Rethinking Mixup for Improving the Adversarial Transferability
Not on the map. Why?
Abstract (arXiv)
Mixup augmentation has been widely integrated to generate adversarial examples with superior adversarial transferability when immigrating from a surrogate model to other models. However, the underlying mechanism influencing the mixup's effect on transferability remains unexplored. In this work, we posit that the adversarial examples located at the convergence of decision boundaries across various categories exhibit better transferability and identify that Admix tends to steer the adversarial examples towards such regions. However, we find the constraint on the added image in Admix decays its capability, resulting in limited transferability. To address such an issue, we propose a new input transformation-based attack called Mixing the Image but Separating the gradienT (MIST). Specifically, MIST randomly mixes the input image with a randomly shifted image and separates the gradient of each loss item for each mixed image. To counteract the imprecise gradient, MIST calculates the gradient on several mixed images for each input sample. Extensive experimental results on the ImageNet dataset demonstrate that MIST outperforms existing SOTA input transformation-based attacks with a clear margin on both Convolutional Neural Networks (CNNs) and Vision Transformers (ViTs) w/wo defense mechanisms, supporting MIST's high effectiveness and generality.
Key facts. Cited by 3 papers in the map (data through 14 Oct 2026). Builds on 48 of its 55 references that are in the map. First posted on arXiv 28 Nov 2023.
Builds on
48 of 55 references.
References · 48
- 2015Deep Residual Learning for Image Recognitioncited by 52,096
- 2014Very Deep Convolutional Networks for Large-Scale Image Recognitioncited by 15,364
- 2021Swin Transformer: Hierarchical Vision Transformer using Shifted Windowscited by 12,139
- 2014ImageNet Large Scale Visual Recognition Challengecited by 8,498
- 2014Explaining and Harnessing Adversarial Examplescited by 7,364
- 2016Densely Connected Convolutional Networkscited by 6,720
- 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,415
- 2017mixup: Beyond Empirical Risk Minimizationcited by 5,183
- 2013Intriguing properties of neural networkscited by 5,155
- 2016Aggregated Residual Transformations for Deep Neural Networkscited by 2,546
- 2016Adversarial examples in the physical worldcited by 1,769
- 2019Certified Adversarial Robustness via Randomized Smoothingcited by 1,340
36 more
- 2018CosFace: Large Margin Cosine Loss for Deep Face Recognitioncited by 971
- 2017Ensemble Adversarial Training: Attacks and Defensescited by 840
- 2020Fast is better than free: Revisiting adversarial trainingcited by 727
- 2018Improving Transferability of Adversarial Examples with Input Diversitycited by 599
- 2016Delving into Transferable Adversarial Examples and Black-box Attackscited by 536
- 2017Countering Adversarial Images using Input Transformationscited by 520
- 2018Black-box Adversarial Attacks with Limited Queries and Informationcited by 501
- 2017Decision-Based Adversarial Attacks: Reliable Attacks Against Black-Box Machine Learning Modelscited by 462
- 2018Efficient Neural Network Robustness Certification with General Activation Functionscited by 445
- 2019Evading Defenses to Transferable Adversarial Examples by Translation-Invariant Attackscited by 442
- 2017Mitigating Adversarial Effects Through Randomizationcited by 383
- 2021Rethinking Spatial Dimensions of Vision Transformerscited by 361
- 2019Nesterov Accelerated Gradient and Scale Invariance for Adversarial Attackscited by 355
- 2017Defense against Adversarial Attacks Using High-Level Representation Guided Denoisercited by 329
- 2019Simple Black-box Adversarial Attackscited by 251
- 2021Enhancing the Transferability of Adversarial Attacks through Variance Tuningcited by 244
- 2015DeepDriving: Learning Affordance for Direct Perception in Autonomous Drivingcited by 231
- 2020A Self-supervised Approach for Adversarial Robustnesscited by 180
- 2020Skip Connections Matter: On the Transferability of Adversarial Examples Generated with ResNetscited by 167
- 2021Admix: Enhancing the Transferability of Adversarial Attackscited by 156
- 2017Generative Adversarial Perturbationscited by 153
- 2021Visformer: The Vision-friendly Transformercited by 137
- 2022Frequency Domain Model Augmentation for Adversarial Attackcited by 130
- 2018Transferable Adversarial Attacks for Image and Video Object Detectioncited by 109
- 2022Improving Adversarial Transferability via Neuron Attribution-Based Attackscited by 93
- 2021Stochastic Variance Reduced Ensemble Adversarial Attack for Boosting the Adversarial Transferabilitycited by 84
- 2020Patch-wise Attack for Fooling Deep Neural Networkcited by 78
- 2018Learning Transferable Adversarial Examples via Ghost Networkscited by 70
- 2021On Generating Transferable Targeted Perturbationscited by 65
- 2023Boosting Adversarial Transferability by Block Shuffle and Rotationcited by 64
- 2023Structure Invariant Transformation for better Adversarial Transferabilitycited by 62
- 2021Boosting Adversarial Transferability through Enhanced Momentumcited by 54
- 2021Triangle Attack: A Query-efficient Decision-based Adversarial Attackcited by 48
- 2023Boosting Adversarial Transferability by Achieving Flat Local Maximacited by 48
- 2023Rethinking the Backward Propagation for Adversarial Transferabilitycited by 27
- 2021Adaptive Image Transformations for Transfer-based Adversarial Attackcited by 22
Built on by
Citing papers per year: 2024: 2; 2025: 1.
3 papers.