Skip to content

All supported attacks

We roughly categorize transferable adversarial attacks into the following categories based on their strategies to improve adversarial transferability:

  • Classic attacks: The line of work that first proposed gradient-based adversarial attacks.
  • Gradient augmentations: Stabilizing or augmenting the gradient flows to improve transferability.
  • Input transformations: Applying all forms of transformations as image augmentations to inputs.
  • Feature disruption: Disrupting intermediate features of the surrogate model.
  • Surrogate self-refinement: Refining the surrogate model, both structure-wise and in forward/backward passes.
  • Generative modelling: Using generative models to generate adversarial examples.
  • Others: Other attacks that do not fit into transfer-based attacks but are important black-box attacks.

We provide a detailed list of all supported attacks below.

Name Class Name Publication Paper (Open Access)
Classic attacks
FGSM FGSM ICLR 2015 Explaining and Harnessing Adversarial Examples
PGD PGD ICLR 2018 Towards Deep Learning Models Resistant to Adversarial Attacks
PGD (L2) PGDL2 ICLR 2018 Towards Deep Learning Models Resistant to Adversarial Attacks
I-FGSM IFGSM ICLR 2019 Adversarial examples in the physical world
Gradient augmentations
MI-FGSM MIFGSM CVPR 2018 Boosting Adversarial Attacks with Momentum
NI-FGSM NIFGSM ICLR 2020 Nesterov Accelerated Gradient and Scale Invariance for Adversarial Attacks
VMI-FGSM VMIFGSM CVPR 2021 Enhancing the Transferability of Adversarial Attacks through Variance Tuning
VNI-FGSM VNIFGSM CVPR 2021 Enhancing the Transferability of Adversarial Attacks through Variance Tuning
MIG MIG ICCV 2023 Transferable Adversarial Attack for Both Vision Transformers and Convolutional Networks via Momentum Integrated Gradients
GRA GRA ICCV 2023 Boosting Adversarial Transferability via Gradient Relevance Attack
MuMoDIG MuMoDIG AAAI 2025 Improving Integrated Gradient-based Transferable Adversarial Examples by Refining the Integration Path
Input transformations
DI-FGSM DIFGSM CVPR 2019 Improving Transferability of Adversarial Examples with Input Diversity
TI-FGSM TIFGSM CVPR 2019 Evading Defenses to Transferable Adversarial Examples by Translation-Invariant Attacks
SI-NI-FGSM SINIFGSM ICLR 2020 Nesterov Accelerated Gradient and Scale Invariance for Adversarial Attacks
Admix Admix ICCV 2021 Admix: Enhancing the Transferability of Adversarial Attacks
SSA SSA ECCV 2022 Frequency Domain Model Augmentation for Adversarial Attack
DeCoWA DeCoWA AAAI 2024 Boosting Adversarial Transferability across Model Genus by Deformation-Constrained Warping
BSR BSR CVPR 2024 Boosting Adversarial Transferability by Block Shuffle and Rotation
L2T L2T CVPR 2024 Learning to Transform Dynamically for Better Adversarial Transferability
Feature disruption
FDA FDA ICCV 2019 FDA: Feature Disruptive Attack
DR DR CVPR 2020 Enhancing Cross-Task Black-Box Transferability of Adversarial Examples With Dispersion Reduction
FIA FIA ICCV 2021 Feature Importance-aware Transferable Adversarial Attacks
NAA NAA CVPR 2022 Improving Adversarial Transferability via Neuron Attribution-Based Attacks
ILPD ILPD NeurIPS 2023 Improving Adversarial Transferability via Intermediate-level Perturbation Decay
BFA BFA Neurocomputing' 2024 Improving the transferability of adversarial examples through black-box feature attacks
Surrogate self-refinement
SGM SGM ICLR 2020 Skip Connections Matter: On the Transferability of Adversarial Examples Generated with ResNets
PNA-PatchOut PNAPatchOut AAAI 2022 Towards Transferable Adversarial Attacks on Vision Transformers
TGR TGR CVPR 2023 Transferable Adversarial Attacks on Vision Transformers with Token Gradient Regularization
BPA BPA NeurIPS 2023 Rethinking the Backward Propagation for Adversarial Transferability
VDC VDC AAAI 2024 Improving the Adversarial Transferability of Vision Transformers with Virtual Dense Connection
ATT ATT NeurIPS 2024 Boosting the Transferability of Adversarial Attack on Vision Transformer with Adaptive Token Tuning
Generative modelling
CDA CDA NeurIPS 2019 Cross-Domain Transferability of Adversarial Perturbations
LTP LTP NeurIPS 2021 Learning Transferable Adversarial Perturbations
BIA BIA ICLR 2022 Beyond ImageNet Attack: Towards Crafting Adversarial Examples for Black-box Domains
GAMA GAMA NeurIPS 2022 GAMA: Generative Adversarial Multi-Object Scene Attacks
Others
DeepFool DeepFool CVPR 2016 DeepFool: A Simple and Accurate Method to Fool Deep Neural Networks
GeoDA GeoDA CVPR 2020 GeoDA: A Geometric Framework for Black-box Adversarial Attacks
SSP SSP CVPR 2020 A Self-supervised Approach for Adversarial Robustness