{"type":"ScholarlyArticle","title":"Advancing Generalized Transfer Attack with Initialization Derived Bilevel Optimization and Dynamic Sequence Truncation","authors":[{"name":"Yaohua Liu","slug":"yaohua-liu","given":"Yaohua","family":"Liu","affiliation":"School of Software Engineering , Dalian University of Technology , China"},{"name":"Jiaxin Gao","slug":"jiaxin-gao","given":"Jiaxin","family":"Gao","affiliation":"School of Software Engineering , Dalian University of Technology , China"},{"name":"Xuan Liu","slug":"xuan-liu","given":"Xuan","family":"Liu","affiliation":"CRRC Qingdao Sifang Rolling Stock Research Institute Co. , Ltd , China"},{"name":"Xianghao Jiao","slug":"xianghao-jiao","given":"Xianghao","family":"Jiao","affiliation":"School of Software Engineering , Dalian University of Technology , China"},{"name":"Xin Fan","slug":"xin-fan","given":"Xin","family":"Fan","affiliation":"School of Software Engineering , Dalian University of Technology , China"},{"name":"Risheng Liu","slug":"risheng-liu","given":"Risheng","family":"Liu","affiliation":"School of Software Engineering , Dalian University of Technology , China; Pazhou Laboratory (Huangpu) , Guangzhou , China."}],"abstract":"Transfer attacks generate significant interest for real-world black-box applications by crafting transferable adversarial examples through surrogate models. Whereas, existing works essentially directly optimize the single-level objective w.r.t. the surrogate model, which always leads to poor interpretability of attack mechanism and limited generalization performance over unknown victim models. In this work, we propose the BilEvel Transfer AttacK (BETAK) framework by establishing an initialization derived bilevel optimization paradigm, which explicitly reformulates the nested constraint relationship between the Upper-Level (UL) pseudo-victim attacker and the Lower-Level (LL) surrogate attacker. Algorithmically, we introduce the Hyper Gradient Response (HGR) estimation as an effective feedback for the transferability over pseudo-victim attackers, and propose the Dynamic Sequence Truncation (DST) technique to dynamically adjust the back-propagation path for HGR and reduce computational overhead simultaneously. Meanwhile, we conduct detailed algorithmic analysis and provide convergence guarantee to support non-convexity of the LL surrogate attacker. Extensive evaluations demonstrate substantial improvement of BETAK (e.g., 53.41% increase of attack success rates against IncRes-v2_ens victim) against different victims and defense methods in targeted and untargeted attack scenarios.","doi":"10.24963/ijcai.2024/126","url":"https://ijcai.org/proceedings/2024/126","pdf":"https://ijcai.org/proceedings/2024/0126.pdf","markdown":"https://ijcai.org/proceedings/2024/126.md","bibtex":"https://ijcai.org/proceedings/2024/bibtex/126","volume":{"slug":"2024","title":"Proceedings of the Thirty-Third International Joint Conference on Artificial Intelligence","short_title":"IJCAI 2024","url":"https://ijcai.org/proceedings/2024/","year":2024,"location":"Jeju, Korea","dates":"3-9 August 2024","editors":"Kate Larson","isbn":"978-1-956792-04-1","publisher":"International Joint Conferences on Artificial Intelligence Organization","doi_prefix":"10.24963/ijcai.2024"},"section":"Computer Vision","track":"Main Track","number":126,"pages":{"first":1137,"last":1145},"keywords":["Computer Vision: CV: Adversarial learning, adversarial attack and defense methods","Computer Vision: CV: Machine learning for vision"],"videos":[],"references":[{"position":1,"raw":"[Alparslan et al., 2020] Yigit Alparslan, Ken