Pith. sign in

REVIEW 3 major objections 4 minor 58 references

The Relationship Between Network Similarity and Transferability of Adversarial Attacks

T0 review · 3 major / 4 minor · reviewed 2026-08-10 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Network similarity scores predict the success of transferred black-box and C&W attacks with over 90% accuracy.

desk verdict The descriptive similarity analysis is worth a look, but the headline >90% prediction accuracy is very likely a train/test leakage artifact and should not be taken at face value. read the letter →

arxiv 2501.18629 v1 pith:SOY7O656 submitted 2025-01-27 cs.CR cs.LG

Gerrit Klause , Niklas Bunzel This is my paper · ORCID
classification cs.CRcs.LG
keywords AdversarialAttacksTransferabilityNetworkSimilarityCenteredKernelAlignment(CKA)DiagonalBox(DBS)DecisionTreeRegressionConvolutionalNeuralNetworksBlack-box
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper asks whether the similarity between two convolutional neural networks can predict how well an adversarial attack on one will transfer to the other. The authors compare twenty common CNN architectures using the Centered Kernel Alignment (CKA) similarity score and their own Diagonal Box Similarity (DBS) score, then relate those scores to measured transferred-attack success rates for a range of white-box and black-box attacks. They find that networks are only moderately similar overall, that simpler networks are better sources of transferable attacks while larger networks are more vulnerable targets, and that a decision-tree regressor predicts transferred-attack success rates for black-box attacks and for the C&W family of optimization-based attacks with over 90% accuracy within a 1% threshold. The practical hope behind the work is that a network designer could compare a new model to existing ones and estimate its vulnerability before deploying it.

What carries the argument

The argument runs on three pieces. Centered Kernel Alignment (CKA) quantifies representational similarity between networks by comparing the similarity matrices of their activations on shared inputs, with values from 0 to 1. The proposed Diagonal Box Similarity (DBS) score computes the mean absolute CKA similarity over a band around the diagonal of the layer-wise similarity matrix, focusing on corresponding layers rather than all cross-layer pairs. A decision-tree regressor takes these similarity scores together with the layer counts of the two networks as features and the measured transferred-attack success rate as the target; its near-zero mean squared error on black-box and C&W subsets is the paper's main evidence for a usable relationship.

What would settle it

Re-run the decision-tree evaluation with a group split that assigns all attacks from a given (source, target) pair to either the training or the test set, never both; if the over-90% accuracy figure collapses toward chance or toward the accuracy achieved on other subsets (roughly 30%), the central predictive claim is refuted. A second check would be to train on a set of architectures and test on a completely held-out architecture not seen in training.

Watch

Extended reading notes

Core claim

The paper's central claim is that, under the conditions tested, a network-similarity signal carries usable information about adversarial-attack transferability: a decision-tree regressor trained on pair-wise similarity scores and layer counts predicts transferred-attack success rates for all black-box attacks and for the C&W family of optimization-based attacks with an accuracy above 90% within a 1% tolerance. The authors further report that non-transferred attacks succeed at a nearly uniform rate across architectures (mean around 87%, standard deviation around 4%), while transferred attacks vary substantially, and that a simpler or smaller source network produces more transferable attacks whereas a larger or more complex target network is more easily attacked. They introduce the Diagonal Box Similarity (DBS) score, which averages CKA similarities only near the diagonal of the layer-similarity matrix, and find it gives a wider range of network similarity values than plain CKA.

Load-bearing premise

The reported over-90% accuracy claim presumes that randomly splitting individual attack instances into training and test sets measures generalization to unseen network pairs, even though every attack from the same (source, target) pair shares the same features and the same pair can appear in both splits.

