Research map / Adversarial robustness and security / Black-box and transfer attacks
Making Substitute Models More Bayesian Can Enhance Transferability of Adversarial Examples
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's title only (no summary yet). Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Attack a Bayesian substitute using an isotropic posterior rather than a deterministic model (ablation) | ResNet-18 with I-FGSM · CIFAR-10, six victim models | average attack success rate: 43.06% -> 57.36% | Helped |
| Add finetuning to the isotropic Bayesian substitute (ablation) | ResNet-18 with I-FGSM · CIFAR-10, six victim models | average attack success rate: 57.36% -> 78.98% | Helped |
| Use SWAG to improve the posterior approximation (ablation) | Finetuned isotropic Bayesian substitute with I-FGSM · CIFAR-10, six victim models | average attack success rate: 78.98% -> 83.38% | Helped |
| Attack a Bayesian substitute using an isotropic posterior rather than a deterministic model (ablation) | ResNet-50 with I-FGSM · ImageNet, ten victim models | average attack success rate: 27.69% -> 51.06% | Helped |
| Add finetuning to the isotropic Bayesian substitute (ablation) | ResNet-50 with I-FGSM · ImageNet, ten victim models | average attack success rate: 51.06% -> 81.43% | Helped |
| Use SWAG to improve the posterior approximation (ablation) | Finetuned isotropic Bayesian substitute with I-FGSM · ImageNet, ten victim models | average attack success rate: 81.43% -> 91.33% | Helped |
| Combine the Bayesian substitute method with ILA++ | I-FGSM transfer attack · ImageNet, eleven victim models | average attack success rate: 62.89% -> 94.65% | Helped |
| Combine the Bayesian substitute method with SVRE | I-FGSM transfer attack · ImageNet, seven victim models | average attack success rate: 57.52% -> 93.69% | Helped |
| Increase the number of sampled substitute models (ablation) | Bayesian substitute attack · ImageNet | average attack success rate | Helped |
| Use a diagonal covariance rather than diagonal plus low-rank covariance for SWAG (ablation) | SWAG Bayesian substitute · CIFAR-10 and ImageNet | attack success rate | No clear effect |
Closest papers by meaning
- Enhancing Adversarial Transferability with Adversarial Weight Tuning (AAAI 2025 · similarity 0.88)
- Boosting Adversarial Transferability through Augmentation in Hypothesis Space (CVPR 2025 · similarity 0.88)
- AGS: Affordable and Generalizable Substitute Training for Transferable Adversarial Attack (AAAI 2024 · similarity 0.88)
- Rethinking Model Ensemble in Transfer-based Adversarial Attacks (ICLR 2024 · similarity 0.87)
- Improving Transferable Targeted Adversarial Attacks with Model Self-Enhancement (CVPR 2024 · similarity 0.87)
- Understanding Model Ensemble in Transferable Adversarial Attack (ICML 2025 · similarity 0.86)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.