mlsanityData to 7 Oct 2026

Towards Evaluating Transfer-based Attacks Systematically, Practically, and Fairly

arXiv 2311.01323 ↗First posted 2 Nov 2023cs.LG cs.CR cs.CVcited by 6

Not on the map. Why?

Abstract (arXiv)

The adversarial vulnerability of deep neural networks (DNNs) has drawn great attention due to the security risk of applying these models in real-world applications. Based on transferability of adversarial examples, an increasing number of transfer-based methods have been developed to fool black-box DNN models whose architecture and parameters are inaccessible. Although tremendous effort has been exerted, there still lacks a standardized benchmark that could be taken advantage of to compare these methods systematically, fairly, and practically. Our investigation shows that the evaluation of some methods needs to be more reasonable and more thorough to verify their effectiveness, to avoid, for example, unfair comparison and insufficient consideration of possible substitute/victim models. Therefore, we establish a transfer-based attack benchmark (TA-Bench) which implements 30+ methods. In this paper, we evaluate and compare them comprehensively on 25 popular substitute/victim models on ImageNet. New insights about the effectiveness of these methods are gained and guidelines for future evaluations are provided. Code at: https://github.com/qizhangli/TA-Bench.

Key facts. Cited by 6 papers in the map (data through 7 Oct 2026). Builds on 67 of its 76 references that are in the map. First posted on arXiv 2 Nov 2023.

Builds on

67 of 76 references.

References · 67

  1. 2015Deep Residual Learning for Image Recognitioncited by 51,809
  2. 2020An Image is Worth 16x16 Words: Transformers for Image Recognition at Scalecited by 29,915
  3. 2021Swin Transformer: Hierarchical Vision Transformer using Shifted Windowscited by 12,082
  4. 2014ImageNet Large Scale Visual Recognition Challengecited by 8,441
  5. 2021Emerging Properties in Self-Supervised Vision Transformerscited by 6,893
  6. 2016Densely Connected Convolutional Networkscited by 6,691
  7. 2019EfficientNet: Rethinking Model Scaling for Convolutional Neural Networkscited by 6,415
  8. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  9. 2015Rethinking the Inception Architecture for Computer Visioncited by 5,451
  10. 2017mixup: Beyond Empirical Risk Minimizationcited by 5,155
  11. 2018MobileNetV2: Inverted Residuals and Linear Bottleneckscited by 4,773
  12. 2017Squeeze-and-Excitation Networkscited by 4,763
38 more
  1. 2020Training data-efficient image transformers & distillation through attentioncited by 4,560
  2. 2022A ConvNet for the 2020scited by 3,545
  3. 2019CutMix: Regularization Strategy to Train Strong Classifiers with Localizable Featurescited by 2,875
  4. 2016Aggregated Residual Transformations for Deep Neural Networkscited by 2,540
  5. 2021BEiT: BERT Pre-Training of Image Transformerscited by 2,360
  6. 2020Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attackscited by 1,442
  7. 2021MLP-Mixer: An all-MLP Architecture for Visioncited by 1,441
  8. 2021Swin Transformer V2: Scaling Up Capacity and Resolutioncited by 1,215
  9. 2021EfficientNetV2: Smaller Models and Faster Trainingcited by 1,127
  10. 2016Deep Networks with Stochastic Depthcited by 973
  11. 2016Adversarial Machine Learning at Scalecited by 934
  12. 2023ConvNeXt V2: Co-designing and Scaling ConvNets with Masked Autoencoderscited by 703
  13. 2022EVA: Exploring the Limits of Masked Visual Representation Learning at Scalecited by 685
  14. 2020RobustBench: a standardized adversarial robustness benchmarkcited by 659
  15. 2020Simple Copy-Paste is a Strong Data Augmentation Method for Instance Segmentationcited by 595
  16. 2018Improving Transferability of Adversarial Examples with Input Diversitycited by 591
  17. 2021RepVGG: Making VGG-style ConvNets Great Againcited by 520
  18. 2022MaxViT: Multi-Axis Vision Transformercited by 476
  19. 2019Evading Defenses to Transferable Adversarial Examples by Translation-Invariant Attackscited by 440
  20. 2023EVA-02: A Visual Representation for Neon Genesiscited by 377
  21. 2019Nesterov Accelerated Gradient and Scale Invariance for Adversarial Attackscited by 352
  22. 2021Enhancing the Transferability of Adversarial Attacks through Variance Tuningcited by 242
  23. 2020Torchattacks: A PyTorch Repository for Adversarial Attackscited by 156
  24. 2021Admix: Enhancing the Transferability of Adversarial Attackscited by 155
  25. 2017Generative Adversarial Perturbationscited by 153
  26. 2019Enhancing Adversarial Example Transferability with an Intermediate Level Attackcited by 139
  27. 2022MetaFormer Baselines for Visioncited by 131
  28. 2021Feature Importance-aware Transferable Adversarial Attackscited by 125
  29. 2016Technical Report on the CleverHans v2.1.0 Adversarial Examples Librarycited by 123
  30. 2019Cross-Domain Transferability of Adversarial Perturbationscited by 92
  31. 2022Improving Adversarial Transferability via Neuron Attribution-Based Attackscited by 92
  32. 2023A Comprehensive Study on Robustness of Image Classification Models: Benchmarking and Rethinkingcited by 85
  33. 2021Towards Transferable Adversarial Attacks on Vision Transformerscited by 80
  34. 2020Backpropagating Linearly Improves Transferability of Adversarial Examplescited by 79
  35. 2023Revisiting Adversarial Training for ImageNet: Architectures, Training and Generalization across Threat Modelscited by 79
  36. 2021RobustART: Benchmarking Robustness on Architecture Design and Training Techniquescited by 78
  37. 2020A Unified Approach to Interpreting and Boosting Adversarial Transferabilitycited by 71
  38. 2021On Improving Adversarial Transferability of Vision Transformerscited by 70

50 most cited of 67 All 67 (JSON)

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2023: 1; 2024: 1; 2025: 3; 2026: 1.

6 papers.

  1. 2024Improved Generation of Adversarial Examples Against Safety-aligned LLMscited by 17
  2. 2025Use as Many Surrogates as You Want: Selective Ensemble Attack to Unleash Transferability without Sacrificing Resource Efficiencycited by 1
  3. 2023The Ultimate Combo: Boosting Adversarial Example Transferability by Composing Data Augmentationscited by 0
  4. 2025Seeking Flat Minima over Diverse Surrogates for Improved Adversarial Transferability: A Theoretical Framework and Algorithmic Instantiationcited by 0
  5. 2025On the Trade-Off Between Transparency and Security in Adversarial Machine Learningcited by 0
  6. 2026Devling into Adversarial Transferability on Image Classification: Review, Benchmark, and Evaluationcited by 0