Pith. sign in

REVIEW 3 major objections 5 minor 94 references

NAT: Learning to Attack Neurons for Enhanced Adversarial Transferability

T0 review · 3 major / 5 minor · reviewed 2026-08-15 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Attacking individual neurons instead of whole layers makes adversarial images transfer across many more models.

desk verdict Per-neuron generators are a genuinely new attack idea with a broad evaluation, but the headline gain over LTP is confounded by an unreported padding change in the generator. read the letter →

arxiv 2508.16937 v1 pith:DEI4RLNQ submitted 2025-08-23 cs.CV

Krishna Kanth Nakka , Alexandre Alahi This is my paper · ORCID
classification cs.CV
keywords adversarialtransferabilitygenerativeattacksneuron-levelfeature-basedblack-boxquery-efficientImageNetvisiontransformers
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Existing generative adversarial attacks train a single generator to pull whole mid-layer embeddings apart, and this paper shows that in practice such attacks concentrate their damage on a small set of neurons encoding one concept, leaving most of the layer untouched. NAT instead trains one generator per neuron, with the sole objective of maximizing the change in that neuron's activation between clean and adversarial images. The paper reports that a single such generator fools an average of 60.6% of 41 ImageNet models, compared with 44.6% for the strongest baseline LTP, and that querying the top-40 generators in ranking order pushes fooling rates above 90% on convolutional models within 10 queries. The larger claim is that individual neurons, not layer-level representations, are the common currency that transfers across architectures.

What carries the argument

The mechanism is a family of neuron-specific generators. A 'neuron' here means one channel of a CNN feature map: layer 18 of VGG16 has 512 such channels. Each generator G_j is trained with the loss $L_{adv}(G_j) = ||f^j_l(x) - f^j_l(x_a)||_2^2$, so it attacks exactly one concept rather than the whole embedding. The critical second piece is low-fidelity selection: all 512 generators are trained briefly on 3.12% of ImageNet, ranked by fooling rate on a held-out model, and only the top 40 are fully trained; at inference the generators are queried in that rank order, and an image counts as fooled if any one of the queries succeeds. The loss gives each generator a single focused objective, and the ranking procedure converts that diversity into an ordered ensemble that works within a tight query budget.

What would settle it

Take a held-out model outside the 41 target architectures, retrain the 512 lightweight generators on a different 3.12% data subset, rank them, fully train the top-1 and a bottom-ranked generator, and measure average fooling rates on the remaining targets; if the top-1 rate falls to roughly LTP's 44.6% or the ranking flips under full training, the neuron-ranking premise is false.

Watch

Extended reading notes

Core claim

The central discovery is that transferability is better bought at the level of a single channel of a mid-layer feature map than at the level of the whole embedding. For each neuron position j in layer 18 of VGG16, NAT trains a generator G_j that maximizes $||f^j_l(x) - f^j_l(x_a)||_2^2$, where $f^j_l$ is the activation map of that neuron. After a cheap training pass on 3.12% of ImageNet to rank all 512 generators by transferability to a held-out model, the top 40 are fully trained; in the single-query setting the best-ranked generator reaches 60.6% average fooling rate across 41 architectures, over 14 percentage points above the LTP baseline's 44.6%, and with 10 or 40 queries the complementary generators reach 93.9% and 96.2% on the 16 convolutional models. In cross-domain settings the single-query attack lowers average adversarial accuracy from around 50% for prior feature-based baselines to 40.94% across nine fine-grained models. The paper argues these gains come from each generator specializing in one distinct concept, producing diverse perturbations that cover neurons other attacks leave untouched.

Load-bearing premise

The load-bearing premise is that the ordering of the 512 neuron-specific generators by transferability, measured after training on only 3.12% of ImageNet and judged on a single held-out model such as DenseNet121, remains the right ordering after full training and on the 41 target models, even though those held-out models are themselves part of the target set.

Editorial extensions

If this is right

  • Black-box attacks on unseen architectures improve with no extra information: a single NAT generator already outperforms the strongest prior baseline on 41 ImageNet models, and the gap widens on transformers and hybrid models when a few queries are allowed.
  • The top-40 generators behave as a small ordered ensemble, so an attacker can trade queries for fooling rate: 10 queries reach 93.9% on convolutional, 44.9% on transformer, and 74.1% on hybrid models.
  • Because each generator targets a distinct concept, the attack portfolio is complementary; the best generator for a target varies by architecture, so no single pattern dominates.
  • If neurons are genuinely shared across models, then interpretability tools that name neuron concepts could directly predict which generators to train, linking attack transferability to model alignment.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • A stronger selection rule may be available: the paper notes the best fully trained generator G391 outperforms the top-ranked G250 by over 4%, implying the cheap 3.12% ranking leaves recoverable gains; a two-stage or diversity-aware selection could push single-query rates higher.
  • The ranking premise should be tested with held-out models fully disjoint from the target set, since DenseNet121, ResNet152, and VGG16 all appear among the 41 evaluated models; if the ranking advantage shrinks on a disjoint held-out model, part of the reported gain is selection leakage.
  • Cross-domain transfer might be improved by choosing the ranking model from the target domain's backbone family, since the paper's own ablation shows ResNet152 as held-out gives 9.5% adversarial accuracy versus 13.6% for DenseNet121 on the nine fine-grained models.
  • The same neuron-ranking map could serve as an interpretability diagnostic: the ordering of which neurons transfer best across 41 models is itself a measurement of how universally concepts are represented in vision networks.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. The paper proposes NAT, a generative transferable-attack method that trains individual generators to maximize L2 separation of a single neuron (channel) in a mid-layer embedding of a VGG16 source model, rather than maximizing separation of the full embedding as in LTP/BIA. Using a low-fidelity warm-up on 3.12% of ImageNet, the authors select 40 of 512 neuron-specific generators and fully train them; at inference they query the target with one or several of these generators. The central empirical claim is that a single NAT generator achieves about 60.6% average fooling rate over 41 ImageNet models versus 44.6% for LTP, and that querying up to 10 generators improves transferability further. The paper also reports cross-domain results on three fine-grained datasets.