Editorial extensions

If this is right

  • A network designer could estimate a new model's vulnerability to black-box and C&W transferred attacks by computing its CKA/DBS similarity to a set of reference networks, without running the attacks.
  • Because non-transferred attack success rates are nearly identical across architectures, robustness differences between CNNs are best measured through transferred attacks rather than direct white-box attacks.
  • Attacks crafted on simpler or smaller networks transfer more readily, while larger and more complex targets are more susceptible, which could guide both attack and defense choices.
  • The DBS score, with its wider range of similarity values than CKA, may provide a more discriminating input for similarity-based vulnerability models.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If the result holds, the decision-tree approach becomes a cheap 'vulnerability probe': an analyst with a candidate architecture could screen it against a library of known networks before any attack is run, and the same recipe might carry over to transformers or other architectures with an appropriate similarity metric.
  • The reported accuracy should be re-tested with a group split that keeps every (source, target) pair entirely in either the training or test set; because the features are constant for all attacks from one pair, the current split may let the tree memorize pair-level averages and overstate generalization.
  • The direction of the transferability pattern—simple sources, complex targets—suggests a testable hypothesis that decision-boundary curvature or capacity, not just layer count, drives transfer success; measuring similarity-limited variants of the same architecture would isolate the mechanism.
  • One could extend the analysis to targeted vs non-targeted attacks separately in the regression, since the paper finds the largest variability in targeted PGD and FGSM, and see whether similarity features become more predictive on those high-variance subsets.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 4 minor

Summary. The paper studies the relationship between network similarity, measured by Centered Kernel Alignment (CKA) and a newly proposed Diagonal Box Similarity (DBS) score, and the success rates of transferred adversarial attacks across a suite of torchvision CNNs. It presents descriptive statistics of network and layer similarity, an analysis of transferred attack success rates, and a supervised-learning component in which a DecisionTreeRegressor is trained on pair-level similarity features and layer counts to predict transferred attack success rates. The central claim, stated in the abstract and conclusion, is that this regressor predicts the success rate of transferred attacks for all black-box and Carlini & Wagner attacks with accuracy above 90%, suggesting that predictive models may be viable for network designers. The paper also introduces the DBS score as a refinement of CKA and reports extensive correlation analyses.

Significance. If the central predictive claim were sound, the paper would offer a practically useful empirical result: network designers could estimate a new network's vulnerability to transferred black-box and C&W attacks from similarity scores and layer counts alone. The descriptive parts of the paper—CKA/DBS similarity statistics, layer-wise similarity patterns, and the transferability observations across many architectures—are potentially useful reference material. The paper also contributes a concrete, if simple, definition of a new similarity metric (DBS). However, the load-bearing claim of 'over 90% accuracy' is undermined by a likely data-leakage artifact in the evaluation protocol, and the abstract overstates what Table 4 actually reports even under the paper's own evaluation scheme. For this reason the significance of the current manuscript is limited; the predictive claim requires re-evaluation with a properly separated data split before it can be taken as evidence.

major comments (3)
  1. [§4.5.2, Table 4] The decision-tree evaluation uses a random 80/20 split of individual instances via train_test_split with random_state=42. Each instance corresponds to a (source, target, attack) triple, but the feature vector X is constructed from the similarity score of the (source, target) pair and the layer counts of the two networks; it does not depend on the attack. Consequently, all rows belonging to the same network pair have identical feature vectors, and under a random instance-level split the same pair can appear in both training and test sets. A decision tree can isolate such pairs in leaves and output the mean training success rate for that pair, which is effectively memorization of pair-level averages rather than generalization to unseen pairs. Because Table 2 shows that transferred success rates for many attacks are highly consistent across attacks (e.g., low standard deviations for C&W and several black-box attacks), the memorized pair mean will often fall within the paper's 0.01 accuracy threshold, inflating the reported accuracy and MSE improvement. The reported values in Table 4 are therefore not evidence that the model predicts for new network pairs, which is precisely the scenario the paper's application requires. The evaluation should be repeated with a split by (source, target) pair, holding out entire pairs, or by a grouped cross-validation scheme.
  2. [Abstract and §5; Table 4] The abstract and Section 5 state that the DecisionTreeRegressor predicts transferred attack success rates 'for all black-box and Carlini & Wagner attacks with an accuracy of over 90%'. This is not supported by Table 4 even when the flawed split is taken at face value: the non-targeted black-box subset reports 73.68% accuracy and the non-targeted C&W subset reports 71.05%, both below 90%. The 'over 90%' phrasing is also internally inconsistent with the paper's own recognition that results vary across data subsets. At minimum, the abstract should be corrected to report the per-subset numbers accurately.
  3. [§4.5.3 and §4.5.2] The paper acknowledges in Section 4.5.3 that visual inspection of the data reveals no identifiable correlation between similarity and transferred attack success rates, and in Section 4.5.2 it notes that no other attack subset achieves similar decision-tree accuracy. The high accuracy for black-box and C&W attacks is then attributed to properties of these attacks, but no controlled experiment is presented to support that explanation. A pair-level split evaluation would serve as the necessary control; without it, the post-hoc interpretation that 'black-box attacks are more likely to be influenced by the similarity scores' is speculative and not grounded in the reported experiments.
minor comments (4)
  1. [§4.1] The figure references are swapped: the text says the most similar networks are 'highlighted in their similarity heatmap in 2' and the least similar networks are 'shown in their similarity heatmap in 1', but Figure 1 depicts the SqueezeNet/MNASNet pair and Figure 2 depicts the VGG11_BN/DenseNet201 pair. Please correct the cross-references.
  2. [§4.5.2] There are several typos in this subsection: 'evalution' should be 'evaluation', 'decission tree' should be 'decision tree', 'threshhold' should be 'threshold', and 'investiagation' should be 'investigation'. These should be fixed in a revision.
  3. [§4.5.2] The description of the feature matrix X is underspecified: it is unclear whether both CKA and DBS scores are included, how the layer counts are normalized across architectures with very different total numbers of layers, and whether the layer counts are provided for both source and target networks. Please clarify the exact feature construction for reproducibility.
  4. [§4.3] The DBS score is defined with box sizes 1, 2, 3, 5, ... and the paper states that box size 5 is chosen as a good middle ground, but the analysis in Section 4.5 uses both CKA and DBS. It would be helpful to state explicitly whether all reported decision-tree and correlation results were computed with DBS box size 5 only, or whether other box sizes were also systematically evaluated.

