Research map / Adversarial robustness and security / Black-box and transfer attacks
Learning Transferable Adversarial Examples via Ghost Networks
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's title only (no summary yet). Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Add Ghost Networks to the No.1 competition submission | No.1 Submission · NeurIPS 2017 black-box average | attack rate (%): 33.57 -> 39.59 | Helped |
| Add Ghost Networks to the No.1 competition submission | No.1 Submission · NeurIPS 2017 white-box average | attack rate (%): 94.90 -> 96.37 | Helped |
| Add Ghost Networks to I-FGSM | I-FGSM · Res-50 hold-out | attack rate (%): 71.08 -> 80.22 | Helped |
| Add Ghost Networks to MI-FGSM | MI-FGSM · Res-50 hold-out | attack rate (%): 79.32 -> 87.14 | Helped |
| Replace the base model with one eroded ghost model (ablation) | MI-FGSM single-model attack · ILSVRC 2012 validation, black-box average | attack rate (%): 29.4 -> 17.4 | Hurt |
| Add a longitudinal ensemble of 10 ghost models (ablation) | MI-FGSM single-model attack · ILSVRC 2012 validation, black-box average | attack rate (%): 29.4 -> 39.4 | Helped |
| Use standard ensembling of 10 ghost models instead of the base model (ablation) | MI-FGSM single-model attack · ILSVRC 2012 validation, black-box average | attack rate (%): 29.4 -> 44.5 | Helped |
| Combine standard and longitudinal ensembling of ghost models (ablation) | MI-FGSM single-model attack · ILSVRC 2012 validation, black-box average | attack rate (%): 29.4 -> 50.6 | Helped |
| Use 30 intrinsic ghost models from one base model rather than three independently trained models (ablation) | MI-FGSM multi-model attack · ILSVRC 2012 validation, average attack rate | attack rate (%): 46.8 -> 52.5 | Helped |
| Add three independently trained base models to the ghost-network multi-model setup (ablation) | MI-FGSM multi-model attack · ILSVRC 2012 validation, average attack rate | attack rate (%): 52.5 -> 54.3 | Helped |
| Increase the erosion magnitude (ablation) | Ghost Networks · ILSVRC 2012 validation | top-1 classification accuracy | Hurt |
Closest papers by meaning
- Rethinking Model Ensemble in Transfer-based Adversarial Attacks (ICLR 2024 · similarity 0.90)
- Understanding Model Ensemble in Transferable Adversarial Attack (ICML 2025 · similarity 0.88)
- Boosting Adversarial Transferability through Augmentation in Hypothesis Space (CVPR 2025 · similarity 0.88)
- Enhancing Adversarial Transferability with Checkpoints of a Single Model's Training (CVPR 2025 · similarity 0.87)
- Enhancing Adversarial Transferability with Adversarial Weight Tuning (AAAI 2025 · similarity 0.87)
- Wide Two-Layer Networks can Learn from Adversarial Perturbations (NeurIPS 2024 · similarity 0.87)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.