Pith. sign in

REVIEW 3 major objections 5 minor 75 references

Towards Model Resistant to Transferable Adversarial Examples via Trigger Activation

T0 review · 3 major / 5 minor · reviewed 2026-08-16 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read A model trained to guess randomly on clean images and classify only triggered images can repel transferable adversarial attacks at a fraction of adversarial training's cost.

desk verdict Genuinely new trigger-activation defense with strong empirical results against transferable attacks, but the theoretical guarantee is unsupported and should be fixed or dropped before publication. read the letter →

arxiv 2504.14541 v1 pith:G7CK73WC submitted 2025-04-20 cs.CR cs.CVcs.LG

Yi Yu , Song Xia , Xun Lin , Chenqi Kong , Wenhan Yang , Shijian Lu , Yap-Peng Tan , Alex C. Kot This is my paper · ORCID
classification cs.CRcs.CVcs.LG
keywords transferableadversarialexamplestriggeractivationrobustnessrandomguessingclassifierlearnableblack-boxattackCIFAR-10gradientmisalignment
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper tries to establish a new training paradigm, called trigger activation, that protects against transferable adversarial examples more cheaply than adversarial training and with less clean-accuracy loss. The trained model outputs near-random guesses on clean inputs $\boldsymbol{x}$ and accurate predictions on triggered inputs $\boldsymbol{x}+\boldsymbol{\tau}$, and at deployment the model is the single function $f_t(\boldsymbol{x})=f(\boldsymbol{x}+\boldsymbol{\tau})$. The paper argues that this model resists transferred attacks because an attacker's perturbation $\boldsymbol{\delta}_s$ is aimed along the surrogate's gradient and almost never aligns with the defender's steepest ascent direction $-\boldsymbol{\tau}$, and it supports this with a first-order bound on the transferred loss. On CIFAR-10 the method reports 85.49% accuracy under transferred PGD versus 11.29% without defense, with clean accuracy 91.93%, and the trend repeats on CIFAR-100 and an ImageNet subset. If the claim holds, it offers a training-time defense that keeps test-time cost identical to a normal classifier.

What carries the argument

The central object is the trigger $\boldsymbol{\tau}$, a fixed input perturbation shared by all instances, and the two-part training objective: KL divergence pushes $f(\boldsymbol{x})$ toward the uniform distribution while cross-entropy trains $f(\boldsymbol{x}+\boldsymbol{\tau})$ toward the true label. The paper calls the resulting model one with trigger activation. The identities that carry the argument are the first-order consequences of this training: the clean loss averages to $\log C$, the average gradient satisfies $\mathbb{E}[\nabla_{\boldsymbol{x}}\ell_t]^\top \boldsymbol{\tau} = -\log C$, and the trigger points opposite to the average gradient with magnitude $\epsilon_t$. These combine to bound the loss impact of any transferred perturbation by $\epsilon/\epsilon_t \log C$, making the trigger a 'fast path' for gradient ascent that the transferred perturbation must miss in order for the attack to succeed.

What would settle it

On a trained trigger-activated model, compute both sides of Equation 9 over the training set and compare the realized loss $\mathbb{E}[\ell_t(\boldsymbol{x}+\boldsymbol{\tau}+\boldsymbol{\delta})]$ for $\boldsymbol{\delta}=-(\epsilon/\epsilon_t)\boldsymbol{\tau}$ with the bound $(\epsilon/\epsilon_t)\log C$; if the measured loss is clearly larger than the bound, the robustness is not explained by the paper's stated mechanism and the linearity assumption is the point of failure.

Watch

Extended reading notes

Core claim

On its own terms, the paper discovers that a model trained to be a random classifier on clean data and a correct classifier on data carrying a fixed trigger becomes, when deployed as $f_t(\boldsymbol{x})=f(\boldsymbol{x}+\boldsymbol{\tau})$, unusually resistant to adversarial examples transferred from other models. The mechanism is directional misalignment: the trigger creates a fast gradient-ascent path $-\boldsymbol{\tau}$, and since transferred perturbations are optimized on a different surrogate, they need almost never point along that path. Under a first-order/linearity assumption, the paper proves $\mathbb{E}[\ell_t(\boldsymbol{x}+\boldsymbol{\tau}+\boldsymbol{\delta}_s)] \le (\epsilon/\epsilon_t)\log C$, with equality when $\boldsymbol{\delta}_s = -(\epsilon/\epsilon_t)\boldsymbol{\tau}$, which explains why larger trigger bounds improve robustness. The paper then extends the idea by jointly optimizing the trigger and the model, showing better clean accuracy and robustness than the fixed-trigger version. It reports that this holds across three datasets and against standard gradient-based and feature-based transfer attacks, and that even a knowledgeable attacker who trains a surrogate the same way only partially erodes the defense.

Load-bearing premise

The load-bearing premise is that the model's loss is exactly linear between $\boldsymbol{x}$ and $\boldsymbol{x}+\boldsymbol{\tau}$ and that the trained model exactly satisfies the two gradient-matching identities (Equations 8 and 9); real deep networks are curved, so if either equality fails, the proven bound does not hold.

