mlsanityData to 14 Oct 2026

A Survey on Transferability of Adversarial Examples across Deep Neural Networks

arXiv 2310.17626 ↗First posted 26 Oct 2023cs.CVcited by 44

Not on the map. Why?

Abstract (arXiv)

The emergence of Deep Neural Networks (DNNs) has revolutionized various domains by enabling the resolution of complex tasks spanning image recognition, natural language processing, and scientific problem-solving. However, this progress has also brought to light a concerning vulnerability: adversarial examples. These crafted inputs, imperceptible to humans, can manipulate machine learning models into making erroneous predictions, raising concerns for safety-critical applications. An intriguing property of this phenomenon is the transferability of adversarial examples, where perturbations crafted for one model can deceive another, often with a different architecture. This intriguing property enables black-box attacks which circumvents the need for detailed knowledge of the target model. This survey explores the landscape of the adversarial transferability of adversarial examples. We categorize existing methodologies to enhance adversarial transferability and discuss the fundamental principles guiding each approach. While the predominant body of research primarily concentrates on image classification, we also extend our discussion to encompass other vision tasks and beyond. Challenges and opportunities are discussed, highlighting the importance of fortifying DNNs against adversarial vulnerabilities in an evolving landscape.

Key facts. Cited by 44 papers in the map (data through 14 Oct 2026). Builds on 119 of its 161 references that are in the map. First posted on arXiv 26 Oct 2023.

Builds on

119 of 161 references.

References · 119

  1. 2017Attention Is All You Needcited by 60,361
  2. 2015Deep Residual Learning for Image Recognitioncited by 52,096
  3. 2018BERT: Pre-training of Deep Bidirectional Transformers for Language Understandingcited by 40,399
  4. 2021Learning Transferable Visual Models From Natural Language Supervisioncited by 33,744
  5. 2020Language Models are Few-Shot Learnerscited by 32,419
  6. 2020An Image is Worth 16x16 Words: Transformers for Image Recognition at Scalecited by 30,186
  7. 2020Denoising Diffusion Probabilistic Modelscited by 21,076
  8. 2015U-Net: Convolutional Networks for Biomedical Image Segmentationcited by 19,713
  9. 2023GPT-4 Technical Reportcited by 18,396
  10. 2014ImageNet Large Scale Visual Recognition Challengecited by 8,498
  11. 2023Visual Instruction Tuningcited by 7,869
  12. 2014Explaining and Harnessing Adversarial Examplescited by 7,364
38 more
  1. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,415
  2. 2017mixup: Beyond Empirical Risk Minimizationcited by 5,183
  3. 2013Intriguing properties of neural networkscited by 5,155
  4. 2022Flamingo: a Visual Language Model for Few-Shot Learningcited by 4,386
  5. 2022BLIP: Bootstrapping Language-Image Pre-training for Unified Vision-Language Understanding and Generationcited by 4,322
  6. 2017Axiomatic Attribution for Deep Networkscited by 3,384
  7. 2023MiniGPT-4: Enhancing Vision-Language Understanding with Advanced Large Language Modelscited by 2,711
  8. 2015Learning Deep Features for Discriminative Localizationcited by 2,436
  9. 2014Conditional Generative Adversarial Netscited by 2,162
  10. 2020Shortcut Learning in Deep Neural Networkscited by 1,969
  11. 2019Natural Adversarial Examplescited by 1,408
  12. 2019VisualBERT: A Simple and Performant Baseline for Vision and Languagecited by 1,296
  13. 2019Adversarial Examples Are Not Bugs, They Are Featurescited by 953
  14. 2016Universal adversarial perturbationscited by 784
  15. 2017Evasion Attacks against Machine Learning at Test Timecited by 689
  16. 2020RobustBench: a standardized adversarial robustness benchmarkcited by 661
  17. 2018Improving Transferability of Adversarial Examples with Input Diversitycited by 599
  18. 2016Delving into Transferable Adversarial Examples and Black-box Attackscited by 536
  19. 2016Transferability in Machine Learning: from Phenomena to Black-Box Attacks using Adversarial Samplescited by 446
  20. 2019Evading Defenses to Transferable Adversarial Examples by Translation-Invariant Attackscited by 442
  21. 2019Nesterov Accelerated Gradient and Scale Invariance for Adversarial Attackscited by 355
  22. 2023On Evaluating Adversarial Robustness of Large Vision-Language Modelscited by 284
  23. 2018Generating Adversarial Examples with Adversarial Networkscited by 258
  24. 2021Enhancing the Transferability of Adversarial Attacks through Variance Tuningcited by 244
  25. 2018Textual Explanations for Self-Driving Vehiclescited by 226
  26. 2017Generating Natural Adversarial Examplescited by 183
  27. 2023How Robust is Google's Bard to Adversarial Image Attacks?cited by 183
  28. 2020Skip Connections Matter: On the Transferability of Adversarial Examples Generated with ResNetscited by 167
  29. 2021Admix: Enhancing the Transferability of Adversarial Attackscited by 156
  30. 2017Generative Adversarial Perturbationscited by 153
  31. 2018Generating 3D Adversarial Point Cloudscited by 144
  32. 2022Towards Adversarial Attack on Vision-Language Pre-training Modelscited by 144
  33. 2019Enhancing Adversarial Example Transferability with an Intermediate Level Attackcited by 140
  34. 2021Feature Importance-aware Transferable Adversarial Attackscited by 127
  35. 2018Transferable Adversarial Attacks for Image and Video Object Detectioncited by 109
  36. 2023Set-level Guidance Attack: Boosting Adversarial Transferability of Vision-Language Pre-training Modelscited by 108
  37. 2017Interpretable Learning for Self-Driving Cars by Visualizing Causal Attentioncited by 107
  38. 2022LAS-AT: Adversarial Training with Learnable Attack Strategycited by 95

50 most cited of 119 All 119 (JSON)

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2023: 5; 2024: 15; 2025: 15; 2026: 9.