Alparslan, Jeremy Keim-Shenk, Shweta Khade, and Rachel Green- stadt. Adversarial attacks on convolutional neural net- works in facial recognition domain. arXiv preprint arXiv:2001.11137, 2020.","title":"Adversarial attacks on convolutional neural networks in facial recognition domain","authors":"Yigit Alparslan, Ken Alparslan, Jeremy Keim-Shenk, Shweta Khade, Rachel Greenstadt","year":"2020","venue":null,"doi":null,"url":null,"internal_url":null},{"position":2,"raw":"[Cheng et al., 2021] Yaya Cheng, Jingkuan Song, Xiaosu Zhu, Qilong Zhang, Lianli Gao, and Heng Tao Shen. Fast gradient non-sign methods. arXiv preprint arXiv:2110.12734, 2021.","title":"Fast gradient non-sign methods","authors":"Yaya Cheng, Jingkuan Song, Xiaosu Zhu, Qilong Zhang, Lianli Gao, Heng Tao Shen","year":"2021","venue":null,"doi":null,"url":null,"internal_url":null},{"position":3,"raw":"[Cohen et al., 2019] Jeremy Cohen, Elan Rosenfeld, and Zico Kolter. Certified adversarial robustness via random- ized smoothing. In international conference on machine learning, pages 1310-1320. PMLR, 2019.","title":"Certified adversarial robustness via randomized smoothing","authors":"Jeremy Cohen, Elan Rosenfeld, Zico Kolter","year":"2019","venue":"international conference on machine learning","doi":null,"url":null,"internal_url":null},{"position":4,"raw":"[Deng et al., 2020] Yao Deng, Xi Zheng, Tianyi Zhang, Chen Chen, Guannan Lou, and Miryung Kim. An analysis of adversarial attacks and defenses on autonomous driving models. In 2020 IEEE international conference on per- vasive computing and communications (PerCom), pages 1-10. IEEE, 2020.","title":"An analysis of adversarial attacks and defenses on autonomous driving models","authors":"Yao Deng, Xi Zheng, Tianyi Zhang, Chen Chen, Guannan Lou, Miryung Kim","year":"2020","venue":"IEEE international conference on pervasive computing and communications (PerCom)","doi":null,"url":null,"internal_url":null},{"position":5,"raw":"[Dong et al., 2018] Yinpeng Dong, Fangzhou Liao, Tianyu Pang, Hang Su, Jun Zhu, Xiaolin Hu, and Jianguo Li. Boosting adversarial attacks with momentum. In Proceed- ings of the IEEE conference on computer vision and pat- tern recognition, pages 9185-9193, 2018.","title":"Boosting adversarial attacks with momentum","authors":"Dong","year":"2018","venue":"Proceedings of the IEEE conference on computer vision and pattern recognition","doi":null,"url":null,"internal_url":null},{"position":6,"raw":"[Fang et al., 2022] Shuman Fang, Jie Li, Xianming Lin, and Rongrong Ji. Learning to learn transferable attack. In Pro- ceedings of the AAAI Conference on Artificial Intelligence, volume 36, pages 571-579, 2022.","title":"Learning to learn transferable attack","authors":"Shuman Fang, Jie Li, Xianming Lin, Rongrong Ji","year":"2022","venue":"Proceedings of the AAAI Conference on Artificial Intelligence","doi":null,"url":null,"internal_url":null},{"position":7,"raw":"[Franceschi et al., 2017] Luca Franceschi, Michele Donini, Paolo Frasconi, and Massimiliano Pontil. Forward and reverse gradient-based hyperparameter optimization. arXiv:1703.01785, 2017.","title":"Forward and reverse gradient-based hyperparameter optimization","authors":"Luca Franceschi, Michele Donini, Paolo Frasconi, Massimiliano Pontil","year":"2017","venue":null,"doi":null,"url":null,"internal_url":null},{"position":8,"raw":"[Goodfellow et al., 2014] Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6572, 2014.","title":"Explaining and harnessing adversarial examples","authors":"Ian J Goodfellow, Jonathon Shlens, Christian Szegedy","year":"2014","venue":null,"doi":null,"url":null,"internal_url":null},{"position":9,"raw":"[Guo