Editorial extensions

If this is right

  • At deployment the defense is just the classifier $f(\boldsymbol{x}+\boldsymbol{\tau})$, so it adds no test-time computation compared with purification defenses.
  • Larger fixed trigger bounds increase transfer robustness until the linearity assumption breaks, after which clean accuracy drops; the learnable trigger keeps clean accuracy near 92% while improving robustness.
  • On CIFAR-100 and ImageNet-subset, the mean accuracy over seven to ten transfer attacks is comparable to or above AT-PGD, RAT, and TDAT while training time is roughly 0.86 h versus 3.6 h for AT on CIFAR-10.
  • Under an informed attacker who trains the surrogate with the same trigger-activation paradigm, CIFAR-10 PGD accuracy falls from 85.49% to 59.56%, showing the defense weakens when the trigger algorithm is known.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Editorial inference: the mechanism is effectively robustness through a hidden gradient direction: the defender never exposes $f$ alone, only $f(\boldsymbol{x}+\boldsymbol{\tau})$, so the trigger acts as a secret; this suggests the defense's strength is tied to keeping the trigger distribution private.
  • Editorial inference: a direct extension would randomize $\boldsymbol{\tau}$ across deployments or batches to prevent an informed attacker from matching the fast path; the paper's fixed trigger is the most favorable case for the attacker among trigger-based variants, so a randomized version is a natural stress test.
  • Editorial inference: because the learnable trigger concentrates magnitude in low-sensitivity regions, the method can be viewed as learning a fixed input transformation that flattens the loss landscape; comparing it against other fixed input-perturbation defenses would clarify whether the benefit comes from direction misalignment or from general input obfuscation.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. The paper proposes a training paradigm in which a classifier is trained to produce near-uniform predictions on clean inputs x and accurate predictions on triggered inputs x+tau, where tau is a constant trigger applied to all data instances. At deployment the model is treated as f_t(x) = f(x+tau). The authors report that such 'trigger activation' models exhibit resistance to transferable adversarial examples (TAEs) crafted on standard surrogate models, and they provide a first-order theoretical analysis (Theorems 1 and 2) intended to explain this robustness. They also propose jointly optimizing the trigger and the model to improve the robustness/accuracy trade-off. Experiments on CIFAR-10, CIFAR-100, and an ImageNet subset compare the method against preprocessing defenses, adversarial training, and purification methods across many attacks, showing competitive robust accuracy with better clean accuracy and lower training cost than adversarial training.

Significance. If the empirical claims hold, the method is an interesting low-cost training-based defense that avoids on-the-fly adversarial example generation and adds no test-time computation. The evaluation is broad (three datasets, many attacks, several defenses) and includes a useful same-paradigm attack analysis in Table VIII. However, the theoretical explanation is not established: the proof of Theorem 2 relies on unverified equalities and a global linearity assumption, and the proposed bound would imply white-box robustness that the paper does not report and that the same-paradigm experiments contradict. The empirical contribution is still valuable, but the theoretical claims need substantial revision or removal before the paper can be accepted.

major comments (3)
  1. [Section III-B, Theorem 1 and Eq. (8)] Eqs. (8) and (9) are asserted rather than derived from the training objective. The text itself says 'While it may not be exact' immediately before Eq. (8), and Algorithm 1 only encourages E[loss(x,y)] to be near log C and E[loss(x+tau,y)] to be small; it does not enforce the gradient relation -epsilon_t * sgn(E[grad]) = tau or the inner-product relation in Eq. (9). No empirical verification of these equalities is provided. Since Theorem 2's bound (13) is derived directly from these equalities, the theoretical explanation for the observed transfer robustness is unsupported. The authors should either provide measurements of E[grad_x loss] and compare them with Eqs. (8) and (9) on the trained models, or explicitly reframe Theorems 1 and 2 as heuristic analysis under assumptions that are not claimed to hold for the actual models.
  2. [Section III-B, Theorem 2 proof and Eq. (15)] The proof uses a first-order Taylor expansion of the loss across x, x+tau, and x+tau+delta_s, which requires the loss to be approximately linear over a displacement whose infinity norm is up to ||tau||_inf + ||delta_s||_inf, e.g., 64/255 + 8/255 for the large-epsilon_t rows in Table I. Deep networks are highly nonlinear and no linearity check is reported. Moreover, because the inequality in Eq. (15) uses only ||delta_s||_inf <= epsilon and never any property of the surrogate model f_s, Theorem 2 would certify f_t against every l_infinity-bounded perturbation, including a white-box PGD attack on f_t itself. No such white-box robustness is reported, and Table VIII shows that a same-paradigm surrogate attack reduces PGD robust accuracy on CIFAR-10 from 85.49% (Table II) to 59.56%, directly contradicting the certification-style claim. This internal inconsistency indicates that the assumptions of Theorem 2 are not satisfied by the trained models; the theorem should be verified, substantially weakened, or removed.
  3. [Section III-B, Eq. (14) and Table VIII] Theorem 2 identifies the worst-case perturbation as delta_s = -(epsilon/epsilon_t) * tau, i.e., exactly the negative trigger direction. This means that under the paper's own theory, an attacker who knows the trigger can construct the most effective perturbation, and the 'misalignment' between delta_s and -tau is not a security guarantee. The advanced attack results in Table VIII are consistent with this observation: when the attacker trains a surrogate with the same paradigm, robust accuracy drops substantially. The paper should explicitly acknowledge this limitation and temper the claim that the method is 'resistant to transferable adversarial examples' to clarify that the protection relies on the attacker not knowing the trigger or the training paradigm.
minor comments (5)
  1. [Section III-C and Section IV-B] Several table cross-references are incorrect: 'Table III-B' in Section III-C should refer to Table II (the CIFAR-10 comparison), and 'Table IV-A' in Section IV-B should refer to Table III for CIFAR-100 and Table IV for ImageNet-subset.
  2. [Throughout] There are typos, including 'comminications' in the Introduction, 'sveral' in Section IV-A, and 'purification framework' in Section IV-B where the proposed method is a training-based defense, not a purification method.
  3. [Algorithm 1] The loss L_KLD(zneg, 1/C * 1_C) is described as 'KLD loss between two logits,' but it is not clear whether the KL divergence is computed on softmax probabilities or on logits. Please define the loss precisely, including the form of the uniform target.
  4. [Table V] The unit '10^-3 S/BATCH' in Table V is awkward; consider writing '10^-3 s/batch' or 'ms/batch' for clarity.
  5. [Section I and Abstract] The phrase 'random guessing behavior' is used for the model on clean x, but the reported clean accuracy (e.g., 91.93% in Table II) refers to the deployed model f_t on clean inputs, which is not random. The text should clarify this distinction explicitly to avoid confusion.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: theory is a first-order consequence of the training objective, and the robustness numbers come from external transfer attacks.

