mlsanityData to 14 Oct 2026

Learning to Transform Dynamically for Better Adversarial Transferability

arXiv 2405.14077 ↗First posted 23 May 2024cs.CV cs.AIcited by 23

Not on the map. Why?

Abstract (arXiv)

Adversarial examples, crafted by adding perturbations imperceptible to humans, can deceive neural networks. Recent studies identify the adversarial transferability across various models, textiti.e., the cross-model attack ability of adversarial samples. To enhance such adversarial transferability, existing input transformation-based methods diversify input data with transformation augmentation. However, their effectiveness is limited by the finite number of available transformations. In our study, we introduce a novel approach named Learning to Transform (L2T). L2T increases the diversity of transformed images by selecting the optimal combination of operations from a pool of candidates, consequently improving adversarial transferability. We conceptualize the selection of optimal transformation combinations as a trajectory optimization problem and employ a reinforcement learning strategy to effectively solve the problem. Comprehensive experiments on the ImageNet dataset, as well as practical tests with Google Vision and GPT-4V, reveal that L2T surpasses current methodologies in enhancing adversarial transferability, thereby confirming its effectiveness and practical significance. The code is available at https://github.com/RongyiZhu/L2T.

Key facts. Cited by 23 papers in the map (data through 14 Oct 2026). Builds on 62 of its 75 references that are in the map. First posted on arXiv 23 May 2024.

Builds on

62 of 75 references.

References · 62

  1. 2015Deep Residual Learning for Image Recognitioncited by 52,096
  2. 2020An Image is Worth 16x16 Words: Transformers for Image Recognition at Scalecited by 30,186
  3. 2021Swin Transformer: Hierarchical Vision Transformer using Shifted Windowscited by 12,139
  4. 2014ImageNet Large Scale Visual Recognition Challengecited by 8,498
  5. 2014Explaining and Harnessing Adversarial Examplescited by 7,364
  6. 2016Densely Connected Convolutional Networkscited by 6,720
  7. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,415
  8. 2015Continuous control with deep reinforcement learningcited by 3,407
  9. 2015FaceNet: A Unified Embedding for Face Recognition and Clusteringcited by 2,849
  10. 2016Aggregated Residual Transformations for Deep Neural Networkscited by 2,546
  11. 2016Adversarial examples in the physical worldcited by 1,769
  12. 2016Inception-v4, Inception-ResNet and the Impact of Residual Connections on Learningcited by 1,512
38 more
  1. 2019Certified Adversarial Robustness via Randomized Smoothingcited by 1,340
  2. 2018CosFace: Large Margin Cosine Loss for Deep Face Recognitioncited by 971
  3. 2017Ensemble Adversarial Training: Attacks and Defensescited by 840
  4. 2017ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Modelscited by 666
  5. 2018Improving Transferability of Adversarial Examples with Input Diversitycited by 599
  6. 2016Delving into Transferable Adversarial Examples and Black-box Attackscited by 536
  7. 2018Black-box Adversarial Attacks with Limited Queries and Informationcited by 501
  8. 2017Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networkscited by 486
  9. 2017Decision-Based Adversarial Attacks: Reliable Attacks Against Black-Box Machine Learning Modelscited by 462
  10. 2019Evading Defenses to Transferable Adversarial Examples by Translation-Invariant Attackscited by 442
  11. 2017Mitigating Adversarial Effects Through Randomizationcited by 383
  12. 2021Rethinking Spatial Dimensions of Vision Transformerscited by 361
  13. 2019Nesterov Accelerated Gradient and Scale Invariance for Adversarial Attackscited by 355
  14. 2017Defense against Adversarial Attacks Using High-Level Representation Guided Denoisercited by 329
  15. 2018Feature Denoising for Improving Adversarial Robustnesscited by 314
  16. 2018Certified Defenses against Adversarial Examplescited by 306
  17. 2018Generating Adversarial Examples with Adversarial Networkscited by 258
  18. 2021Enhancing the Transferability of Adversarial Attacks through Variance Tuningcited by 244
  19. 2020A Self-supervised Approach for Adversarial Robustnesscited by 180
  20. 2020Skip Connections Matter: On the Transferability of Adversarial Examples Generated with ResNetscited by 167
  21. 2018Physical Adversarial Examples for Object Detectorscited by 163
  22. 2021Admix: Enhancing the Transferability of Adversarial Attackscited by 156
  23. 2021Visformer: The Vision-friendly Transformercited by 137
  24. 2022Frequency Domain Model Augmentation for Adversarial Attackcited by 130
  25. 2018Transferable Adversarial Attacks for Image and Video Object Detectioncited by 109
  26. 2020QEBA: Query-Efficient Boundary-Based Blackbox Attackcited by 104
  27. 2018Feature Distillation: DNN-Oriented JPEG Compression Against Adversarial Examplescited by 99
  28. 2019NATTACK: Learning the Distributions of Adversarial Examples for an Improved Black-Box Attack on Deep Neural Networkscited by 94
  29. 2021Stochastic Variance Reduced Ensemble Adversarial Attack for Boosting the Adversarial Transferabilitycited by 84
  30. 2018Learning Transferable Adversarial Examples via Ghost Networkscited by 70
  31. 2023Boosting Adversarial Transferability by Block Shuffle and Rotationcited by 64
  32. 2020Trustworthy AIcited by 62
  33. 2023Structure Invariant Transformation for better Adversarial Transferabilitycited by 62
  34. 2021Boosting Adversarial Transferability through Enhanced Momentumcited by 54
  35. 2021Triangle Attack: A Query-efficient Decision-based Adversarial Attackcited by 48
  36. 2023Differentially Private Low-Rank Adaptation of Large Language Model Using Federated Learningcited by 41
  37. 2021Improving the Transferability of Adversarial Examples with Resized-Diverse-Inputs, Diversity-Ensemble and Region Fittingcited by 37
  38. 2021Direct Differentiable Augmentation Searchcited by 28