Significance. If the reported gains hold under a controlled comparison, the paper would be a meaningful step in understanding why embedding-level generative attacks transfer: shifting from whole-embedding objectives to per-neuron experts is a clean, simple idea, and the experiments are substantially broader than prior work (41 ImageNet models instead of about five). The full per-generator/per-model tables in the appendix, the public code release, and the explicit discussion of generator-level failure modes are strengths. However, the headline improvement is currently difficult to attribute to neuron-specific targeting because the NAT generator architecture differs from the baselines in a way that is known to affect perturbation patterns, and the neuron-selection protocol uses models that are also in the evaluation set.

major comments (3)
  1. [Section 6, 'Generator Modifications'; Section 3.3; Figure 4; Tables 2-4] The comparison is not architecture-controlled. The paper states that it removed the non-deterministic ReflectionPad2d operations from the generator and replaced them with ordinary padding, while the LTP and BIA baselines are the original pretrained generators that retain ReflectionPad2d. Because padding type changes boundary artifacts and can materially affect the transferability of generated perturbations, the reported 14-point single-query improvement over LTP may be partly or largely due to this architectural change rather than to the neuron-specific loss in Eq. (1). Please retrain LTP and BIA with the identical padding-free generator architecture, or provide an ablation of NAT trained with the original ReflectionPad2d generator, and report the controlled comparison.
  2. [Section 4.1, Section 4.4, Tables 2-6] The neuron-selection protocol is not independent of the evaluation set. In the main experiments the top-k neurons are selected using DenseNet121 as the held-out model, and DenseNet121 is also one of the 41 target models in Table 2; the ablation uses ResNet152 and VGG16, which also appear in the target list. This means the rows for these models are not held out. Although Table 6 suggests robustness across selection models, the reported averages should be recomputed excluding the selection model from the target set, or the authors should use a held-out model that is not among the 41 evaluation models.
  3. [Section 4.2, Table 5] The cross-domain claim in the abstract and Section 4.2 should be stated in a way that matches Table 5. Table 5 reports adversarial accuracy, where lower values indicate a stronger attack, and the difference between NAT (40.94%) and FACL (44.05%) is about 3.1 percentage points, not 4%; the text says 'additional 3.5% points' and the abstract says 'over 4% improvement'. Please reconcile the numbers and clearly state the metric orientation in the text.
minor comments (5)
  1. [Abstract and Section 4.1] The abstract and text say 'cross-modal' where the intended term is likely 'cross-model'; please correct for consistency.
  2. [Section 3.1, Figure 2] The text says 'around 424/512 (83%) neurons are largely unaffected with the LTA'; 'LTA' appears to be a typo for 'LTP'.
  3. [Section 3.1] There are several typos that should be cleaned up, including 'phenemenon', 'synthethesised', 'prevous', and 'stratefies'.
  4. [Section 6, Generator Modifications] The term 'ReflectionPadding layers' is used in Section 3.3 while the appendix uses 'ReflectionPad2d'; please use one consistent name.
  5. [Section 4.2] In Table 5, please add a note in the caption that lower adversarial accuracy means a stronger attack, since the values in the text otherwise appear counterintuitive.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the central claims are empirical measurements, not derivations from fitted inputs.

full rationale

The paper's derivation chain is empirical rather than circular. NAT trains per-neuron generators using Eq. (1), which is the L2 feature-separation loss of LTP applied to a single channel; the reported gains are measured fooling rates on held-out target models, not quantities computed from the training objective or from the neuron-selection ranking. The top-k selection procedure uses lightweight training and a held-out model (DenseNet121, ResNet152, or VGG16), and the paper transparently reports that the top-ranked generator is not the best after full training (Tables 9 and 10), so the headline single-query result is not forced by the selection step. The self-citations in the introduction and related work are contextual and not load-bearing. The choice of attack layer l=18 is inherited from LTP and is an empirical hyperparameter, not a uniqueness claim or a self-citation chain that forecloses alternatives. Two legitimate concerns exist but are not circularity: DenseNet121 is both the held-out selector and one of the 41 target models, which is a mild selection-leakage issue, and the paper replaces ReflectionPad2d in its generator while using pretrained LTP/BIA baselines that keep it, an architecture-controlled comparison issue. Neither concern makes the central claim equivalent to its inputs by construction, and the ablation with different held-out models shows the results are stable. Therefore the paper is self-contained against external benchmarks and receives a circularity score of 0.

Assumptions & free parameters 3 free parameters · 3 assumptions · 0 invented entities

The experiment has no fitted mathematical constants. Its hyperparameters (k, layer, epsilon) come from prior work or compute budgets, and its premises are standard domain assumptions about neuron interpretability and transferability. No new physical or conceptual entities are introduced.

free parameters (3)
  • k (number of selected generators) = 40
    Chosen as a computational budget; not fitted to data. The paper trains all 512 briefly, then selects the top 40 by held-out transferability.
  • attack layer l = 18 (VGG16)
    Taken from LTP's recommendation; not re-tuned for NAT, though the paper acknowledges it did not explore other layers.
  • perturbation budget epsilon = 10
    Standard value used in prior works LTP, BIA, CDA; copied rather than derived.
assumptions (3)
  • domain assumption Neurons in VGG16 layer 18 correspond to distinct interpretable concepts
    Used to justify attacking individual neurons; based on CLIP-Dissect and Describe-and-Dissect, cited in Sections 1 and 3.2.
  • domain assumption L2 separation of a single neuron activation is a sufficient objective to disrupt that neuron's concept
    Eq. 1 defines the loss; the paper provides qualitative images linking perturbation patterns to neuron visualizations but no quantitative verification that other neurons are left unchanged.
  • domain assumption The held-out model's transferability ranking of neurons after lightweight training generalizes to full training and to unseen target models
    Neuron selection in Section 3.3 depends on this; Table 6 shows robustness across three held-out models, which partially supports it.

how reviews work

0 comments
Cite this review

Pith. "Pith review of NAT: Learning to Attack Neurons for Enhanced Adversarial Transferability." pith.science (2026). https://pith.science/paper/DEI4RLNQ