full rationale

Section III-B's Theorems 1-2 are not circular reductions. Algorithm 1 trains f to be uniform on x and accurate on x+tau; Theorem 1 derives Eqs. 8-9 from those target values plus a first-order Taylor assumption, explicitly conceding 'While it may not be exact'. Theorem 2 then bounds the cross-entropy loss at x+tau+delta_s by (epsilon/epsilon_t) log C using Eqs. 8-9. This is a first-order consequence of the training objective, not an independent physical prediction, and the paper does not fit any parameter to the robust-accuracy numbers in Tables I-IV. The empirical robustness claim is tested against external PGD/I-FGSM/MI-FGSM/DI-FGSM etc. transfers from standard surrogates, so it is not obtained by construction. The same-paradigm attack in Table VIII weakens the robustness but is an external adversarial scenario rather than a circularity. There is no load-bearing self-citation or imported uniqueness theorem. Thus no step satisfies the standard for circularity; the unverified linearity and Eq. 8 are correctness/verification concerns, not self-referential derivation.

Assumptions & free parameters 3 free parameters · 3 assumptions · 1 invented entities

The central claim rests on the training objective that produces a uniform-output model on clean data and a well-calibrated model on triggered data. The theoretical bound is a consequence of this objective under a linearity assumption, so no external constants are fitted. The trigger bound and step size are hyperparameters swept by the authors, and the learned trigger itself is a model parameter. The key unverified premises are the linearity of the loss and the exact satisfaction of Eqs. 8 and 9.

free parameters (3)
  • trigger bound epsilon_t (fixed trigger) = swept over 1/255 to 64/255
    Controls the magnitude of the fixed trigger; paper shows robustness increases with epsilon_t and clean accuracy slightly decreases; a hand-chosen hyperparameter, not fitted to a theory.
  • trigger step size alpha (learnable trigger) = swept over 0.5/255 to 16/255, default 4/255
    Step size for updating the learnable trigger in Algorithm 2; ablation in Table VII shows little sensitivity.
  • learnable trigger tau = learned per model, MSE values in Table XI
    Optimized to minimize cross-entropy on x+tau; its specific values are dataset and model dependent and are not predicted a priori.
assumptions (3)
  • domain assumption Cross-entropy loss of the model is linear between x and x+tau (first-order Taylor expansion), so loss(x+tau) = loss(x) + gradient(x)^T tau.
    Used in the proofs of Theorem 1 and Theorem 2 in Section III-B; deep network losses are highly nonlinear, so this is an idealization.
  • domain assumption The trained model satisfies Eqs. 8 and 9 exactly, i.e., expected gradient aligns with -tau and expected clean loss equals log(C).
    These equalities are stated as should conform to structure and are treated as exact in the proof; training only approximately realizes them.
  • standard math Training data D_train and test data D_test are drawn from the same distribution, so expectations can be interchanged.
    Used in the first line of Theorem 2's proof; standard but unstated formally.
invented entities (1)
  • activation trigger tau
    purpose: A constant input perturbation added to all test inputs to activate the well-trained mode of the model; the model is trained to be random on x and accurate on x+tau.
    The trigger is a learned or randomly fixed parameter of the defense, not a physical entity with independent evidence. Its existence is confirmed only through the defense's own training and evaluation.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Towards Model Resistant to Transferable Adversarial Examples via Trigger Activation." pith.science (2026). https://pith.science/paper/G7CK73WC

@misc{pith2026250414541,
  author       = {Pith},
  title        = {Pith review of: Towards Model Resistant to Transferable Adversarial Examples via Trigger Activation},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/G7CK73WC}},
  note         = {Machine review of arXiv:2504.14541}
}
abstract

Adversarial examples, characterized by imperceptible perturbations, pose significant threats to deep neural networks by misleading their predictions. A critical aspect of these examples is their transferability, allowing them to deceive {unseen} models in black-box scenarios. Despite the widespread exploration of defense methods, including those on transferability, they show limitations: inefficient deployment, ineffective defense, and degraded performance on clean images. In this work, we introduce a novel training paradigm aimed at enhancing robustness against transferable adversarial examples (TAEs) in a more efficient and effective way. We propose a model that exhibits random guessing behavior when presented with clean data $\boldsymbol{x}$ as input, and generates accurate predictions when with triggered data $\boldsymbol{x}+\boldsymbol{\tau}$. Importantly, the trigger $\boldsymbol{\tau}$ remains constant for all data instances. We refer to these models as \textbf{models with trigger activation}. We are surprised to find that these models exhibit certain robustness against TAEs. Through the consideration of first-order gradients, we provide a theoretical analysis of this robustness. Moreover, through the joint optimization of the learnable trigger and the model, we achieve improved robustness to transferable attacks. Extensive experiments conducted across diverse datasets, evaluating a variety of attacking methods, underscore the effectiveness and superiority of our approach.

