Research map / Adversarial robustness and security / Black-box and transfer attacks
Stochastic Variance Reduced Ensemble Adversarial Attack for Boosting the Adversarial Transferability
Check your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's title only (no summary yet). Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Add SVRE gradient-variance reduction to the ensemble attack | Ensemble attacks with I-FGSM, MI-FGSM, TIM, TI-DIM, or SI-TI-DIM · ImageNet-compatible dataset; normally trained hold-out models | average attack success rate (%): 62.83 -> 79.02; 84.13 -> 93.59; 85.98 -> 91.33; 93.28 -> 96.14; 97.08 -> 98.35 | Helped |
| Add SVRE gradient-variance reduction to the ensemble attack | Ensemble attacks with I-FGSM, MI-FGSM, TIM, TI-DIM, or SI-TI-DIM · ImageNet-compatible dataset; adversarially trained models | average attack success rate (%): 22.43 -> 34.05; 44.03 -> 54.21; 67.10 -> 84.40; 83.10 -> 93.02; 94.37 -> 97.38 | Helped |
| Add SVRE gradient-variance reduction to the ensemble attack | Ensemble attacks with I-FGSM, MI-FGSM, TIM, TI-DIM, or SI-TI-DIM · ImageNet-compatible dataset; nine defended models | average attack success rate (%): 29.39 -> 40.40; 48.78 -> 56.03; 64.16 -> 77.36; 76.99 -> 86.12; 89.82 -> 93.59 | Helped |
| Add SVRE to ensemble Admix-TI-DIM | Admix-TI-DIM · ImageNet-compatible dataset; adversarially trained models | average attack success rate (%): 95.5 -> 97.9 | Helped |
| Set internal update frequency M to 16 rather than zero (ablation) | SVRE ensemble attack · ImageNet-compatible dataset; adversarially trained models | attack success rate (%) | Helped |
| Use too many or too few inner updates (ablation) | SVRE ensemble attack · ImageNet-compatible dataset; adversarially trained models | attack success rate (%) | Hurt |
| Vary the internal step size beta (ablation) | SVRE ensemble attack · ImageNet-compatible dataset; adversarially trained models | attack success rate (%) | Mixed |
| Increase Ens-MI-FGSM gradient calculations instead of using SVRE (ablation) | Ens-MI-FGSM · ImageNet-compatible dataset; black-box adversarially trained models | attack success rate (%) | Hurt |
| Add SVRE to the ensemble attack | I-FGSM, MI-FGSM, TIM, TI-DIM, and SI-TI-DIM · ImageNet-compatible dataset; white-box models | attack success rate (%) | No clear effect |
Closest papers by meaning
- Ensemble Diversity Facilitates Adversarial Transferability (CVPR 2024 · similarity 0.89)
- A New Ensemble Adversarial Attack Powered by Long-Term Gradient Memories (AAAI 2020 · similarity 0.89)
- Rethinking Model Ensemble in Transfer-based Adversarial Attacks (ICLR 2024 · similarity 0.89)
- MORA: Improving Ensemble Robustness Evaluation with Model Reweighing Attack (NeurIPS 2022 · similarity 0.89)
- Understanding Model Ensemble in Transferable Adversarial Attack (ICML 2025 · similarity 0.88)
- Strong Transferable Adversarial Attacks via Ensembled Asymptotically Normal Distribution Learning (CVPR 2024 · similarity 0.87)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.