mlsanityData to 14 Oct 2026

Improving the Transferability of Adversarial Examples by Feature Augmentation

arXiv 2407.06714 ↗First posted 9 Jul 2024cs.CVcited by 5

Not on the map. Why?

Abstract (arXiv)

Despite the success of input transformation-based attacks on boosting adversarial transferability, the performance is unsatisfying due to the ignorance of the discrepancy across models. In this paper, we propose a simple but effective feature augmentation attack (FAUG) method, which improves adversarial transferability without introducing extra computation costs. Specifically, we inject the random noise into the intermediate features of the model to enlarge the diversity of the attack gradient, thereby mitigating the risk of overfitting to the specific model and notably amplifying adversarial transferability. Moreover, our method can be combined with existing gradient attacks to augment their performance further. Extensive experiments conducted on the ImageNet dataset across CNN and transformer models corroborate the efficacy of our method, e.g., we achieve improvement of +26.22% and +5.57% on input transformation-based attacks and combination methods, respectively.

Key facts. Cited by 5 papers in the map (data through 14 Oct 2026). Builds on 52 of its 64 references that are in the map. First posted on arXiv 9 Jul 2024.

Builds on

52 of 64 references.

References · 52

  1. 2015Deep Residual Learning for Image Recognitioncited by 52,096
  2. 2020An Image is Worth 16x16 Words: Transformers for Image Recognition at Scalecited by 30,186
  3. 2014Very Deep Convolutional Networks for Large-Scale Image Recognitioncited by 15,364
  4. 2021Swin Transformer: Hierarchical Vision Transformer using Shifted Windowscited by 12,139
  5. 2015Faster R-CNN: Towards Real-Time Object Detection with Region Proposal Networkscited by 9,639
  6. 2023Segment Anythingcited by 8,234
  7. 2020End-to-End Object Detection with Transformerscited by 7,414
  8. 2014Explaining and Harnessing Adversarial Examplescited by 7,364
  9. 2017Mask R-CNNcited by 7,277
  10. 2016Densely Connected Convolutional Networkscited by 6,720
  11. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,415
  12. 2017mixup: Beyond Empirical Risk Minimizationcited by 5,183
38 more
  1. 2013Intriguing properties of neural networkscited by 5,155
  2. 2016Towards Evaluating the Robustness of Neural Networkscited by 2,998
  3. 2019CutMix: Regularization Strategy to Train Strong Classifiers with Localizable Featurescited by 2,884
  4. 2016Aggregated Residual Transformations for Deep Neural Networkscited by 2,546
  5. 2016Adversarial examples in the physical worldcited by 1,769
  6. 2017Improved Regularization of Convolutional Neural Networks with Cutoutcited by 1,628
  7. 2017Ensemble Adversarial Training: Attacks and Defensescited by 840
  8. 2019Square Attack: a query-efficient black-box adversarial attack via random searchcited by 685
  9. 2018Improving Transferability of Adversarial Examples with Input Diversitycited by 599
  10. 2017Countering Adversarial Images using Input Transformationscited by 520
  11. 2019Evading Defenses to Transferable Adversarial Examples by Translation-Invariant Attackscited by 442
  12. 2017Mitigating Adversarial Effects Through Randomizationcited by 383
  13. 2021Rethinking Spatial Dimensions of Vision Transformerscited by 361
  14. 2019Nesterov Accelerated Gradient and Scale Invariance for Adversarial Attackscited by 355
  15. 2017Defense against Adversarial Attacks Using High-Level Representation Guided Denoisercited by 329
  16. 2018Generating Adversarial Examples with Adversarial Networkscited by 258
  17. 2021Understanding Robustness of Transformers for Image Classificationcited by 249
  18. 2021Enhancing the Transferability of Adversarial Attacks through Variance Tuningcited by 244
  19. 2021Data Augmentation Can Improve Robustnesscited by 194
  20. 2020A Self-supervised Approach for Adversarial Robustnesscited by 180
  21. 2020Torchattacks: A PyTorch Repository for Adversarial Attackscited by 158
  22. 2021Admix: Enhancing the Transferability of Adversarial Attackscited by 156
  23. 2021Visformer: The Vision-friendly Transformercited by 137
  24. 2022Frequency Domain Model Augmentation for Adversarial Attackcited by 130
  25. 2021Dual Attention Suppression Attack: Generate Adversarial Camouflage in Physical Worldcited by 127
  26. 2021Feature Importance-aware Transferable Adversarial Attackscited by 127
  27. 2018Feature Distillation: DNN-Oriented JPEG Compression Against Adversarial Examplescited by 99
  28. 2022Improving Adversarial Transferability via Neuron Attribution-Based Attackscited by 93
  29. 2023Rethinking Model Ensemble in Transfer-based Adversarial Attackscited by 89
  30. 2021Stochastic Variance Reduced Ensemble Adversarial Attack for Boosting the Adversarial Transferabilitycited by 84
  31. 2018GenAttack: Practical Black-box Attacks with Gradient-Free Optimizationcited by 82
  32. 2021FCA: Learning a 3D Full-coverage Vehicle Camouflage for Multi-view Physical Adversarial Attackcited by 74
  33. 2019FDA: Feature Disruptive Attackcited by 56
  34. 2019Certified Robustness for Top-k Predictions against Adversarial Perturbations via Randomized Smoothingcited by 54
  35. 2023RFLA: A Stealthy Reflected Light Adversarial Attack in the Physical Worldcited by 23
  36. 2022Minimizing Maximum Model Discrepancy for Transferable Black-box Targeted Attackscited by 14
  37. 2023StyLess: Boosting the Transferability of Adversarial Examplescited by 11
  38. 2022Differential Evolution based Dual Adversarial Camouflage: Fooling Human Eyes and Object Detectorscited by 6

50 most cited of 52 All 52 (JSON)

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2025: 2; 2026: 3.

5 papers.

  1. 2025Adversarial Attacks Leverage Interference Between Features in Superpositioncited by 8
  2. 2025Enhancing Adversarial Transferability through Block Stretch and Shrinkcited by 0
  3. 2026Devling into Adversarial Transferability on Image Classification: Review, Benchmark, and Evaluationcited by 0
  4. 2026Fast Preemptive Robustification: High-Frequency Response Anti-Aligns Shared Vulnerabilitycited by 0
  5. 2026Learning with Bilevel-Minimax Optimization for Efficient and Reliable Transfer Attackscited by 0