Figures

Figures reproduced from arXiv: 2504.14541 by the authors.

Figure 1
Figure 1. (a) Illustration of model with trigger activation: a model [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. Loss and Accuracy (Acc.) when using −τ with randomly flipped proportions as adversarial perturbations to attack the model with trigger activation. the model with trigger activation to TAEs may be attributed to the misalignment between −τ and δs. To investigate this, we conduct experiments where −τ was used with randomly flipped proportions as adversarial perturbations to attack. Specifically, we performed experiment… view at source ↗
Figure 3
Figure 3. Visualization of the trigger for models with trigger activation on the CIFAR-10 dataset. [PITH_FULL_IMAGE:figures/full_fig_p010_3.png] view at source ↗

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

75 extracted references · 59 canonical work pages

  1. [1]

    Hidemia: Hidden wavelet mining for privacy- enhancing medical image analysis,

    X. Lin, Y . Yu, Z. Yu, R. Meng, J. Zhou, A. Liu, Y . Liu, S. Wang, W. Tang, Z. Lei et al. , “Hidemia: Hidden wavelet mining for privacy- enhancing medical image analysis,” in ACM Trans. Multimedia , 2024, pp. 8110–8119

    work page 2024

  2. [2]

    Purify unlearnable examples via rate-constrained variational autoencoders,

    Y . Yu, Y . Wang, S. Xia, W. Yang, S. Lu, Y .-P. Tan, and A. Kot, “Purify unlearnable examples via rate-constrained variational autoencoders,” in Proc. Int’l Conf. Machine Learning . PMLR, 2024, pp. 57 678–57 702

    work page 2024

  3. [3]

    Semantic deep hiding for robust unlearnable examples,

    R. Meng, C. Yi, Y . Yu, S. Yang, B. Shen, and A. C. Kot, “Semantic deep hiding for robust unlearnable examples,” IEEE Trans. on Information Forensics and Security, 2024. JOURNAL OF LATEX CLASS FILES, VOL. 14, NO. 8, AUGUST 2021 11

    work page 2024

  4. [4]

    Towards physical world backdoor attacks against skeleton action recognition,

    Q. Zheng, Y . Yu, S. Yang, J. Liu, K.-Y . Lam, and A. Kot, “Towards physical world backdoor attacks against skeleton action recognition,” in Proc. IEEE European Conf. Computer Vision . Springer, 2024, pp. 215–233

    work page 2024

  5. [5]

    Robust and transferable backdoor attacks against deep image compression with selective frequency prior,

    Y . Yu, Y . Wang, W. Yang, L. Guo, S. Lu, L.-Y . Duan, Y .-P. Tan, and A. C. Kot, “Robust and transferable backdoor attacks against deep image compression with selective frequency prior,” IEEE Trans. on Pattern Analysis and Machine Intelligence , 2024

    work page 2024

  6. [6]

    Theoretical insights in model inversion robustness and conditional entropy maximization for collaborative inference systems,

    S. Xia, Y . Yu, W. Yang, M. Ding, Z. Chen, L. Duan, A. C. Kot, and X. Jiang, “Theoretical insights in model inversion robustness and conditional entropy maximization for collaborative inference systems,” arXiv preprint arXiv:2503.00383 , 2025

    arXiv 2025

  7. [7]

    Backdoor attacks against no-reference image quality assessment models via a scalable trigger,

    Y . Yu, S. Xia, X. Lin, W. Yang, S. Lu, Y .-P. Tan, and A. Kot, “Backdoor attacks against no-reference image quality assessment models via a scalable trigger,” in Proc. AAAI Conf. on Artificial Intelligence , vol. 39, no. 9, 2025, pp. 9698–9706

    work page 2025

  8. [8]

    Intriguing properties of neural networks,

    C. Szegedy, W. Zaremba, I. Sutskever, J. Bruna, D. Erhan, I. Goodfellow, and R. Fergus, “Intriguing properties of neural networks,” arXiv preprint arXiv:1312.6199, 2013

    arXiv 2013

Show all 75 references
  1. [9]

    Explaining and harnessing adversarial examples,

    I. J. Goodfellow, J. Shlens, and C. Szegedy, “Explaining and harnessing adversarial examples,” in Proc. Int’l Conf. Learning Representations , 2015

    2015

  2. [10]

    Mitigating the curse of dimensionality for certified robustness via dual randomized smoothing,

    S. Xia, Y . Yu, X. Jiang, and H. Ding, “Mitigating the curse of dimensionality for certified robustness via dual randomized smoothing,” in Proc. Int’l Conf. Learning Representations , 2024

    2024

  3. [11]

    Transferable adversarial attacks on sam and its downstream models,

    S. Xia, W. Yang, Y . Yu, X. Lin, H. Ding, L. DUAN, and X. Jiang, “Transferable adversarial attacks on sam and its downstream models,” in Proc. Annual Conf. Neural Information Processing Systems , 2024

    2024

  4. [12]

    Adversarial attack vulnerability of medical image analysis systems: Unexplored factors,

    G. Bortsova, C. Gonz ´alez-Gonzalo, S. C. Wetstein, F. Dubost, I. Ka- tramados, L. Hogeweg, B. Liefers, B. van Ginneken, J. P. Pluim, M. Veta et al. , “Adversarial attack vulnerability of medical image analysis systems: Unexplored factors,” Medical Image Analysis, vol. 73, p. ...

