Pith. sign in

REVIEW 4 major objections 6 minor 46 references

Three-in-One: Robust Enhanced Universal Transferable Anti-Facial Retrieval in Online Social Networks

T0 review · 4 major / 6 minor · reviewed 2026-08-11 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read This paper claims that TOAP is the first adversarial perturbation that is simultaneously universal across face images, transferable across deep hash models, and robust to online social network post-processing, thereby protecting users…

desk verdict A plausible incremental extension of UTAP; the OSN-robustness claims hinge on an unclear fine-tuning condition that could be test-label leakage. read the letter →

arxiv 2412.09692 v2 pith:ATQU4DYQ submitted 2024-12-12 cs.CV

Yunna Lv , Long Tang , Dengpan Ye , Caiyun Xie , Jiacheng Deng , Yiheng He This is my paper · ORCID
classification cs.CV
keywords adversarialperturbationdeephashingfacialprivacyprotectiononlinesocialnetworksuniversaltransferabilityrobustnessimageretrieval
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Deep hash-based facial retrieval systems encode face images as binary codes so that a photo posted online can be matched against a large database and reveal other private photos of the same person. This paper proposes TOAP, a universal adversarial perturbation: a single additive noise pattern applied to any face image before upload. The paper claims TOAP is the first perturbation that stays adversarial after the compression, resizing, blurring, and other post-processing applied by online social networks, while also transferring across unseen models and working across images. The reported gains over prior methods are 5% to 28% in universality and transferability, and up to about 33% after simulated post-processing and up to 10% on platforms such as Facebook, WeChat, and Weibo. If correct, social-network users can protect their facial privacy with a perturbation that survives the actual sharing pipeline.

What carries the argument

The central machinery is the local-and-global Compression Generator (CG), a U-Net encoder-decoder combined with a differentiable JPEG layer that simulates OSN post-processing by first dividing the perturbed image into overlapping grids and processing each locally, then merging the grids and applying a global pass. The second piece is a meta-learning objective that maximizes Hamming distance from cluster centers $h_p$ in meta-training and from data-space centers $h_s$ in meta-testing, with gradients from both original and CG-processed images combined to update the universal perturbation $\delta$. The third piece is an alternating loop where the perturbation is optimized while the CG is fine-tuned with pixel-, feature-, and hash-level losses $L_{pixel}$, $L_{fea}$, and $L_{hash}$, so the generator becomes a better adversary against the perturbation as the perturbation becomes more robust.

What would settle it

Upload TOAP-perturbed photos to Facebook, WeChat, and Weibo at scale (thousands of images, not 84), download the processed versions, and measure retrieval mAP; if the post-processed adversarial images retrieve the original identity at mAP close to the unperturbed baseline, the claimed robustness is falsified.

Watch

Extended reading notes

Core claim

On the paper's own terms, the discovery is that post-processing robustness can be engineered into a universal transferable perturbation by observing what does not change when images are processed: the overall data distribution and most individual sample positions in Hamming space shift very little after operations like JPEG compression, while the model's focus regions on original clean images also stay roughly fixed. TOAP therefore optimizes the perturbation away from the original cluster centers during meta-training and away from data-space (sub) centers during meta-testing, instead of using a single overall center, and it trains the perturbation jointly on original and Compression-Generator-processed images. The learned local and global Compression Generator, a U-Net with a differentiable JPEG module that processes overlapping grids and then merges them, acts as a surrogate for OSN post-processing and is fine-tuned with pixel-, feature-, and hash-level losses so that it keeps removing perturbation while the attack keeps escaping. The paper reports that this three-in-one design achieves the best balance of universality, transferability, and robustness in nearly all tested settings.

Load-bearing premise

The claim stands on the simulated post-processing module (the Compression Generator) being a faithful stand-in for what social networks actually do to images, because that module is checked only indirectly against 84 uploaded images per platform.

