Research map / Adversarial robustness and security / Black-box and transfer attacks
Transfer attacks on face recognition
Improve transfer attacks with momentum and checkpoints, including against face recognition.
48 accepted papers at ICML, NeurIPS, ICLR, CVPR and AAAI (2018–2026) · an approach in Black-box and transfer attacks, keyword cluster “transferable · adversarial transferability · transferability adversarial”
State History Tried Checklist Preprints Who Export
Where it stands
Not enough benchmark data Fewer than four papers report the same benchmark, so there is no record to follow.
9 papers in 2023–24 and 25 in 2025–26 (at ICML, NeurIPS, ICLR, CVPR and AAAI); its share of the topic grew, from 10.1% to 21.6%.
How this is decided
A benchmark is tracked when at least four papers of this approach report their own method on the same dataset and metric in at least two different years. Its record is the best number reported up to 2024 compared with the best reported in 2025–26: still improving means at least 1% better, flat means at most 0.2% better with at least two papers from 2025–26 trying. Numbers on a different scale from the rest (a fraction among percentages) and far outliers are left out. Results come from different papers with different setups, so they are signals, not head-to-head comparisons. The share of papers is counted at ICML, NeurIPS, ICLR, CVPR and AAAI.
How it got here
Most cited paper of each year
- 2018 · Boosting Adversarial Attacks With Momentum (CVPR 2018 · 3,047 citations)
- 2020 · Nesterov Accelerated Gradient and Scale Invariance for Adversarial Attacks (ICLR 2020 · 230 citations)
- 2021 · Improving Transferability of Adversarial Patches on Face Recognition With Generative Models (CVPR 2021 · 124 citations)
- 2022 · Stochastic Variance Reduced Ensemble Adversarial Attack for Boosting the Adversarial Transferability (CVPR 2022 · 140 citations)
- 2023 · Sibling-Attack: Rethinking Transferable Adversarial Attacks Against Face Recognition (CVPR 2023 · 53 citations)
- 2024 · DiffAM: Diffusion-based Adversarial Makeup Transfer for Facial Privacy Protection (CVPR 2024 · 47 citations)
- 2025 · Improving the Transferability of Adversarial Attacks on Face Recognition with Diverse Parameters Augmentation (CVPR 2025 · 9 citations)
- 2026 · AnchorRep: Defending LLMs Against Cross-Model Adversarial Transfer via Representation Repulsion (NeurIPS 2026 · 0 citations)
Earliest papers here
- Boosting Adversarial Attacks With Momentum (CVPR 2018 · 3,047 citations)
- EAD: Elastic-Net Attacks to Deep Neural Networks via Adversarial Examples (AAAI 2018 · 581 citations)
- Learning to Attack: Adversarial Transformation Networks (AAAI 2018 · 233 citations)
What has been tried
30 papers here report 308 measured changes (a component added, removed or swapped, compared with a baseline): helped 79%, no clear effect 5%, hurt 12%, mixed 5%. Papers mostly publish changes that helped, so "helped" is over-represented.