et al., 2017] Chuan Guo, Mayank Rana, Moustapha Cisse, and Laurens Van Der Maaten. Countering adver- sarial images using input transformations. arXiv preprint arXiv:1711.00117, 2017.","title":"Countering adversarial images using input transformations","authors":"Chuan Guo, Mayank Rana, Moustapha Cisse, Laurens Van Der Maaten","year":"2017","venue":null,"doi":null,"url":null,"internal_url":null},{"position":10,"raw":"[Guo et al., 2020] Yiwen Guo, Qizhang Li, and Hao Chen. Backpropagating linearly improves transferability of ad- versarial examples. Advances in neural information pro- cessing systems, 33:85-95, 2020.","title":"Backpropagating linearly improves transferability of adversarial examples","authors":"Yiwen Guo, Qizhang Li, Hao Chen","year":"2020","venue":"Advances in neural information processing systems","doi":null,"url":null,"internal_url":null},{"position":11,"raw":"[Hospedales et al., 2020] Timothy Hospedales, Antreas An- toniou, Paul Micaelli, and Amos Storkey. Meta-learning in neural networks: A survey. arXiv:2004.05439, 2020.","title":"Meta-learning in neural networks: A survey","authors":"Hospedales","year":"2020","venue":null,"doi":null,"url":null,"internal_url":null},{"position":12,"raw":"[Hu et al., 2018] Jie Hu, Li Shen, and Gang Sun. Squeeze- and-excitation networks. In Proceedings of the IEEE con- ference on computer vision and pattern recognition, pages 7132-7141, 2018.","title":"Squeezeand-excitation networks","authors":"Hu","year":"2018","venue":"Proceedings of the IEEE conference on computer vision and pattern recognition","doi":null,"url":null,"internal_url":null},{"position":13,"raw":"[Huang et al., 2017] Gao Huang, Zhuang Liu, Laurens Van Der Maaten, and Kilian Q Weinberger. Densely connected convolutional networks. In Proceedings of the IEEE con- ference on computer vision and pattern recognition, pages 4700-4708, 2017.","title":"Densely connected convolutional networks","authors":"Gao Huang, Zhuang Liu, Laurens Van Der Maaten, Kilian Q Weinberger","year":"2017","venue":"Proceedings of the IEEE conference on computer vision and pattern recognition","doi":null,"url":null,"internal_url":null},{"position":14,"raw":"[Huang et al., 2019] Qian Huang, Isay Katsman, Horace He, Zeqi Gu, Serge Belongie, and Ser-Nam Lim. Enhancing adversarial example transferability with an intermediate level attack. In Proceedings of the IEEE/CVF interna- tional conference on computer vision, pages 4733-4742, 2019.","title":"Enhancing adversarial example transferability with an intermediate level attack","authors":"Qian Huang, Isay Katsman, Horace He, Zeqi Gu, Serge Belongie, Ser-Nam Lim","year":"2019","venue":"Proceedings of the IEEE/CVF international conference on computer vision","doi":null,"url":null,"internal_url":null},{"position":15,"raw":"[Jiao et al., 2023] Xianghao Jiao, Yaohua Liu, Jiaxin Gao, Xinyuan Chu, Xin Fan, and Risheng Liu. Pearl: Prepro- cessing enhanced adversarial robust learning of image de- raining for semantic segmentation. In Proceedings of the 31st ACM International Conference on Multimedia, pages 8185-8194, 2023.","title":"Pearl: Preprocessing enhanced adversarial robust learning of image deraining for semantic segmentation","authors":"Xianghao Jiao, Yaohua Liu, Jiaxin Gao, Xinyuan Chu, Xin Fan, Risheng Liu","year":"2023","venue":"Proceedings of the 31st ACM International Conference on Multimedia","doi":null,"url":null,"internal_url":null},{"position":16,"raw":"[Kurakin et al., 2018a] Alexey Kurakin, Ian Goodfellow, Samy Bengio, Yinpeng Dong, Fangzhou Liao, Ming Liang, Tianyu Pang, Jun