Editorial extensions

If this is right

  • A user or data-collection agency can add the same perturbation to many photos before upload, so privacy protection no longer requires per-image computation.
  • Because the perturbation transfers across deep hash models, it remains effective even when the retrieval system's architecture is unknown, as companies do not disclose it.
  • The robustness extends to real platform pipelines, so the protection survives Facebook, WeChat, and Weibo post-processing rather than only simulated JPEG, blur, and resize in a test set.
  • The approach can be evaluated with mAP on retrieval after processing: lower adversarial mAP means better protection, so practitioners can measure whether a platform's compression has destroyed the protection.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The 84-image-per-platform manual upload validation is small; a larger, automated evaluation across many accounts and platforms would tell whether the learned CG generalizes to the full diversity of real OSN pipelines.
  • The invariance observation suggests that post-processing robustness could be achieved by optimizing objectives that are stable under processing rather than by enumerating all possible transformations, and the same principle might extend to video or cross-modal hash retrieval.
  • The alternating perturbation/CG training is a form of adversarial co-evolution; if the CG is updated on real downloaded images, TOAP could become an adaptive attack that tracks platform changes.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 6 minor

Summary. The paper proposes TOAP, a universal adversarial perturbation against deep hash-based facial retrieval systems, designed to remain effective after the post-processing applied by online social networks (OSNs). The method introduces a local and global Compression Generator (CG) that simulates post-processing operations, optimizes the perturbation with a point-to-space objective based on cluster centers and data space centers under a meta-learning scheme, and alternately fine-tunes the CG with pixel-, feature-, and hash-level losses. Experiments on CASIA and VGGFace2 with two hash algorithms (DHD, CSQ) and two backbones (VGG16, ResNet50), under five simulated post-processing operations, plus limited real-OSN tests on Facebook, WeChat, and Weibo, are reported to support claims of universality, transferability, and robustness.

Significance. If the claims hold, TOAP would be a practically useful privacy-protection tool: it is, to my knowledge, among the first attempts to explicitly combine cross-image universality, cross-model transferability, and robustness to OSN post-processing for deep hash retrieval. The alternating optimization of the perturbation and the Compression Generator is a creative design, and the ablation studies give some evidence for the contribution of each component. The experimental scope is broad: two datasets, two hash algorithms, two backbones, five simulated post-processing operations, and three real OSNs, which is a strength. However, the central real-world robustness claim currently rests on a very small validation set and on an unspecified data split in the core algorithm, which limits confidence in the reported improvements.

major comments (4)
  1. [Section III-E, Algorithm 1] Algorithm 1 (line 10) computes mAP_i with Eq. 12 to decide whether to fine-tune the Compression Generator, but the dataset on which this mAP is computed is never stated. The paper defines mAP in Section IV-A.4 as the evaluation metric on the testing set Xs, and Section IV-A.6 says perturbations are trained on Xtr and evaluated on Xs. If mAP_i is computed on Xs, then the CG fine-tuning schedule uses test-set labels, which would give TOAP an unfair advantage over baselines that do not use test information and could explain parts of the reported gains. Please clarify explicitly which set is used; if it is Xs, the experiments must be redone with the condition evaluated on Xtr only, and all tables and conclusions rechecked.
  2. [Section IV-C.2, Table III] The central claim that TOAP remains effective after real OSN post-processing is supported only by Table III, which is based on 84 manually uploaded images per platform, from a single run, with no confidence intervals, error bars, or significance tests. The text reports improvements of about 10% over the second-best method, but with such a small sample it is unclear whether these differences are statistically meaningful. Please report results from multiple upload batches or repeated evaluations, provide confidence intervals (e.g., bootstrap), and specify whether the 84 images are drawn from Xs or Xtr. Without this, the main real-world robustness claim is not firmly established.
  3. [Section IV-B, Tables II and Fig. 10] All quantitative results are single-run mAP values with no variance or significance testing, yet the abstract and Section IV-B.3 use the word 'significant' to describe improvements. Because the differences between methods are often a few mAP points, it is not possible to assess whether they exceed run-to-run variation. Please report means and standard deviations over multiple runs (or equivalent significance measures) for the main tables and figures, or temper the 'significant' wording accordingly.
  4. [Section III-C and III-E] The robustness evaluation under simulated post-processing operations uses the same CG that was co-trained with the perturbation: the CG is explicitly fine-tuned to weaken the perturbation, and the perturbation is optimized to survive that CG. This creates a risk of co-adaptation, so the simulated-robustness numbers in Table II and Fig. 10 may overestimate performance on unseen post-processing pipelines. The paper should include a fidelity check between CG outputs and actual OSN post-processed images, or evaluate on held-out operations not used in CG training (e.g., screenshots, platform-specific resizing/compression variants), to demonstrate that the robustness transfers beyond the learned CG.
minor comments (6)
  1. [Abstract and Introduction] The claim that TOAP is 'the first OSNs-oriented adversarial perturbation' is too strong given that reference [2] (DF-RAP) also addresses real-world social network scenarios; please qualify the novelty as first for deep hash-based facial retrieval or similar.
  2. [Table I] The symbols '%' and '"' in Table I are not defined in the caption or text; please add a legend.
  3. [Section IV-A.3] The phrase 'noise magnitude is 0.0020.5' appears to be a typo; the corresponding axis in Fig. 10(e) suggests values like 0.002 or 0.002^0.5. Please correct.
  4. [Section III-C] The local CG grid size and stride are not specified; please provide these implementation details in Section IV-A.6.
  5. [Section IV-C.2] It is unclear whether the 84 uploaded images are the same across all methods and whether they belong to the training or test split; please clarify.
  6. [Fig. 10] The X-axis labels 'N/A' in several subfigures are ambiguous; please define them as 'no post-processing'.