@misc{pith2026250816937,
  author       = {Pith},
  title        = {Pith review of: NAT: Learning to Attack Neurons for Enhanced Adversarial Transferability},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/DEI4RLNQ}},
  note         = {Machine review of arXiv:2508.16937}
}
read the original abstract

The generation of transferable adversarial perturbations typically involves training a generator to maximize embedding separation between clean and adversarial images at a single mid-layer of a source model. In this work, we build on this approach and introduce Neuron Attack for Transferability (NAT), a method designed to target specific neuron within the embedding. Our approach is motivated by the observation that previous layer-level optimizations often disproportionately focus on a few neurons representing similar concepts, leaving other neurons within the attacked layer minimally affected. NAT shifts the focus from embedding-level separation to a more fundamental, neuron-specific approach. We find that targeting individual neurons effectively disrupts the core units of the neural network, providing a common basis for transferability across different models. Through extensive experiments on 41 diverse ImageNet models and 9 fine-grained models, NAT achieves fooling rates that surpass existing baselines by over 14\% in cross-model and 4\% in cross-domain settings. Furthermore, by leveraging the complementary attacking capabilities of the trained generators, we achieve impressive fooling rates within just 10 queries. Our code is available at: https://krishnakanthnakka.github.io/NAT/

Figures

Figures reproduced from arXiv: 2508.16937 by the authors.

Figure 1
Figure 1. Comparison with prior work [60, 90]. On the left, we illustrate how prior single generator-based methods, such as LTP [60] and BIA [90], attack the entire embedding but predominantly disrupt neurons related to a single concept, like a circular text pattern, while leaving most other neurons largely unaffected. In contrast, our framework trains specific generators to target individual neurons, each representing distin… view at source ↗
Figure 2
Figure 2. In the top row, we present the histogram of acti [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗
Figure 3
Figure 3. Overview of the NAT method. A neuron-specific generator [PITH_FULL_IMAGE:figures/full_fig_p005_3.png] view at source ↗
Figures from the paper (10 more)
Figure 4
Figure 4. Figure 4: Performance of NAT. We report the aver￾age fooling rates for three groups of models: 16 Convolu￾tional models, 7 Transformer models, and 18 Hybrid mod￾els, represented by blue, orange, and green lines, respec￾tively. Our method outperforms the baselines in the single￾q…
Figure 5
Figure 5. Figure 5: Generator’s Performance in NAT. We plot the heatmap of fooling rates for top-k = 40 gen￾erators across 41 ImageNet target models. The genera￾tors are ordered based on the ranking determined by the DenseNet121 [23] held-out model after lightweight train￾ing, while the x…
Figure 6
Figure 6. Figure 6: Unbounded Adversarial Images with Our NAT Framework. We visualize the generated adversarial images before projection using our top-24 neuron-specific generators. Each generator produces a distinct perturbation with its own texture type, complementing one another to ach…
Figure 7
Figure 7. Figure 7: Evaluation of 512 Neuron specific generators on DenseNet121 [23] obtained after end of lightweight training on VGG16 [62]. We observe that some filters are more transferable than others and we choose top-k generators that has highest transferability [PITH_FULL_IMAGE:f…
Figure 8
Figure 8. Figure 8: Evaluation of 512 Neuron specific generators on VGG16 [62] obtained after end of lightweight training on the same VGG16 [62]. We observe that all generators have high fooling rates suggesting that overfitting to the source VGG16 [62] model [PITH_FULL_IMAGE:figures/ful…
Figure 9
Figure 9. Figure 9: Impact of heldout model for top-k neuron selection after lightweight training We use the same source model VGG16 [62] as the heldout model for top-k neuron selection after lightweight training in the left and similarily using ResNet152 [21] on the right. We observe tha…
Figure 10
Figure 10. Figure 10: Generated unbounded adversarial images along with synthesized neuron visualizations for the top [PITH_FULL_IMAGE:figures/full_fig_p018_10.png]
Figure 11
Figure 11. Figure 11: Generated unbounded adversarial images along with synthesized neuron visualizations for the top [PITH_FULL_IMAGE:figures/full_fig_p019_11.png]
Figure 12
Figure 12. Figure 12: Generated unbounded adversarial images along with synthesized neuron visualizations for the top [PITH_FULL_IMAGE:figures/full_fig_p020_12.png]
Figure 13
Figure 13. Figure 13: Generated unbounded adversarial images along with synthesized neuron visualizations for the top [PITH_FULL_IMAGE:figures/full_fig_p021_13.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

94 extracted references · 61 canonical work pages

  1. [1]

    Gama: Generative adver- sarial multi-object scene attacks

    Abhishek Aich, Calvin-Khang Ta, Akash Gupta, Chengyu Song, Srikanth Krishnamurthy, Salman Asif, and Amit Roy-Chowdhury. Gama: Generative adver- sarial multi-object scene attacks. Advances in Neu- ral Information Processing Systems , 35:36914–36930,

  2. [2]

    Attack to fool and explain deep networks.IEEE Transactions on Pat- tern Analysis and Machine Intelligence , 44(10):5980– 5995, 2021

    Naveed Akhtar, Mohammad AAK Jalwana, Mo- hammed Bennamoun, and Ajmal Mian. Attack to fool and explain deep networks.IEEE Transactions on Pat- tern Analysis and Machine Intelligence , 44(10):5980– 5995, 2021. 1

    2021

  3. [3]

    An image is worth 16x16 words: Transformers for image recognition at scale

    Dosovitskiy Alexey. An image is worth 16x16 words: Transformers for image recognition at scale. arXiv preprint arXiv: 2010.11929 , 2020. 2, 4, 6, 17, 22, 23

    arXiv 2010

  4. [4]

    On the robustness of semantic segmentation models to adversarial attacks

    Anurag Arnab, Ondrej Miksik, and Philip HS Torr. On the robustness of semantic segmentation models to adversarial attacks. In Proceedings of the IEEE confer- ence on computer vision and pattern recognition, pages 888–897, 2018. 1

    2018

  5. [5]

