mlsanityData to 14 Oct 2026

GNP Attack: Transferable Adversarial Examples via Gradient Norm Penalty

arXiv 2307.04099 ↗First posted 9 Jul 2023cs.LG cs.CR cs.CVcited by 8

Not on the map. Why?

Abstract (arXiv)

Adversarial examples (AE) with good transferability enable practical black-box attacks on diverse target models, where insider knowledge about the target models is not required. Previous methods often generate AE with no or very limited transferability; that is, they easily overfit to the particular architecture and feature representation of the source, white-box model and the generated AE barely work for target, black-box models. In this paper, we propose a novel approach to enhance AE transferability using Gradient Norm Penalty (GNP). It drives the loss function optimization procedure to converge to a flat region of local optima in the loss landscape. By attacking 11 state-of-the-art (SOTA) deep learning models and 6 advanced defense methods, we empirically show that GNP is very effective in generating AE with high transferability. We also demonstrate that it is very flexible in that it can be easily integrated with other gradient based methods for stronger transfer-based attacks.

Key facts. Cited by 8 papers in the map (data through 14 Oct 2026). Builds on 21 of its 23 references that are in the map. First posted on arXiv 9 Jul 2023.

Builds on

21 of 23 references.

References · 21

  1. 2015Deep Residual Learning for Image Recognitioncited by 52,096
  2. 2014Very Deep Convolutional Networks for Large-Scale Image Recognitioncited by 15,364
  3. 2014ImageNet Large Scale Visual Recognition Challengecited by 8,498
  4. 2014Explaining and Harnessing Adversarial Examplescited by 7,364
  5. 2016Densely Connected Convolutional Networkscited by 6,720
  6. 2015Rethinking the Inception Architecture for Computer Visioncited by 5,475
  7. 2018MobileNetV2: Inverted Residuals and Linear Bottleneckscited by 4,795
  8. 2017Squeeze-and-Excitation Networkscited by 4,789
  9. 2016Wide Residual Networkscited by 3,070
  10. 2016Aggregated Residual Transformations for Deep Neural Networkscited by 2,546
  11. 2020Sharpness-Aware Minimization for Efficiently Improving Generalizationcited by 1,417
  12. 2018MnasNet: Platform-Aware Neural Architecture Search for Mobilecited by 943
9 more
  1. 2017Ensemble Adversarial Training: Attacks and Defensescited by 840
  2. 2018Improving Transferability of Adversarial Examples with Input Diversitycited by 599
  3. 2016Delving into Transferable Adversarial Examples and Black-box Attackscited by 536
  4. 2017Countering Adversarial Images using Input Transformationscited by 520
  5. 2017Progressive Neural Architecture Searchcited by 487
  6. 2019Evading Defenses to Transferable Adversarial Examples by Translation-Invariant Attackscited by 442
  7. 2017Mitigating Adversarial Effects Through Randomizationcited by 383
  8. 2020A Self-supervised Approach for Adversarial Robustnesscited by 180
  9. 2020Yet Another Intermediate-Level Attackcited by 35

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2023: 2; 2024: 1; 2025: 4; 2026: 1.

8 papers.

  1. 2023Why Does Little Robustness Help? A Further Step Towards Understanding Adversarial Transferabilitycited by 32
  2. 2024Boosting Adversarial Transferability with Low-Cost Optimization via Maximin Expected Flatnesscited by 7
  3. 2023Transferability Bound Theory: Exploring Relationship between Adversarial Transferability and Flatnesscited by 5
  4. 2025Exploring Adversarial Transferability between Kolmogorov-arnold Networkscited by 4
  5. 2025Improving the Transferability of Adversarial Attacks by an Input Transposecited by 1
  6. 2025Boosting Adversarial Transferability via Residual Perturbation Attackcited by 1
  7. 2025Enabling Heterogeneous Adversarial Transferability via Feature Permutation Attackscited by 0
  8. 2026Devling into Adversarial Transferability on Image Classification: Review, Benchmark, and Evaluationcited by 0