Circularity Check

0 steps flagged · score 0.0 of 10

No by-construction circularity: TOAP's robustness is trained against a learned compression generator but evaluated on independent post-processing operations; the Algorithm 1 mAP-set ambiguity is a validity caveat, not an exhibited reduction.

full rationale

The derivation is self-contained and not circular. The perturbation δ is optimized via Eq. (4) to maximize Hamming distance from cluster/data-space centers for both the original perturbed image x′ and the CG-processed image CG(x′); the CG is separately trained via Eqs. (8)–(11) to make CG(x′) resemble the clean image x. These are opposing objectives in a minimax loop, not quantities defined in terms of one another. The paper's robustness claims are evaluated on fixed external post-processing operations (JPEG, Resize, Blur, Rotate, Noise) and on real OSN uploads, not on the CG's own output, so the reported test metric is not the training loss. Reliance on UTAP [6] and DF-RAP [2] provides prior architecture and meta-learning recipes, but these are published external results and no uniqueness theorem is imported from the authors. The only genuine caveat is Algorithm 1's line 10, which computes mAP_i with Eq. (12) without stating whether the set is Xtr or Xs; if it were Xs, test labels would drive CG fine-tuning and the reported test mAP would be partially optimized rather than predicted. Because the manuscript is ambiguous on this point, and because the main evaluation uses held-out Xs and independent OSN platforms, this is a potential leakage/validity risk rather than a demonstrated by-construction circularity. The 84-image-per-platform OSN validation is also a statistical robustness concern, not a circularity.

Assumptions & free parameters 7 free parameters · 5 assumptions · 1 invented entities

The central claim rests on the CG's ability to simulate real OSN post-processing, on the stability of hash cluster centers under post-processing, and on several hand-chosen hyperparameters. There are no derived physical constants or novel entities; the only invented component is the learned CG, which has no independent external validation.

