mlsanityData to 7 Oct 2026

Boosting Adversarial Transferability by Block Shuffle and Rotation

arXiv 2308.10299 ↗First posted 20 Aug 2023cs.CV eess.IVcited by 64

Not on the map. Why?

Abstract (arXiv)

Adversarial examples mislead deep neural networks with imperceptible perturbations and have brought significant threats to deep learning. An important aspect is their transferability, which refers to their ability to deceive other models, thus enabling attacks in the black-box setting. Though various methods have been proposed to boost transferability, the performance still falls short compared with white-box attacks. In this work, we observe that existing input transformation based attacks, one of the mainstream transfer-based attacks, result in different attention heatmaps on various models, which might limit the transferability. We also find that breaking the intrinsic relation of the image can disrupt the attention heatmap of the original image. Based on this finding, we propose a novel input transformation based attack called block shuffle and rotation (BSR). Specifically, BSR splits the input image into several blocks, then randomly shuffles and rotates these blocks to construct a set of new images for gradient calculation. Empirical evaluations on the ImageNet dataset demonstrate that BSR could achieve significantly better transferability than the existing input transformation based methods under single-model and ensemble-model settings. Combining BSR with the current input transformation method can further improve the transferability, which significantly outperforms the state-of-the-art methods. Code is available at https://github.com/Trustworthy-AI-Group/BSR

Key facts. Cited by 64 papers in the map (data through 7 Oct 2026). Builds on 47 of its 59 references that are in the map. First posted on arXiv 20 Aug 2023.

Builds on

47 of 59 references.

References · 47

  1. 2015Deep Residual Learning for Image Recognitioncited by 51,809
  2. 2015Faster R-CNN: Towards Real-Time Object Detection with Region Proposal Networkscited by 9,617
  3. 2014ImageNet Large Scale Visual Recognition Challengecited by 8,441
  4. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  5. 2016Densely Connected Convolutional Networkscited by 6,691
  6. 2016Grad-CAM: Visual Explanations from Deep Networks via Gradient-based Localizationcited by 6,690
  7. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  8. 2015Rethinking the Inception Architecture for Computer Visioncited by 5,451
  9. 2013Intriguing properties of neural networkscited by 5,114
  10. 2014Fully Convolutional Networks for Semantic Segmentationcited by 4,845
  11. 2015You Only Look Once: Unified, Real-Time Object Detectioncited by 4,829
  12. 2017Axiomatic Attribution for Deep Networkscited by 3,350
35 more
  1. 2016Towards Evaluating the Robustness of Neural Networkscited by 2,976
  2. 2015Learning Deep Features for Discriminative Localizationcited by 2,430
  3. 2016Adversarial examples in the physical worldcited by 1,762
  4. 2016Inception-v4, Inception-ResNet and the Impact of Residual Connections on Learningcited by 1,509
  5. 2019Certified Adversarial Robustness via Randomized Smoothingcited by 1,324
  6. 2017SmoothGrad: removing noise by adding noisecited by 1,097
  7. 2018CosFace: Large Margin Cosine Loss for Deep Face Recognitioncited by 968
  8. 2016Practical Black-Box Attacks against Machine Learningcited by 893
  9. 2017Ensemble Adversarial Training: Attacks and Defensescited by 833
  10. 2018Improving Transferability of Adversarial Examples with Input Diversitycited by 591
  11. 2016Delving into Transferable Adversarial Examples and Black-box Attackscited by 530
  12. 2017Countering Adversarial Images using Input Transformationscited by 517
  13. 2017Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networkscited by 484
  14. 2019Evading Defenses to Transferable Adversarial Examples by Translation-Invariant Attackscited by 440
  15. 2017Mitigating Adversarial Effects Through Randomizationcited by 382
  16. 2019Nesterov Accelerated Gradient and Scale Invariance for Adversarial Attackscited by 352
  17. 2017Defense against Adversarial Attacks Using High-Level Representation Guided Denoisercited by 329
  18. 2019Simple Black-box Adversarial Attackscited by 249
  19. 2021Enhancing the Transferability of Adversarial Attacks through Variance Tuningcited by 242
  20. 2018Adversarial Risk and the Dangers of Evaluating Against Weak Attackscited by 221
  21. 2019Towards Stable and Efficient Training of Verifiably Robust Neural Networkscited by 204
  22. 2020A Self-supervised Approach for Adversarial Robustnesscited by 180
  23. 2021Admix: Enhancing the Transferability of Adversarial Attackscited by 155
  24. 2021Feature Importance-aware Transferable Adversarial Attackscited by 125
  25. 2020QEBA: Query-Efficient Boundary-Based Blackbox Attackcited by 103
  26. 2018Feature Distillation: DNN-Oriented JPEG Compression Against Adversarial Examplescited by 98
  27. 2021Stochastic Variance Reduced Ensemble Adversarial Attack for Boosting the Adversarial Transferabilitycited by 84
  28. 2018Learning Transferable Adversarial Examples via Ghost Networkscited by 69
  29. 2021Boosting Adversarial Transferability through Enhanced Momentumcited by 53
  30. 2021Triangle Attack: A Query-efficient Decision-based Adversarial Attackcited by 48
  31. 2023Boosting Adversarial Transferability by Achieving Flat Local Maximacited by 48
  32. 2023Improving the Transferability of Adversarial Samples by Path-Augmented Methodcited by 36
  33. 2023Diversifying the High-level Features for better Adversarial Transferabilitycited by 34
  34. 2019Robust Local Features for Improving the Generalization of Adversarial Trainingcited by 30
  35. 2023Rethinking the Backward Propagation for Adversarial Transferabilitycited by 27

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2023: 3; 2024: 14; 2025: 31; 2026: 16.

64 papers.

