Research map / Adversarial robustness and security / Black-box and transfer attacks
Beyond ImageNet Attack: Towards Crafting Adversarial Examples for Black-box Domains
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's title only (no summary yet). Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use low-level feature disruption to train the generator instead of a domain-specific classification loss | ImageNet-trained BIA transferred to CIFAR-10 · CIFAR-10 | top-1 accuracy after attack: 66.41 -> 57.38 | Helped |
| Add random normalization to simulate input-distribution variation (ablation) | BIA trained against VGG-16 · CIFAR-10 | top-1 accuracy after attack: 57.38 -> 52.81 | Helped |
| Add domain-agnostic attention to weight essential intermediate features (ablation) | BIA trained against Dense-169 · Fine-grained domains (average) | top-1 accuracy after attack: 29.23 -> 20.75 | Helped |
| Add domain-agnostic attention (ablation) | BIA trained against Dense-169 · ImageNet (average) | top-1 accuracy after attack: 12.05 -> 7.34 | Helped |
| Add common label-preserving data augmentation (ablation) | BIA trained against VGG-19 · Fine-grained domains (average) | top-1 accuracy after attack: 58.71 -> 62.29 | Hurt |
| Use random normalization rather than common data augmentation (ablation) | BIA trained against VGG-19 · Fine-grained domains (average) | top-1 accuracy after attack: 62.29 -> 47.78 | Helped |
| Add both domain-agnostic attention and random normalization (ablation) | BIA trained against VGG-16 · Coarse-grained domains | top-1 accuracy after attack | Mixed |
| Add both domain-agnostic attention and random normalization (ablation) | BIA trained against Res-152 · Fine-grained domains | top-1 accuracy after attack: 35.75% | Helped |
| Increase the random-normalization standard-deviation mean from 0.25 to 0.75 (ablation) | BIA + random normalization trained against VGG-16 · Fine-grained domains (average) | top-1 accuracy after attack: 3.16% | Helped |
| Attack a shallow or middle feature layer rather than a deep layer (ablation) | BIA generator trained against Res-152 · Coarse- and fine-grained domains | top-1 accuracy after attack | Mixed |
| Train against an ensemble of models instead of VGG-16 alone (ablation) | BIA · CIFAR-10 | top-1 accuracy after attack: 57.38 -> 54.96 | Helped |
| Train against an ensemble of models instead of VGG-16 alone (ablation) | BIA + random normalization · CIFAR-100 | top-1 accuracy after attack: 20.82 -> 22.35 | Hurt |
Closest papers by meaning
- Black-Box Adversarial Attack with Transferable Model-based Embedding (ICLR 2020 · similarity 0.91)
- Cross-Domain Transferability of Adversarial Perturbations (NeurIPS 2019 · similarity 0.91)
- Evading Defenses to Transferable Adversarial Examples by Translation-Invariant Attacks (CVPR 2019 · similarity 0.90)
- Improving Transferability of Adversarial Examples With Input Diversity (CVPR 2019 · similarity 0.90)
- Perturbing Across the Feature Hierarchy to Improve Standard and Strict Blackbox Attack Transferability (NeurIPS 2020 · similarity 0.90)
- Black-box Adversarial Attacks with Limited Queries and Information (ICML 2018 · similarity 0.90)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.