free parameters (7)
  • alpha = 0.3
    Weight for the original-image adversarial loss term in Eq. 4; chosen by hand, no sensitivity analysis reported.
  • beta = 0.7
    Weight for the CG-processed adversarial loss term in Eq. 4; chosen by hand.
  • lambda1:lambda2:lambda3 = 1 : 1e-3 : 1e-5
    Weights for the pixel-, feature-, and hash-level CG fine-tuning losses in Eq. 11; chosen by hand.
  • learning rate eta = 0.02 or 0.03
    Learning rate for perturbation updates; per-model choice.
  • epsilon = 16/255
    l_inf bound on perturbation; chosen as standard imperceptibility budget.
  • local CG grid size and stride = not reported
    Grid and sliding-window parameters for local post-processing; not specified in the paper, affecting robustness.
  • sub-center sampling (Ns, n) = not reported
    The number of data space sub centers and the number of clusters n are selected randomly; values are not given, which affects the optimization objectives.
assumptions (5)
  • domain assumption Deep hash models can be approximated as differentiable via tanh surrogate for sign in the hash layer.
    Used in Eq. 4 to compute gradients; standard in deep hash attack literature, but not exact.
  • domain assumption OSN image post-processing can be adequately simulated by local and global compression operations (later trained as the CG).
    The entire method rests on this simulation being faithful enough for the perturbation to survive real OSN processing; only limited real-platform validation is provided.
  • domain assumption The retrieval system uses Hamming distance over 64-bit hash codes and returns top-k results.
    The threat model and the objective functions are defined for this metric; the method may not transfer to other similarity metrics.
  • domain assumption A universal perturbation found on a 2800-image training set generalizes to other images of the same identities and to unseen identities and models.
    The paper assumes the meta-learned perturbation is universal across images and transferable across models; this is an empirical claim, not guaranteed.
  • ad hoc to paper The alternating optimization between perturbation and CG converges to a good fixed point.
    No convergence analysis is given; the algorithm is heuristic and could oscillate or overfit to the CG.
invented entities (1)
  • Compression Generator (CG)
    purpose: A U-Net with DiffJPEG, operating locally on image grids and globally on merged images, that simulates OSN post-processing; it is co-trained with the perturbation to produce robust adversarial examples.
    The CG is introduced by this paper and its efficacy is shown only through the paper's own experiments; it is not validated against real OSN pipelines beyond a small manual upload test, and no external benchmark supports it.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Three-in-One: Robust Enhanced Universal Transferable Anti-Facial Retrieval in Online Social Networks." pith.science (2026). https://pith.science/paper/ATQU4DYQ

@misc{pith2026241209692,
  author       = {Pith},
  title        = {Pith review of: Three-in-One: Robust Enhanced Universal Transferable Anti-Facial Retrieval in Online Social Networks},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/ATQU4DYQ}},
  note         = {Machine review of arXiv:2412.09692}
}
read the original abstract

Deep hash-based retrieval techniques are widely used in facial retrieval systems to improve the efficiency of facial matching. However, it also carries the danger of exposing private information. Deep hash models are easily influenced by adversarial examples, which can be leveraged to protect private images from malicious retrieval. The existing adversarial example methods against deep hash models focus on universality and transferability, lacking the research on its robustness in online social networks (OSNs), which leads to their failure in anti-retrieval after post-processing. Therefore, we provide the first in-depth discussion on robustness adversarial perturbation in universal transferable anti-facial retrieval and propose Three-in-One Adversarial Perturbation (TOAP). Specifically, we construct a local and global Compression Generator (CG) to simulate complex post-processing scenarios, which can be used to mitigate perturbation. Then, we propose robust optimization objectives based on the discovery of the variation patterns of model's distribution after post-processing, and generate adversarial examples using these objectives and meta-learning. Finally, we iteratively optimize perturbation by alternately generating adversarial examples and fine-tuning the CG, balancing the performance of perturbation while enhancing CG's ability to mitigate them. Numerous experiments demonstrate that, in addition to its advantages in universality and transferability, TOAP significantly outperforms current state-of-the-art methods in multiple robustness metrics. It further improves universality and transferability by 5% to 28%, and achieves up to about 33% significant improvement in several simulated post-processing scenarios as well as mainstream OSNs, demonstrating that TOAP can effectively protect private images from malicious retrieval in real-world scenarios.

Figures

Figures reproduced from arXiv: 2412.09692 by the authors.