Circularity Check

1 steps flagged · score 8.0 of 10

The reported >90% decision-tree accuracy is an artifact of instance-level train/test splitting: rows for the same (source, target) pair share identical features, so the tree can memorize pair-level success rates and 'predict' held-out rows from the same pair.

  1. fitted input called prediction [Section 4.5.2 (Supervised Learning), Table 4]
    "The feature matrix X was created using the similarity scores for the network pairs and the amount of layers for each network. The target vector y contained the success rates of the transferred adversarial attacks. The dataset was split into training and evaluation sets to ensure robust model evaluation. The feature matrix X and the target vector y were split so that 80% of the data was used to train the model and the remaining 20% was reserved for evaluation."

    The feature matrix X is constant for all rows sharing the same (source, target) pair because it contains only the pair similarity score and the two networks' layer counts, not the attack identifier. The random 80/20 row-level split therefore puts many of the same pairs in both training and test sets. A decision tree can isolate each repeated pair in a leaf and output the mean training success rate for that pair; test rows from the same pair receive that memorized mean. The paper reports that black-box and C&W transferred success rates vary little (Table 2 mostly shows standard deviations around 3%, and the text notes 'the highest delta being 0.1' for each source network), so the memorized mean lands within the paper's 1% accuracy threshold for many test rows.

full rationale

The paper's central predictive claim—that a DecisionTreeRegressor predicts transferred-attack success rates for black-box and C&W attacks with 'over 90%' accuracy—rests entirely on Section 4.5.2's evaluation protocol. Because the feature vector is identical for every attack row of a given (source, target) pair, a random row split creates train/test leakage: the model can memorize pair-level means during training and apply them to test rows from the same pair. The low standard deviations reported for these attacks make the memorized mean satisfy the 1% threshold for many test rows, so the reported accuracy and near-zero MSE are expected under the chosen split rather than evidence of generalization. This is the sense in which the 'prediction' reduces to its input by construction. I do not find load-bearing self-citation circularity: the authors cite their own prior work on adversarial patches [11,13], but those citations are not used to justify the main transferability claim. Separately, even taking the numbers at face value, the abstract's 'over 90%' is not supported by Table 4 for the non-targeted subsets (73.68% for black-box, 71.05% for C&W), but that is an accuracy/consistency issue rather than a circularity issue. The descriptive similarity analyses (CKA, DBS, layer similarity) are independent and not circular, but they do not rescue the paper's main predictive conclusion.

