Research map / Adversarial robustness and security / Black-box and transfer attacks
Transfer attacks on vision transformers
Exploit ViT components such as tokens and attention gradients for transferable attacks.
9 accepted papers at ICML, NeurIPS, ICLR, CVPR and AAAI (2022–2026) · an approach in Black-box and transfer attacks, keyword cluster “transferable · adversarial transferability · transferability adversarial”
State History Tried Checklist Preprints Export
Where it stands
Not enough benchmark data Fewer than four papers report the same benchmark, so there is no record to follow.
4 papers in 2023–24 and 3 in 2025–26 (at ICML, NeurIPS, ICLR, CVPR and AAAI); its share of the topic shrank, from 4.5% to 2.6%.
How this is decided
A benchmark is tracked when at least four papers of this approach report their own method on the same dataset and metric in at least two different years. Its record is the best number reported up to 2024 compared with the best reported in 2025–26: still improving means at least 1% better, flat means at most 0.2% better with at least two papers from 2025–26 trying. Numbers on a different scale from the rest (a fraction among percentages) and far outliers are left out. Results come from different papers with different setups, so they are signals, not head-to-head comparisons. The share of papers is counted at ICML, NeurIPS, ICLR, CVPR and AAAI.
How it got here
Most cited paper of each year
- 2022 · Towards Transferable Adversarial Attacks on Vision Transformers (AAAI 2022 · 111 citations)
- 2023 · Transferable Adversarial Attacks on Vision Transformers With Token Gradient Regularization (CVPR 2023 · 82 citations)
- 2024 · Attacking Transformers with Feature Diversity Adversarial Perturbation (AAAI 2024 · 8 citations)
- 2025 · Chain of Attack: On the Robustness of Vision-Language Models Against Transfer-Based Adversarial Attacks (CVPR 2025 · 12 citations)
- 2026 · Manipulating the Mind’s Eye: A-SAGE, the Attention-Based Attack on ViT Explainability (AAAI 2026)
Earliest papers here
- Towards Transferable Adversarial Attacks on Vision Transformers (AAAI 2022 · 111 citations)
- On Improving Adversarial Transferability of Vision Transformers (ICLR 2022 · 11 citations)
- Transferable Adversarial Attacks on Vision Transformers With Token Gradient Regularization (CVPR 2023 · 82 citations)
What has been tried
7 papers here report 86 measured changes (a component added, removed or swapped, compared with a baseline): helped 92%, hurt 8%. Papers mostly publish changes that helped, so "helped" is over-represented.
Ablations in recent papers
| What was changed | Measured on | Result | Effect | Paper |
|---|---|---|---|---|
| Add modality-aware embeddings | Unidiffuser · Ensemble CLIP score | 70.0 -> 71.3 | Helped | Chain of Attack: On the Robustness of Vision-Language Models Against Transfer-Based Adversarial Attacks (CVPR 2025 · 12 citations) |
| Add AMD to MIM | ViTs · ASR (%) | 51.6 -> 82.1 | Helped | Improving Adversarial Transferability on Vision Transformers via Forward Propagation Refinement (CVPR 2025 · 9 citations) |
| Replace random PatchOut with self-paced patch out under semantic guidance | ViTs · ASR (%) | 77.1 -> 80.3 | Helped | Boosting the Transferability of Adversarial Attack on Vision Transformer with Adaptive Token Tuning (NeurIPS 2024 · 7 citations) |
What reviewers will expect
Datasets and baselines named in the 5 papers of this approach from 2024–2026 that have a full-text summary. Leaving out the common ones is a frequent review question.
Baselines
- MIM · 3 of 5 papers
- PNA · 2 of 5 papers
- TGR · 2 of 5 papers
Recent preprints
Loading recent arXiv preprints…
Use it
Download BibTeX of 9 key papersOpen the topic in the interactive map
Get alerts. Describe your idea in scime atlas and save it (free scime account): you get a weekly email when new preprints land close to it.
Related approaches
Same keyword cluster
- Transferable adversarial examples (86 papers)
- Transfer attacks on face recognition (48 papers)
Elsewhere in the topic
- Robustness benchmarks and defenses (89 papers)
- Query-efficient black-box attacks (78 papers)
- Data-free substitute training (49 papers)
- Decision-based boundary attacks (24 papers)
Benchmark numbers, ablations and baseline numbers are extracted by AI from each paper's full text and can be wrong; the paper is the authority. Data: results index of 2026-11-02, citation counts from OpenAlex (2026-10-09).