    2021

  5. [13]

    Safeguarding medical image segmentation datasets against unauthorized training via contour-and texture-aware perturbations,

    X. Lin, Y . Yu, S. Xia, J. Jiang, H. Wang, Z. Yu, Y . Liu, Y . Fu, S. Wang, W. Tang et al. , “Safeguarding medical image segmentation datasets against unauthorized training via contour-and texture-aware perturbations,” arXiv preprint arXiv:2403.14250 , 2024

    2024 arXiv

  6. [14]

    Evaluating adversarial evasion attacks in the context of wireless communications,

    B. Flowers, R. M. Buehrer, and W. C. Headley, “Evaluating adversarial evasion attacks in the context of wireless communications,” IEEE Trans. on Information Forensics and Security , vol. 15, p. 1102–1113, jan

  7. [15]

    Interpretable learning for self-driving cars by visualizing causal attention,

    J. Kim and J. Canny, “Interpretable learning for self-driving cars by visualizing causal attention,” in Proc. IEEE Int’l Conf. Computer Vision, 2017, pp. 2942–2950

    2017

  8. [16]

    Towards robust rain removal against adversarial attacks: A comprehensive benchmark analysis and beyond,

    Y . Yu, W. Yang, Y .-P. Tan, and A. C. Kot, “Towards robust rain removal against adversarial attacks: A comprehensive benchmark analysis and beyond,” in Proc. IEEE Int’l Conf. Computer Vision and Pattern Recognition, 2022, pp. 6013–6022

    2022

  9. [17]

    Benchmarking adversarial robustness of image shadow removal with shadow-adaptive attacks,

    C. Wang, Y . Yu, L. Guo, and B. Wen, “Benchmarking adversarial robustness of image shadow removal with shadow-adaptive attacks,” in Proc. IEEE Int’l Conf. Acoustics, Speech, and Signal Processing. IEEE, 2024, pp. 13 126–13 130

    2024

  10. [18]

    Backdoor attacks against deep image compression via adaptive frequency trigger,

    Y . Yu, Y . Wang, W. Yang, S. Lu, Y .-P. Tan, and A. C. Kot, “Backdoor attacks against deep image compression via adaptive frequency trigger,” in Proc. IEEE Int’l Conf. Computer Vision and Pattern Recognition , June 2023, pp. 12 250–12 259

    2023

  11. [19]

    Black-box adversarial attacks with limited queries and information,

    A. Ilyas, L. Engstrom, A. Athalye, and J. Lin, “Black-box adversarial attacks with limited queries and information,” in Proc. Int’l Conf. Ma- chine Learning. PMLR, 2018, pp. 2137–2146

    2018

  12. [20]

    Simple black-box adversarial attacks,

    C. Guo, J. Gardner, Y . You, A. G. Wilson, and K. Weinberger, “Simple black-box adversarial attacks,” in Proc. Int’l Conf. Machine Learning . PMLR, 2019, pp. 2484–2493

    2019

  13. [21]

    Improving black- box adversarial attacks with a transfer-based prior,

    S. Cheng, Y . Dong, T. Pang, H. Su, and J. Zhu, “Improving black- box adversarial attacks with a transfer-based prior,” Proc. Annual Conf. Neural Information Processing Systems , vol. 32, 2019

    2019

  14. [22]

    Coreset learning-based sparse black-box adversarial attack for video recognition,

    J. Chen, T. Chen, X. Xu, J. Zhang, Y . Yang, and H. T. Shen, “Coreset learning-based sparse black-box adversarial attack for video recognition,” IEEE Trans. on Information Forensics and Security, vol. 19, p. 1547–1560, nov 2023. [Online]. Available: https://doi.org/10.1109/TIF...

    2023

  15. [23]

    Query-efficient decision-based black-box patch attack,

    Z. Chen, B. Li, S. Wu, S. Ding, and W. Zhang, “Query-efficient decision-based black-box patch attack,” IEEE Trans. on Information Forensics and Security , vol. 18, p. 5522–5536, jan 2023. [Online]. Available: https://doi.org/10.1109/TIFS.2023.3307908

    2023

  16. [24]

    Quantization aware attack: Enhancing transferable adversarial attacks by model quantization,

    Y . Yang, C. Lin, Q. Li, Z. Zhao, H. Fan, D. Zhou, N. Wang, T. Liu, and C. Shen, “Quantization aware attack: Enhancing transferable adversarial attacks by model quantization,” IEEE Trans. on Information Forensics and Security , vol. 19, p. 3265–3278, jan 2024. [Online]. Availa...

    2024

  17. [25]

    Logit margin matters: Improving transferable targeted adversarial attack by logit calibration,

    J. Weng, Z. Luo, S. Li, N. Sebe, and Z. Zhong, “Logit margin matters: Improving transferable targeted adversarial attack by logit calibration,” IEEE Trans. on Information Forensics and Security, vol. 18, p. 3561–3574, jan 2023. [Online]. Available: https://doi.org/10.1109/TIFS...