Assumptions & free parameters 2 free parameters · 3 assumptions · 0 invented entities

The central predictive claim rests on the chosen DBS box size and the accuracy threshold, both selected by the authors on the same data. The analysis also assumes CKA is a meaningful similarity measure for this purpose and that the unstated attack dataset is representative. No new physical or mathematical entities are introduced. The decision tree's internal parameters are fitted, but they are not reported as meaningful constants.

free parameters (2)
  • DBS box size r = 5
    Chosen by inspecting the heatmaps in Section 4.3 as 'a good middle ground between capturing the most important similarities and having a wider range of similarity scores'. This is an ad hoc choice made on the same data used in the correlation analysis.
  • Accuracy threshold = 0.01
    The paper defines 'accuracy' as the fraction of predictions within a 1% threshold of the true value. This threshold is chosen by the authors and directly determines the reported accuracy percentages.
assumptions (3)
  • domain assumption CKA similarity computed on a particular set of inputs yields scores that are meaningful for predicting adversarial transferability.
    The paper relies on CKA as its primary similarity measure without comparing to other similarity metrics for this predictive purpose. This enters in Section 2.2.3 and throughout the evaluation.
  • domain assumption The dataset used for the adversarial attacks is representative and consistent across all compared networks.
    The attack dataset is never stated, but the comparisons of success rates assume the same inputs and distribution are used for every network. This is implicit in Section 4.4.
  • ad hoc to paper Transferred attack success rate can be approximated as a regression function of similarity scores and layer counts alone.
    The DecisionTreeRegressor uses only these features, omitting the source model's own success rate and other potentially important factors. This modeling choice is made in Section 4.5.2.

how reviews work

0 comments
Cite this review

Pith. "Pith review of The Relationship Between Network Similarity and Transferability of Adversarial Attacks." pith.science (2026). https://pith.science/paper/SOY7O656

@misc{pith2026250118629,
  author       = {Pith},
  title        = {Pith review of: The Relationship Between Network Similarity and Transferability of Adversarial Attacks},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/SOY7O656}},
  note         = {Machine review of arXiv:2501.18629}
}
read the original abstract

Neural networks are vulnerable to adversarial attacks, and several defenses have been proposed. Designing a robust network is a challenging task given the wide range of attacks that have been developed. Therefore, we aim to provide insight into the influence of network similarity on the success rate of transferred adversarial attacks. Network designers can then compare their new network with existing ones to estimate its vulnerability. To achieve this, we investigate the complex relationship between network similarity and the success rate of transferred adversarial attacks. We applied the Centered Kernel Alignment (CKA) network similarity score and used various methods to find a correlation between a large number of Convolutional Neural Networks (CNNs) and adversarial attacks. Network similarity was found to be moderate across different CNN architectures, with more complex models such as DenseNet showing lower similarity scores due to their architectural complexity. Layer similarity was highest for consistent, basic layers such as DataParallel, Dropout and Conv2d, while specialized layers showed greater variability. Adversarial attack success rates were generally consistent for non-transferred attacks, but varied significantly for some transferred attacks, with complex networks being more vulnerable. We found that a DecisionTreeRegressor can predict the success rate of transferred attacks for all black-box and Carlini & Wagner attacks with an accuracy of over 90%, suggesting that predictive models may be viable under certain conditions. However, the variability of results across different data subsets underscores the complexity of these relationships and suggests that further research is needed to generalize these findings across different attack scenarios and network architectures.

Figures

Figures reproduced from arXiv: 2501.18629 by the authors.

Figure 1
Figure 1. Similarity heatmap between SqueezeNet1_1 and [PITH_FULL_IMAGE:figures/full_fig_p004_1.png] view at source ↗
Figure 3
Figure 3. Difference in the number of layers between net [PITH_FULL_IMAGE:figures/full_fig_p004_3.png] view at source ↗
Figure 5
Figure 5. Mean similarity score for each layer position in the [PITH_FULL_IMAGE:figures/full_fig_p005_5.png] view at source ↗
Figures from the paper (7 more)
Figure 7
Figure 7. Figure 7: Heatmap of mean similarity scores between differ [PITH_FULL_IMAGE:figures/full_fig_p006_7.png]
Figure 8
Figure 8. Figure 8: Similarity heatmaps for DBS and CKA scores with [PITH_FULL_IMAGE:figures/full_fig_p007_8.png]
Figure 9
Figure 9. Figure 9: Success rate for non-targeted PGD attack on all [PITH_FULL_IMAGE:figures/full_fig_p008_9.png]
Figure 10
Figure 10. Figure 10: Success rate for targeted PGD attack on all net [PITH_FULL_IMAGE:figures/full_fig_p008_10.png]
Figure 11
Figure 11. Figure 11: Decision Tree predicted success rates for Black [PITH_FULL_IMAGE:figures/full_fig_p010_11.png]
Figure 12
Figure 12. Figure 12: Decision Tree predicted success rates for C&W [PITH_FULL_IMAGE:figures/full_fig_p010_12.png]
Figure 13
Figure 13. Figure 13: Heatmap for Black-Box Attacks transferred Suc [PITH_FULL_IMAGE:figures/full_fig_p010_13.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

