Research map / Adversarial robustness and security / Black-box and transfer attacks
Transferable adversarial examples
Boost transfer of adversarial examples across models with gradient and input-diversity techniques.
86 accepted papers at ICML, NeurIPS, ICLR, CVPR and AAAI (2017–2026) · an approach in Black-box and transfer attacks, keyword cluster “transferable · adversarial transferability · transferability adversarial”
State History Tried Checklist Preprints Who Export
Where it stands
Not enough benchmark data Fewer than four papers report the same benchmark, so there is no record to follow.
32 papers in 2023–24 and 23 in 2025–26 (at ICML, NeurIPS, ICLR, CVPR and AAAI); its share of the topic shrank, from 36.0% to 19.8%.
How this is decided
A benchmark is tracked when at least four papers of this approach report their own method on the same dataset and metric in at least two different years. Its record is the best number reported up to 2024 compared with the best reported in 2025–26: still improving means at least 1% better, flat means at most 0.2% better with at least two papers from 2025–26 trying. Numbers on a different scale from the rest (a fraction among percentages) and far outliers are left out. Results come from different papers with different setups, so they are signals, not head-to-head comparisons. The share of papers is counted at ICML, NeurIPS, ICLR, CVPR and AAAI.
How it got here
Most cited paper of each year
- 2017 · Delving into Transferable Adversarial Examples and Black-box Attacks (ICLR 2017 · 1,227 citations)
- 2019 · Improving Transferability of Adversarial Examples With Input Diversity (CVPR 2019 · 1,273 citations)
- 2020 · Skip Connections Matter: On the Transferability of Adversarial Examples Generated with ResNets (ICLR 2020 · 186 citations)
- 2021 · Enhancing the Transferability of Adversarial Attacks Through Variance Tuning (CVPR 2021 · 470 citations)
- 2022 · Improving Adversarial Transferability via Neuron Attribution-Based Attacks (CVPR 2022 · 162 citations)
- 2023 · Improving the Transferability of Adversarial Samples by Path-Augmented Method (CVPR 2023 · 61 citations)
- 2024 · Boosting Adversarial Transferability by Block Shuffle and Rotation (CVPR 2024 · 88 citations)
- 2025 · Improving Transferable Targeted Attacks with Feature Tuning Mixup (CVPR 2025 · 10 citations)
- 2026 · Transferable Hypergraph Attack via Injecting Nodes into Pivotal Hyperedges (AAAI 2026 · 1 citation)
Earliest papers here
- Delving into Transferable Adversarial Examples and Black-box Attacks (ICLR 2017 · 1,227 citations)
- Improving Transferability of Adversarial Examples With Input Diversity (CVPR 2019 · 1,273 citations)
- Evading Defenses to Transferable Adversarial Examples by Translation-Invariant Attacks (CVPR 2019 · 974 citations)
What has been tried
68 papers here report 697 measured changes (a component added, removed or swapped, compared with a baseline): helped 77%, no clear effect 4%, hurt 14%, mixed 5%. Papers mostly publish changes that helped, so "helped" is over-represented.
