Research map / Adversarial robustness and security / Black-box and transfer attacks
Transferable Perturbations of Deep Feature Distributions
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's title only (no summary yet). Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use intermediate class-wise feature distributions rather than output-layer information | FDA targeted transfer attacks · ImageNet-1k, 1000-class transfers | tSuc: tmim: 1.4; FDA: 15.5 | Helped |
| Add source-class probability minimization to FDA (ablation) | FDA · ImageNet-1k, 1000-class transfers | error: FDA: 64.9 -> 91.9 | Helped |
| Add feature-disruption term to FDA (ablation) | FDA · ImageNet-1k, 1000-class transfers | tSuc: FDA: 15.5 -> 29.0 | Helped |
| Add source-class probability minimization (ablation) | FDA · ImageNet-1k, 1000-class transfers | error: FDA: 56.4 -> 87.3 | Helped |
| Add feature-disruption term (ablation) | FDA · ImageNet-1k, 1000-class transfers | tSuc: FDA: 12.6 -> 24.3 | Helped |
| Choose an intermediate feature layer instead of the logit layer | FDA+fd · ImageNet-1k targeted transfer | tSuc: DN121 l=7: 34%; VGG19 l=5: 2.3%; RN50 l=8: 18% | Helped |
| Include a term encouraging movement away from the starting feature representation (ablation) | Targeted FDA variants · ImageNet-1k targeted transfer | tSuc | Helped |
| Add feature disruption to untargeted FDA (ablation) | uFDA · ImageNet-1k untargeted transfer to VGG19 | error: 37%; 9% higher than the best baseline at ε=4/255; 79%; 27% higher at ε=8/255 | Helped |
| Use uFDA without a feature-disruption term (ablation) | Untargeted FDA · ImageNet-1k untargeted transfer to VGG19 | error | Hurt |
| Perturb features at an early layer rather than an optimal intermediate layer | FDA+fd · ImageNet-1k targeted transfer | tSuc | Hurt |
| Generate transfer perturbations from VGG19 rather than DN121 or RN50 | FDA+fd · ImageNet-1k targeted transfer | tSuc: VGG19: 2.3%; DN121: 34%; RN50: 18% | Hurt |
Closest papers by meaning
- Perturbing Across the Feature Hierarchy to Improve Standard and Strict Blackbox Attack Transferability (NeurIPS 2020 · similarity 0.93)
- Feature Space Perturbations Yield More Transferable Adversarial Examples (CVPR 2019 · similarity 0.92)
- Pixel2Feature Attack (P2FA): Rethinking the Perturbed Space to Enhance Adversarial Transferability (ICML 2025 · similarity 0.89)
- Enhancing Adversarial Transferability with Adversarial Weight Tuning (AAAI 2025 · similarity 0.89)
- Enhancing Adversarial Transferability with Checkpoints of a Single Model's Training (CVPR 2025 · similarity 0.89)
- Rethinking Model Ensemble in Transfer-based Adversarial Attacks (ICLR 2024 · similarity 0.88)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.