% Key papers for Transfer attacks on face recognition (scime atlas, https://atlas.scime.ai). Authors are not included: add them from the paper pages.

@inproceedings{cvpr2018_boosting_12873,
  title = {{Boosting Adversarial Attacks With Momentum}},
  booktitle = {IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR)},
  year = {2018},
  url = {https://openaccess.thecvf.com/content_cvpr_2018/html/Dong_Boosting_Adversarial_Attacks_CVPR_2018_paper.html},
}

@inproceedings{aaai2018_ead_100338,
  title = {{EAD: Elastic-Net Attacks to Deep Neural Networks via Adversarial Examples}},
  booktitle = {AAAI Conference on Artificial Intelligence (AAAI)},
  year = {2018},
  url = {https://ojs.aaai.org/index.php/AAAI/article/view/11302},
}

@inproceedings{aaai2018_learning_102405,
  title = {{Learning to Attack: Adversarial Transformation Networks}},
  booktitle = {AAAI Conference on Artificial Intelligence (AAAI)},
  year = {2018},
  url = {https://ojs.aaai.org/index.php/AAAI/article/view/11672},
}

@inproceedings{iclr2020_nesterov_29640,
  title = {{Nesterov Accelerated Gradient and Scale Invariance for Adversarial Attacks}},
  booktitle = {International Conference on Learning Representations (ICLR)},
  year = {2020},
  url = {https://openreview.net/forum?id=SJlHwkBYDH},
}

@inproceedings{cvpr2022_stochastic_19937,
  title = {{Stochastic Variance Reduced Ensemble Adversarial Attack for Boosting the Adversarial Transferability}},
  booktitle = {IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR)},
  year = {2022},
}

@inproceedings{cvpr2021_improving_17175,
  title = {{Improving Transferability of Adversarial Patches on Face Recognition With Generative Models}},
  booktitle = {IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR)},
  year = {2021},
}

@inproceedings{cvpr2023_sibling_22202,
  title = {{Sibling-Attack: Rethinking Transferable Adversarial Attacks Against Face Recognition}},
  booktitle = {IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR)},
  year = {2023},
  url = {https://cvpr.thecvf.com/virtual/2023/poster/23136},
}

@inproceedings{cvpr2024_diffam_23174,
  title = {{DiffAM: Diffusion-based Adversarial Makeup Transfer for Facial Privacy Protection}},
  booktitle = {IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR)},
  year = {2024},
  url = {https://cvpr.thecvf.com/virtual/2024/poster/29609},
}

@inproceedings{aaai2022_making_2400,
  title = {{Making Adversarial Examples More Transferable and Indistinguishable}},
  booktitle = {AAAI Conference on Artificial Intelligence (AAAI)},
  year = {2022},
  url = {https://aaai.org/papers/03662-making-adversarial-examples-more-transferable-and-indistinguishable/},
}

@inproceedings{aaai2020_a_101883,
  title = {{A New Ensemble Adversarial Attack Powered by Long-Term Gradient Memories}},
  booktitle = {AAAI Conference on Artificial Intelligence (AAAI)},
  year = {2020},
  url = {https://ojs.aaai.org/index.php/AAAI/article/view/5743},
}

@inproceedings{iclr2021_deep_30377,
  title = {{Deep Neural Network Fingerprinting by Conferrable Adversarial Examples}},
  booktitle = {International Conference on Learning Representations (ICLR)},
  year = {2021},
  url = {https://iclr.cc/virtual/2021/poster/2859},
}

@inproceedings{aaai2024_once_6841,
  title = {{Once and for All: Universal Transferable Adversarial Perturbation against Deep Hashing-Based Facial Image Retrieval}},
  booktitle = {AAAI Conference on Artificial Intelligence (AAAI)},
  year = {2024},
  url = {https://ojs.aaai.org/index.php/AAAI/article/view/28319},
}

@inproceedings{aaai2021_pid_1141,
  title = {{PID-Based Approach to Adversarial Attacks}},
  booktitle = {AAAI Conference on Artificial Intelligence (AAAI)},
  year = {2021},
  url = {https://aaai.org/papers/10033-pid-based-approach-to-adversarial-attacks/},
}

@inproceedings{aaai2020_cag_102128,
  title = {{CAG: A Real-Time Low-Cost Enhanced-Robustness High-Transferability Content-Aware Adversarial Attack Generator}},
  booktitle = {AAAI Conference on Artificial Intelligence (AAAI)},
  year = {2020},
  url = {https://ojs.aaai.org/index.php/AAAI/article/view/5990},
}

@inproceedings{aaai2023_exploring_3620,
  title = {{Exploring Non-target Knowledge for Improving Ensemble Universal Adversarial Attacks}},
  booktitle = {AAAI Conference on Artificial Intelligence (AAAI)},
  year = {2023},
  url = {https://ojs.aaai.org/index.php/AAAI/article/view/25377},
}

@inproceedings{aaai2024_on_6833,
  title = {{On the Convergence of an Adaptive Momentum Method for Adversarial Attacks}},
  booktitle = {AAAI Conference on Artificial Intelligence (AAAI)},
  year = {2024},
  url = {https://ojs.aaai.org/index.php/AAAI/article/view/29323},
}

@inproceedings{aaai2024_facl_5931,
  title = {{FACL-Attack: Frequency-Aware Contrastive Learning for Transferable Adversarial Attacks}},
  booktitle = {AAAI Conference on Artificial Intelligence (AAAI)},
  year = {2024},
  url = {https://ojs.aaai.org/index.php/AAAI/article/view/28470},
}