44 papers.

Sort:

By area:

  1. 2024Improved Techniques for Optimization-Based Jailbreaking on Large Language Modelscited by 110
  2. 2024An Image Is Worth 1000 Lies: Adversarial Transferability across Prompts on Vision-Language Modelscited by 45
  3. 2023SA-Attack: Improving Adversarial Transferability of Vision-Language Pre-training Models via Self-Augmentationcited by 39
  4. 2024Efficient Generation of Targeted and Transferable Adversarial Examples for Vision-Language Models Via Diffusion Modelscited by 38
  5. 2023OT-Attack: Enhancing Adversarial Transferability of Vision-Language Models via Optimal Transport Optimizationcited by 37
  6. 2024Boosting Transferability in Vision-Language Attacks via Diversification along the Intersection Region of Adversarial Trajectorycited by 36
  7. 2023InstructTA: Instruction-Tuned Targeted Attack for Large Vision-Language Modelscited by 21
  8. 2025FreezeVLA: Action-Freezing Attacks against Vision-Language-Action Modelscited by 21
  9. 2024Semantic-Aligned Adversarial Evolution Triangle for High-Transferability Vision-Language Attackcited by 18
  10. 2024As Firm As Their Foundations: Can open-sourced foundation models be used to create adversarial examples for downstream tasks?cited by 11
  11. 2023Improving Adversarial Transferability via Model Alignmentcited by 10
  12. 2023TranSegPGD: Improving Transferability of Adversarial Examples on Semantic Segmentationcited by 10
32 more
  1. 2024A Survey on Responsible Generative AI: What to Generate and What Notcited by 8
  2. 2024Understanding Model Ensemble in Transferable Adversarial Attackcited by 7
  3. 20253D Gaussian Splatting Driven Multi-View Robust Physical Adversarial Camouflage Generationcited by 7
  4. 2024Learning Visual Prompts for Guiding the Attention of Vision Transformerscited by 6
  5. 2025Evolution-based Region Adversarial Prompt Learning for Robustness Enhancement in Vision-Language Modelscited by 6
  6. 2025Improving Generalizability and Undetectability for Targeted Adversarial Attacks on Multimodal Pre-trained Modelscited by 5
  7. 2024Any Target Can be Offense: Adversarial Example Generation via Generalized Latent Infectioncited by 3
  8. 2024Exploring Query Efficient Data Generation towards Data-free Model Stealing in Hard Label Settingcited by 3
  9. 2024Deciphering the Definition of Adversarial Robustness for post-hoc OOD Detectorscited by 2
  10. 2025Use as Many Surrogates as You Want: Selective Ensemble Attack to Unleash Transferability without Sacrificing Resource Efficiencycited by 2
  11. 2025Merge Now, Regret Later: The Hidden Cost of Model Merging Is Adversarial Transferabilitycited by 2
  12. 2024Adversarial Examples are Misaligned in Diffusion Model Manifoldscited by 1
  13. 2024S4ST: A Strong, Self-transferable, faSt, and Simple Scale Transformation for Transferable Targeted Attackcited by 1
  14. 2024Replace-then-Perturb: Targeted Adversarial Attacks With Visual Reasoning for Vision-Language Modelscited by 1
  15. 2025Improving Adversarial Transferability in MLLMs via Dynamic Vision-Language Alignment Attackcited by 1
  16. 2025Light as Deception: GPT-driven Natural Relighting Against Vision-Language Pre-training Modelscited by 1
  17. 2026Jailbreaking LLMs Without Gradients or Priors: Effective and Transferable Attackscited by 1
  18. 2025On the Adversarial Robustness of Spiking Neural Networks Trained by Local Learningcited by 0
  19. 2025RaPA: Enhancing Transferable Targeted Attacks via Random Parameter Pruningcited by 0
  20. 2025Exploiting Edge Features for Transferable Adversarial Attacks in Distributed Machine Learningcited by 0
  21. 2025Exploring Cross-Stage Adversarial Transferability in Class-Incremental Continual Learningcited by 0
  22. 2025BiTAA: A Bi-Task Adversarial Attack for Object Detection and Depth Estimation via 3D Gaussian Splattingcited by 0
  23. 2025Defense That Attacks: How Robust Models Become Better Attackerscited by 0
  24. 2025Optimizing the Adversarial Perturbation with a Momentum-based Adaptive Matrixcited by 0
  25. 2026SGHA-Attack: Semantic-Guided Hierarchical Alignment for Transferable Targeted Attacks on Vision-Language Modelscited by 0
  26. 2026Devling into Adversarial Transferability on Image Classification: Review, Benchmark, and Evaluationcited by 0
  27. 2026R-PGA: Robust Physical Adversarial Camouflage Generation via Relightable 3D Gaussian Splattingcited by 0
  28. 2026SoK: Colluding Adversaries in Machine Learning Pipelinescited by 0
  29. 2026Improving Adversarial Transferability on Vision-Language Pre-training Models via Surrogate-Specific Bias Correctioncited by 0
  30. 2026Learning with Bilevel-Minimax Optimization for Efficient and Reliable Transfer Attackscited by 0
  31. 2026Learning Defensive Policies against Diverse Inference Attacks for Smart Meter Privacycited by 0
  32. 2026Visual-Invariance-Augmented Feature Optimal Alignment for Transferable Adversarial Attacks against Closed-Source MLLMscited by 0