mlsanityData to 14 Oct 2026

Improving Adversarial Transferability via Intermediate-level Perturbation Decay

arXiv 2304.13410 ↗First posted 26 Apr 2023cs.LG cs.CR cs.CVcited by 29

Not on the map. Why?

Abstract (arXiv)

Intermediate-level attacks that attempt to perturb feature representations following an adversarial direction drastically have shown favorable performance in crafting transferable adversarial examples. Existing methods in this category are normally formulated with two separate stages, where a directional guide is required to be determined at first and the scalar projection of the intermediate-level perturbation onto the directional guide is enlarged thereafter. The obtained perturbation deviates from the guide inevitably in the feature space, and it is revealed in this paper that such a deviation may lead to sub-optimal attack. To address this issue, we develop a novel intermediate-level method that crafts adversarial examples within a single stage of optimization. In particular, the proposed method, named intermediate-level perturbation decay (ILPD), encourages the intermediate-level perturbation to be in an effective adversarial direction and to possess a great magnitude simultaneously. In-depth discussion verifies the effectiveness of our method. Experimental results show that it outperforms state-of-the-arts by large margins in attacking various victim models on ImageNet (+10.07% on average) and CIFAR-10 (+3.88% on average). Our code is at https://github.com/qizhangli/ILPD-attack.

Key facts. Cited by 29 papers in the map (data through 14 Oct 2026). Builds on 45 of its 51 references that are in the map. First posted on arXiv 26 Apr 2023.

Builds on

45 of 51 references.

References · 45

  1. 2015Deep Residual Learning for Image Recognitioncited by 52,096
  2. 2020An Image is Worth 16x16 Words: Transformers for Image Recognition at Scalecited by 30,186
  3. 2014Very Deep Convolutional Networks for Large-Scale Image Recognitioncited by 15,364
  4. 2021Swin Transformer: Hierarchical Vision Transformer using Shifted Windowscited by 12,139
  5. 2014ImageNet Large Scale Visual Recognition Challengecited by 8,498
  6. 2014Explaining and Harnessing Adversarial Examplescited by 7,364
  7. 2016Densely Connected Convolutional Networkscited by 6,720
  8. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,415
  9. 2015Rethinking the Inception Architecture for Computer Visioncited by 5,475
  10. 2017mixup: Beyond Empirical Risk Minimizationcited by 5,183
  11. 2020Training data-efficient image transformers & distillation through attentioncited by 4,586
  12. 2022A ConvNet for the 2020scited by 3,579
33 more
  1. 2016Wide Residual Networkscited by 3,070
  2. 2016Aggregated Residual Transformations for Deep Neural Networkscited by 2,546
  3. 2021BEiT: BERT Pre-Training of Image Transformerscited by 2,375
  4. 2021MLP-Mixer: An all-MLP Architecture for Visioncited by 1,446
  5. 2019Certified Adversarial Robustness via Randomized Smoothingcited by 1,340
  6. 2016Adversarial Machine Learning at Scalecited by 936
  7. 2017ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Modelscited by 666
  8. 2018Improving Transferability of Adversarial Examples with Input Diversitycited by 599
  9. 2016Delving into Transferable Adversarial Examples and Black-box Attackscited by 536
  10. 2021RepVGG: Making VGG-style ConvNets Great Againcited by 522
  11. 2018Black-box Adversarial Attacks with Limited Queries and Informationcited by 501
  12. 2017Decision-Based Adversarial Attacks: Reliable Attacks Against Black-Box Machine Learning Modelscited by 462
  13. 2016Transferability in Machine Learning: from Phenomena to Black-Box Attacks using Adversarial Samplescited by 446
  14. 2019Evading Defenses to Transferable Adversarial Examples by Translation-Invariant Attackscited by 442
  15. 2019Nesterov Accelerated Gradient and Scale Invariance for Adversarial Attackscited by 355
  16. 2019Minimally distorted Adversarial Examples with a Fast Adaptive Boundary Attackcited by 334
  17. 2019HopSkipJumpAttack: A Query-Efficient Decision-Based Attackcited by 333
  18. 2019Searching for A Robust Neural Architecture in Four GPU Hourscited by 260
  19. 2021Are Transformers More Robust Than CNNs?cited by 187
  20. 2020A Self-supervised Approach for Adversarial Robustnesscited by 180
  21. 2016Deep Pyramidal Residual Networkscited by 163
  22. 2021Admix: Enhancing the Transferability of Adversarial Attackscited by 156
  23. 2018Prior Convictions: Black-Box Adversarial Attacks with Bandits and Priorscited by 146
  24. 2019Enhancing Adversarial Example Transferability with an Intermediate Level Attackcited by 140
  25. 2018AutoZOOM: Autoencoder-based Zeroth Order Optimization Method for Attacking Black-box Neural Networkscited by 137
  26. 2021Feature Importance-aware Transferable Adversarial Attackscited by 127
  27. 2022Improving Adversarial Transferability via Neuron Attribution-Based Attackscited by 93
  28. 2020Backpropagating Linearly Improves Transferability of Adversarial Examplescited by 79
  29. 2019Subspace Attack: Exploiting Promising Subspaces for Query-Efficient Black-box Attackscited by 35
  30. 2020Yet Another Intermediate-Level Attackcited by 35
  31. 2022Transferable Adversarial Attack based on Integrated Gradientscited by 35
  32. 2023Making Substitute Models More Bayesian Can Enhance Transferability of Adversarial Examplescited by 32
  33. 2022An Intermediate-level Attack Framework on The Basis of Linear Regressioncited by 9

