Research map / Adversarial robustness and security / Black-box and transfer attacks
Everywhere Attack: Attacking Locally and Globally to Boost Targeted Transferability
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes Everywhere Attack, which splits a victim image into blocks and jointly plants a target in the global image and sampled local blocks, boosting targeted transferability of existing iterative attacks in a method-agnostic way.
Problem
Targeted adversarial examples transfer poorly across models, largely because the target-class attention regions differ between surrogate and victim models.
Approach
Instead of planting one high-confidence target object, plant an army of target copies in every local block of the image by attacking the global image plus N sampled padded local blocks simultaneously, so that some target falls in each victim's attention region. The scheme is plug-in for CE, Logit, Margin, SupHigh, SU and CFM attacks.
Key results
- Logit attack's average targeted transfer success rate under random targets rises from 38.6% to 49.7% with everywhere scheme (Res50 surrogate), with CE improving from 0.2% to 10.2% (VGG16 surrogate).
- Under the most difficult-target scenario, Logit with Res50 surrogate averages 36.1% vs 25.8% without everywhere.
- On Google Cloud Vision with Res50adv surrogate, CFM success rises from 26% to 47% with everywhere scheme.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Add Everywhere to Logit | Logit targeted attack · ImageNet-compatible dataset, random-target scenario; average over victims | targeted success rate (%): 38.6% vs. 49.7% (Res50 surrogate); 2.1% vs. 8.4% (Inc-v3 surrogate) | Helped |
| Add Everywhere to Logit | Logit targeted attack · ImageNet-compatible dataset, most difficult-target scenario; average over victims | targeted success rate (%): 25.8% vs. 36.1% (Res50 surrogate) | Helped |
| Add Everywhere to CE | CE targeted attack · ImageNet-compatible dataset, random-target scenario; VGG16 surrogate, average over victims | targeted success rate (%): 0.2% to 10.2% | Helped |
| Add Everywhere to CE | CE attention map · ImageNet-compatible dataset, victim attention coverage | coverage: 0.378 -> 0.645; 0.383 -> 0.638; 0.251 -> 0.504 | Helped |
| Add Everywhere to Logit | Logit DTUAP · ImageNet-compatible dataset, DTUAP applied across input images | targeted success rate (%) | Helped |
| Add Everywhere to Logit | Logit targeted attack · Google Cloud Vision | targeted success rate (%): 6 -> 11 | Helped |
| Add Everywhere to CFM | CFM targeted attack · Google Cloud Vision | targeted success rate (%): 26 -> 47 | Helped |
| Vary the number of sampled local blocks N (ablation) | Logit + Everywhere · ImageNet-compatible dataset, random-target scenario; average over four victims | targeted success rate (%) | Helped |
| Vary the number of image partitions M (ablation) | Logit + Everywhere · ImageNet-compatible dataset, random-target scenario | targeted success rate (%) | Mixed |
Surprising findings
- The everywhere scheme gives largest relative gains for weakest baselines (CE), and gains are larger on harder transfer pairs such as Res50->Swin.
Limitations
- Iterative attacks require per-image optimization and are computationally slower than trained generative attacks.
- Attack success on Google Cloud Vision remains low in absolute terms (6% to 47%).
Experimental setup
Datasets: ImageNet-compatible dataset (1000 images, 299x299) ImageNet train
Benchmarks: ImageNet-compatible dataset Google Cloud Vision
Metrics: targeted transfer success rate attention coverage metric
Baselines: CE Logit Margin SupHigh SU CFM TTP C-GSP Po+Trip
Builds on: IFGSM momentum iterative method diverse inputs translation-invariant method Logit attack Margin attack SupHigh CFM TTP C-GSP
Closest papers by meaning
- Enhancing Adversarial Transferability with Adversarial Weight Tuning (AAAI 2025 · similarity 0.88)
- PubDef: Defending Against Transfer Attacks From Public Models (ICLR 2024 · similarity 0.88)
- Rethinking Model Ensemble in Transfer-based Adversarial Attacks (ICLR 2024 · similarity 0.87)
- Boosting Adversarial Transferability through Augmentation in Hypothesis Space (CVPR 2025 · similarity 0.87)
- AIM: Additional Image Guided Generation of Transferable Adversarial Attacks (AAAI 2025 · similarity 0.87)
- X-Transfer Attacks: Towards Super Transferable Adversarial Attacks on CLIP (ICML 2025 · similarity 0.87)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.