58 extracted references · 31 canonical work pages

  1. [1]

    Mahdieh Abbasi and Christian Gagné. 2017. Robustness to Adversarial Examples through an Ensemble of Specialists. In 5th International Conference on Learning Representations, ICLR 2017, Toulon, France, April 24-26, 2017, Workshop Track Proceedings. OpenReview.net. https://openreview.net/forum?id =S1cYxlSFx

    work page 2017

  2. [2]

    Naveed Akhtar, Ajmal Mian, Navid Kardan, and Mubarak Shah. 2021. Ad- vances in adversarial attacks and defenses in computer vision: A survey. arXiv:2108.00401 [cs.CV]

    arXiv 2021

  3. [3]

    Enrique Álvarez, Rafael Álvarez, and Miguel Cazorla. 2023. Exploring Transfer- ability on Adversarial Attacks. IEEE Access 11 (2023), 105545–105556. https: //doi.org/10.1109/ACCESS.2023.3319389

    work page arXiv 2023

  4. [4]

    Maksym Andriushchenko, Francesco Croce, Nicolas Flammarion, and Matthias Hein. 2020. Square Attack: a query-efficient black-box adversarial attack via random search. arXiv:1912.00049 [cs.LG]

    arXiv 2020

  5. [5]

    Anurag Arnab, Ondrej Miksik, and Philip H. S. Torr. 2018. On the Robustness of Semantic Segmentation Models to Adversarial Attacks. arXiv:1711.09856 [cs.CV]

    work page Pith review arXiv 2018

  6. [6]

    Siddhant Bhambri, Sumanyu Muku, Avinash Tulasi, and Arun Balaji Buduru

    work page

  7. [7]

    Katherine Bourzac. 2016. Bringing Big Neural Networks to Self-Driving Cars, Smartphones, and Drones. IEEE Spectrum (2016)

    work page 2016

  8. [8]

    Wieland Brendel, Jonas Rauber, and Matthias Bethge. 2018. Decision-Based Ad- versarial Attacks: Reliable Attacks Against Black-Box Machine Learning Models. arXiv:1712.04248 [stat.ML]

    arXiv 2018

Show all 58 references
  1. [9]

    J. E. Bresenham. 1965. Algorithm for computer control of a digital plotter. IBM Systems Journal 4, 1 (1965), 25–30. https://doi.org/10.1147/sj.41.0025

    1965 doi

  2. [10]

    Brown, Dandelion Mané, Aurko Roy, Martín Abadi, and Justin Gilmer

    Tom B. Brown, Dandelion Mané, Aurko Roy, Martín Abadi, and Justin Gilmer

  3. [11]

    Niklas Bunzel, Raphael Antonius Frick, Gerrit Klause, Aino Schwarte, and Jonas Honermann. 2024. Signals Are All You Need: Detecting and Mitigating Digital and Real-World Adversarial Patches Using Signal-Based Features. In Proceedings of the 2nd ACM Workshop on Secure and Trust...

    2024

  4. [12]

    Niklas Bunzel and Lukas Graner. 2023. A Concise Analysis of Pasting Attacks and their Impact on Image Classification. In 2023 53rd Annual IEEE/IFIP International Conference on Dependable Systems and Networks Workshops (DSN-W) . IEEE, 136– 140

    2023

  5. [13]

    Niklas Bunzel and Jannis Hamborg. 2024. Adversarial Patch Detection: Leverag- ing Depth Contrast for Enhanced Threat Visibility. In 2024 54th Annual IEEE/IFIP International Conference on Dependable Systems and Networks Workshops (DSN- W). IEEE, 39–45

    2024

  6. [14]

    Francesco Croce, Maksym Andriushchenko, Vikash Sehwag, Edoardo Debenedetti, Nicolas Flammarion, Mung Chiang, Prateek Mittal, and Matthias Hein. 2020. Robustbench: a standardized adversarial robustness benchmark. arXiv preprint arXiv:2010.09670 (2020)

