Research map / Adversarial robustness and security / Black-box and transfer attacks
Perturbing Across the Feature Hierarchy to Improve Standard and Strict Blackbox Attack Transferability
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's title only (no summary yet). Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| add cross-entropy output-layer term (+xent) to single-layer FDA (ablation) | FDA(1) · ImageNet RN50->DN121 | targeted success rate (%): 19.4 -> 40.3 | Helped |
| add cross-entropy term (+xent) (ablation) | FDA(1) · ImageNet DN121->DN201 | targeted success rate (%): 35.3 -> 65.3 | Helped |
| add cross-entropy term (+xent) (ablation) | FDA(N) · ImageNet RN50->DN121 | error rate (%): 94.2 -> 90.9 | Hurt |
| increase number of perturbed intermediate layers from 1 to 5 (ablation) | FDA(N)+xent · ImageNet RN50->DN121 | targeted success rate (%): 40.3 -> 57.9 | Helped |
| switch from output-layer TMIM+SGM to FDA(5)+xent | transfer attack · ImageNet DN121->DN201 | targeted success rate (%): 10.0 -> 77.1 | Helped |
| add xent term when blackbox trained on subset of whitebox label space (ablation) | FDA(N) · Cross-distribution RN50-Full->DN121-B | targeted success rate (%): 45.5 -> 36.3 | Hurt |
| add multi-layer perturbation (FDA(1) to FDA(5)+xent) (ablation) | FDA · Cross-distribution RN50-A->DN121-B | targeted success rate (%): 45.8 -> 63.1 | Helped |
| use larger whitebox training subset (RN50-C vs RN50-A/B) (ablation) | FDA attacks · Cross-distribution ->DN121-Full | targeted success rate (%): 12.6 -> 24.3 | Helped |
| use FDA(5)+xent as prior instead of TMIM in P-RGF query attack | P-RGF · RN50->DN121, 2000 queries | targeted success rate (%): 14.9 -> 92.9 | Helped |
| switch to FDA(4)+xent from TPGD for distal adversaries | distal transfer · Distal transfer RN50->DN121 | top-1 targeted success rate (%): 10.1 -> 65.8 | Helped |
| add layers to FDA vs add models to ensemble (ablation) | FDA(N)+xent vs TMIM ensemble · ImageNet transfers | error / tSuc | Helped |
Closest papers by meaning
- Feature Space Perturbations Yield More Transferable Adversarial Examples (CVPR 2019 · similarity 0.93)
- Transferable Perturbations of Deep Feature Distributions (ICLR 2020 · similarity 0.93)
- Black-Box Adversarial Attack with Transferable Model-based Embedding (ICLR 2020 · similarity 0.91)
- Beyond ImageNet Attack: Towards Crafting Adversarial Examples for Black-box Domains (ICLR 2022 · similarity 0.90)
- Towards Transferable Adversarial Attacks with Centralized Perturbation (AAAI 2024 · similarity 0.89)
- Pixel2Feature Attack (P2FA): Rethinking the Perturbed Space to Enhance Adversarial Transferability (ICML 2025 · similarity 0.89)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.