Disrupting Semantic and Abstract Features for Better Adversarial Transferability
Not on the map. Why?
Abstract (arXiv)
Adversarial examples pose significant threats to deep neural networks (DNNs), and their property of transferability in the black-box setting has led to the emergence of transfer-based attacks, making it feasible to target real-world applications employing DNNs. Among them, feature-level attacks, where intermediate features are perturbed based on feature importance weight matrix computed from transformed images, have gained popularity. In this work, we find that existing feature-level attacks primarily manipulate the semantic information to derive the weight matrix. Inspired by several works that find CNNs tend to focus more on high-frequency components (a.k.a. abstract features, e.g., texture, edge, etc.), we validate that transforming images in the high-frequency space also improves transferability. Based on this finding, we propose a balanced approach called Semantic and Abstract FEatures disRuption (SAFER). Specifically, SAFER conducts BLOCKMIX on the input image and SELF-MIX on the frequency spectrum when computing the weight matrix to highlight crucial features. By using such a weight matrix, we can direct the attacker to disrupt both semantic and abstract features, leading to improved transferability. Extensive experiments on the ImageNet dataset also demonstrate the effectiveness of our method in boosting adversarial transferability.
Key facts. Cited by 1 paper in the map (data through 14 Oct 2026). Builds on 49 of its 61 references that are in the map. First posted on arXiv 21 Jul 2025.
Builds on
49 of 61 references.
References · 49
- 2015Deep Residual Learning for Image Recognitioncited by 52,096
- 2014Very Deep Convolutional Networks for Large-Scale Image Recognitioncited by 15,364
- 2021Swin Transformer: Hierarchical Vision Transformer using Shifted Windowscited by 12,139
- 2015Faster R-CNN: Towards Real-Time Object Detection with Region Proposal Networkscited by 9,639
- 2014Explaining and Harnessing Adversarial Examplescited by 7,364
- 2017Mask R-CNNcited by 7,277
- 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,415
- 2015Rethinking the Inception Architecture for Computer Visioncited by 5,475
- 2017mixup: Beyond Empirical Risk Minimizationcited by 5,183
- 2020Training data-efficient image transformers & distillation through attentioncited by 4,586
- 2015Fast R-CNNcited by 2,933
- 2019CutMix: Regularization Strategy to Train Strong Classifiers with Localizable Featurescited by 2,884
37 more
- 2016Inception-v4, Inception-ResNet and the Impact of Residual Connections on Learningcited by 1,512
- 2019Certified Adversarial Robustness via Randomized Smoothingcited by 1,340
- 2016Adversarial Machine Learning at Scalecited by 936
- 2017Ensemble Adversarial Training: Attacks and Defensescited by 840
- 2021Going deeper with Image Transformerscited by 764
- 2018Improving Transferability of Adversarial Examples with Input Diversitycited by 599
- 2016Delving into Transferable Adversarial Examples and Black-box Attackscited by 536
- 2018Black-box Adversarial Attacks with Limited Queries and Informationcited by 501
- 2017Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networkscited by 486
- 2019Evading Defenses to Transferable Adversarial Examples by Translation-Invariant Attackscited by 442
- 2017Mitigating Adversarial Effects Through Randomizationcited by 383
- 2021Rethinking Spatial Dimensions of Vision Transformerscited by 361
- 2019Nesterov Accelerated Gradient and Scale Invariance for Adversarial Attackscited by 355
- 2019HopSkipJumpAttack: A Query-Efficient Decision-Based Attackcited by 333
- 2019High Frequency Component Helps Explain the Generalization of Convolutional Neural Networkscited by 310
- 2019A Fourier Perspective on Model Robustness in Computer Visioncited by 288
- 2021Enhancing the Transferability of Adversarial Attacks through Variance Tuningcited by 244
- 2020A Self-supervised Approach for Adversarial Robustnesscited by 180
- 2020Skip Connections Matter: On the Transferability of Adversarial Examples Generated with ResNetscited by 167
- 2021Admix: Enhancing the Transferability of Adversarial Attackscited by 156
- 2019Enhancing Adversarial Example Transferability with an Intermediate Level Attackcited by 140
- 2021Visformer: The Vision-friendly Transformercited by 137
- 2022Frequency Domain Model Augmentation for Adversarial Attackcited by 130
- 2021Feature Importance-aware Transferable Adversarial Attackscited by 127
- 2022Improving Adversarial Transferability via Neuron Attribution-Based Attackscited by 93
- 2018Low Frequency Adversarial Perturbationcited by 80
- 2020Backpropagating Linearly Improves Transferability of Adversarial Examplescited by 79
- 2023Boosting Adversarial Transferability by Block Shuffle and Rotationcited by 64
- 2023Structure Invariant Transformation for better Adversarial Transferabilitycited by 62
- 2021Boosting Adversarial Transferability through Enhanced Momentumcited by 54
- 2023Boosting Adversarial Transferability by Achieving Flat Local Maximacited by 48
- 2019Curls & Whey: Boosting Black-Box Adversarial Attackscited by 37
- 2020Towards Frequency-Based Explanation for Robust CNNcited by 29
- 2022Boosting the Transferability of Adversarial Attacks with Global Momentum Initializationcited by 29
- 2023Rethinking the Backward Propagation for Adversarial Transferabilitycited by 27
- 2023Policy Pre-training for Autonomous Driving via Self-supervised Geometric Modelingcited by 26
- 2021Staircase Sign Method for Boosting Adversarial Attackscited by 12
Built on by
Citing papers per year: 2026: 1.
1 paper.