# Improving Integrated Gradient-based Transferable Adversarial Examples by Refining the Integration Path

arXiv: https://arxiv.org/abs/2412.18844 · HTML: https://mlsanity.com/paper/2412.18844/

## Key facts

- Cited by 10 papers in the map (data through 14 Oct 2026).
- Builds on 12 of its 44 references that are in the map.
- First posted on arXiv 25 Dec 2024.

## Builds on (most cited first, 12 of 12)

- [An Image is Worth 16x16 Words: Transformers for Image Recognition at Scale](https://mlsanity.com/paper/2010.11929/) (2020)
- [MobileNets: Efficient Convolutional Neural Networks for Mobile Vision Applications](https://mlsanity.com/paper/1704.04861/) (2017)
- [Axiomatic Attribution for Deep Networks](https://mlsanity.com/paper/1703.01365/) (2017)
- [Ensemble Adversarial Training: Attacks and Defenses](https://mlsanity.com/paper/1705.07204/) (2017)
- [Delving into Transferable Adversarial Examples and Black-box Attacks](https://mlsanity.com/paper/1611.02770/) (2016)
- [Countering Adversarial Images using Input Transformations](https://mlsanity.com/paper/1711.00117/) (2017)
- [Decision-Based Adversarial Attacks: Reliable Attacks Against Black-Box Machine Learning Models](https://mlsanity.com/paper/1712.04248/) (2017)
- [Skip Connections Matter: On the Transferability of Adversarial Examples Generated with ResNets](https://mlsanity.com/paper/2002.05990/) (2020)
- [On Success and Simplicity: A Second Look at Transferable Targeted Attacks](https://mlsanity.com/paper/2012.11207/) (2020)
- [Content-based Unrestricted Adversarial Attack](https://mlsanity.com/paper/2305.10665/) (2023)
- [Transferable Adversarial Attack based on Integrated Gradients](https://mlsanity.com/paper/2205.13152/) (2022)
- [Revisiting Transferable Adversarial Images: Systemization, Evaluation, and New Insights](https://mlsanity.com/paper/2310.11850/) (2023)

## Built on by (most cited first, 10 of 10)

- [Improving Adversarial Transferability on Vision Transformers via Forward Propagation Refinement](https://mlsanity.com/paper/2503.15404/) (2025)
- [Boosting the Local Invariance for Better Adversarial Transferability](https://mlsanity.com/paper/2503.06140/) (2025)
- [Path-Weighted Integrated Gradients for Interpretable Dementia Classification](https://mlsanity.com/paper/2509.17491/) (2025)
- [The Power of Decaying Steps: Enhancing Attack Stability and Transferability for Sign-based Optimizers](https://mlsanity.com/paper/2602.19096/) (2026)
- [Latent Danger Zone: Distilling Unified Attention for Cross-Architecture Black-box Attacks](https://mlsanity.com/paper/2509.19044/) (2025)
- [Beyond Deceptive Flatness: Dual-Order Solution for Strengthening Adversarial Transferability](https://mlsanity.com/paper/2511.01240/) (2025)
- [Devling into Adversarial Transferability on Image Classification: Review, Benchmark, and Evaluation](https://mlsanity.com/paper/2602.23117/) (2026)
- [FRInGe: Distribution-Space Integrated Gradients with Fisher--Rao Geometry](https://mlsanity.com/paper/2605.06404/) (2026)
- [Towards Universal Physical Adversarial Attacks via a Joint Multi-Objective and Multi-Model Optimization Framework](https://mlsanity.com/paper/2605.17772/) (2026)
- [On Success and Simplicity: A Second Look at Transferable Vision-Language Attack Pipeline](https://mlsanity.com/paper/2607.14974/) (2026)

## Abstract (arXiv)

Transferable adversarial examples are known to cause threats in practical, black-box attack scenarios. A notable approach to improving transferability is using integrated gradients (IG), originally developed for model interpretability. In this paper, we find that existing IG-based attacks have limited transferability due to their naive adoption of IG in model interpretability. To address this limitation, we focus on the IG integration path and refine it in three aspects: multiplicity, monotonicity, and diversity, supported by theoretical analyses. We propose the Multiple Monotonic Diversified Integrated Gradients (MuMoDIG) attack, which can generate highly transferable adversarial examples on different CNN and ViT models and defenses. Experiments validate that MuMoDIG outperforms the latest IG-based attack by up to 37.3% and other state-of-the-art attacks by 8.4%. In general, our study reveals that migrating established techniques to improve transferability may require non-trivial efforts. Code is available at urlhttps://github.com/RYC-98/MuMoDIG.