscited by 70

50 most cited of 59 All 59 (JSON)

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2023: 3; 2024: 13; 2025: 10; 2026: 8.

34 papers.

Sort:

By area:

  1. 2024Jailbreak Vision Language Models via Bi-Modal Adversarial Promptcited by 109
  2. 2023Boosting Adversarial Transferability by Block Shuffle and Rotationcited by 64
  3. 2023Boosting Adversarial Transferability by Achieving Flat Local Maximacited by 48
  4. 2024Visual Adversarial Attack on Vision-Language Models for Autonomous Drivingcited by 36
  5. 2024Unlearning Backdoor Threats: Enhancing Backdoor Defense in Multimodal Contrastive Learning via Local Token Unlearningcited by 31
  6. 2024Compromising Embodied Agents with Contextual Backdoor Attackscited by 31
  7. 2024Effectiveness Assessment of Recent Large Vision-Language Modelscited by 29
  8. 2023Rethinking the Backward Propagation for Adversarial Transferabilitycited by 27
  9. 2025Black-Box Adversarial Attack on Vision Language Models for Autonomous Drivingcited by 24
  10. 2024LanEvil: Benchmarking the Robustness of Lane Detection to Environmental Illusionscited by 18
  11. 2024Object Detectors in the Open Environment: Challenges, Solutions, and Outlookcited by 13
  12. 2026When World Models Dream Wrong: Physical-Conditioned Adversarial Attacks against World Modelscited by 13
22 more
  1. 2024Understanding Model Ensemble in Transferable Adversarial Attackcited by 7
  2. 2025Improving Adversarial Transferability on Vision Transformers via Forward Propagation Refinementcited by 7
  3. 2026WMAttack: Automated Attack Search for Adversarial Evaluation of World-Model Agentscited by 7
  4. 2024Efficient Backdoor Defense in Multimodal Contrastive Learning: A Token-Level Unlearning Method for Mitigating Threatscited by 6
  5. 2025Lie Detector: Unified Backdoor Detection via Cross-Examination Frameworkcited by 6
  6. 2024TrapFlow: Controllable Website Fingerprinting Defense via Dynamic Backdoor Learningcited by 5
  7. 2024Towards Robust Object Detection: Identifying and Removing Backdoors via Module Inconsistency Analysiscited by 4
  8. 2025Exploring Adversarial Transferability between Kolmogorov-arnold Networkscited by 4
  9. 2025Harnessing the Computation Redundancy in ViTs to Boost Adversarial Transferabilitycited by 4
  10. 2024Forward Learning for Gradient-based Black-box Saliency Map Generationcited by 2
  11. 2025Boosting the Local Invariance for Better Adversarial Transferabilitycited by 2
  12. 2025Text Adversarial Attacks with Dynamic Outputscited by 2
  13. 2025Bridging the Task Gap: Multi-Task Adversarial Transferability in CLIP and Its Derivativescited by 2
  14. 2025Improving the Transferability of Adversarial Attacks by an Input Transposecited by 1
  15. 2026Multimodal Backdoor Attack on VLMs for Autonomous Driving via Graffiti and Cross-Lingual Triggerscited by 1
  16. 2026Benchmarking the Robustness of Autonomous Driving to Environmental Illusions: A Lane Perception Perspectivecited by 1
  17. 2024Patch is Enough: Naturalistic Adversarial Patch against Vision-Language Pre-training Modelscited by 0
  18. 2025Boosting Adversarial Transferability for Hyperspectral Image Classification Using 3D Structure-invariant Transformation and Weighted Intermediate Feature Divergencecited by 0
  19. 2026Devling into Adversarial Transferability on Image Classification: Review, Benchmark, and Evaluationcited by 0
  20. 2026Contract And Conquer: How to Provably Compute Adversarial Examples for a Black-Box Model?cited by 0
  21. 2026A Patch-based Cross-view Regularized Framework for Backdoor Defense in Multimodal Large Language Modelscited by 0
  22. 2026CIVA: Critic-Induced Value-Subspace Attacks on Visual World-Model Agentscited by 0