    Describe-and-dissect: Interpreting neurons in vision networks with language models

    Nicholas Bai, Rahul A Iyer, Tuomas Oikarinen, and Tsui-Wei Weng. Describe-and-dissect: Interpreting neurons in vision networks with language models. arXiv preprint arXiv:2403.13771 , 2024. 2, 3, 4

    arXiv 2024

  6. [6]

    Beit: Bert pre-training of image transformers

    Hangbo Bao, Li Dong, Songhao Piao, and Furu Wei. Beit: Bert pre-training of image transformers. arXiv preprint arXiv:2106.08254, 2021. 2, 6, 17, 22, 23

    arXiv 2021

  7. [7]

    Adversarial attack vulnerability of medical image analysis systems: Unexplored factors

    Gerda Bortsova, Cristina Gonzalez-Gonzalo, Suzanne C Wetstein, Florian Dubost, Ioannis Katramados, Laurens Hogeweg, Bart Liefers, Bram van Ginneken, Josien PW Pluim, Mitko Veta, et al. Adversarial attack vulnerability of medical image analysis systems: Unexplored factors. Medical Image Analysis, 73:102141, 2021. 1

    2021

  8. [8]

    Characterizing signal propagation to close the performance gap in unnormalized ResNets

    Andrew Brock, Soham De, and Samuel L Smith. Characterizing signal propagation to close the perfor- mance gap in unnormalized resnets. arXiv preprint arXiv:2101.08692, 2021. 6, 17, 22, 23

    work page Pith review arXiv 2021

Show all 94 references
  1. [9]

    On evaluating adversarial robustness

    Nicholas Carlini, Anish Athalye, Nicolas Papernot, Wieland Brendel, Jonas Rauber, Dimitris Tsipras, Ian Goodfellow, Aleksander Madry, and Alexey Kurakin. On evaluating adversarial robustness. arXiv preprint arXiv:1902.06705, 2019. 2

    1902 arXiv

  2. [10]

    Cross-vit: Cross-attention vision transformer for im- age duplicate detection

    MDN Chandrasiri and Priyanga Dilini Talagala. Cross-vit: Cross-attention vision transformer for im- age duplicate detection. In 2023 8th International Conference on Information Technology Research (IC- ITR), pages 1–6. IEEE, 2023. 6, 17, 22, 23

    2023

  3. [11]

    Visformer: The vision- friendly transformer

    Zhengsu Chen, Lingxi Xie, Jianwei Niu, Xuefeng Liu, Longhui Wei, and Qi Tian. Visformer: The vision- friendly transformer. In Proceedings of the IEEE/CVF international conference on computer vision , pages 589–598, 2021. 6, 17, 22, 23

    2021

  4. [12]

    Xception: Deep learning with depth- wise separable convolutions

    Fran¸ cois Chollet. Xception: Deep learning with depth- wise separable convolutions. In Proceedings of the IEEE conference on computer vision and pattern recog- nition, pages 1251–1258, 2017. 2, 6, 17, 22, 23

    2017

  5. [13]

    Davit: Dual attention vi- sion transformers

    Mingyu Ding, Bin Xiao, Noel Codella, Ping Luo, Jing- dong Wang, and Lu Yuan. Davit: Dual attention vi- sion transformers. In European conference on computer vision, pages 74–92. Springer, 2022. 6, 17, 22, 23

    2022

  6. [14]

    Boosting adversarial attacks with momentum

    Yinpeng Dong, Fangzhou Liao, Tianyu Pang, Hang Su, Jun Zhu, Xiaolin Hu, and Jianguo Li. Boosting adversarial attacks with momentum. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 9185–9193, 2018. 2, 3

    2018

  7. [15]

    Efficient decision- based black-box adversarial attacks on face recogni- tion

    Yinpeng Dong, Hang Su, Baoyuan Wu, Zhifeng Li, Wei Liu, Tong Zhang, and Jun Zhu. Efficient decision- based black-box adversarial attacks on face recogni- tion. In proceedings of the IEEE/CVF conference on computer vision and pattern recognition , pages 7714– 7722, 2019. 1

    2019

  8. [16]

    Explaining and harnessing adversarial exam- ples

    Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial exam- ples. arXiv preprint arXiv:1412.6572 , 2014. 2

    2014 arXiv

  9. [17]

    Levit: a vision transformer in con- vnet’s clothing for faster inference

    Benjamin Graham, Alaaeldin El-Nouby, Hugo Tou- vron, Pierre Stock, Armand Joulin, Herv´ e J´ egou, and Matthijs Douze. Levit: a vision transformer in con- vnet’s clothing for faster inference. In Proceedings of the IEEE/CVF international conference on computer vision, pages 12...

    2021

  10. [18]

    Sparsely activated mixture-of-experts are robust multi-task learners

    Shashank Gupta, Subhabrata Mukherjee, Krishan Subudhi, Eduardo Gonzalez, Damien Jose, Ahmed H Awadallah, and Jianfeng Gao. Sparsely activated mixture-of-experts are robust multi-task learners. arXiv preprint arXiv:2204.07689 , 2022. 4

    2022 arXiv

  11. [19]

    Ghostnet: More features from cheap operations

    Kai Han, Yunhe Wang, Qi Tian, Jianyuan Guo, Chun- jing Xu, and Chang Xu. Ghostnet: More features from cheap operations. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 1580–1589, 2020. 6, 17, 22, 23

    2020

  12. [20]

    Global context vision transformers

    Ali Hatamizadeh, Hongxu Yin, Greg Heinrich, Jan Kautz, and Pavlo Molchanov. Global context vision transformers. In International Conference on Machine Learning, pages 12633–12646. PMLR, 2023. 6, 17, 22, 23

    2023

  13. [21]

    Deep residual learning for image recognition

    Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 770–778, 2016. 2, 4, 6, 7, 8, 14, 16, 17, 22, 23

    2016

  14. [22]

    Mobilenets: Efficient convolu- tional neural networks for mobile vision applications

    Andrew G Howard. Mobilenets: Efficient convolu- tional neural networks for mobile vision applications. arXiv preprint arXiv:1704.04861 , 2017. 2, 6, 17, 22, 23

