mlsanityData to 7 Oct 2026

Texture Re-scalable Universal Adversarial Perturbation

arXiv 2406.06089 ↗First posted 10 Jun 2024cs.CVcited by 9

Not on the map. Why?

Abstract (arXiv)

Universal adversarial perturbation (UAP), also known as image-agnostic perturbation, is a fixed perturbation map that can fool the classifier with high probabilities on arbitrary images, making it more practical for attacking deep models in the real world. Previous UAP methods generate a scale-fixed and texture-fixed perturbation map for all images, which ignores the multi-scale objects in images and usually results in a low fooling ratio. Since the widely used convolution neural networks tend to classify objects according to semantic information stored in local textures, it seems a reasonable and intuitive way to improve the UAP from the perspective of utilizing local contents effectively. In this work, we find that the fooling ratios significantly increase when we add a constraint to encourage a small-scale UAP map and repeat it vertically and horizontally to fill the whole image domain. To this end, we propose texture scale-constrained UAP (TSC-UAP), a simple yet effective UAP enhancement method that automatically generates UAPs with category-specific local textures that can fool deep models more easily. Through a low-cost operation that restricts the texture scale, TSC-UAP achieves a considerable improvement in the fooling ratio and attack transferability for both data-dependent and data-free UAP methods. Experiments conducted on two state-of-the-art UAP methods, eight popular CNN models and four classical datasets show the remarkable performance of TSC-UAP.

Key facts. Cited by 9 papers in the map (data through 7 Oct 2026). Builds on 53 of its 67 references that are in the map. First posted on arXiv 10 Jun 2024.

Builds on

53 of 67 references.

References · 53

  1. 2015Deep Residual Learning for Image Recognitioncited by 51,809
  2. 2020An Image is Worth 16x16 Words: Transformers for Image Recognition at Scalecited by 29,915
  3. 2014Very Deep Convolutional Networks for Large-Scale Image Recognitioncited by 15,267
  4. 2021Swin Transformer: Hierarchical Vision Transformer using Shifted Windowscited by 12,082
  5. 2014ImageNet Large Scale Visual Recognition Challengecited by 8,441
  6. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  7. 2017Mask R-CNNcited by 7,259
  8. 2016Densely Connected Convolutional Networkscited by 6,691
  9. 2016Grad-CAM: Visual Explanations from Deep Networks via Gradient-based Localizationcited by 6,690
  10. 2019EfficientNet: Rethinking Model Scaling for Convolutional Neural Networkscited by 6,415
  11. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  12. 2013Intriguing properties of neural networkscited by 5,114
38 more
  1. 2018MobileNetV2: Inverted Residuals and Linear Bottleneckscited by 4,773
  2. 2014Going Deeper with Convolutionscited by 4,231
  3. 2016Towards Evaluating the Robustness of Neural Networkscited by 2,976
  4. 2015Fast R-CNNcited by 2,930
  5. 2020Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attackscited by 1,442
  6. 2018ImageNet-trained CNNs are biased towards texture; increasing shape bias improves accuracy and robustnesscited by 1,430
  7. 2015DeepFool: a simple and accurate method to fool deep neural networkscited by 1,315
  8. 2019EfficientDet: Scalable and Efficient Object Detectioncited by 1,018
  9. 2022YOLOv7: Trainable bag-of-freebies sets new state-of-the-art for real-time object detectorscited by 978
  10. 2016Adversarial Machine Learning at Scalecited by 934
  11. 2016Universal adversarial perturbationscited by 774
  12. 2021Image Segmentation Using Text and Image Promptscited by 509
  13. 2022Diffusion Models for Adversarial Purificationcited by 469
  14. 2022AMOS: A Large-Scale Abdominal Multi-Organ Benchmark for Versatile Medical Image Segmentationcited by 347
  15. 2021ResMLP: Feedforward networks for image classification with data-efficient trainingcited by 338
  16. 2021Are Transformers More Robust Than CNNs?cited by 187
  17. 2017Generative Adversarial Perturbationscited by 153
  18. 2023On the Adversarial Robustness of Multi-Modal Foundation Modelscited by 142
  19. 2022Towards Large-Scale Small Object Detection: Survey and Benchmarkscited by 119
  20. 2022MMRotate: A Rotated Object Detection Benchmark using PyTorchcited by 115
  21. 2022ReSTR: Convolution-free Referring Image Segmentation Using Transformerscited by 112
  22. 2018Universal Adversarial Trainingcited by 85
  23. 2017Fast Feature Fool: A data independent approach to universal adversarial perturbationscited by 65
  24. 2020Understanding Adversarial Examples from the Mutual Influence of Images and Perturbationscited by 59
  25. 2021A Survey On Universal Adversarial Attackcited by 59
  26. 2017NAG: Network for Adversary Generationcited by 51
  27. 2017Art of singular vectors and universal adversarial perturbationscited by 49
  28. 2017Defense against Universal Adversarial Perturbationscited by 48
  29. 2023Personalization as a Shortcut for Few-Shot Backdoor Attack against Text-to-Image Diffusion Modelscited by 42
  30. 2023OT-Attack: Enhancing Adversarial Transferability of Vision-Language Models via Optimal Transport Optimizationcited by 36
  31. 2024Boosting Transferability in Vision-Language Attacks via Diversification along the Intersection Region of Adversarial Trajectorycited by 35
  32. 2023Improving Fast Adversarial Training with Prior-Guided Knowledgecited by 34
  33. 2018Defending Against Universal Perturbations With Shared Adversarial Trainingcited by 25
  34. 2019Walking on the Edge: Fast, Low-Distortion Adversarial Examplescited by 18
  35. 2023Black-box Adversarial Example Attack towards FCG Based Android Malware Detection under Incomplete Feature Informationcited by 13
  36. 2023A Closer Look at the Adversarial Robustness of Deep Equilibrium Modelscited by 13
  37. 2022ALA: Naturalness-aware Adversarial Lightness Attackcited by 11
  38. 2021AdvFilter: Predictive Perturbation-aware Filtering against Adversarial Attack via Multi-domain Learningcited by 9

50 most cited of 53 All 53 (JSON)

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2024: 3; 2025: 4; 2026: 2.

9 papers.

  1. 2024Perception-guided Jailbreak against Text-to-Image Modelscited by 37
  2. 2024Heuristic-Induced Multimodal Risk Distribution Jailbreak Attack for Multimodal Large Language Modelscited by 29
  3. 2025Token-Level Constraint Boundary Search for Jailbreaking Text-to-Image Modelscited by 9
  4. 2026Unveiling the Fragility of Vision-Language Models: Multi-Modal Adversarial Synergy via Texture-Constrained Perturbations and Cross-Modal Optimizationcited by 9
  5. 2025Evolution-based Region Adversarial Prompt Learning for Robustness Enhancement in Vision-Language Modelscited by 6
  6. 2024Efficient and Effective Universal Adversarial Attack against Vision-Language Pre-training Modelscited by 4
  7. 2025Scale-Invariant Adversarial Attack against Arbitrary-scale Super-resolutioncited by 3
  8. 2025PATFinger: Prompt-Adapted Transferable Fingerprinting against Unauthorized Multimodal Dataset Usagecited by 1
  9. 2026Generating Multi-view Adversarial Examples for Visual Geometry Grounded Transformercited by 0