Research map / Adversarial robustness and security / Black-box and transfer attacks
Delving into Transferable Adversarial Examples and Black-box Attacks
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's title only (no summary yet). Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Generate non-targeted adversarial examples by optimizing against an ensemble rather than one model | ImageNet classifiers · ImageNet non-targeted transfer | accuracy: at most 6% for models outside the ensemble; single-model approaches are at least 12% | Helped |
| Generate targeted adversarial examples by optimizing against an ensemble rather than one model | ImageNet classifiers · ImageNet targeted transfer | matching rate: 2% -> 38% | Helped |
| Use ensemble optimization instead of VGG-16-only optimization | Clarifai targeted attack · Clarifai labels close to target | matching rate: 2% -> 18% | Helped |
| Use FG instead of optimization-based generation | Single-model non-targeted attacks · ImageNet non-targeted transfer | accuracy: ResNet-152 → ResNet-101: 13% -> 13%; ResNet-152 self accuracy: 0% -> 4% | Mixed |
| Use FGS instead of FG | Single-model non-targeted attacks · ImageNet non-targeted transfer | accuracy: ResNet-152 → ResNet-101: 13% -> 27% | Hurt |
| Increase single-model targeted optimization distortion by using a larger learning rate | Single-model targeted attacks · ImageNet targeted transfer | matching rate: ResNet-152 → ResNet-101: 2% -> 8% | No clear effect |
| Use a one-dimensional fast-gradient search for targeted ensemble attacks instead of ensemble optimization | Ensemble targeted attacks · ImageNet targeted transfer | matching rate: no better than single-model fast-gradient approaches | Hurt |
| Add Gaussian noise instead of using an adversarial attack | ImageNet classifiers · ImageNet non-targeted fooling | accuracy: at RMSD 23.59, accuracy remains 83.10% on ResNet-152 | Hurt |
| Remove ResNet-152 from the targeted ensemble (ablation) | Ensemble optimization · ImageNet targeted transfer to ResNet-152 | matching rate: 38% | Helped |
| Remove ResNet-101 from the targeted ensemble (ablation) | Ensemble optimization · ImageNet targeted transfer to ResNet-101 | matching rate: 43% | Helped |
| Remove ResNet-50 from the targeted ensemble (ablation) | Ensemble optimization · ImageNet targeted transfer to ResNet-50 | matching rate: 46% | Helped |
| Remove VGG-16 from the targeted ensemble (ablation) | Ensemble optimization · ImageNet targeted transfer to VGG-16 | matching rate: 24% | Helped |
Closest papers by meaning
- Towards Transferable Targeted Adversarial Examples (CVPR 2023 · similarity 0.95)
- Towards Transferable Targeted Attack (CVPR 2020 · similarity 0.94)
- Rethinking Model Ensemble in Transfer-based Adversarial Attacks (ICLR 2024 · similarity 0.91)
- Boosting Adversarial Transferability through Augmentation in Hypothesis Space (CVPR 2025 · similarity 0.90)
- Understanding Model Ensemble in Transferable Adversarial Attack (ICML 2025 · similarity 0.90)
- Transferability Bound Theory: Exploring Relationship between Adversarial Transferability and Flatness (NeurIPS 2024 · similarity 0.88)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.