    2017 arXiv

  15. [23]

    Densely connected convo- lutional networks

    Gao Huang, Zhuang Liu, Laurens Van Der Maaten, and Kilian Q Weinberger. Densely connected convo- lutional networks. In Proceedings of the IEEE confer- ence on computer vision and pattern recognition, pages 4700–4708, 2017. 4, 5, 6, 7, 8, 9, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23

    2017

  16. [24]

    Enhancing adversarial example transferability with an intermediate level at- tack

    Qian Huang, Isay Katsman, Horace He, Zeqi Gu, Serge Belongie, and Ser-Nam Lim. Enhancing adversarial example transferability with an intermediate level at- tack. In Proceedings of the IEEE/CVF international conference on computer vision, pages 4733–4742, 2019. 2, 3

    2019

  17. [25]

    Squeezenet: Alexnet-level accuracy with 50x fewer parameters and¡ 0.5 mb model size

    Forrest N Iandola. Squeezenet: Alexnet-level accuracy with 50x fewer parameters and¡ 0.5 mb model size. arXiv preprint arXiv:1602.07360 , 2016. 2, 6, 17, 22, 23

    2016 arXiv

  18. [26]

    Adver- sarial attacks and defenses on ai in medical imaging informatics: A survey

    Sara Kaviani, Ki Jin Han, and Insoo Sohn. Adver- sarial attacks and defenses on ai in medical imaging informatics: A survey. Expert Systems with Applica- tions, 198:116815, 2022. 1

    2022

  19. [27]

    Densenets reloaded: Paradigm shift beyond resnets and vits

    Donghyun Kim, Byeongho Heo, and Dongyoon Han. Densenets reloaded: Paradigm shift beyond resnets and vits. arXiv preprint arXiv:2403.19588 , 2024. 6, 17, 22, 23

    2024 arXiv

  20. [28]

    Adam: A method for stochastic optimization

    Diederik P Kingma. Adam: A method for stochastic optimization. arXiv preprint arXiv:1412.6980, 2014. 5

    2014 arXiv

  21. [29]

    Efficientnet

    Brett Koonce and Brett Koonce. Efficientnet. Convo- lutional neural networks with swift for Tensorflow: im- age recognition and dataset categorization, pages 109– 123, 2021. 6, 17, 22, 23

    2021

  22. [30]

    Collecting a large-scale dataset of fine-grained cars

    Jonathan Krause, Jia Deng, Michael Stark, and Li Fei- Fei. Collecting a large-scale dataset of fine-grained cars. 2013. 2, 5, 7

    2013

  23. [31]

    Imagenet classification with deep convolutional neural networks

    Alex Krizhevsky, Ilya Sutskever, and Geoffrey E Hin- ton. Imagenet classification with deep convolutional neural networks. Advances in neural information pro- cessing systems, 25, 2012. 6, 17, 22, 23

    2012

  24. [32]

    Adversarial machine learning at scale

    Alexey Kurakin, Ian Goodfellow, and Samy Bengio. Adversarial machine learning at scale. arXiv preprint arXiv:1611.01236, 2016. 2

    2016 arXiv

  25. [33]

    Hyperband: A novel bandit-based approach to hyperparameter op- timization

    Lisha Li, Kevin Jamieson, Giulia DeSalvo, Afshin Ros- tamizadeh, and Ameet Talwalkar. Hyperband: A novel bandit-based approach to hyperparameter op- timization. Journal of Machine Learning Research , 18(185):1–52, 2018. 4

    2018

  26. [34]

    Yet another intermediate-level attack

    Qizhang Li, Yiwen Guo, and Hao Chen. Yet another intermediate-level attack. In Computer Vision–ECCV 2020: 16th European Conference, Glasgow, UK, Au- gust 23–28, 2020, Proceedings, Part XVI 16 , pages 241–257. Springer, 2020. 3

    2020

  27. [35]

    Mvitv2: Improved multiscale vision transformers for classification and detection

    Yanghao Li, Chao-Yuan Wu, Haoqi Fan, Karttikeya Mangalam, Bo Xiong, Jitendra Malik, and Christoph Feichtenhofer. Mvitv2: Improved multiscale vision transformers for classification and detection. In Pro- ceedings of the IEEE/CVF conference on computer vi- sion and pattern recog...

    2022

  28. [36]

    Progressive neu- ral architecture search

    Chenxi Liu, Barret Zoph, Maxim Neumann, Jonathon Shlens, Wei Hua, Li-Jia Li, Li Fei-Fei, Alan Yuille, Jonathan Huang, and Kevin Murphy. Progressive neu- ral architecture search. In Proceedings of the European conference on computer vision (ECCV) , pages 19–34,

  29. [37]

    Efficientvit: Mem- ory efficient vision transformer with cascaded group at- tention

    Xinyu Liu, Houwen Peng, Ningxin Zheng, Yuqing Yang, Han Hu, and Yixuan Yuan. Efficientvit: Mem- ory efficient vision transformer with cascaded group at- tention. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages 14420–14430, 2023. 6, ...

    2023

  30. [38]

    Swin transformer: Hierarchical vision transformer using shifted windows

    Ze Liu, Yutong Lin, Yue Cao, Han Hu, Yixuan Wei, Zheng Zhang, Stephen Lin, and Baining Guo. Swin transformer: Hierarchical vision transformer using shifted windows. In Proceedings of the IEEE/CVF international conference on computer vision , pages 10012–10022, 2021. 2, 6, 17, 22, 23

    2021

  31. [39]

    A con- vnet for the 2020s

    Zhuang Liu, Hanzi Mao, Chao-Yuan Wu, Christoph Feichtenhofer, Trevor Darrell, and Saining Xie. A con- vnet for the 2020s. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 11976–11986, 2022. 2, 4, 6, 17, 22, 23

    2022

  32. [40]

    Shufflenet v2: Practical guidelines for effi- cient cnn architecture design

    Ningning Ma, Xiangyu Zhang, Hai-Tao Zheng, and Jian Sun. Shufflenet v2: Practical guidelines for effi- cient cnn architecture design. InProceedings of the Eu- ropean conference on computer vision (ECCV) , pages 116–131, 2018. 6, 17, 22, 23

    2018

  33. [41]

    Edgenext: efficiently amalgamated cnn-transformer architecture for mobile vision applications

    Muhammad Maaz, Abdelrahman Shaker, Hisham Cholakkal, Salman Khan, Syed Waqas Zamir, Rao Muhammad Anwer, and Fahad Shahbaz Khan. Edgenext: efficiently amalgamated cnn-transformer architecture for mobile vision applications. In Eu- ropean conference on computer vision , pages 3–...