    2020 arXiv

  7. [15]

    Matszangosz, Gergely Papp, and Dániel Varga

    Adrián Csiszárik, Péter Kőrösi-Szabó, Ákos K. Matszangosz, Gergely Papp, and Dániel Varga. 2021. Similarity and Matching of Neural Network Representations. arXiv:2110.14633 [cs.LG]

    2021 arXiv

  8. [16]

    Nilaksh Das, Madhuri Shanbhogue, Shang-Tse Chen, Fred Hohman, Li Chen, Michael E Kounavis, and Duen Horng Chau. 2017. Keeping the bad guys out: Protecting and vaccinating deep learning with jpeg compression. arXiv preprint arXiv:1705.02900 (2017)

    2017 arXiv

  9. [17]

    Ambra Demontis, Marco Melis, Maura Pintor, Matthew Jagielski, Battista Biggio, Alina Oprea, Cristina Nita-Rotaru, and Fabio Roli. 2019. Why do adversarial attacks transfer? explaining transferability of evasion and poisoning attacks. In Proceedings of the 28th USENIX Conferenc...

    2019

  10. [18]

    Yinpeng Dong, Qi-An Fu, Xiao Yang, Tianyu Pang, Hang Su, Zihao Xiao, and Jun Zhu. 2020. Benchmarking adversarial robustness on image classification. In proceedings of the IEEE/CVF conference on computer vision and pattern recognition . 321–331

    2020

  11. [19]

    Goodfellow, Jonathon Shlens, and Christian Szegedy

    Ian J. Goodfellow, Jonathon Shlens, and Christian Szegedy. 2015. Explaining and Harnessing Adversarial Examples. arXiv:1412.6572 [stat.ML]

    2015 arXiv

  12. [20]

    Puneet Gupta and Esa Rahtu. 2019. CIIDefence: Defeating Adversarial Attacks by Fusing Class-Specific Image Inpainting and Image Denoising. In 2019 IEEE/CVF International Conference on Computer Vision (ICCV) . 6707–6716. https://doi.org/ 10.1109/ICCV.2019.00681

    2019

  13. [21]

    Imran Ul Haq. 2022. An overview of deep learning in medical imaging. arXiv:2202.08546 [eess.IV]

    2022 arXiv

  14. [22]

    Hardoon, Sandor Szedmak, and John Shawe-Taylor

    David R. Hardoon, Sandor Szedmak, and John Shawe-Taylor. 2004. Canonical Cor- relation Analysis: An Overview with Application to Learning Methods. Neural Computation 16, 12 (2004), 2639–2664. https://doi.org/10.1162/0899766042321814

    2004 doi

  15. [23]

    Pranav K B and Manikandan J. 2020. Design and Evaluation of a Real-Time Face Recognition System using Convolutional Neural Networks. Procedia Com- puter Science 171 (2020), 1651–1659. https://doi.org/10.1016/j.procs.2020.04.177 Third International Conference on Computing and N...

    2020 doi

  16. [24]

    Simon Kornblith, Mohammad Norouzi, Honglak Lee, and Geoffrey Hin- ton. 2019. Similarity of Neural Network Representations Revisited. arXiv:1905.00414 [cs.LG]

    2019 arXiv

  17. [25]

    Jeonghun Lee and Kwang-il Hwang. 2022. YOLO with adaptive frame control for real-time object detection applications. Multim. Tools Appl. 81, 25 (2022), 36375–36396. https://doi.org/10.1007/S11042-021-11480-0

    2022 doi

  18. [26]

    Linjie Li, Jie Lei, Zhe Gan, and Jingjing Liu. 2021. Adversarial vqa: A new benchmark for evaluating the robustness of vqa models. In Proceedings of the IEEE/CVF International Conference on Computer Vision . 2042–2051

    2021

  19. [27]

    Yanpei Liu, Xinyun Chen, Chang Liu, and Dawn Song. 2017. Delving into Transferable Adversarial Examples and Black-box Attacks. arXiv:1611.02770 [cs]

    2017 arXiv

  20. [28]

    Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. 2019. Towards Deep Learning Models Resistant to Adversarial Attacks. arXiv:1706.06083 [stat.ML]