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2023: 5; 2024: 10; 2025: 10; 2026: 4.

29 papers.

Sort:

By area:

  1. 2023SA-Attack: Improving Adversarial Transferability of Vision-Language Pre-training Models via Self-Augmentationcited by 39
  2. 2023Robustness of SAM: Segment Anything Under Corruptions and Beyondcited by 31
  3. 2024Transferable Adversarial Attacks on SAM and Its Downstream Modelscited by 21
  4. 2024Improved Generation of Adversarial Examples Against Safety-aligned LLMscited by 18
  5. 2024Semantic-Aligned Adversarial Evolution Triangle for High-Transferability Vision-Language Attackcited by 18
  6. 2023Black-box Targeted Adversarial Attack on Segment Anything (SAM)cited by 13
  7. 2024Rethinking Impersonation and Dodging Attacks on Face Recognition Systemscited by 8
  8. 2024Understanding Model Ensemble in Transferable Adversarial Attackcited by 7
  9. 2024Unsegment Anything by Simulating Deformationcited by 6
  10. 2024Adversarial Attacks on Both Face Recognition and Face Anti-spoofing Modelscited by 4
  11. 2023MF-CLIP: Leveraging CLIP as Surrogate Models for No-box Adversarial Attackscited by 3
  12. 2023Improving Transferability of Adversarial Examples via Bayesian Attackscited by 3
17 more
  1. 2024Region-Guided Attack on the Segment Anything Model (SAM)cited by 2
  2. 2025Boosting the Local Invariance for Better Adversarial Transferabilitycited by 2
  3. 2025Use as Many Surrogates as You Want: Selective Ensemble Attack to Unleash Transferability without Sacrificing Resource Efficiencycited by 2
  4. 2024On the Adversarial Transferability of Generalized "Skip Connections"cited by 1
  5. 2025ViT-EnsembleAttack: Augmenting Ensemble Models for Stronger Adversarial Transferability in Vision Transformerscited by 1
  6. 2026The Power of Decaying Steps: Enhancing Attack Stability and Transferability for Sign-based Optimizerscited by 1
  7. 2024Transform-Dependent Adversarial Attackscited by 0
  8. 2025FSPGD: Rethinking Black-box Attacks on Semantic Segmentationcited by 0
  9. 2025Boosting Adversarial Transferability for Hyperspectral Image Classification Using 3D Structure-invariant Transformation and Weighted Intermediate Feature Divergencecited by 0
  10. 2025Improving Black-Box Generative Attacks via Generator Semantic Consistencycited by 0
  11. 2025A Unified Framework for Stealthy Adversarial Generation via Latent Optimization and Transferability Enhancementcited by 0
  12. 2025SAM Encoder Breach by Adversarial Simplicial Complex Triggers Downstream Model Failurescited by 0
  13. 2025Transferable Dual-Domain Feature Importance Attack against AI-Generated Image Detectorcited by 0
  14. 2025Optimizing the Adversarial Perturbation with a Momentum-based Adaptive Matrixcited by 0
  15. 2026Feature-Space Smoothing: Certified Robustness of Deep Representationscited by 0
  16. 2026Devling into Adversarial Transferability on Image Classification: Review, Benchmark, and Evaluationcited by 0
  17. 2026Latent Transfer Attack: Adversarial Examples via Generative Latent Spacescited by 0