    2022

  34. [42]

    To- wards deep learning models resistant to adversarial at- tacks

    Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. To- wards deep learning models resistant to adversarial at- tacks. stat, 1050(9), 2017. 2

    2017

  35. [43]

    Torchvi- sion: Pytorch’s computer vision library

    TorchVision maintainers and contributors. Torchvi- sion: Pytorch’s computer vision library. https:// github.com/pytorch/vision, 2016. 5, 14, 17

    2016

  36. [44]

    Fine-grained vi- sual classification of aircraft

    Subhransu Maji, Esa Rahtu, Juho Kannala, Matthew Blaschko, and Andrea Vedaldi. Fine-grained vi- sual classification of aircraft. arXiv preprint arXiv:1306.5151, 2013. 2, 5, 7

    2013 arXiv

  37. [45]

    Mixture of experts: a literature survey

    Saeed Masoudnia and Reza Ebrahimpour. Mixture of experts: a literature survey. Artificial Intelligence Review, 42:275–293, 2014. 4

    2014

  38. [46]

    Mobilevit: light-weight, general-purpose, and mobile-friendly vi- sion transformer

    Sachin Mehta and Mohammad Rastegari. Mobilevit: light-weight, general-purpose, and mobile-friendly vi- sion transformer. arXiv preprint arXiv:2110.02178 ,

    arXiv

  39. [47]

    Deepfool: a simple and accurate method to fool deep neural networks

    Seyed-Mohsen Moosavi-Dezfooli, Alhussein Fawzi, and Pascal Frossard. Deepfool: a simple and accurate method to fool deep neural networks. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 2574–2582, 2016. 3

    2016

  40. [48]

    Indirect local attacks for context-aware semantic segmentation networks

    Krishna Kanth Nakka and Mathieu Salzmann. Indirect local attacks for context-aware semantic segmentation networks. In Computer Vision–ECCV 2020: 16th Eu- ropean Conference, Glasgow, UK, August 23–28, 2020, Proceedings, Part V 16, pages 611–628. Springer, 2020. 1, 2

    2020

  41. [49]

    To- wards robust fine-grained recognition by maximal sep- aration of discriminative features

    Krishna Kanth Nakka and Mathieu Salzmann. To- wards robust fine-grained recognition by maximal sep- aration of discriminative features. In Proceedings of the Asian Conference on Computer Vision , 2020. 1

    2020

  42. [50]

    Uni- versal, transferable adversarial perturbations for visual object trackers

    Krishna Kanth Nakka and Mathieu Salzmann. Uni- versal, transferable adversarial perturbations for visual object trackers. In European Conference on Computer Vision, pages 413–429. Springer, 2022. 1

    2022

  43. [51]

    Cross-domain transferability of adver- sarial perturbations

    Muhammad Muzammal Naseer, Salman H Khan, Muhammad Haris Khan, Fahad Shahbaz Khan, and Fatih Porikli. Cross-domain transferability of adver- sarial perturbations. Advances in Neural Information Processing Systems, 32, 2019. 2, 3, 4, 5, 7, 14, 22, 23

    2019

  44. [52]

    Clip-dissect: Automatic description of neuron representations in deep vision networks

    Tuomas Oikarinen and Tsui-Wei Weng. Clip-dissect: Automatic description of neuron representations in deep vision networks. In The Eleventh International Conference on Learning Representations. 1, 2, 3, 4

  45. [53]

    Pytorch: An imperative style, high-performance deep learning library

    Adam Paszke, Sam Gross, Francisco Massa, Adam Lerer, James Bradbury, Gregory Chanan, Trevor Killeen, Zeming Lin, Natalia Gimelshein, Luca Antiga, et al. Pytorch: An imperative style, high-performance deep learning library. Advances in neural information processing systems, 32,...

    2019

  46. [54]

    Generative adversarial perturbations

    Omid Poursaeed, Isay Katsman, Bicheng Gao, and Serge Belongie. Generative adversarial perturbations. In Proceedings of the IEEE conference on computer vi- sion and pattern recognition, pages 4422–4431, 2018. 2, 3, 5, 7, 22, 23

    2018

  47. [55]

    Boosting the transfer- ability of adversarial attacks with reverse adversarial perturbation

    Zeyu Qin, Yanbo Fan, Yi Liu, Li Shen, Yong Zhang, Jue Wang, and Baoyuan Wu. Boosting the transfer- ability of adversarial attacks with reverse adversarial perturbation. Advances in neural information process- ing systems, 35:29845–29858, 2022. 1, 3

    2022

  48. [56]

    Learning transferable visual models from natural lan- guage supervision

    Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sas- try, Amanda Askell, Pamela Mishkin, Jack Clark, et al. Learning transferable visual models from natural lan- guage supervision. In International conference on ma- chine learni...

    2021

  49. [57]

    Designing net- work design spaces

    Ilija Radosavovic, Raj Prateek Kosaraju, Ross Gir- shick, Kaiming He, and Piotr Doll´ ar. Designing net- work design spaces. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 10428–10436, 2020. 6, 17, 22, 23

    2020

  50. [58]

    Imagenet large scale visual recognition challenge

    Olga Russakovsky, Jia Deng, Hao Su, Jonathan Krause, Sanjeev Satheesh, Sean Ma, Zhiheng Huang, Andrej Karpathy, Aditya Khosla, Michael Bernstein, et al. Imagenet large scale visual recognition challenge. International journal of computer vision , 115:211–252,

  51. [59]

    Hiera: A hierarchical vision trans- former without the bells-and-whistles

    Chaitanya Ryali, Yuan-Ting Hu, Daniel Bolya, Chen Wei, Haoqi Fan, Po-Yao Huang, Vaibhav Aggarwal, Arkabandhu Chowdhury, Omid Poursaeed, Judy Hoff- man, et al. Hiera: A hierarchical vision trans- former without the bells-and-whistles. In International Conference on Machine Lear...