Figure 1
Figure 1. Threat Scenario. The red arrows indicate that adversary utilizes a [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. Visualization of the change in model’s focus areas before (line 1) [PITH_FULL_IMAGE:figures/full_fig_p002_2.png] view at source ↗
Figure 3
Figure 3. The pipeline of TOAP. a) using local and global CG to process [PITH_FULL_IMAGE:figures/full_fig_p003_3.png] view at source ↗
Figures from the paper (11 more)
Figure 5
Figure 5. Figure 5: The relationship between the number of database samples and [PITH_FULL_IMAGE:figures/full_fig_p004_5.png]
Figure 6
Figure 6. Figure 6: The relationship between the number of adversarial examples guided [PITH_FULL_IMAGE:figures/full_fig_p005_6.png]
Figure 7
Figure 7. Figure 7: The illustration of the selection of different centers. The red shaded [PITH_FULL_IMAGE:figures/full_fig_p005_7.png]
Figure 9
Figure 9. Figure 9: The illustration of fine-tuning CG. We fine-tune CG using the three [PITH_FULL_IMAGE:figures/full_fig_p006_9.png]
Figure 8
Figure 8. Figure 8: T-SNE distributions of original/adversarial examples before and after [PITH_FULL_IMAGE:figures/full_fig_p006_8.png]
Figure 10
Figure 10. Figure 10: Robustness evaluation of adversarial examples after different image post-processing operations, Y-axis denotes [PITH_FULL_IMAGE:figures/full_fig_p009_10.png]
Figure 11
Figure 11. Figure 11: Visualization of the change in model’s focus areas of original images [PITH_FULL_IMAGE:figures/full_fig_p010_11.png]
Figure 12
Figure 12. Figure 12: The relationship between the number of adversarial examples and [PITH_FULL_IMAGE:figures/full_fig_p010_12.png]
Figure 13
Figure 13. Figure 13: Top-5 retrieval results of AdvHash, UTAP, and TOAP. The query images are post-processed by Facebook. The experimental setting is CASIA, DHD. [PITH_FULL_IMAGE:figures/full_fig_p011_13.png]
Figure 14
Figure 14. Figure 14: Ablation study for (a) LAP , (b) LCG. Y-axis represents ∆mAP↑ for the adversarial examples before (-A) and after (-PA) post-processing. The white-box model is emphasized with * [PITH_FULL_IMAGE:figures/full_fig_p012_14.png]
Figure 15
Figure 15. Figure 15: Illustration of TOAP protecting users’ facial images from malicious [PITH_FULL_IMAGE:figures/full_fig_p012_15.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

46 extracted references · 34 canonical work pages

  1. [1]

    Towards compression-resistant privacy-preserving photo sharing on social networks,

    Z. Wang, H. Guo, Z. Zhang, M. Song, S. Zheng, Q. Wang, and B. Niu, “Towards compression-resistant privacy-preserving photo sharing on social networks,” in Proceedings of the Twenty-First International Sym- posium on Theory, Algorithmic Foundations, and Protocol Design for Mobile Networks and Mobile Computing , 2020, pp. 81–90

    work page 2020

  2. [2]

    Df-rap: A robust adversarial perturbation for defending against deepfakes in real-world social network scenarios,

    Z. Qu, Z. Xi, W. Lu, X. Luo, Q. Wang, and B. Li, “Df-rap: A robust adversarial perturbation for defending against deepfakes in real-world social network scenarios,” IEEE Transactions on Information Forensics and Security, 2024

    work page 2024

  3. [3]

    Evade deep image retrieval by stashing private images in the hash space,

    Y . Xiao, C. Wang, and X. Gao, “Evade deep image retrieval by stashing private images in the hash space,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , 2020, pp. 9651–9660

    work page 2020

  4. [4]

    Precise target- oriented attack against deep hashing-based retrieval,

    W. Zhao, J. Song, S. Yuan, L. Gao, Y . Yang, and H. Shen, “Precise target- oriented attack against deep hashing-based retrieval,” in Proceedings of the 31st ACM International Conference on Multimedia, 2023, pp. 6379– 6389

    work page 2023

  5. [5]

    Advhash: Set-to-set targeted attack on deep hashing with one single adversarial patch,

    S. Hu, Y . Zhang, X. Liu, L. Y . Zhang, M. Li, and H. Jin, “Advhash: Set-to-set targeted attack on deep hashing with one single adversarial patch,” in Proceedings of the 29th ACM International Conference on Multimedia, 2021, pp. 2335–2343

    work page 2021

  6. [6]

    Once and for all: Universal transferable adversarial perturbation against deep hashing- based facial image retrieval,

    L. Tang, D. Ye, Y . Lv, C. Chen, and Y . Zhang, “Once and for all: Universal transferable adversarial perturbation against deep hashing- based facial image retrieval,” in Proceedings of the AAAI Conference on Artificial Intelligence , vol. 38, no. 6, 2024, pp. 5136–5144

    work page 2024

  7. [7]

    Jpeg-resistant adversarial images,

    R. Shin and D. Song, “Jpeg-resistant adversarial images,” in NIPS 2017 workshop on machine learning and computer security, vol. 1, 2017, p. 8

    2017

  8. [8]

