Research map / Adversarial robustness and security / Attacks on text and graphs
Learning Transferable Adversarial Perturbations
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's title only (no summary yet). Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| train generator with mid-level feature separation loss instead of cross-entropy-based CDA loss | perturbation generator, ImageNet-trained · ImageNet val black-box average | fooling rate (%): 76.5 -> 86.8 | Helped |
| train generator with feature separation loss instead of CDA loss on Comics data (no target data) | perturbation generator · ImageNet val strict black-box average | fooling rate (%): 80.5 -> 90.8 | Helped |
| use ChestX (large domain gap) as generator training data with feature separation loss instead of CDA | perturbation generator · ImageNet val strict black-box average | fooling rate (%): 40.6 -> 62.0 | Helped |
| train generator on ChestX or Comics data instead of ImageNet-like data, same loss (ablation) | Ours · ImageNet val strict black-box average | fooling rate (%): 90.8 (Comics) -> 62.0 (ChestX) | Hurt |
| extreme black-box: classifier trained on ChestX instead of ImageNet (ablation) | Ours · ImageNet val average | fooling rate (%): 87.0 -> 68.5 | Hurt |
| use feature separation loss instead of CDA against adversarially trained defences | SqueezeNet generator · EnsembleAdv, HGD, R&P | top-1 error increase (%): HGD 31.4 -> 43.9 | Helped |
| use feature separation loss instead of CDA against PGD and FD defences | SqueezeNet generator · FD and PGD | top-1 error increase (%): FD 4.06 -> 7.06; PGD 5.42 -> 3.30 | Mixed |
| use feature separation loss instead of CDA to attack object detectors (cross-task) | perturbation generator, ImageNet-trained · PASCAL VOC SSD average | mAP: 14.4 -> 9.31 | Helped |
| attack the initial layers instead of mid-level layers (ablation) | generator · transfer attacks | required perturbation strength | Hurt |
| attack top-level features instead of mid-level features (ablation) | generator · transfer to different data or architectures | fooling rate | Hurt |
Closest papers by meaning
- Towards Transferable Adversarial Attacks with Centralized Perturbation (AAAI 2024 · similarity 0.90)
- Enhancing Adversarial Transferability with Adversarial Weight Tuning (AAAI 2025 · similarity 0.89)
- AIM: Additional Image Guided Generation of Transferable Adversarial Attacks (AAAI 2025 · similarity 0.89)
- Boosting Adversarial Transferability through Augmentation in Hypothesis Space (CVPR 2025 · similarity 0.88)
- Improving Transferable Targeted Adversarial Attacks with Model Self-Enhancement (CVPR 2024 · similarity 0.88)
- Enhancing Adversarial Transferability with Checkpoints of a Single Model's Training (CVPR 2025 · similarity 0.88)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.