Research map / Adversarial robustness and security / Black-box and transfer attacks
Feature Space Perturbations Yield More Transferable Adversarial Examples
Check your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's title only (no summary yet). Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Perturb intermediate feature activations toward a target image instead of optimizing classification loss | DenseNet-121 Activation Attack · CIFAR-10 test, transfer to ResNet-50 | tSuc: 42.53 -> 75.13 | Helped |
| Perturb intermediate feature activations toward a target image instead of optimizing classification loss | VGG19bn Activation Attack · CIFAR-10 test, transfer to ResNet-50 | tSuc: 37.72 -> 55.64 | Helped |
| Perturb intermediate feature activations toward a target image instead of optimizing classification loss | DenseNet-121 Activation Attack · ImageNet (ILSVRC2012 subset), transfer to ResNet-50 | error: 47.75 -> 80.58 | Helped |
| Use the best-performing feature layer (L=21) rather than the TMIFGSM baseline | DenseNet-121 attacks · CIFAR-10 test, transfer to ResNet-50 | tTR: +32.5% | Helped |
| Use the best-performing feature layer (L=6) rather than the TMIFGSM baseline | VGG19bn attacks · CIFAR-10 test, transfer to ResNet-50 | tTR: 14.8% | Helped |
| Use feature-space perturbations on the ImageNet-trained DenseNet-121 | DenseNet-121 Activation Attack · ImageNet (ILSVRC2012 subset), transfer to ResNet-50 | tSuc: 0.3% | Helped |
| Choose the feature layer used for perturbation; layer-wise variants perform differently (ablation) | Activation Attack · CIFAR-10 test | tSuc | Mixed |
| Choose the feature layer used for perturbation; earlier layers transfer better in this model setting (ablation) | ImageNet-trained DenseNet-121 Activation Attack · ImageNet (ILSVRC2012 subset), transfer to ResNet-50 | tSuc | Mixed |
Closest papers by meaning
- Perturbing Across the Feature Hierarchy to Improve Standard and Strict Blackbox Attack Transferability (NeurIPS 2020 · similarity 0.93)
- Transferable Perturbations of Deep Feature Distributions (ICLR 2020 · similarity 0.92)
- Pixel2Feature Attack (P2FA): Rethinking the Perturbed Space to Enhance Adversarial Transferability (ICML 2025 · similarity 0.91)
- Boosting Adversarial Transferability through Augmentation in Hypothesis Space (CVPR 2025 · similarity 0.88)
- Transferable Adversarial Attacks for Object Detection Using Object-Aware Significant Feature Distortion (AAAI 2024 · similarity 0.88)
- Enhancing Adversarial Transferability with Adversarial Weight Tuning (AAAI 2025 · similarity 0.88)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.