Research map / Adversarial robustness and security / Black-box and transfer attacks
Improving Transferability of Adversarial Examples With Input Diversity
Check your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's title only (no summary yet). Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Add random resizing and padding during iterative attack updates | I-FGSM · ImageNet black-box models, single-network attack | success rate: 20.8% -> 53.8% | Helped |
| Add random resizing and padding to MI-FGSM | MI-FGSM · ImageNet black-box models, single-network attack from IncRes-v2 | success rate: 45.9% -> 67.4% | Helped |
| Add random input diversity to the C&W attack | C&W · ImageNet black-box models, attack from IncRes-v2 to Inc-v3 | success rate: 15.8% -> 33.9% | Helped |
| Add input diversity to MI-FGSM | MI-FGSM · NIPS 2017 competition test, Average | success rate: 66.4% -> 73.0% | Helped |
| Set transformation probability p to 0 (remove input transformations) (ablation) | M-DI²-FGSM · ImageNet ensemble attack | black-box success rate | Hurt |
| Increase transformation probability p (ablation) | DI²-FGSM and M-DI²-FGSM · ImageNet ensemble attack | white-box success rate | Hurt |
| Increase transformation probability p (ablation) | DI²-FGSM and M-DI²-FGSM · ImageNet ensemble attack | black-box success rate | Helped |
| Increase the iteration count N (ablation) | DI²-FGSM · ImageNet ensemble attack | success rate | Helped |
| Increase the iteration count N (ablation) | M-DI²-FGSM · ImageNet adversarially trained black-box models | success rate | No clear effect |
| Use a smaller step size alpha with N adjusted to reach the perturbation limit (ablation) | DI²-FGSM · ImageNet ensemble attack | white-box success rate | Helped |
| Use a smaller step size alpha with N adjusted to reach the perturbation limit (ablation) | M-DI²-FGSM · ImageNet ensemble attack | black-box success rate | Helped |
| Replace random resizing and padding with rotation or flipping (ablation) | Input-diversity attack · ImageNet transferability | success rate | Hurt |
Closest papers by meaning
- Evading Defenses to Transferable Adversarial Examples by Translation-Invariant Attacks (CVPR 2019 · similarity 0.93)
- Improving the Transferability of Adversarial Samples With Adversarial Transformations (CVPR 2021 · similarity 0.91)
- Boosting Adversarial Transferability through Augmentation in Hypothesis Space (CVPR 2025 · similarity 0.90)
- Enhancing Adversarial Transferability with Adversarial Weight Tuning (AAAI 2025 · similarity 0.90)
- Enhancing Adversarial Transferability with Checkpoints of a Single Model's Training (CVPR 2025 · similarity 0.90)
- Rethinking Model Ensemble in Transfer-based Adversarial Attacks (ICLR 2024 · similarity 0.89)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.