Sort:

By area:

  1. 2024Learning to Transform Dynamically for Better Adversarial Transferabilitycited by 23
  2. 2024Transferable Adversarial Attacks on SAM and Its Downstream Modelscited by 20
  3. 2025Attention! Your Vision Language Model Could Be Maliciously Manipulatedcited by 12
  4. 2025Towards Model Resistant to Transferable Adversarial Examples via Trigger Activationcited by 10
  5. 2025When Robots Obey the Patch: Universal Transferable Patch Attacks on Vision-Language-Action Modelscited by 9
  6. 2025From Pretrain to Pain: Adversarial Vulnerability of Video Foundation Models Without Task Knowledgecited by 8
  7. 2024Rethinking Impersonation and Dodging Attacks on Face Recognition Systemscited by 7
  8. 2024TASAR: Transfer-based Attack on Skeletal Action Recognitioncited by 7
  9. 2025Improving Adversarial Transferability on Vision Transformers via Forward Propagation Refinementcited by 7
  10. 2024Boosting Adversarial Transferability with Low-Cost Optimization via Maximin Expected Flatnesscited by 6
  11. 2024Understanding Model Ensemble in Transferable Adversarial Attackcited by 6
  12. 2025ForensicsSAM: Toward Robust and Unified Image Forgery Detection and Localization Resisting to Adversarial Attackcited by 6
38 more
  1. 2023Transferability Bound Theory: Exploring Relationship between Adversarial Transferability and Flatnesscited by 5
  2. 2025Enhancing Targeted Adversarial Attacks on Large Vision-Language Models via Intermediate Projectorcited by 5
  3. 2024Adversarial Attacks on Both Face Recognition and Face Anti-spoofing Modelscited by 4
  4. 2023Rethinking Mixup for Improving the Adversarial Transferabilitycited by 3
  5. 2024Exploring Frequencies via Feature Mixing and Meta-Learning for Improving Adversarial Transferabilitycited by 3
  6. 2024Improving the Transferability of Adversarial Attacks on Face Recognition with Diverse Parameters Augmentationcited by 3
  7. 2025Data-free Universal Adversarial Perturbation with Pseudo-semantic Priorcited by 3
  8. 2025Boosting Adversarial Transferability via High-Frequency Augmentation and Hierarchical-Gradient Fusioncited by 3
  9. 2025Enhancing Diffusion-based Unrestricted Adversarial Attacks via Adversary Preferences Alignmentcited by 3
  10. 2025ScoreAdv: Score-based Targeted Generation of Natural Adversarial Examples via Diffusion Modelscited by 3
  11. 2025MAA: Meticulous Adversarial Attack against Vision-Language Pre-trained Modelscited by 2
  12. 2025Information-Geometric Inverse Distillation for Enhancing Adversarial Transferabilitycited by 2
  13. 2025Boosting the Local Invariance for Better Adversarial Transferabilitycited by 2
  14. 2025GSBAK: top-K Geometric Score-based Black-box Attackcited by 2
  15. 2025Boosting Adversarial Transferability via Ensemble Non-Attentioncited by 2
  16. 2023Generating Visually Realistic Adversarial Patchcited by 1
  17. 2024On the Adversarial Transferability of Generalized "Skip Connections"cited by 1
  18. 2024S4ST: A Strong, Self-transferable, faSt, and Simple Scale Transformation for Transferable Targeted Attackcited by 1
  19. 2025Enhancing Adversarial Transferability via Component-Wise Transformationcited by 1
  20. 2025Improving the Transferability of Adversarial Attacks by an Input Transposecited by 1
  21. 2025Disrupting Semantic and Abstract Features for Better Adversarial Transferabilitycited by 1
  22. 2025Boosting Adversarial Transferability via Residual Perturbation Attackcited by 1
  23. 2025ViT-EnsembleAttack: Augmenting Ensemble Models for Stronger Adversarial Transferability in Vision Transformerscited by 1
  24. 2025Generating Transferrable Adversarial Examples via Local Mixing and Logits Optimization for Remote Sensing Object Recognitioncited by 1
  25. 2026OTI: A Model-free and Visually Interpretable Measure of Image Attackabilitycited by 1
  26. 2026Universal Adversarial Attacks against Closed-Source MLLMs via Target-View Routed Meta Optimizationcited by 1
  27. 2024Looking From the Future: Multi-order Iterations Can Enhance Adversarial Attack Transferabilitycited by 0
  28. 2024Enhancing Transferability of Targeted Adversarial Examples: A Self-Universal Perspectivecited by 0
  29. 2024Improving Adversarial Transferability with Neighbourhood Gradient Informationcited by 0
  30. 2025Rethinking Target Label Conditioning in Adversarial Attacks: A 2D Tensor-Guided Generative Approachcited by 0
  31. 2025RaPA: Enhancing Transferable Targeted Attacks via Random Parameter Pruningcited by 0
  32. 2025Temporal Consistency Constrained Transferable Adversarial Attacks with Background Mixup for Action Recognitioncited by 0
  33. 2025Boosting Adversarial Transferability for Hyperspectral Image Classification Using 3D Structure-invariant Transformation and Weighted Intermediate Feature Divergencecited by 0
  34. 2025Boosting Adversarial Transferability Against Defenses via Multi-Scale Transformationcited by 0
  35. 2025SAM Encoder Breach by Adversarial Simplicial Complex Triggers Downstream Model Failurescited by 0
  36. 2025Attack logics, not outputs: Towards efficient robustification of deep neural networks by falsifying concept-based propertiescited by 0
  37. 2025Dynamic Parameter Optimization for Highly Transferable Transformation-Based Attackscited by 0
  38. 2025Enhancing Adversarial Transferability through Block Stretch and Shrinkcited by 0

50 most cited of 64 All 64 (JSON)