Ablations in recent papers
| What was changed | Measured on | Result | Effect | Paper |
|---|---|---|---|---|
| add makeup direction loss Ldir_MT | Image quality evaluation · FID | 33.6896 -> 26.1015 | Helped | DiffAM: Diffusion-based Adversarial Makeup Transfer for Facial Privacy Protection (CVPR 2024 · 47 citations) |
| Add sub-task-based meta-learning | CASIA-WebFace, ResNet34, 64-bit · mAP (%) | 6.64* -> 5.00* | Helped | Once and for All: Universal Transferable Adversarial Perturbation against Deep Hashing-Based Facial Image Retrieval (AAAI 2024 · 17 citations) |
| add diverse parameter optimization (DPO) to the vanilla surrogate | LFW, IR152 victim · ASR (%) | 5.3 -> 35.9 | Helped | Improving the Transferability of Adversarial Attacks on Face Recognition with Diverse Parameters Augmentation (CVPR 2025 · 9 citations) |
| Add FADR and FACL | Cross-domain · top-1 accuracy after attack | 51.07 -> 44.05 | Helped | FACL-Attack: Frequency-Aware Contrastive Learning for Transferable Adversarial Attacks (AAAI 2024 · 9 citations) |
| add the feature loss ℓ_feat | CIFAR-10 · overall accuracy | 32.7 -> 24.6 | Helped | Mutual-Modality Adversarial Attack with Semantic Perturbation (AAAI 2024 · 9 citations) |
| Replace cross-entropy with max-margin loss (MAA) | Cora · robust accuracy (%) | 33.21 -> 32.71 | Helped | Stronger and Transferable Node Injection Attacks (AAAI 2024 · 7 citations) |
| Intervene on the target's child variables rather than only its co-parent (CADE(2)/CADE(3) versus CADE(1)) | Pendulum · ASR (%) | Helped | Where and How to Attack? A Causality-Inspired Recipe for Generating Counterfactual Adversarial Examples (AAAI 2024 · 6 citations) | |
| Increase the angle threshold τ | ModelNet40 · ASR | Helped | NoPain: No-box Point Cloud Attack via Optimal Transport Singular Boundary (CVPR 2025 · 4 citations) | |
| Use importance-based checkpoint selection instead of random selection | ImageNet target models (average across eight) · ASR | 48.9% -> 61.2% | Helped | Enhancing Adversarial Transferability with Checkpoints of a Single Model's Training (CVPR 2025 · 3 citations) |
| Use pseudo-semantic samples cropped from the UAP instead of random noise | ImageNet validation · FR (%) | Helped | Data-free Universal Adversarial Perturbation with Pseudo-semantic Prior (CVPR 2025 · 2 citations) | |
| Increase perturbation budget from ε=4 to ε=16 | NIPS 2017 Adversarial Attacks and Defenses Competition, GPT-4o · ASR | 0.26 -> 0.95 | Helped | A Frustratingly Simple Yet Highly Effective Attack Baseline: Over 90% Success Rate Against the Strong Black-box Models of GPT-4.5/4o/o1 (NeurIPS 2025 · 2 citations) |
| add global feature alignment | GPT-4o · ASR | 78.0 -> 81.0 | Helped | Adversarial Attacks against Closed-Source MLLMs via Feature Optimal Alignment (NeurIPS 2025 · 0 citations) |
What reviewers will expect
Datasets and baselines named in the 12 papers of this approach from 2025–2026 that have a full-text summary. Leaving out the common ones is a frequent review question.
Datasets
- ImageNet · 2 of 12 papers
Baselines
- Ens · 2 of 12 papers
- LGV · 2 of 12 papers
- MI-FGSM · 2 of 12 papers
- DI · 2 of 12 papers
- VMI · 2 of 12 papers
- AttackVLM · 2 of 12 papers
- SSA-CWA · 2 of 12 papers
- AnyAttack · 2 of 12 papers
Recent preprints
Loading recent arXiv preprints…
Who publishes on it
Institutions on the most papers of this approach since 2023 (of 34 papers; from OpenAlex and the papers' affiliations).
- Korea Advanced Institute of Science and Technology · 2 papers
- Wuhan University · 2 papers
- Huazhong University of Science and Technology · 2 papers
- Mohamed bin Zayed University of Artificial Intelligence · 2 papers
Use it
Download BibTeX of 33 key papersOpen the topic in the interactive map
Get alerts. Describe your idea in scime atlas and save it (free scime account): you get a weekly email when new preprints land close to it.
Related approaches
Same keyword cluster
- Transferable adversarial examples (86 papers)
- Transfer attacks on vision transformers (9 papers)
Elsewhere in the topic
- Robustness benchmarks and defenses (89 papers)
- Query-efficient black-box attacks (78 papers)
- Data-free substitute training (49 papers)
- Decision-based boundary attacks (24 papers)
Benchmark numbers, ablations and baseline numbers are extracted by AI from each paper's full text and can be wrong; the paper is the authority. Data: results index of 2026-11-02, citation counts from OpenAlex (2026-10-09).