@inproceedings{aaai2024_mutual_6732,
  title = {{Mutual-Modality Adversarial Attack with Semantic Perturbation}},
  booktitle = {AAAI Conference on Artificial Intelligence (AAAI)},
  year = {2024},
  url = {https://ojs.aaai.org/index.php/AAAI/article/view/28488},
}

@inproceedings{cvpr2025_improving_26614,
  title = {{Improving the Transferability of Adversarial Attacks on Face Recognition with Diverse Parameters Augmentation}},
  booktitle = {IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR)},
  year = {2025},
  url = {https://cvpr.thecvf.com/virtual/2025/poster/34976},
}

@inproceedings{aaai2024_stronger_7426,
  title = {{Stronger and Transferable Node Injection Attacks}},
  booktitle = {AAAI Conference on Artificial Intelligence (AAAI)},
  year = {2024},
  url = {https://ojs.aaai.org/index.php/AAAI/article/view/30111},
}

@inproceedings{aaai2024_where_7823,
  title = {{Where and How to Attack? A Causality-Inspired Recipe for Generating Counterfactual Adversarial Examples}},
  booktitle = {AAAI Conference on Artificial Intelligence (AAAI)},
  year = {2024},
  url = {https://ojs.aaai.org/index.php/AAAI/article/view/28990},
}

@inproceedings{cvpr2025_nopain_27073,
  title = {{NoPain: No-box Point Cloud Attack via Optimal Transport Singular Boundary}},
  booktitle = {IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR)},
  year = {2025},
  url = {https://cvpr.thecvf.com/virtual/2025/poster/35084},
}

@inproceedings{cvpr2025_enhancing_26134,
  title = {{Enhancing Adversarial Transferability with Checkpoints of a Single Model's Training}},
  booktitle = {IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR)},
  year = {2025},
  url = {https://cvpr.thecvf.com/virtual/2025/poster/34191},
}

@inproceedings{cvpr2025_data_25859,
  title = {{Data-free Universal Adversarial Perturbation with Pseudo-semantic Prior}},
  booktitle = {IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR)},
  year = {2025},
  url = {https://cvpr.thecvf.com/virtual/2025/poster/33690},
}

@inproceedings{neurips2025_a_75603,
  title = {{A Frustratingly Simple Yet Highly Effective Attack Baseline: Over 90\% Success Rate Against the Strong Black-box Models of GPT-4.5/4o/o1}},
  booktitle = {Advances in Neural Information Processing Systems (NeurIPS)},
  year = {2025},
  url = {https://openreview.net/forum?id=9xXjWwAoUF},
}

@inproceedings{neurips2025_towards_77454,
  title = {{Towards Building Model/Prompt-Transferable Attackers against Large Vision-Language Models}},
  booktitle = {Advances in Neural Information Processing Systems (NeurIPS)},
  year = {2025},
  url = {https://openreview.net/forum?id=TyW1V1KukG},
}

@inproceedings{neurips2025_adversarial_79027,
  title = {{Adversarial Attacks against Closed-Source MLLMs via Feature Optimal Alignment}},
  booktitle = {Advances in Neural Information Processing Systems (NeurIPS)},
  year = {2025},
  url = {https://openreview.net/forum?id=ktC3cDu320},
}

@inproceedings{iclr2025_tasar_81581,
  title = {{TASAR: Transfer-based Attack on Skeletal Action Recognition}},
  booktitle = {International Conference on Learning Representations (ICLR)},
  year = {2025},
  url = {https://iclr.cc/virtual/2025/poster/30195},
}

@inproceedings{neurips2026_anchorrep_94059,
  title = {{AnchorRep: Defending LLMs Against Cross-Model Adversarial Transfer via Representation Repulsion}},
  booktitle = {Advances in Neural Information Processing Systems (NeurIPS)},
  year = {2026},
  url = {https://neurips.cc/virtual/2026/poster/149182},
}

@inproceedings{neurips2026_anchoring_94149,
  title = {{Anchoring Adversarial Trajectories to Data Manifolds: A Bilevel Transfer Optimization Framework}},
  booktitle = {Advances in Neural Information Processing Systems (NeurIPS)},
  year = {2026},
  url = {https://neurips.cc/virtual/2026/poster/153364},
}

@inproceedings{cvpr2026_generative_97113,
  title = {{Generative Adversarial Perturbations with Cross-paradigm Transferability on Localized Crowd Counting}},
  booktitle = {IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR)},
  year = {2026},
  url = {https://openaccess.thecvf.com/content/CVPR2026/html/Anisha_Generative_Adversarial_Perturbations_with_Cross-paradigm_Transferability_on_Localized_Crowd_Counting_CVPR_2026_paper.html},
}

@inproceedings{cvpr2026_pa_98910,
  title = {{PA-Attack: Guiding Gray-Box Attacks on LVLM Vision Encoders with Prototypes and Attention}},
  booktitle = {IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR)},
  year = {2026},
  url = {https://openaccess.thecvf.com/content/CVPR2026/html/Mei_PA-Attack_Guiding_Gray-Box_Attacks_on_LVLM_Vision_Encoders_with_Prototypes_CVPR_2026_paper.html},
}

@inproceedings{cvpr2026_multi_98943,
  title = {{Multi-Paradigm Collaborative Adversarial Attack Against Multi-Modal Large Language Models}},
  booktitle = {IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR)},
  year = {2026},
  url = {https://openaccess.thecvf.com/content/CVPR2026/html/Li_Multi-Paradigm_Collaborative_Adversarial_Attack_Against_Multi-Modal_Large_Language_Models_CVPR_2026_paper.html},
}