    2023

  18. [26]

    Transferability in ma- chine learning: from phenomena to black-box attacks using adversarial samples,

    N. Papernot, P. McDaniel, and I. Goodfellow, “Transferability in ma- chine learning: from phenomena to black-box attacks using adversarial samples,” arXiv preprint arXiv:1605.07277 , 2016

    2016 arXiv

  19. [27]

    Improving the transferability of adversarial samples by path-augmented method,

    J. Zhang, J.-t. Huang, W. Wang, Y . Li, W. Wu, X. Wang, Y . Su, and M. R. Lyu, “Improving the transferability of adversarial samples by path-augmented method,” in Proc. IEEE Int’l Conf. Computer Vision and Pattern Recognition, 2023, pp. 8173–8182

    2023

  20. [28]

    Transferable adversarial attacks on vision transformers with token gradient regularization,

    J. Zhang, Y . Huang, W. Wu, and M. R. Lyu, “Transferable adversarial attacks on vision transformers with token gradient regularization,” in Proc. IEEE Int’l Conf. Computer Vision and Pattern Recognition , 2023, pp. 16 415–16 424

    2023

  21. [29]

    Delving into transferable ad- versarial examples and black-box attacks,

    Y . Liu, X. Chen, C. Liu, and D. Song, “Delving into transferable ad- versarial examples and black-box attacks,” in Proc. Int’l Conf. Learning Representations, 2017

    2017

  22. [30]

    Practical black-box attacks against machine learning,

    N. Papernot, P. McDaniel, I. Goodfellow, S. Jha, Z. B. Celik, and A. Swami, “Practical black-box attacks against machine learning,” in Proceedings of the 2017 ACM on Asia conference on computer and communications security, 2017, pp. 506–519

    2017

  23. [31]

    Ensemble adversarial training: Attacks and defenses,

    F. Tram `er, A. Kurakin, N. Papernot, I. Goodfellow, D. Boneh, and P. McDaniel, “Ensemble adversarial training: Attacks and defenses,” in Proc. Int’l Conf. Learning Representations , 2018

    2018

  24. [32]

    Towards deep learning models resistant to adversarial attacks,

    A. Madry, A. Makelov, L. Schmidt, D. Tsipras, and A. Vladu, “Towards deep learning models resistant to adversarial attacks,” in Proc. Int’l Conf. Learning Representations , 2018

    2018

  25. [33]

    Ima- genet: A large-scale hierarchical image database,

    J. Deng, W. Dong, R. Socher, L.-J. Li, K. Li, and L. Fei-Fei, “Ima- genet: A large-scale hierarchical image database,” in Proc. IEEE Int’l Conf. Computer Vision and Pattern Recognition . Ieee, 2009, pp. 248– 255

    2009

  26. [34]

    Theoretically principled trade-off between robustness and accuracy,

    H. Zhang, Y . Yu, J. Jiao, E. Xing, L. El Ghaoui, and M. Jordan, “Theoretically principled trade-off between robustness and accuracy,” in Proc. Int’l Conf. Machine Learning . PMLR, 2019, pp. 7472–7482

    2019

  27. [35]

    Deep residual learning for image recognition,

    K. He, X. Zhang, S. Ren, and J. Sun, “Deep residual learning for image recognition,” in Proc. IEEE Int’l Conf. Computer Vision and Pattern Recognition, 2016, pp. 770–778

    2016

  28. [36]

    Countering adver- sarial images using input transformations,

    C. Guo, M. Rana, M. Cisse, and L. Van Der Maaten, “Countering adver- sarial images using input transformations,” in Proc. Int’l Conf. Learning Representations, 2018

    2018

  29. [37]

    Deflecting adversarial attacks with pixel deflection,

    A. Prakash, N. Moran, S. Garber, A. DiLillo, and J. Storer, “Deflecting adversarial attacks with pixel deflection,” in Proc. IEEE Int’l Conf. Com- puter Vision and Pattern Recognition , 2018, pp. 8571–8580

    2018

  30. [38]

    Pixelde- fend: Leveraging generative models to understand and defend against adversarial examples,

    Y . Song, T. Kim, S. Nowozin, S. Ermon, and N. Kushman, “Pixelde- fend: Leveraging generative models to understand and defend against adversarial examples,” in Proc. Int’l Conf. Learning Representations , 2018

    2018

  31. [39]

    Defense against adversarial attacks using high-level representation guided denoiser,

    F. Liao, M. Liang, Y . Dong, T. Pang, X. Hu, and J. Zhu, “Defense against adversarial attacks using high-level representation guided denoiser,” in Proc. IEEE Int’l Conf. Computer Vision and Pattern Recognition , 2018, pp. 1778–1787

    2018

  32. [40]

    Comdefend: An efficient image compression model to defend adversarial examples,

    X. Jia, X. Wei, X. Cao, and H. Foroosh, “Comdefend: An efficient image compression model to defend adversarial examples,” in Proc. IEEE Int’l Conf. Computer Vision and Pattern Recognition , 2019, pp. 6084–6092

    2019

  33. [41]

    Diffusion models for adversarial purification,

    W. Nie, B. Guo, Y . Huang, C. Xiao, A. Vahdat, and A. Anandkumar, “Diffusion models for adversarial purification,” in Proc. Int’l Conf. Ma- chine Learning. PMLR, 2022, pp. 16 805–16 827

    2022

  34. [42]

    Synthesizing robust adversarial examples,

    A. Athalye, L. Engstrom, A. Ilyas, and K. Kwok, “Synthesizing robust adversarial examples,” in Proc. Int’l Conf. Machine Learning . PMLR, 2018, pp. 284–293