50 most cited of 62 All 62 (JSON)

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2024: 6; 2025: 13; 2026: 4.

23 papers.

Sort:

By area:

  1. 2024Semantic-Aligned Adversarial Evolution Triangle for High-Transferability Vision-Language Attackcited by 18
  2. 2025When Robots Obey the Patch: Universal Transferable Patch Attacks on Vision-Language-Action Modelscited by 13
  3. 2025Towards Model Resistant to Transferable Adversarial Examples via Trigger Activationcited by 10
  4. 2024Boosting Adversarial Transferability with Low-Cost Optimization via Maximin Expected Flatnesscited by 7
  5. 2024TASAR: Transfer-based Attack on Skeletal Action Recognitioncited by 7
  6. 2024Understanding Model Ensemble in Transferable Adversarial Attackcited by 7
  7. 2025Harnessing the Computation Redundancy in ViTs to Boost Adversarial Transferabilitycited by 4
  8. 2025Data-free Universal Adversarial Perturbation with Pseudo-semantic Priorcited by 3
  9. 2025Use as Many Surrogates as You Want: Selective Ensemble Attack to Unleash Transferability without Sacrificing Resource Efficiencycited by 2
  10. 2024S4ST: A Strong, Self-transferable, faSt, and Simple Scale Transformation for Transferable Targeted Attackcited by 1
  11. 2025Enhancing Adversarial Transferability via Component-Wise Transformationcited by 1
  12. 2025Improving the Transferability of Adversarial Attacks by an Input Transposecited by 1
11 more
  1. 2026Generative Adversarial Perturbations with Cross-paradigm Transferability on Localized Crowd Countingcited by 1
  2. 2024Enhancing Transferability of Targeted Adversarial Examples: A Self-Universal Perspectivecited by 0
  3. 2025Rethinking Target Label Conditioning in Adversarial Attacks: A 2D Tensor-Guided Generative Approachcited by 0
  4. 2025Temporal Consistency Constrained Transferable Adversarial Attacks with Background Mixup for Action Recognitioncited by 0
  5. 2025Latent Danger Zone: Distilling Unified Attention for Cross-Architecture Black-box Attackscited by 0
  6. 2025Attack logics, not outputs: Towards efficient robustification of deep neural networks by falsifying concept-based propertiescited by 0
  7. 2025Dynamic Parameter Optimization for Highly Transferable Transformation-Based Attackscited by 0
  8. 2025Enhancing Adversarial Transferability through Block Stretch and Shrinkcited by 0
  9. 2026Devling into Adversarial Transferability on Image Classification: Review, Benchmark, and Evaluationcited by 0
  10. 2026A Unified Spatial Alignment Framework for Highly Transferable Transformation-Based Attacks on Spatially Structured Taskscited by 0
  11. 2026Perspective-Invariant Attack with Enhanced Transferability of Adversarial Examplescited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2023Boosting Adversarial Transferability using Dynamic Cues
  2. 2025Boosting the Local Invariance for Better Adversarial Transferability
  3. 2026Improving Adversarial Transferability on Vision-Language Pre-training Models via Surrogate-Specific Bias Correction
  4. 2023Improving Adversarial Transferability by Stable Diffusion
  5. 2025Enhancing Adversarial Transferability in Visual-Language Pre-training Models via Local Shuffle and Sample-based Attack
  6. 2024Boosting Transferability in Vision-Language Attacks via Diversification along the Intersection Region of Adversarial Trajectory
  7. 2026Boosting Transferable Adversarial Attacks against Deep Reinforcement Learning
  8. 2025Enhancing Adversarial Transferability by Balancing Exploration and Exploitation with Gradient-Guided Sampling