    Proactive privacy-preserving learning for cross-modal retrieval,

    P.-F. Zhang, G. Bai, H. Yin, and Z. Huang, “Proactive privacy-preserving learning for cross-modal retrieval,” ACM Transactions on Information Systems, vol. 41, no. 2, pp. 1–23, 2023

    work page 2023

Show all 46 references
  1. [9]

    Efficient query-based black-box attack against cross-modal hashing retrieval,

    L. Zhu, T. Wang, J. Li, Z. Zhang, J. Shen, and X. Wang, “Efficient query-based black-box attack against cross-modal hashing retrieval,” ACM Transactions on Information Systems , vol. 41, no. 3, pp. 1–25, 2023

    2023

  2. [10]

    Targeted adversarial attack against deep cross-modal hashing retrieval,

    T. Wang, L. Zhu, Z. Zhang, H. Zhang, and J. Han, “Targeted adversarial attack against deep cross-modal hashing retrieval,” IEEE Transactions on Circuits and Systems for Video Technology, vol. 33, no. 10, pp. 6159– 6172, 2023

    2023

  3. [11]

    Learning face representation from scratch,

    D. Yi, Z. Lei, S. Liao, and S. Z. Li, “Learning face representation from scratch,” arXiv preprint arXiv:1411.7923 , 2014

    2014 arXiv

  4. [12]

    Vggface2: A dataset for recognising faces across pose and age,

    Q. Cao, L. Shen, W. Xie, O. M. Parkhi, and A. Zisserman, “Vggface2: A dataset for recognising faces across pose and age,” in 2018 13th IEEE International Conference on Automatic Face & Gesture Recognition (FG 2018). IEEE, 2018, pp. 67–74

    2018

  5. [13]

    Very deep convolutional networks for large-scale image recognition,

    K. Simonyan, “Very deep convolutional networks for large-scale image recognition,” arXiv preprint arXiv:1409.1556 , 2014

    2014 arXiv

  6. [14]

    Deep residual learning for image recognition,

    K. He, X. Zhang, S. Ren, and J. Sun, “Deep residual learning for image recognition,” in Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, 2016, pp. 770–778

    2016

  7. [15]

    Hashnet: Deep learning to hash by continuation,

    Z. Cao, M. Long, J. Wang, and P. S. Yu, “Hashnet: Deep learning to hash by continuation,” in Proceedings of the IEEE International Conference on Computer Vision , 2017, pp. 5608–5617

    2017

  8. [16]

    Central similarity quantization for efficient image and video retrieval,

    L. Yuan, T. Wang, X. Zhang, F. E. Tay, Z. Jie, W. Liu, and J. Feng, “Central similarity quantization for efficient image and video retrieval,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2020, pp. 3083–3092. 13

    2020

  9. [17]

    Deep hash distillation for image retrieval,

    Y . K. Jang, G. Gu, B. Ko, I. Kang, and N. I. Cho, “Deep hash distillation for image retrieval,” in European Conference on Computer Vision. Springer, 2022, pp. 354–371

    2022

  10. [18]

    Explaining and harnessing adversarial examples,

    I. J. Goodfellow, J. Shlens, and C. Szegedy, “Explaining and harnessing adversarial examples,” arXiv preprint arXiv:1412.6572 , 2014

    2014 arXiv

  11. [19]

    Towards transferable adversarial attacks on vision transformers,

    Z. Wei, J. Chen, M. Goldblum, Z. Wu, T. Goldstein, and Y .-G. Jiang, “Towards transferable adversarial attacks on vision transformers,” in Proceedings of the AAAI Conference on Artificial Intelligence , vol. 36, no. 3, 2022, pp. 2668–2676

    2022

  12. [20]

    Perturbing attention gives you more bang for the buck: Subtle imaging perturbations that efficiently fool customized diffusion models,

    J. Xu, Y . Lu, Y . Li, S. Lu, D. Wang, and X. Wei, “Perturbing attention gives you more bang for the buck: Subtle imaging perturbations that efficiently fool customized diffusion models,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , 20...