    2023

  52. [60]

    Learning transferable adver- sarial perturbations

    Mathieu Salzmann et al. Learning transferable adver- sarial perturbations. Advances in Neural Information Processing Systems, 34:13950–13962, 2021. 1, 2, 3, 4, 5, 6, 7, 8, 14, 17, 22, 23

    2021

  53. [61]

    Deep inside convolutional networks: Visualising image classification models and saliency maps

    Karen Simonyan. Deep inside convolutional networks: Visualising image classification models and saliency maps. arXiv preprint arXiv:1312.6034 , 2013. 4, 14

    2013 arXiv

  54. [62]

    Very deep convolutional networks for large-scale image recogni- tion

    Karen Simonyan and Andrew Zisserman. Very deep convolutional networks for large-scale image recogni- tion. arXiv preprint arXiv:1409.1556 , 2014. 4, 7, 8, 14, 15, 16, 17

    2014 arXiv

  55. [63]

    Mnasnet: Platform-aware neural architecture search for mobile

    Mingxing Tan, Bo Chen, Ruoming Pang, Vijay Va- sudevan, Mark Sandler, Andrew Howard, and Quoc V Le. Mnasnet: Platform-aware neural architecture search for mobile. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 2820–2828, 2019. 2, 6,...

    2019

  56. [64]

    Mlp-mixer: An all-mlp architecture for vision

    Ilya O Tolstikhin, Neil Houlsby, Alexander Kolesnikov, Lucas Beyer, Xiaohua Zhai, Thomas Unterthiner, Jes- sica Yung, Andreas Steiner, Daniel Keysers, Jakob Uszkoreit, et al. Mlp-mixer: An all-mlp architecture for vision. Advances in neural information processing systems, 34:2...

    2021

  57. [65]

    Training data-efficient image transformers & distilla- tion through attention

    Hugo Touvron, Matthieu Cord, Matthijs Douze, Fran- cisco Massa, Alexandre Sablayrolles, and Herv´ e J´ egou. Training data-efficient image transformers & distilla- tion through attention. In International conference on machine learning, pages 10347–10357. PMLR, 2021. 2, 4, 6, ...

    2021

  58. [66]

    Going deeper with image transformers

    Hugo Touvron, Matthieu Cord, Alexandre Sablay- rolles, Gabriel Synnaeve, and Herv´ e J´ egou. Going deeper with image transformers. In Proceedings of the IEEE/CVF international conference on computer vi- sion, pages 32–42, 2021. 6, 17, 22, 23

    2021

  59. [67]

    Patches are all you need? arXiv preprint arXiv:2201.09792 , 2022

    Asher Trockman and J Zico Kolter. Patches are all you need? arXiv preprint arXiv:2201.09792 , 2022. 6, 17, 22, 23

    2022 arXiv

  60. [68]

    Maxvit: Multi-axis vision transformer

    Zhengzhong Tu, Hossein Talebi, Han Zhang, Feng Yang, Peyman Milanfar, Alan Bovik, and Yinxiao Li. Maxvit: Multi-axis vision transformer. In Eu- ropean conference on computer vision, pages 459–479. Springer, 2022. 6, 17, 22, 23

    2022

  61. [69]

    The caltech-ucsd birds- 200-2011 dataset

    Catherine Wah, Steve Branson, Peter Welinder, Pietro Perona, and Serge Belongie. The caltech-ucsd birds- 200-2011 dataset. 2011. 2, 5, 7

    2011

  62. [70]

    Cspnet: A new backbone that can enhance learning capability of cnn

    Chien-Yao Wang, Hong-Yuan Mark Liao, Yueh-Hua Wu, Ping-Yang Chen, Jun-Wei Hsieh, and I-Hau Yeh. Cspnet: A new backbone that can enhance learning capability of cnn. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition workshops, pages 390–391, 20...

    2020

  63. [71]

    Deep high- resolution representation learning for visual recogni- tion

    Jingdong Wang, Ke Sun, Tianheng Cheng, Borui Jiang, Chaorui Deng, Yang Zhao, Dong Liu, Yadong Mu, Mingkui Tan, Xinggang Wang, et al. Deep high- resolution representation learning for visual recogni- tion. IEEE transactions on pattern analysis and ma- chine intelligence , 43(10...

    2020

  64. [72]

    Enhancing the transfer- ability of adversarial attacks through variance tuning

    Xiaosen Wang and Kun He. Enhancing the transfer- ability of adversarial attacks through variance tuning. In Proceedings of the IEEE/CVF conference on com- puter vision and pattern recognition, pages 1924–1933,

    1924

  65. [73]

    Admix: Enhancing the transferability of adversar- ial attacks

    Xiaosen Wang, Xuanran He, Jingdong Wang, and Kun He. Admix: Enhancing the transferability of adversar- ial attacks. In Proceedings of the IEEE/CVF Interna- tional Conference on Computer Vision , pages 16158– 16167, 2021. 1, 2

    2021

  66. [74]

    Feature importance- aware transferable adversarial attacks

    Zhibo Wang, Hengchang Guo, Zhifei Zhang, Wenxin Liu, Zhan Qin, and Kui Ren. Feature importance- aware transferable adversarial attacks. In Proceedings of the IEEE/CVF international conference on com- puter vision, pages 7639–7648, 2021. 2, 3

    2021

  67. [75]

    Pytorch image models

    Ross Wightman. Pytorch image models. https: / / github . com / rwightman / pytorch - image - models,

  68. [76]