Ablations in recent papers
| What was changed | Measured on | Result | Effect | Paper |
|---|---|---|---|---|
| Add block shuffling | ImageNet, black-box transfer · attack success rate | Helped | Boosting Adversarial Transferability by Block Shuffle and Rotation (CVPR 2024 · 88 citations) | |
| Use random rather than sequential model selection | Adversarial-trained victims · ASR (%) | about 5% | Helped | Ensemble Diversity Facilitates Adversarial Transferability (CVPR 2024 · 34 citations) |
| Increase the number of operations from 1 to 2 | ImageNet validation, targets excluding ResNet-18 · average ASR | 80.89% to 88.98% | Helped | Learning to Transform Dynamically for Better Adversarial Transferability (CVPR 2024 · 25 citations) |
| Add MLP parameter optimization to feature-grid optimization | ImageNet classes, random viewpoints; ResNet-50 victim · ASR (%) | 64.85 -> 78.85 | Helped | Towards Transferable Targeted 3D Adversarial Attack in the Physical World (CVPR 2024 · 25 citations) |
| Add weight scaling to SASD | NIPS17 targeted attack; target Inc-v3, Dense121, VGG16 · targeted attack success rate | 46.5 ± 0.5 -> 70.3 ± 0.8; 91.2 ± 0.2 -> 93.0 ± 0.2; 86.7 ± 0.1 -> 88.7 ± 0.4 | Helped | Improving Transferable Targeted Adversarial Attacks with Model Self-Enhancement (CVPR 2024 · 15 citations) |
| Use adversary-centric contrastive learning with adversarial and benign views instead of classical contrastive learning with adversarial views | ImageNet validation, COCO-trained substitute, CNNs (Avg.) · Top-1 accuracy (%) | 6.13 -> 2.75 | Helped | AGS: Affordable and Generalizable Substitute Training for Transferable Adversarial Attack (AAAI 2024 · 14 citations) |
| Use both regularization orders rather than LRS-1 alone | CIFAR-10, ε=4/255, average over target models · attack success rate | 58.87% -> 68.94% | Helped | LRS: Enhancing Adversarial Transferability through Lipschitz Regularized Surrogate (AAAI 2024 · 12 citations) |
| Allocate more quantization to the luma channel rather than chroma channels | ImageNet transfer attacks · fooling rate | Helped | Towards Transferable Adversarial Attacks with Centralized Perturbation (AAAI 2024 · 11 citations) | |
| add RRB data augmentation | COCO mAP (black-box mean) · mAP | 0.195 -> 0.039 | Helped | Transferable Adversarial Attacks for Object Detection Using Object-Aware Significant Feature Distortion (AAAI 2024 · 11 citations) |
| Use the FTM-perturbed model ensemble instead of a single FTM-perturbed model | ImageNet-compatible, target models across ensemble sizes · targeted attack success rate (%) | Helped | Improving Transferable Targeted Attacks with Feature Tuning Mixup (CVPR 2025 · 10 citations) | |
| use arbitrary multiple baselines rather than monotonic baselines | ImageNet-1k val; RN-18 surrogate; target-model mean · attack success rate | 50.8 -> 13.6 | Hurt | Improving Integrated Gradient-based Transferable Adversarial Examples by Refining the Integration Path (AAAI 2025 · 8 citations) |
| Increase OPS sample counts from (5, 5) to (30, 30) | ImageNet validation, ResNet-18 to ViT · ASR (%) | 58.7 -> 76.3 | Helped | Boosting Adversarial Transferability through Augmentation in Hypothesis Space (CVPR 2025 · 8 citations) |
What reviewers will expect
Datasets and baselines named in the 14 papers of this approach from 2025–2026 that have a full-text summary. Leaving out the common ones is a frequent review question.
Datasets
- ImageNet · 4 of 14 papers
- CIFAR-10 · 2 of 14 papers
Baselines
- TTP · 3 of 14 papers
- Logit · 3 of 14 papers
- SU · 3 of 14 papers
- GAP · 2 of 14 papers
- MI · 2 of 14 papers
- NI · 2 of 14 papers
- VMI · 2 of 14 papers
- RAP · 2 of 14 papers
Recent preprints
Loading recent arXiv preprints…
Who publishes on it
Institutions on the most papers of this approach since 2023 (of 55 papers; from OpenAlex and the papers' affiliations).
- The Chinese University of Hong Kong · 6 papers
- Sun Yat-sen University · 4 papers
- Tsinghua University · 4 papers
- Fudan University · 4 papers
- Huawei · 4 papers
- Harbin Institute of Technology · 4 papers
- Beihang University · 3 papers
- University of California, Davis · 3 papers
- Zhejiang University · 2 papers
- The Hong Kong Polytechnic University · 2 papers
Use it
Download BibTeX of 39 key papersOpen the topic in the interactive map
Get alerts. Describe your idea in scime atlas and save it (free scime account): you get a weekly email when new preprints land close to it.
Related approaches
Same keyword cluster
- Transfer attacks on face recognition (48 papers)
- Transfer attacks on vision transformers (9 papers)
Elsewhere in the topic
- Robustness benchmarks and defenses (89 papers)
- Query-efficient black-box attacks (78 papers)
- Data-free substitute training (49 papers)
- Decision-based boundary attacks (24 papers)
Benchmark numbers, ablations and baseline numbers are extracted by AI from each paper's full text and can be wrong; the paper is the authority. Data: results index of 2026-11-02, citation counts from OpenAlex (2026-10-09).