    2018

  35. [43]

    Zoo: Zeroth order optimization based black-box attacks to deep neural networks without training substitute models,

    P.-Y . Chen, H. Zhang, Y . Sharma, J. Yi, and C.-J. Hsieh, “Zoo: Zeroth order optimization based black-box attacks to deep neural networks without training substitute models,” in Proceedings of the 10th ACM workshop on artificial intelligence and security , 2017, pp. 15–26

    2017

  36. [44]

    Transferable adversarial attack based on integrated gradients,

    Y . Huang and A. W.-K. Kong, “Transferable adversarial attack based on integrated gradients,” arXiv preprint arXiv:2205.13152 , 2022

    2022 arXiv

  37. [45]

    Query- efficient hard-label black-box attack: An optimization-based approach,

    M. Cheng, T. Le, P.-Y . Chen, J. Yi, H. Zhang, and C.-J. Hsieh, “Query- efficient hard-label black-box attack: An optimization-based approach,” arXiv preprint arXiv:1807.04457 , 2018

    2018 arXiv

  38. [46]

    Decision-based black-box attack against vision transformers via patch-wise adversarial removal,

    Y . Shi, Y . Han, Y .-a. Tan, and X. Kuang, “Decision-based black-box attack against vision transformers via patch-wise adversarial removal,” in Proc. Annual Conf. Neural Information Processing Systems , vol. 35, 2022, pp. 12 921–12 933. JOURNAL OF LATEX CLASS FILES, VOL. 14, ...

    2022

  39. [47]

    Can neural nets learn the same model twice? investigating reproducibility and double descent from the decision boundary perspective,

    G. Somepalli, L. Fowl, A. Bansal, P. Yeh-Chiang, Y . Dar, R. Baraniuk, M. Goldblum, and T. Goldstein, “Can neural nets learn the same model twice? investigating reproducibility and double descent from the decision boundary perspective,” in Proc. IEEE Int’l Conf. Computer Visio...

    2022

  40. [48]

    Adversarial examples in the physical world,

    A. Kurakin, I. J. Goodfellow, and S. Bengio, “Adversarial examples in the physical world,” in Artificial intelligence safety and security . Chapman and Hall/CRC, 2018, pp. 99–112

    2018

  41. [49]

    Boosting adversarial attacks with momentum,

    Y . Dong, F. Liao, T. Pang, H. Su, J. Zhu, X. Hu, and J. Li, “Boosting adversarial attacks with momentum,” inProc. IEEE Int’l Conf. Computer Vision and Pattern Recognition , 2018, pp. 9185–9193

    2018

  42. [50]

    Nesterov accelerated gradient and scale invariance for adversarial attacks,

    J. Lin, C. Song, K. He, L. Wang, and J. E. Hopcroft, “Nesterov accelerated gradient and scale invariance for adversarial attacks,” arXiv preprint arXiv:1908.06281, 2019

    1908 arXiv

  43. [51]

    Enhancing the transferability of adversarial attacks through variance tuning,

    X. Wang and K. He, “Enhancing the transferability of adversarial attacks through variance tuning,” in Proc. IEEE Int’l Conf. Computer Vision and Pattern Recognition, 2021, pp. 1924–1933

    2021

  44. [52]

    Boosting adversar- ial transferability via gradient relevance attack,

    H. Zhu, Y . Ren, X. Sui, L. Yang, and W. Jiang, “Boosting adversar- ial transferability via gradient relevance attack,” in Proc. IEEE Int’l Conf. Computer Vision, 2023, pp. 4741–4750

    2023

  45. [53]

    Improving transferability of adversarial examples with input diversity,

    C. Xie, Z. Zhang, Y . Zhou, S. Bai, J. Wang, Z. Ren, and A. L. Yuille, “Improving transferability of adversarial examples with input diversity,” in Proc. IEEE Int’l Conf. Computer Vision and Pattern Recognition , 2019, pp. 2730–2739

    2019

  46. [54]

    Admix: Enhancing the trans- ferability of adversarial attacks,

    X. Wang, X. He, J. Wang, and K. He, “Admix: Enhancing the trans- ferability of adversarial attacks,” in Proc. IEEE Int’l Conf. Computer Vision, 2021, pp. 16 158–16 167

    2021

  47. [55]

    Boosting Adversarial Transferability by Block Shuffle and Rotation,

    K. Wang, X. He, W. Wang, and X. Wang, “Boosting Adversarial Transferability by Block Shuffle and Rotation,” in Proc. IEEE Int’l Conf. Computer Vision and Pattern Recognition , 2024

    2024

  48. [56]

    Learning to transform dynamically for better adversarial transferability,

    R. Zhu, Z. Zhang, S. Liang, Z. Liu, and C. Xu, “Learning to transform dynamically for better adversarial transferability,” in Proc. IEEE Int’l Conf. Computer Vision and Pattern Recognition , 2024, pp. 24 273– 24 283

    2024

  49. [57]

    Fda: Feature disruptive attack,

    A. Ganeshan, V . BS, and R. V . Babu, “Fda: Feature disruptive attack,” in Proc. IEEE Int’l Conf. Computer Vision , 2019, pp. 8069–8079

    2019

  50. [58]

    Feature importance-aware transferable adversarial attacks,

    Z. Wang, H. Guo, Z. Zhang, W. Liu, Z. Qin, and K. Ren, “Feature importance-aware transferable adversarial attacks,” in Proceedings of the IEEE/CVF international conference on computer vision, 2021, pp. 7639– 7648