    2024

  13. [21]

    En- hancing transferability of adversarial examples through mixed-frequency inputs,

    Y . Qian, K. Chen, B. Wang, Z. Gu, S. Ji, W. Wang, and Y . Zhang, “En- hancing transferability of adversarial examples through mixed-frequency inputs,” IEEE Transactions on Information Forensics and Security, 2024

    2024

  14. [22]

    Task-specific importance-awareness matters: On targeted attacks against object detec- tion,

    X. Sun, G. Cheng, H. Li, H. Peng, and J. Han, “Task-specific importance-awareness matters: On targeted attacks against object detec- tion,” IEEE Transactions on Circuits and Systems for Video Technology, 2024

    2024

  15. [23]

    Language model agnostic gray-box adversarial attack on image captioning,

    N. Aafaq, N. Akhtar, W. Liu, M. Shah, and A. Mian, “Language model agnostic gray-box adversarial attack on image captioning,” IEEE Transactions on Information Forensics and Security , vol. 18, pp. 626– 638, 2022

    2022

  16. [24]

    Towards deep learning models resistant to adversarial attacks,

    A. M ˛ adry, A. Makelov, L. Schmidt, D. Tsipras, and A. Vladu, “Towards deep learning models resistant to adversarial attacks,” stat, vol. 1050, no. 9, 2017

    2017

  17. [25]

    V oice guard: Protecting voice privacy with strong and imperceptible adversarial perturbation in the time domain

    J. Li, D. Ye, L. Tang, C. Chen, and S. Hu, “V oice guard: Protecting voice privacy with strong and imperceptible adversarial perturbation in the time domain.” in Proceedings of the Thirty-Second International Joint Conference on Artificial Intelligence , 2023, pp. 4812–4820

    2023

  18. [26]

    Cross-modal transferable adversarial attacks from images to videos,

    Z. Wei, J. Chen, Z. Wu, and Y .-G. Jiang, “Cross-modal transferable adversarial attacks from images to videos,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , 2022, pp. 15 064–15 073

    2022

  19. [27]

    Adversarial examples in the physical world,

    A. Kurakin, I. J. Goodfellow, and S. Bengio, “Adversarial examples in the physical world,” in Artificial Intelligence Safety and Security . Chapman and Hall/CRC, 2018, pp. 99–112

    2018

  20. [28]

    Boosting adversarial attacks with momentum,

    Y . Dong, F. Liao, T. Pang, H. Su, J. Zhu, X. Hu, and J. Li, “Boosting adversarial attacks with momentum,” in Proceedings of the IEEE Con- ference on Computer Vision and Pattern Recognition , 2018, pp. 9185– 9193

    2018

  21. [29]

    Nesterov accelerated gradient and scale invariance for adversarial attacks,

    J. Lin, C. Song, K. He, L. Wang, and J. E. Hopcroft, “Nesterov accelerated gradient and scale invariance for adversarial attacks,” arXiv preprint arXiv:1908.06281, 2019

    1908 arXiv

  22. [30]

    Learning to learn transferable attack,

    S. Fang, J. Li, X. Lin, and R. Ji, “Learning to learn transferable attack,” in Proceedings of the AAAI Conference on Artificial Intelligence, vol. 36, no. 1, 2022, pp. 571–579

    2022

  23. [31]

    Univer- sal adversarial perturbations,

    S.-M. Moosavi-Dezfooli, A. Fawzi, O. Fawzi, and P. Frossard, “Univer- sal adversarial perturbations,” in Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition , 2017, pp. 1765–1773

    2017

  24. [32]

    Image-to-image translation with conditional adversarial networks,

    P. Isola, J.-Y . Zhu, T. Zhou, and A. A. Efros, “Image-to-image translation with conditional adversarial networks,” in Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition , 2017, pp. 1125–1134

    2017

  25. [33]

    Who’s afraid of adversarial queries? the impact of image modifications on content-based image retrieval,

    Z. Liu, Z. Zhao, and M. Larson, “Who’s afraid of adversarial queries? the impact of image modifications on content-based image retrieval,” in Proceedings of the 2019 on International Conference on Multimedia Retrieval, 2019, pp. 306–314

    2019

  26. [34]

    Unsupervised adversar- ial attacks on deep feature-based retrieval with gan,

    G. Zhao, M. Zhang, J. Liu, and J.-R. Wen, “Unsupervised adversar- ial attacks on deep feature-based retrieval with gan,” arXiv preprint arXiv:1907.05793, 2019

    1907 arXiv

  27. [35]

