mlsanityData to 13 Oct 2026

Improving Adversarial Transferability via Model Alignment

arXiv 2311.18495 ↗First posted 30 Nov 2023cs.LG cs.CVcited by 10

On the map: LLM alignment / RLHF / preference optimisation → Safety alignment and jailbreak attacks

Abstract (arXiv)

Neural networks are susceptible to adversarial perturbations that are transferable across different models. In this paper, we introduce a novel model alignment technique aimed at improving a given source model's ability in generating transferable adversarial perturbations. During the alignment process, the parameters of the source model are fine-tuned to minimize an alignment loss. This loss measures the divergence in the predictions between the source model and another, independently trained model, referred to as the witness model. To understand the effect of model alignment, we conduct a geometric analysis of the resulting changes in the loss landscape. Extensive experiments on the ImageNet dataset, using a variety of model architectures, demonstrate that perturbations generated from aligned source models exhibit significantly higher transferability than those from the original source model.

Key facts. Cited by 10 papers in the map (data through 13 Oct 2026). Placed in Safety alignment and jailbreak attacks, one of 10 directions in LLM alignment / RLHF / preference optimisation. Builds on 70 of its 91 references that are in the map. First posted on arXiv 30 Nov 2023.

Builds on

70 of 91 references.

References · 70

  1. 2020An Image is Worth 16x16 Words: Transformers for Image Recognition at Scalecited by 30,043
  2. 2014Very Deep Convolutional Networks for Large-Scale Image Recognitioncited by 15,321
  3. 2021Swin Transformer: Hierarchical Vision Transformer using Shifted Windowscited by 12,111
  4. 2015Distilling the Knowledge in a Neural Networkcited by 10,180
  5. 2014Explaining and Harnessing Adversarial Examplescited by 7,336
  6. 2015Batch Normalization: Accelerating Deep Network Training by Reducing Internal Covariate Shiftcited by 6,991
  7. 2016Densely Connected Convolutional Networkscited by 6,707
  8. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,379
  9. 2015Rethinking the Inception Architecture for Computer Visioncited by 5,457
  10. 2017mixup: Beyond Empirical Risk Minimizationcited by 5,170
  11. 2013Intriguing properties of neural networkscited by 5,137
  12. 2019CutMix: Regularization Strategy to Train Strong Classifiers with Localizable Featurescited by 2,882
38 more
  1. 2019RandAugment: Practical automated data augmentation with a reduced search spacecited by 2,266
  2. 2016Identity Mappings in Deep Residual Networkscited by 1,962
  3. 2014FitNets: Hints for Thin Deep Netscited by 1,631
  4. 2019Certified Adversarial Robustness via Randomized Smoothingcited by 1,336
  5. 2017Random Erasing Data Augmentationcited by 1,238
  6. 2019When Does Label Smoothing Help?cited by 986
  7. 2019Adversarial Examples Are Not Bugs, They Are Featurescited by 953
  8. 2019Relational Knowledge Distillationcited by 881
  9. 2020Fast is better than free: Revisiting adversarial trainingcited by 725
  10. 2021Do Vision Transformers See Like Convolutional Neural Networks?cited by 674
  11. 2018Improving Transferability of Adversarial Examples with Input Diversitycited by 597
  12. 2021How to train your ViT? Data, Augmentation, and Regularization in Vision Transformerscited by 566
  13. 2016Delving into Transferable Adversarial Examples and Black-box Attackscited by 536
  14. 2017Countering Adversarial Images using Input Transformationscited by 519
  15. 2017Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networkscited by 486
  16. 2019Evading Defenses to Transferable Adversarial Examples by Translation-Invariant Attackscited by 441
  17. 2018Bag of Tricks for Image Classification with Convolutional Neural Networkscited by 430
  18. 2019Nesterov Accelerated Gradient and Scale Invariance for Adversarial Attackscited by 355
  19. 2019High Frequency Component Helps Explain the Generalization of Convolutional Neural Networkscited by 310
  20. 2019A Fourier Perspective on Model Robustness in Computer Visioncited by 288
  21. 2021Enhancing the Transferability of Adversarial Attacks through Variance Tuningcited by 244
  22. 2021TrivialAugment: Tuning-free Yet State-of-the-Art Data Augmentationcited by 227
  23. 2020How Does Mixup Help With Robustness and Generalization?cited by 193
  24. 2020A Self-supervised Approach for Adversarial Robustnesscited by 180
  25. 2020Skip Connections Matter: On the Transferability of Adversarial Examples Generated with ResNetscited by 167
  26. 2021On the Robustness of Vision Transformers to Adversarial Examplescited by 167
  27. 2020Torchattacks: A PyTorch Repository for Adversarial Attackscited by 157
  28. 2021Admix: Enhancing the Transferability of Adversarial Attackscited by 156
  29. 2022Understanding The Robustness in Vision Transformerscited by 144
  30. 2020Bridging Mode Connectivity in Loss Landscapes and Adversarial Robustnesscited by 132
  31. 2018Feature Distillation: DNN-Oriented JPEG Compression Against Adversarial Examplescited by 99
  32. 2020On Success and Simplicity: A Second Look at Transferable Targeted Attackscited by 89
  33. 2021Stochastic Variance Reduced Ensemble Adversarial Attack for Boosting the Adversarial Transferabilitycited by 84
  34. 2020On Mixup Regularizationcited by 82
  35. 2021Improving Transferability of Adversarial Patches on Face Recognition with Generative Modelscited by 80
  36. 2021Towards Transferable Adversarial Attacks on Vision Transformerscited by 80
  37. 2020Backpropagating Linearly Improves Transferability of Adversarial Examplescited by 79
  38. 2020Secure and Robust Machine Learning for Healthcare: A Surveycited by 78