    Understand- ing and enhancing the transferability of adversarial ex- amples

    Lei Wu, Zhanxing Zhu, Cheng Tai, et al. Understand- ing and enhancing the transferability of adversarial ex- amples. arXiv preprint arXiv:1802.09707 , 2018. 1

    2018 arXiv

  69. [77]

    Improving the transferability of adversarial samples with adversarial transformations

    Weibin Wu, Yuxin Su, Michael R Lyu, and Irwin King. Improving the transferability of adversarial samples with adversarial transformations. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 9024–9033, 2021. 3

    2021

  70. [78]

    Adversarial exam- ples for semantic segmentation and object detection

    Cihang Xie, Jianyu Wang, Zhishuai Zhang, Yuyin Zhou, Lingxi Xie, and Alan Yuille. Adversarial exam- ples for semantic segmentation and object detection. In Proceedings of the IEEE international conference on computer vision , pages 1369–1378, 2017. 1

    2017

  71. [79]

    Improving transferability of adversarial examples with input di- versity

    Cihang Xie, Zhishuai Zhang, Yuyin Zhou, Song Bai, Jianyu Wang, Zhou Ren, and Alan L Yuille. Improving transferability of adversarial examples with input di- versity. InProceedings of the IEEE/CVF conference on computer vision and pattern recognition , pages 2730– 2739, 2019. 1, 2

    2019

  72. [80]

    Co-scale conv-attentional image transformers

    Weijian Xu, Yifan Xu, Tyler Chang, and Zhuowen Tu. Co-scale conv-attentional image transformers. In Pro- ceedings of the IEEE/CVF international conference on computer vision, pages 9981–9990, 2021. 6, 17, 22, 23

    2021

  73. [81]

    Ila-da: Improving transferability of intermediate level attack with data augmentation

    Chiu Wai Yan, Tsz-Him Cheung, and Dit-Yan Yeung. Ila-da: Improving transferability of intermediate level attack with data augmentation. In The Eleventh In- ternational Conference on Learning Representations ,

  74. [82]

    Facl-attack: Frequency-aware contrastive learning for transferable adversarial attacks

    Hunmin Yang, Jongoh Jeong, and Kuk-Jin Yoon. Facl-attack: Frequency-aware contrastive learning for transferable adversarial attacks. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 38, pages 6494–6502, 2024. 2, 3, 7

    2024

  75. [83]

    Prompt-driven contrastive learning for transferable ad- versarial attacks

    Hunmin Yang, Jongoh Jeong, and Kuk-Jin Yoon. Prompt-driven contrastive learning for transferable ad- versarial attacks. arXiv preprint arXiv:2407.20657 ,

    arXiv

  76. [84]

    Focal modulation networks

    Jianwei Yang, Chunyuan Li, Xiyang Dai, and Jianfeng Gao. Focal modulation networks. Advances in Neural Information Processing Systems , 35:4203–4217, 2022. 6, 17, 22, 23

    2022

  77. [85]

    On hyperparameter op- timization of machine learning algorithms: Theory and practice

    Li Yang and Abdallah Shami. On hyperparameter op- timization of machine learning algorithms: Theory and practice. Neurocomputing, 415:295–316, 2020. 4

    2020

  78. [86]

    Deep layer aggregation

    Fisher Yu, Dequan Wang, Evan Shelhamer, and Trevor Darrell. Deep layer aggregation. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 2403–2412, 2018. 17

    2018

  79. [87]

    Metaformer baselines for vision

    Weihao Yu, Chenyang Si, Pan Zhou, Mi Luo, Yichen Zhou, Jiashi Feng, Shuicheng Yan, and Xinchao Wang. Metaformer baselines for vision. IEEE Transactions on Pattern Analysis and Machine Intelligence , 2023. 4, 6, 17, 22, 23

    2023

  80. [88]

    Adap- tive image transformations for transfer-based adver- sarial attack

    Zheng Yuan, Jie Zhang, and Shiguang Shan. Adap- tive image transformations for transfer-based adver- sarial attack. In European Conference on Computer Vision, pages 1–17. Springer, 2022. 3

    2022

  81. [89]

    Wide residual networks

    Sergey Zagoruyko. Wide residual networks. arXiv preprint arXiv:1605.07146, 2016. 6, 17, 22, 23

    2016 arXiv

  82. [90]

    Be- yond imagenet attack: Towards crafting adversar- ial examples for black-box domains

    Qilong Zhang, Xiaodan Li, Yuefeng Chen, Jingkuan Song, Lianli Gao, Yuan He, and Hui Xue. Be- yond imagenet attack: Towards crafting adversar- ial examples for black-box domains. arXiv preprint arXiv:2201.11528, 2022. 1, 2, 3, 4, 5, 7, 14, 22, 23

    2022 arXiv

  83. [91]

    A survey on neural network interpretability.IEEE Trans- actions on Emerging Topics in Computational Intelli- gence, 5(5):726–742, 2021

    Yu Zhang, Peter Tiˇ no, Aleˇ s Leonardis, and Ke Tang. A survey on neural network interpretability.IEEE Trans- actions on Emerging Topics in Computational Intelli- gence, 5(5):726–742, 2021. 2

    2021

  84. [92]

    Libraries

    Implementation We provide below additional details for the repro- ducibility of our experiments. Libraries. We conducted our experiments on NVIDIA GeForce RTX 3090 using PyTorch 2.1.1 [53], CUDA 11.8, Timm 1.0.9 [75], and Torchvision 0.16.1 [43]. Generator Modifications. Due t...

  85. [93]

    In Tables 9 and 10, we provide the performance of all fully trained top-40 generators selected using DenseNet121 [23] as the held-out model

    Additional Quantitative Results Performance of each neuron-specific generator. In Tables 9 and 10, we provide the performance of all fully trained top-40 generators selected using DenseNet121 [23] as the held-out model. We observed that our neuron-specific generators outperfor...

  86. [94]

    Additional Qualitative Results We present the visualizations of adversarial images generated by different neuron-specific generators in Figures 10, 11, 12, and 13. Next to each adversarial im- age, we show the synthesized images that is optimized to have large activation magni...

Pith tools

Reviewed August 15, 2026 · model on record in the stance chip above.