Zhu, Xiaolin Hu, Cihang Xie, et al. Adversarial attacks and defences competition. In The NIPS'17 Competition: Building Intelligent Systems, pages 195-231. Springer, 2018.","title":"Adversarial attacks and defences competition","authors":"Kurakin","year":"2018","venue":"The NIPS'17 Competition: Building Intelligent Systems","doi":null,"url":null,"internal_url":null},{"position":17,"raw":"[Kurakin et al., 2018b] Alexey Kurakin, Ian J Goodfellow, and Samy Bengio. Adversarial examples in the physical world. In Artificial intelligence safety and security, pages 99-112.","title":"Adversarial examples in the physical world","authors":"Kurakin","year":"2018","venue":"Artificial intelligence safety and security","doi":null,"url":null,"internal_url":null},{"position":18,"raw":"Chapman and Hall/CRC, 2018.","title":null,"authors":"Hall / Chapman, Crc","year":"2018","venue":null,"doi":null,"url":null,"internal_url":null},{"position":19,"raw":"[Li et al., 2020] Yingwei Li, Song Bai, Yuyin Zhou, Cihang Xie, Zhishuai Zhang, and Alan Yuille. Learning trans- ferable adversarial examples via ghost networks. In Pro- ceedings of the AAAI Conference on Artificial Intelligence, volume 34, pages 11458-11465, 2020.","title":"Learning transferable adversarial examples via ghost networks","authors":"Yingwei Li, Song Bai, Yuyin Zhou, Cihang Xie, Zhishuai Zhang, Alan Yuille","year":"2020","venue":"Proceedings of the AAAI Conference on Artificial Intelligence","doi":null,"url":null,"internal_url":null},{"position":20,"raw":"[Liao et al., 2018] Fangzhou Liao, Ming Liang, Yinpeng Dong, Tianyu Pang, Xiaolin Hu, and Jun Zhu. Defense against adversarial attacks using high-level representation guided denoiser. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 1778- 1787, 2018.","title":"Defense against adversarial attacks using high-level representation guided denoiser","authors":"Fangzhou Liao, Ming Liang, Yinpeng Dong, Tianyu Pang, Xiaolin Hu, Jun Zhu","year":"2018","venue":"Proceedings of the IEEE conference on computer vision and pattern recognition","doi":null,"url":null,"internal_url":null},{"position":21,"raw":"[Lin et al., 2019] Jiadong Lin, Chuanbiao Song, Kun He, Li- wei Wang, and John E Hopcroft. Nesterov accelerated gra- dient and scale invariance for adversarial attacks. arXiv preprint arXiv:1908.06281, 2019.","title":"Nesterov accelerated gradient and scale invariance for adversarial attacks","authors":"Lin","year":"2019","venue":null,"doi":null,"url":null,"internal_url":null},{"position":22,"raw":"[Liu and Liu, 2021] Yaohua Liu and Risheng Liu. Boml: A modularized bilevel optimization library in python for meta learning. In 2021 IEEE International Conference on Multimedia & Expo Workshops (ICMEW), pages 1-2. IEEE, 2021.","title":"Boml: A modularized bilevel optimization library in python for meta learning","authors":"Yaohua Liu, Risheng Liu","year":"2021","venue":"IEEE International Conference on Multimedia & Expo Workshops (ICMEW)","doi":null,"url":null,"internal_url":null},{"position":23,"raw":"[Liu et al., 2018] Chenxi Liu, Barret Zoph, Maxim Neu- mann, Jonathon Shlens, Wei Hua, Li-Jia Li, Li Fei-Fei, Alan Yuille, Jonathan Huang, and Kevin Murphy. Pro- gressive neural architecture search. In Proceedings of the European conference on computer vision (ECCV), pages 19-34, 2018.","title":"Progressive neural architecture search","authors":"Chenxi Liu, Barret Zoph, Maxim Neumann, Jonathon Shlens, Wei Hua, Li-Jia Li, Li Fei-Fei, Alan Yuille, Jonathan Huang, Kevin Murphy","year":"2018","venue":"Proceedings of the European conference on computer vision (ECCV)","doi":null,"url":null,"internal_url":null},{"position":24,"raw":"[Liu et al., 2020] Risheng Liu, Pan Mu, Jian Chen, Xin Fan, and Zhongxuan Luo. Investigating task-driven latent feasi- bility for nonconvex image modeling. IEEE Transactions on Image Processing, 29:7629-7640, 2020.","title":"Investigating task-driven latent feasibility for nonconvex image modeling","authors":"Risheng Liu, Pan Mu, Jian Chen, Xin Fan, Zhongxuan Luo","year":"2020","venue":"IEEE Transactions on Image Processing","doi":null,"url":null,"internal_url":null},{"position":25,"raw":"[Liu et al., 2021a] Risheng Liu, Xuan Liu, Xiaoming Yuan, Shangzhi Zeng, and Jin Zhang. A value-function-based interior-point method for non-convex bi-level optimiza- tion. In International Conference on Machine Learning, pages 6882-6892. PMLR, 2021.","title":"A value-function-based interior-point method for non-convex bi-level optimization","authors":"Liu","year":"2021","venue":"International Conference on Machine Learning","doi":null,"url":null,"internal_url":null},{"position":26,"raw":"[Liu et al., 2021b] Risheng Liu, Yaohua Liu, Shangzhi Zeng, and Jin Zhang. Towards gradient-based bilevel optimiza- tion with non-convex followers and beyond. Advances in Neural Information Processing Systems, 34:8662-8675, 2021.","title":"Towards gradient-based bilevel optimization with non-convex followers and beyond","authors":"Liu","year":"2021","venue":"Advances in Neural Information Processing Systems","doi":null,"url":null,"internal_url":null},{"position":27,"raw":"[Liu et al., 2023a] Risheng Liu, Yaohua Liu, Wei Yao, Shangzhi Zeng, and Jin Zhang. Averaged method of multi- pliers for bi-level optimization without lower-level strong convexity. In International Conference on Machine Learn- ing, pages 21839-21866. PMLR, 2023.","title":"Averaged method of multipliers for bi-level optimization without lower-level strong convexity","authors":"Liu","year":"2023","venue":"International Conference on Machine Learning","doi":null,"url":null,"internal_url":null},{"position":28,"raw":"[Liu et al., 2023b] Risheng Liu, Yaohua Liu, Shangzhi Zeng, and Jin Zhang. Augmenting iterative trajectory for bilevel optimization: Methodology, analysis and exten- sions. arXiv preprint arXiv:2303.16397, 2023.","title":"Augmenting iterative trajectory for bilevel optimization: Methodology, analysis and extensions","authors":"Liu","year":"2023","venue":null,"doi":null,"url":null,"internal_url":null},{"position":29,"raw":"[Liu et al., 2024] Risheng Liu, Jiaxin Gao, Xuan Liu, and Xin Fan. Learning with constraint learning: New per- spective, solution strategy and various applications. IEEE Transactions on Pattern Analysis and Machine Intelli- gence, 2024.","title":"Learning with constraint learning: New perspective, solution strategy and various applications","authors":"Risheng Liu, Jiaxin Gao, Xuan Liu, Xin Fan","year":"2024","venue":"IEEE Transactions on Pattern Analysis and Machine Intelligence","doi":null,"url":null,"internal_url":null},{"position":30,"raw":"[Long et al., 2022] Yuyang Long, Qilong Zhang, Boheng Zeng, Lianli Gao, Xianglong Liu, Jian Zhang, and Jingkuan Song. Frequency domain model augmentation for adversarial attack. In European Conference on Com- puter Vision, pages 549-566. Springer, 2022.","title":"Frequency domain model augmentation for adversarial attack","authors":"Yuyang Long, Qilong Zhang, Boheng Zeng, Lianli Gao, Xianglong Liu, Jian Zhang, Jingkuan Song","year":"2022","venue":"European Conference on Computer Vision","doi":null,"url":null,"internal_url":null},{"position":31,"raw":"[Sandler et al., 2018] Mark Sandler, Andrew Howard, Men- glong Zhu, Andrey Zhmoginov, and Liang-Chieh Chen. Mobilenetv2: Inverted residuals and linear bottlenecks. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 4510-4520, 2018.","title":"Mobilenetv2: Inverted residuals and linear bottlenecks","authors":"Mark Sandler, Andrew Howard, Menglong Zhu, Andrey Zhmoginov, Liang-Chieh Chen","year":"2018","venue":"Proceedings of the IEEE conference on computer vision and pattern recognition","doi":null,"url":null,"internal_url":null},{"position":32,"raw":"[Selvaraju et al., 2017] Ramprasaath R Selvaraju, Michael Cogswell, Abhishek Das, Ramakrishna Vedantam, Devi Parikh, and Dhruv Batra. Grad-cam: Visual explanations from deep networks via gradient-based localization. In Proceedings of the IEEE international conference on com- puter vision, pages 618-626, 2017.","title":"Grad-cam: Visual explanations from deep networks via gradient-based localization","authors":"Michael Ramprasaath R Selvaraju, Abhishek Cogswell, Ramakrishna Das, Devi Vedantam, Dhruv Parikh, Batra","year":"2017","venue":"Proceedings of the IEEE international conference on computer vision","doi":null,"url":null,"internal_url":null},{"position":33,"raw":"[Szegedy et al., 2016] Christian Szegedy, Vincent Van- houcke, Sergey Ioffe, Jon Shlens, and Zbigniew Wojna. Rethinking the inception architecture for computer vision. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 2818-2826, 2016.","title":"Rethinking the inception architecture for computer vision","authors":"Szegedy","year":"2016","venue":"Proceedings of the IEEE conference on computer vision and pattern recognition","doi":null,"url":null,"internal_url":null},{"position":34,"raw":"[Szegedy et al., 2017] Christian Szegedy, Sergey Ioffe, Vin- cent Vanhoucke, and Alexander Alemi. Inception-v4, inception-resnet and the impact of residual connections on learning. In Proceedings of the AAAI conference on artifi- cial intelligence, volume 31, 2017.","title":"Christian Szegedy, Sergey Ioffe, Vincent Vanhoucke, and Alexander Alemi. Inception-v4, inception-resnet and the impact of residual connections on learning","authors":"Szegedy","year":"2017","venue":"Proceedings of the AAAI conference on artificial intelligence","doi":null,"url":null,"internal_url":null},{"position":35,"raw":"[Tramèr et al., 2017] Florian Tramèr, Alexey Kurakin, Nico- las Papernot, Ian Goodfellow, Dan Boneh, and Patrick Mc- Daniel. Ensemble adversarial training: Attacks and de- fenses. arXiv preprint arXiv:1705.07204, 2017.","title":"Florian Tramèr","authors":"Tramèr","year":"2017","venue":"Ensemble adversarial training: Attacks and defenses","doi":null,"url":null,"internal_url":null},{"position":36,"raw":"[Wang and He, 2021] Xiaosen Wang and Kun He. Enhanc- ing the transferability of adversarial attacks through vari- ance tuning. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 1924- 1933, 2021.","title":"Enhancing the transferability of adversarial attacks through variance tuning","authors":"Wang, He ;, Xiaosen Wang, Kun He","year":"2021","venue":"Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition","doi":null,"url":null,"internal_url":null},{"position":37,"raw":"[Wang et al., 2021] Xiaosen Wang, Xuanran He, Jingdong Wang, and Kun He. Admix: Enhancing the transferability of adversarial attacks. In Proceedings of the IEEE/CVF In- ternational Conference on Computer Vision, pages 16158- 16167, 2021.","title":"Admix: Enhancing the transferability of adversarial attacks","authors":"Wang","year":"2021","venue":"Proceedings of the IEEE/CVF International Conference on Computer Vision","doi":null,"url":null,"internal_url":null},{"position":38,"raw":"[Wang