50 most cited of 70 All 70 (JSON)

Built on by

Cited by year (2026 to 13 Oct)

Citing papers per year: 2024: 3; 2025: 4; 2026: 3.

10 papers.

  1. 2024PAL: Proxy-Guided Black-Box Attack on Large Language Modelscited by 49
  2. 2024A Survey on Responsible Generative AI: What to Generate and What Notcited by 8
  3. 2024Transfer Attack for Bad and Good: Explain and Boost Adversarial Transferability across Multimodal Large Language Modelscited by 5
  4. 2025Boosting Adversarial Transferability with Spatial Adversarial Alignmentcited by 1
  5. 2025Enhancing Adversarial Transferability via Component-Wise Transformationcited by 1
  6. 2025Revisiting Model Inversion Evaluation: From Misleading Standards to Reliable Privacy Assessmentcited by 1
  7. 2026OTI: A Model-free and Visually Interpretable Measure of Image Attackabilitycited by 1
  8. 2025A Modern Look at Simplicity Bias in Image Classification Taskscited by 0
  9. 2026Devling into Adversarial Transferability on Image Classification: Review, Benchmark, and Evaluationcited by 0
  10. 2026Fast Preemptive Robustification: High-Frequency Response Anti-Aligns Shared Vulnerabilitycited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2026Visual-Invariance-Augmented Feature Optimal Alignment for Transferable Adversarial Attacks against Closed-Source MLLMs
  2. 2025Adversarial Attacks against Closed-Source MLLMs via Feature Optimal Alignment
  3. 2026Improving Adversarial Transferability on Vision-Language Pre-training Models via Surrogate-Specific Bias Correction
  4. 2024Adversarial Feature Alignment: Balancing Robustness and Accuracy in Deep Learning via Adversarial Training
  5. 2023Rethinking Model Ensemble in Transfer-based Adversarial Attacks
  6. 2025Boosting the Local Invariance for Better Adversarial Transferability
  7. 2026Perspective-Invariant Attack with Enhanced Transferability of Adversarial Examples
  8. 2025Understanding Adversarial Transfer: Why Representation-Space Attacks Fail Where Data-Space Attacks Succeed