    2019 arXiv

  21. [29]

    Nag Mani, Melody Moh, and Teng-Sheng Moh. 2019. Towards robust ensemble defense against adversarial examples attack. In2019 IEEE Global Communications Conference (GLOBECOM). IEEE, 1–6

    2019

  22. [30]

    Jian-Xun Mi, Xu-Dong Wang, Li-Fang Zhou, and Kun Cheng. 2023. Adversarial examples based on object detection tasks: A survey. Neurocomputing 519 (2023), 114–126. https://doi.org/10.1016/j.neucom.2022.10.046

    2023 doi

  23. [31]

    Seyed-Mohsen Moosavi-Dezfooli, Alhussein Fawzi, Omar Fawzi, and Pascal Frossard. 2017. Universal adversarial perturbations. arXiv:1610.08401 [cs.CV]

    2017 arXiv

  24. [32]

    Ali Bou Nassif, Ismail Shahin, Imtinan Attili, Mohammad Azzeh, and Khaled Shaalan. 2019. Speech recognition using deep neural networks: A systematic review. IEEE access 7 (2019), 19143–19165

    2019

  25. [33]

    Nicolas Papernot, Patrick McDaniel, and Ian Goodfellow. 2016. Transferability in Machine Learning: From Phenomena to Black-Box Attacks Using Adversarial Samples. arXiv:1605.07277 [cs]

    2016 arXiv

  26. [34]

    Berkay Celik, and Ananthram Swami

    Nicolas Papernot, Patrick McDaniel, Ian Goodfellow, Somesh Jha, Z. Berkay Celik, and Ananthram Swami. 2017. Practical Black-Box Attacks against Machine Learning. arXiv:1602.02697 [cs]

    2017 arXiv

  27. [35]

    Berkay Celik, and Ananthram Swami

    Nicolas Papernot, Patrick McDaniel, Somesh Jha, Matt Fredrikson, Z. Berkay Celik, and Ananthram Swami. 2015. The Limitations of Deep Learning in Adver- sarial Settings. arXiv:1511.07528 [cs.CR]

    2015 arXiv

  28. [36]

    Nicolas Papernot, Patrick McDaniel, Xi Wu, Somesh Jha, and Ananthram Swami

  29. [37]

    F Pedregosa, G Varoquaux, A Gramfort, V Michel, B Thirion, O Grisel, M Blondel, P Prettenhofer, R Weiss, V Dubourg, J Vanderplas, A Passos, D Cournapeau, M Brucher, M Perrot, and E Duchesnay. 2011. Scikit-learn: Machine Learning in Python. Journal of Machine Learning Research ...

    2011

  30. [38]

    Hospedales

    Deyan Petrov and Timothy M. Hospedales. 2019. Measuring the Transferability of Adversarial Examples. arXiv:1907.06291 [cs, stat]

    2019 arXiv

  31. [39]

    Thomas Ponn, Thomas Kröger, and Frank Diermeyer. 2020. Identification and Explanation of Challenging Conditions for Camera-Based Object Detection of Automated Vehicles. Sensors 20, 13 (2020). https://doi.org/10.3390/s20133699

    2020 doi

  32. [40]

    Yunxiao Qin, Yuanhao Xiong, Jinfeng Yi, and Cho-Jui Hsieh. 2023. Training Meta-Surrogate Model for Transferable Adversarial Attack. Proceedings of the AAAI Conference on Artificial Intelligence (2023). https://doi.org/10.1609/aaai. v37i8.26139

    2023 doi

  33. [41]

    Maithra Raghu, Justin Gilmer, Jason Yosinski, and Jascha Sohl-Dickstein. 2017. SVCCA: Singular Vector Canonical Correlation Analysis for Deep Learning Dynamics and Interpretability. arXiv:1706.05806 [stat.ML]

    2017 arXiv

  34. [42]

    Rashmi and Rashmi Chaudhry. 2024. SD-YOLO-AWDNet: A hybrid approach for smart object detection in challenging weather for self-driving cars. Expert Syst. Appl. 256 (2024), 124942. https://doi.org/10.1016/J.ESWA.2024.124942

    2024

  35. [43]

    Kevin Roth, Yannic Kilcher, and Thomas Hofmann. 2019. The odds are odd: A statistical test for detecting adversarial examples. In International Conference on Machine Learning. PMLR, 5498–5507