et al., 2023] Xiaosen Wang, Kangheng Tong, and Kun He. Rethinking the backward propagation for ad- versarial transferability. In Thirty-seventh Conference on Neural Information Processing Systems, 2023.","title":"Rethinking the backward propagation for adversarial transferability","authors":"Wang","year":"2023","venue":"Thirty-seventh Conference on Neural Information Processing Systems","doi":null,"url":null,"internal_url":null},{"position":39,"raw":"[Wu et al., 2020] Weibin Wu, Yuxin Su, Xixian Chen, Shenglin Zhao, Irwin King, Michael R Lyu, and Yu-Wing Tai. Boosting the transferability of adversarial samples via attention. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 1161- 1170, 2020.","title":"Boosting the transferability of adversarial samples via attention","authors":"Weibin Wu, Yuxin Su, Xixian Chen, Shenglin Zhao, Irwin King, Yu-Wing Michael R Lyu, Tai","year":"2020","venue":"Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition","doi":null,"url":null,"internal_url":null},{"position":40,"raw":"[Xie et al., 2017a] Cihang Xie, Jianyu Wang, Zhishuai Zhang, Zhou Ren, and Alan Yuille. Mitigating ad- versarial effects through randomization. arXiv preprint arXiv:1711.01991, 2017.","title":"Mitigating adversarial effects through randomization","authors":"Xie","year":"2017","venue":null,"doi":null,"url":null,"internal_url":null},{"position":41,"raw":"[Xie et al., 2017b] Cihang Xie, Jianyu Wang, Zhishuai Zhang, Yuyin Zhou, Lingxi Xie, and Alan Yuille. Ad- versarial examples for semantic segmentation and object detection. In Proceedings of the IEEE international con- ference on computer vision, pages 1369-1378, 2017.","title":"Adversarial examples for semantic segmentation and object detection","authors":"Xie","year":"2017","venue":"Proceedings of the IEEE international conference on computer vision","doi":null,"url":null,"internal_url":null},{"position":42,"raw":"[Xie et al., 2019] Cihang Xie, Zhishuai Zhang, Yuyin Zhou, Song Bai, Jianyu Wang, Zhou Ren, and Alan L Yuille. Improving transferability of adversarial examples with in- put diversity. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 2730- 2739, 2019.","title":"Improving transferability of adversarial examples with input diversity","authors":"Cihang Xie, Zhishuai Zhang, Yuyin Zhou, Song Bai, Jianyu Wang, Alan L Zhou Ren, Yuille","year":"2019","venue":"Proceedings of the IEEE/CVF conference on computer vision and pattern recognition","doi":null,"url":null,"internal_url":null},{"position":43,"raw":"[Yuan et al., 2021] Zheng Yuan, Jie Zhang, Yunpei Jia, Chuanqi Tan, Tao Xue, and Shiguang Shan. Meta gradient adversarial attack. In Proceedings of the IEEE/CVF In- ternational Conference on Computer Vision, pages 7748- 7757, 2021.","title":"Meta gradient adversarial attack","authors":"Zheng Yuan, Jie Zhang, Yunpei Jia, Chuanqi Tan, Tao Xue, Shiguang Shan","year":"2021","venue":"Proceedings of the IEEE/CVF International Conference on Computer Vision","doi":null,"url":null,"internal_url":null},{"position":44,"raw":"[Zhao et al., 2021] Zhengyu Zhao, Zhuoran Liu, and Martha Larson. On success and simplicity: A second look at trans- ferable targeted attacks. Advances in Neural Information Processing Systems, 34:6115-6128, 2021.","title":"On success and simplicity: A second look at transferable targeted attacks","authors":"Zhengyu Zhao, Zhuoran Liu, Martha Larson","year":"2021","venue":"Advances in Neural Information Processing Systems","doi":null,"url":null,"internal_url":null}],"license_note":"Copyright International Joint Conferences on Artificial Intelligence."}