mlsanityData to 14 Oct 2026

Bag of Tricks to Boost Adversarial Transferability

arXiv 2401.08734 ↗First posted 16 Jan 2024cs.CV cs.LGcited by 12

Not on the map. Why?

Abstract (arXiv)

Deep neural networks are widely known to be vulnerable to adversarial examples. However, vanilla adversarial examples generated under the white-box setting often exhibit low transferability across different models. Since adversarial transferability poses more severe threats to practical applications, various approaches have been proposed for better transferability, including gradient-based, input transformation-based, and model-related attacks, etc. In this work, we find that several tiny changes in the existing adversarial attacks can significantly affect the attack performance, eg, the number of iterations and step size. Based on careful studies of existing adversarial attacks, we propose a bag of tricks to enhance adversarial transferability, including momentum initialization, scheduled step size, dual example, spectral-based input transformation, and several ensemble strategies. Extensive experiments on the ImageNet dataset validate the high effectiveness of our proposed tricks and show that combining them can further boost adversarial transferability. Our work provides practical insights and techniques to enhance adversarial transferability, and offers guidance to improve the attack performance on the real-world application through simple adjustments.

Key facts. Cited by 12 papers in the map (data through 14 Oct 2026). Builds on 44 of its 66 references that are in the map. First posted on arXiv 16 Jan 2024.

Builds on

44 of 66 references.

References · 44

  1. 2020An Image is Worth 16x16 Words: Transformers for Image Recognition at Scalecited by 30,186
  2. 2014Very Deep Convolutional Networks for Large-Scale Image Recognitioncited by 15,364
  3. 2014Explaining and Harnessing Adversarial Examplescited by 7,364
  4. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,415
  5. 2013Intriguing properties of neural networkscited by 5,155
  6. 2017MobileNets: Efficient Convolutional Neural Networks for Mobile Vision Applicationscited by 3,845
  7. 2015Delving Deep into Rectifiers: Surpassing Human-Level Performance on ImageNet Classificationcited by 3,611
  8. 2016Towards Evaluating the Robustness of Neural Networkscited by 2,998
  9. 2016Adversarial examples in the physical worldcited by 1,769
  10. 2020Sharpness-Aware Minimization for Efficiently Improving Generalizationcited by 1,417
  11. 2018Averaging Weights Leads to Wider Optima and Better Generalizationcited by 1,209
  12. 2017Visualizing the Loss Landscape of Neural Netscited by 1,130
32 more
  1. 2020Fast is better than free: Revisiting adversarial trainingcited by 727
  2. 2019Square Attack: a query-efficient black-box adversarial attack via random searchcited by 685
  3. 2018Improving Transferability of Adversarial Examples with Input Diversitycited by 599
  4. 2016Delving into Transferable Adversarial Examples and Black-box Attackscited by 536
  5. 2017Countering Adversarial Images using Input Transformationscited by 520
  6. 2019Evading Defenses to Transferable Adversarial Examples by Translation-Invariant Attackscited by 442
  7. 2019Nesterov Accelerated Gradient and Scale Invariance for Adversarial Attackscited by 355
  8. 2017Defense against Adversarial Attacks Using High-Level Representation Guided Denoisercited by 329
  9. 2021Enhancing the Transferability of Adversarial Attacks through Variance Tuningcited by 244
  10. 2021Admix: Enhancing the Transferability of Adversarial Attackscited by 156
  11. 2019Adversarial Sensor Attack on LiDAR-based Perception in Autonomous Drivingcited by 152
  12. 2019An Exponential Learning Rate Schedule for Deep Learningcited by 121
  13. 2022Improving Adversarial Transferability via Neuron Attribution-Based Attackscited by 93
  14. 2023Rethinking Model Ensemble in Transfer-based Adversarial Attackscited by 89
  15. 2021Stochastic Variance Reduced Ensemble Adversarial Attack for Boosting the Adversarial Transferabilitycited by 84
  16. 2022Boosting the Transferability of Adversarial Attacks with Reverse Adversarial Perturbationcited by 68
  17. 2021Evaluating the Robustness of Semantic Segmentation for Autonomous Driving against Real-World Adversarial Patch Attackscited by 55
  18. 2021Boosting Adversarial Transferability through Enhanced Momentumcited by 54
  19. 2023Transferable Adversarial Attacks on Vision Transformers with Token Gradient Regularizationcited by 42
  20. 2022LGV: Boosting Adversarial Example Transferability from Large Geometric Vicinitycited by 39
  21. 2021TRS: Transferability Reduced Ensemble via Encouraging Gradient Diversity and Model Smoothnesscited by 38
  22. 2020Adversarial Example Gamescited by 34
  23. 2023Why Does Little Robustness Help? A Further Step Towards Understanding Adversarial Transferabilitycited by 32
  24. 2020Towards Frequency-Based Explanation for Robust CNNcited by 29
  25. 2022Boosting the Transferability of Adversarial Attacks with Global Momentum Initializationcited by 29
  26. 2021Can audio-visual integration strengthen robustness under multimodal attacks?cited by 23
  27. 2018To compress or not to compress: Understanding the Interactions between Adversarial Attacks and Neural Network Compressioncited by 14
  28. 2022Minimizing Maximum Model Discrepancy for Transferable Black-box Targeted Attackscited by 14
  29. 2022On the Role of Generalization in Transferability of Adversarial Examplescited by 9
  30. 2020Pick-Object-Attack: Type-Specific Adversarial Attack for Object Detectioncited by 8
  31. 2021Meta-Learning the Search Distribution of Black-Box Random Search Based Adversarial Attackscited by 7
  32. 2021Improving the Transferability of Adversarial Examples with New Iteration Framework and Input Dropoutcited by 5

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2024: 6; 2025: 5; 2026: 1.

12 papers.

  1. 2024Learning to Transform Dynamically for Better Adversarial Transferabilitycited by 23
  2. 2025Attention! Your Vision Language Model Could Be Maliciously Manipulatedcited by 12
  3. 2024Discover and Mitigate Multiple Biased Subgroups in Image Classifierscited by 11
  4. 2024Can CLIP Count Stars? An Empirical Study on Quantity Bias in CLIPcited by 9
  5. 2024Understanding Model Ensemble in Transferable Adversarial Attackcited by 7
  6. 2024Forward Learning for Gradient-based Black-box Saliency Map Generationcited by 2
  7. 2025Rethinking Audio-Visual Adversarial Vulnerability from Temporal and Modality Perspectivescited by 2
  8. 2025Boosting the Local Invariance for Better Adversarial Transferabilitycited by 2
  9. 2024Will the Inclusion of Generated Data Amplify Bias Across Generations in Future Image Classification Models?cited by 1
  10. 2025Improving the Transferability of Adversarial Attacks by an Input Transposecited by 1
  11. 2025ViT-EnsembleAttack: Augmenting Ensemble Models for Stronger Adversarial Transferability in Vision Transformerscited by 1
  12. 2026Devling into Adversarial Transferability on Image Classification: Review, Benchmark, and Evaluationcited by 0