    Ap-gan: Adversarial patch attack on content-based image retrieval systems,

    G. Zhao, M. Zhang, J. Liu, Y . Li, and J.-R. Wen, “Ap-gan: Adversarial patch attack on content-based image retrieval systems,” GeoInformatica, pp. 1–31, 2022

    2022

  28. [36]

    Targeted mismatch adversarial attack: Query with a flower to retrieve the tower,

    G. Tolias, F. Radenovic, and O. Chum, “Targeted mismatch adversarial attack: Query with a flower to retrieve the tower,” in Proceedings of the IEEE/CVF International Conference on Computer Vision , 2019, pp. 5037–5046

    2019

  29. [37]

    Dair: A query-efficient decision-based attack on image retrieval systems,

    M. Chen, J. Lu, Y . Wang, J. Qin, and W. Wang, “Dair: A query-efficient decision-based attack on image retrieval systems,” in Proceedings of the 44th International ACM SIGIR Conference on Research and Develop- ment in Information Retrieval , 2021, pp. 1064–1073

    2021

  30. [38]

    Universal pertur- bation attack against image retrieval,

    J. Li, R. Ji, H. Liu, X. Hong, Y . Gao, and Q. Tian, “Universal pertur- bation attack against image retrieval,” in Proceedings of the IEEE/CVF International Conference on Computer Vision , 2019, pp. 4899–4908

    2019

  31. [39]

    Adversarial examples for hamming space search,

    E. Yang, T. Liu, C. Deng, and D. Tao, “Adversarial examples for hamming space search,” IEEE Transactions on Cybernetics , vol. 50, no. 4, pp. 1473–1484, 2018

    2018

  32. [40]

    Targeted attack for deep hashing based retrieval,

    J. Bai, B. Chen, Y . Li, D. Wu, W. Guo, S.-t. Xia, and E.-h. Yang, “Targeted attack for deep hashing based retrieval,” in Computer Vision– ECCV 2020: 16th European Conference, Glasgow, UK, August 23–28, 2020, Proceedings, Part I 16 . Springer, 2020, pp. 618–634

    2020

  33. [41]

    A smart adversarial attack on deep hashing based image retrieval,

    J. Lu, M. Chen, Y . Sun, W. Wang, Y . Wang, and X. Yang, “A smart adversarial attack on deep hashing based image retrieval,” inProceedings of the 2021 International Conference on Multimedia Retrieval, 2021, pp. 227–235

    2021

  34. [42]

    You see what i want you to see: Exploring targeted black-box transferability attack for hash-based image retrieval systems,

    Y . Xiao and C. Wang, “You see what i want you to see: Exploring targeted black-box transferability attack for hash-based image retrieval systems,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , 2021, pp. 1934–1943

    2021

  35. [43]

    Initiative defense against facial manipulation,

    Q. Huang, J. Zhang, W. Zhou, W. Zhang, and N. Yu, “Initiative defense against facial manipulation,” in Proceedings of the AAAI Conference on Artificial Intelligence, vol. 35, no. 2, 2021, pp. 1619–1627

    2021

  36. [44]

    Anti-dreambooth: Protecting users from personalized text-to-image synthesis,

    T. Van Le, H. Phung, T. H. Nguyen, Q. Dao, N. N. Tran, and A. Tran, “Anti-dreambooth: Protecting users from personalized text-to-image synthesis,” in Proceedings of the IEEE/CVF International Conference on Computer Vision , 2023, pp. 2116–2127

    2023

  37. [45]

    Robust image forgery detection against transmission over online social networks,

    H. Wu, J. Zhou, J. Tian, J. Liu, and Y . Qiao, “Robust image forgery detection against transmission over online social networks,” IEEE Trans- actions on Information Forensics and Security , vol. 17, pp. 443–456, 2022

    2022

  38. [46]

    Dual defense: Adversarial, traceable, and invisible robust watermarking against face swapping,

    Y . Zhang, D. Ye, C. Xie, L. Tang, X. Liao, Z. Liu, C. Chen, and J. Deng, “Dual defense: Adversarial, traceable, and invisible robust watermarking against face swapping,”IEEE Transactions on Information Forensics and Security, 2024

    2024

Pith tools

Reviewed August 11, 2026 · model on record in the stance chip above.