Perspective-Invariant Attack with Enhanced Transferability of Adversarial Examples

arXiv 2608.15115 ↗First posted 15 Aug 2026cs.CVcited by 0

Not on the map. Why?

Abstract (arXiv)

Adversarial examples generated on a surrogate deep neural network (DNN) can often successfully fool other black-box DNN models. This cross-model transferability poses serious security threats to DNNs in practical applications. Input transformation techniques are widely used to enhance adversarial transferability by increasing the diversity of input images. However, existing methods primarily rely on local operations with limited degrees of freedom (DOF), such as block-wise shuffling and resizing, overlooking global perspective transformations that naturally arise from viewpoint changes. In this work, we propose a Perspective-Invariant Attack (PIA), which introduces a multi-DOF vertex sampling strategy that systematically covers the perspective transformation hierarchy from 2-DOF translation to 8-DOF projective mapping. By generating geometrically diverse input variations, PIA effectively reduces overfitting of adversarial perturbations to the surrogate model, thereby improving adversarial transferability. We further propose PIA-Mix, a generic extension that maintains a complementary transformation pool and efficiently combines our perspective transformation with auxiliary methods for improved transferability. Extensive experiments involving various DNN architectures, advanced defense mechanisms, and multimodal large language models (LLMs) demonstrate that PIA and PIA-Mix outperform state-of-the-art transfer-based attacks.

Key facts. No citing papers in the map yet (data through 14 Oct 2026). Builds on 50 of its 60 references that are in the map. First posted on arXiv 15 Aug 2026.

Builds on

50 of 60 references.

References · 50

2015Deep Residual Learning for Image Recognitioncited by 52,096
2020An Image is Worth 16x16 Words: Transformers for Image Recognition at Scalecited by 30,186
2015U-Net: Convolutional Networks for Biomedical Image Segmentationcited by 19,713
2014ImageNet Large Scale Visual Recognition Challengecited by 8,498
2014Explaining and Harnessing Adversarial Examplescited by 7,364
2016Densely Connected Convolutional Networkscited by 6,720
2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,415
2015Rethinking the Inception Architecture for Computer Visioncited by 5,475
2013Intriguing properties of neural networkscited by 5,155
2018MobileNetV2: Inverted Residuals and Linear Bottleneckscited by 4,795
2016Towards Evaluating the Robustness of Neural Networkscited by 2,998
2015FaceNet: A Unified Embedding for Face Recognition and Clusteringcited by 2,849

38 more

2016Adversarial examples in the physical worldcited by 1,769
2019Certified Adversarial Robustness via Randomized Smoothingcited by 1,340
2015DeepFool: a simple and accurate method to fool deep neural networkscited by 1,318
2017Ensemble Adversarial Training: Attacks and Defensescited by 840
2020Fast is better than free: Revisiting adversarial trainingcited by 727
2018Improving Transferability of Adversarial Examples with Input Diversitycited by 599
2016Delving into Transferable Adversarial Examples and Black-box Attackscited by 536
2018Black-box Adversarial Attacks with Limited Queries and Informationcited by 501
2021ConViT: Improving Vision Transformers with Soft Convolutional Inductive Biasescited by 484
2022Diffusion Models for Adversarial Purificationcited by 476
2021LeViT: a Vision Transformer in ConvNet's Clothing for Faster Inferencecited by 475
2017Decision-Based Adversarial Attacks: Reliable Attacks Against Black-Box Machine Learning Modelscited by 462
2019Evading Defenses to Transferable Adversarial Examples by Translation-Invariant Attackscited by 442
2021Rethinking Spatial Dimensions of Vision Transformerscited by 361
2019Nesterov Accelerated Gradient and Scale Invariance for Adversarial Attackscited by 355
2017Defense against Adversarial Attacks Using High-Level Representation Guided Denoisercited by 329
2020A Self-supervised Approach for Adversarial Robustnesscited by 180
2020Skip Connections Matter: On the Transferability of Adversarial Examples Generated with ResNetscited by 167
2021Admix: Enhancing the Transferability of Adversarial Attackscited by 156
2017Generative Adversarial Perturbationscited by 153
2019Enhancing Adversarial Example Transferability with an Intermediate Level Attackcited by 140
2022Frequency Domain Model Augmentation for Adversarial Attackcited by 130
2021Feature Importance-aware Transferable Adversarial Attackscited by 127
2022Improving Adversarial Transferability via Neuron Attribution-Based Attackscited by 93
2019Cross-Domain Transferability of Adversarial Perturbationscited by 92
2020On Success and Simplicity: A Second Look at Transferable Targeted Attackscited by 89
2020Backpropagating Linearly Improves Transferability of Adversarial Examplescited by 79
2020DVERGE: Diversifying Vulnerabilities for Enhanced Robust Generation of Ensemblescited by 73
2018Learning Transferable Adversarial Examples via Ghost Networkscited by 70
2019Improving Adversarial Robustness of Ensembles with Diversity Trainingcited by 69
2023Boosting Adversarial Transferability by Block Shuffle and Rotationcited by 64
2023Structure Invariant Transformation for better Adversarial Transferabilitycited by 62
2023AdvDiff: Generating Unrestricted Adversarial Examples using Diffusion Modelscited by 46
2024Learning to Transform Dynamically for Better Adversarial Transferabilitycited by 23
2024Boosting Adversarial Transferability across Model Genus by Deformation-Constrained Warpingcited by 18
2023StyLess: Boosting the Transferability of Adversarial Examplescited by 11
2025UV-Attack: Physical-World Adversarial Attacks for Person Detection via Dynamic-NeRF-based UV Mappingcited by 9
2024Improving Transferable Targeted Attacks with Feature Tuning Mixupcited by 6

Built on by

Not cited yet.

Similar, not cited

Close in wording, no citation either way