    2021

  51. [59]

    Improving adversarial transferability via neuron attribution- based attacks,

    J. Zhang, W. Wu, J.-t. Huang, Y . Huang, W. Wang, Y . Su, and M. R. Lyu, “Improving adversarial transferability via neuron attribution- based attacks,” in Proc. IEEE Int’l Conf. Computer Vision and Pattern Recognition, 2022, pp. 14 993–15 002

    2022

  52. [60]

    Enhancing the transferability of adversarial examples with random patch

    Y . Zhang, Y .-a. Tan, T. Chen, X. Liu, Q. Zhang, and Y . Li, “Enhancing the transferability of adversarial examples with random patch.” in IJCAI, 2022, pp. 1672–1678

    2022

  53. [61]

    Diffusion-based adversarial sample generation for improved stealthiness and controllability,

    H. Xue, A. Araujo, B. Hu, and Y . Chen, “Diffusion-based adversarial sample generation for improved stealthiness and controllability,” in Proc. Annual Conf. Neural Information Processing Systems , vol. 36, 2023, pp. 2894–2921

    2023

  54. [62]

    Adversarial machine learning at scale,

    A. Kurakin, I. Goodfellow, and S. Bengio, “Adversarial machine learning at scale,” in Proc. Int’l Conf. Learning Representations , 2017

    2017

  55. [63]

    Feature squeezing: Detecting adversarial examples in deep neural networks,

    W. Xu, D. Evans, and Y . Qi, “Feature squeezing: Detecting adversarial examples in deep neural networks,” in Proceedings 2018 Network and Distributed System Security Symposium . Internet Society, 2018

    2018

  56. [64]

    Mitigating adversarial effects through randomization,

    C. Xie, J. Wang, Z. Zhang, Z. Ren, and A. Yuille, “Mitigating adversarial effects through randomization,” in Proc. Int’l Conf. Learning Represen- tations, 2018

    2018

  57. [65]

    Feature distillation: Dnn-oriented jpeg compression against adversarial examples,

    Z. Liu, Q. Liu, T. Liu, N. Xu, X. Lin, Y . Wang, and W. Wen, “Feature distillation: Dnn-oriented jpeg compression against adversarial examples,” in Proc. IEEE Int’l Conf. Computer Vision and Pattern Recognition. IEEE, 2019, pp. 860–868

    2019

  58. [66]

    A self- supervised approach for adversarial robustness,

    M. Naseer, S. Khan, M. Hayat, F. S. Khan, and F. Porikli, “A self- supervised approach for adversarial robustness,” in Proc. IEEE Int’l Conf. Computer Vision and Pattern Recognition , 2020, pp. 262–271

    2020

  59. [67]

    Score-based generative modeling through stochastic differ- ential equations,

    Y . Song, J. Sohl-Dickstein, D. P. Kingma, A. Kumar, S. Ermon, and B. Poole, “Score-based generative modeling through stochastic differ- ential equations,” in Proc. Int’l Conf. Learning Representations , 2021

    2021

  60. [68]

    Randomized adversarial training via taylor expansion,

    G. Jin, X. Yi, D. Wu, R. Mu, and X. Huang, “Randomized adversarial training via taylor expansion,” inProc. IEEE Int’l Conf. Computer Vision and Pattern Recognition, 2023

    2023

  61. [69]

    Taxonomy driven fast adversarial training,

    K. Tong, C. Jiang, J. Gui, and Y . Cao, “Taxonomy driven fast adversarial training,” in Proc. AAAI Conf. on Artificial Intelligence , vol. 38, no. 6, 2024, pp. 5233–5242

    2024

  62. [70]

    Learning multiple layers of features from tiny images,

    A. Krizhevsky, G. Hinton et al. , “Learning multiple layers of features from tiny images,” 2009

    2009

  63. [71]

    Very deep convolutional networks for large-scale image recognition,

    K. Simonyan and A. Zisserman, “Very deep convolutional networks for large-scale image recognition,” arXiv preprint arXiv:1409.1556 , 2014

    2014 arXiv

  64. [72]

    Mobilenetv2: Inverted residuals and linear bottlenecks,

    M. Sandler, A. Howard, M. Zhu, A. Zhmoginov, and L.-C. Chen, “Mobilenetv2: Inverted residuals and linear bottlenecks,” in Proc. IEEE Int’l Conf. Computer Vision and Pattern Recognition , 2018, pp. 4510– 4520

    2018

  65. [73]

    Densely connected convolutional networks,

    G. Huang, Z. Liu, L. Van Der Maaten, and K. Q. Weinberger, “Densely connected convolutional networks,” in Proc. IEEE Int’l Conf. Computer Vision and Pattern Recognition , 2017, pp. 4700–4708

    2017

  66. [74]

    Inception-v4, inception-resnet and the impact of residual connections on learning,

    C. Szegedy, S. Ioffe, V . Vanhoucke, and A. Alemi, “Inception-v4, inception-resnet and the impact of residual connections on learning,” in Proc. AAAI Conf. on Artificial Intelligence , vol. 31, no. 1, 2017

    2017

  67. [2020]

    Available: https://doi.org/10.1109/TIFS.2019.2934069

    [Online]. Available: https://doi.org/10.1109/TIFS.2019.2934069

    2019

Pith tools

Reviewed August 16, 2026 · model on record in the stance chip above.