    2019

  36. [44]

    Neha Sharma, Vibhor Jain, and Anju Mishra. 2018. An analysis of convolutional neural networks for image classification. Procedia computer science 132 (2018), 377–384

    2018

  37. [45]

    Dong Su, Huan Zhang, Hongge Chen, Jinfeng Yi, Pin-Yu Chen, and Yupeng Gao

  38. [46]

    Wattanapong Suttapak, Jianfu Zhang, and Liqing Zhang. 2022. Diminishing- feature attack: The adversarial infiltration on visual tracking. Neurocomputing 509 (2022), 21–33. https://doi.org/10.1016/j.neucom.2022.08.071

    2022 doi

  39. [47]

    Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. 2014. Intriguing Properties of Neural Networks. arXiv:1312.6199 [cs]

    2014 arXiv

  40. [48]

    Florian Tramèr, Nicolas Papernot, Ian Goodfellow, Dan Boneh, and Patrick McDaniel. 2017. The Space of Transferable Adversarial Examples. arXiv:1704.03453 [cs, stat]

    2017 arXiv

  41. [49]

    Oliphant, Matt Haberland, Tyler Reddy, David Cournapeau, Evgeni Burovski, Pearu Peterson, Warren Weckesser, Jonathan Bright, Stéfan J

    Pauli Virtanen, Ralf Gommers, Travis E. Oliphant, Matt Haberland, Tyler Reddy, David Cournapeau, Evgeni Burovski, Pearu Peterson, Warren Weckesser, Jonathan Bright, Stéfan J. van der Walt, Matthew Brett, Joshua Wilson, K. Jar- rod Millman, Nikolay Mayorov, Andrew R. J. Nelson,...

    2020

  42. [50]

    Chang Xiao, Peilin Zhong, and Changxi Zheng. 2020. Enhancing Adversarial Defense by k-Winners-Take-All. In8th International Conference on Learning Rep- resentations, ICLR 2020, Addis Ababa, Ethiopia, April 26-30, 2020 . OpenReview.net. https://openreview.net/forum?id=Skgvy64tvr

    2020

  43. [51]

    Weilin Xu, David Evans, and Yanjun Qi. 2018. Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networks. In 25th Annual Network and Distributed System Security Symposium, NDSS 2018, San Diego, California, USA, February 18-21, 2018. The Internet Society. https://...

    2018

  44. [52]

    Salman Asif, Amit K

    Mingjun Yin, Shasha Li, Chengyu Song, M. Salman Asif, Amit K. Roy-Chowdhury, and Srikanth V. Krishnamurthy. 2021. ADC: Adversarial attacks against object Detection that evade Context consistency checks. arXiv:2110.12321 [cs.CV]

    2021 arXiv

  45. [53]

    Sheng, Ahoud Alhazmi, and Chenliang Li

    Wei Emma Zhang, Quan Z. Sheng, Ahoud Alhazmi, and Chenliang Li. 2019. Adversarial Attacks on Deep Learning Models in Natural Language Processing: A Survey. arXiv:1901.06796 [cs.CL]

    2019 arXiv

  46. [54]

    Piotr Żelasko, Sonal Joshi, Yiwen Shao, Jesus Villalba, Jan Trmal, Najim Dehak, and Sanjeev Khudanpur. 2021. Adversarial Attacks and Defenses for Speech Recognition Systems. arXiv:2103.17122 [eess.AS]

    2021 arXiv

  47. [2016]

    arXiv:1511.04508 [cs.CR]

    Distillation as a Defense to Adversarial Perturbations against Deep Neural Networks. arXiv:1511.04508 [cs.CR]

    arXiv

  48. [2018]

    arXiv:1712.09665 [cs]

    Adversarial Patch. arXiv:1712.09665 [cs]

    arXiv

  49. [2019]

    arXiv:1808.01688 [cs]

    Is Robustness the Cost of Accuracy? – A Comprehensive Study on the Robustness of 18 Deep Image Classification Models. arXiv:1808.01688 [cs]

    arXiv

  50. [2020]

    arXiv:1912.01667 [cs.LG]

    A Survey of Black-Box Adversarial Attacks on Computer Vision Models. arXiv:1912.01667 [cs.LG]

    1912 arXiv

Pith tools

Reviewed August 10, 2026 · model on record in the stance chip above.