OTI: A Model-free and Visually Interpretable Measure of Image Attackability
Not on the map. Why?
Abstract (arXiv)
Despite the tremendous success of neural networks, benign images can be corrupted by adversarial perturbations to deceive these models. Intriguingly, images differ in their attackability. Specifically, given an attack configuration, some images are easily corrupted, whereas others are more resistant. Evaluating image attackability has important applications in active learning, adversarial training, and attack enhancement. This prompts a growing interest in developing attackability measures. However, existing methods are scarce and suffer from two major limitations: (1) They rely on a model proxy to provide prior knowledge (e.g., gradients or minimal perturbation) to extract model-dependent image features. Unfortunately, in practice, many task-specific models are not readily accessible. (2) Extracted features characterizing image attackability lack visual interpretability, obscuring their direct relationship with the images. To address these, we propose a novel Object Texture Intensity (OTI), a model-free and visually interpretable measure of image attackability, which measures image attackability as the texture intensity of the image's semantic object. Theoretically, we describe the principles of OTI from the perspectives of decision boundaries as well as the mid- and high-frequency characteristics of adversarial perturbations. Comprehensive experiments demonstrate that OTI is effective and computationally efficient. In addition, our OTI provides the adversarial machine learning community with a visual understanding of attackability.
Key facts. Cited by 1 paper in the map (data through 7 Oct 2026). Builds on 35 of its 47 references that are in the map. First posted on arXiv 24 Jan 2026.
Builds on
35 of 47 references.
References · 35
- 2016Grad-CAM: Visual Explanations from Deep Networks via Gradient-based Localizationcited by 6,690
- 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
- 2013Intriguing properties of neural networkscited by 5,114
- 2016Adversarial examples in the physical worldcited by 1,762
- 2019Kvasir-SEG: A Segmented Polyp Datasetcited by 588
- 2016Delving into Transferable Adversarial Examples and Black-box Attackscited by 530
- 2019High Frequency Component Helps Explain the Generalization of Convolutional Neural Networkscited by 310
- 2021Visual Saliency Transformercited by 175
- 2018Large Margin Deep Networks for Classificationcited by 110
- 2023A Comprehensive Study on Robustness of Image Classification Models: Benchmarking and Rethinkingcited by 85
- 2023Revisiting Adversarial Training for ImageNet: Architectures, Training and Generalization across Threat Modelscited by 79
- 2023Boosting Adversarial Transferability by Block Shuffle and Rotationcited by 64
23 more
- 2023Structure Invariant Transformation for better Adversarial Transferabilitycited by 61
- 2023Robust Principles: Architectural Design Principles for Adversarially Robust CNNscited by 46
- 2023An Adaptive Model Ensemble Adversarial Attack for Boosting Adversarial Transferabilitycited by 42
- 2022Enhancing the Self-Universality for Transferable Targeted Attackscited by 30
- 2022Boosting the Transferability of Adversarial Attacks with Global Momentum Initializationcited by 29
- 2023Logit Margin Matters: Improving Transferable Targeted Adversarial Attack by Logit Calibrationcited by 18
- 2023MimicDiffusion: Purifying Adversarial Perturbation via Mimicking Clean Diffusion Modelcited by 18
- 2024Boosting Adversarial Transferability across Model Genus by Deformation-Constrained Warpingcited by 18
- 2023Introducing Competition to Boost the Transferability of Targeted Adversarial Examples through Clean Feature Mixupcited by 17
- 2022Strong Transferable Adversarial Attacks via Ensembled Asymptotically Normal Distribution Learningcited by 15
- 2019Needles in Haystacks: On Classifying Tiny Objects in Large Imagescited by 13
- 2023Improving Adversarial Transferability via Model Alignmentcited by 10
- 2024Enhancing targeted transferability via feature space fine-tuningcited by 7
- 2024ADBA:Approximation Decision Boundary Approach for Black-Box Adversarial Attackscited by 7
- 2024SEEV: Synthesis with Efficient Exact Verification for ReLU Neural Barrier Functionscited by 7
- 2023Identifying Adversarially Attackable and Robust Samplescited by 5
- 2024Self-Supervised Representation Learning for Adversarial Attack Detectioncited by 4
- 2025AIM: Additional Image Guided Generation of Transferable Adversarial Attackscited by 4
- 2024Towards Million-Scale Adversarial Robustness Evaluation With Stronger Individual Attackscited by 3
- 2025GSBAK: top-K Geometric Score-based Black-box Attackcited by 2
- 2022Transferability Ranking of Adversarial Examplescited by 1
- 2024Universal Robustness via Median Randomized Smoothing for Real-World Super-Resolutioncited by 1
- 2025Intriguing Frequency Interpretation of Adversarial Robustness for CNNs and ViTscited by 1
Built on by
Citing papers per year: 2026: 1.
1 paper.