Aug 2026· Neural Networks· Vol 205 Pt B, pp.
109488
· 0 citations· 58 references
Medicine
TL;DR
Transfer-Dislocation and Curvature-Aware Gradient (TD-CAG), a new adversarial attack framework comprising two complementary modules: a curvature-aware gradient (CAG) module for modeling local nonlinearity, and a translation-dislocation (TD) module for modeling saliency misalignment.
Abstract
Transfer-based adversarial attacks are widely used to evaluate the robustness of deep neural networks (DNNs) under black-box settings, yet improving their cross-model transferability remains a key challenge. This limitation arises from reliance on locally linear gradient approximations and insufficient guidance from semantically critical regions. To address these limitations, we propose Translation-Dislocation and Curvature-Aware Gradient (TD-CAG), a new adversarial attack framework comprising two complementary modules: a curvature-aware gradient (CAG) module for modeling local nonlinearity, and a translation-dislocation (TD) module for modeling saliency misalignment. Specifically, CAG approximates second-order directional curvature to help perturbations escape local linearity, and TD introduces lightweight spatial shifts to simulate saliency misalignments across architectures, guiding perturbations toward model-invariant discriminative regions. Both modules are plug-and-play and compatible with existing attack pipelines. Extensive experiments demonstrate that TD-CAG consistently achieves superior transferability compared to state-of-the-art attack methods, while maintaining high compatibility and low computational cost. The source code is publicly available at https://github.com/hlkuang24/TD-CAG.
Empirical support is provided for the utility of structure-aware perturbation refinement in improving black-box adversarial transferability across heterogeneous visual architectures.
Qi-Rui Lu, Liansong Zong, Fu-Ran Liu et al.· Neural Networks· 0 citations
Season, a spectrum-aware orthogonal gradient refinement framework for L-infinity transfer attacks against black-box target models on ImageNet, using a white-box surrogate to improve transfer success rate.
Focusing on zero-shot classification, this study demonstrates that 3D vision-language models exhibit heightened sensitivity to small coordinate perturbations, highlighting the need for a more rigorous security evaluation of 3D vision-language models.
Xuanxiang Lin, Yan Huang, Longkun Zou et al.· IEEE Access· 0 citations
Transfer-based black-box attacks are an important tool for evaluating deployed vision models, yet adversarial examples generated from Vision Transformer (ViT) surrogates often exhibit limited cross-architecture transferability. Existing momentum-based attacks are effective for convolutional neural network (CNN) surrogates, but they can accumulate stale directions and overfit the surrogate when the source model is a ViT. This paper presents Ada-MGNS, a ViToriented transferable attack that combines adaptive momentum with deep attention guidance. The adaptive component measures the directional discrepancy between the current guided gradient and the accumulated trajectory, and then attenuates stale momentum when the search direction becomes unstable. The guidance component fuses the classification gradient with an auxiliary gradient extracted from the last transformer block’s attention responses, encouraging perturbations to disturb both output decisions and semantic aggregation. Experiments on ImageNet with four ViT surrogates, thirteen standard black-box targets, and five defense models show that Ada-MGNS consistently improves attack success rates over representative ViT-specific baselines, remains compatible with DI/TI transformations and effective against adversarially trained and purification-based defenses.
Lei Lu, Run-Han Yao, Qinghe Du et al.· 2026 International Conferenc...· 0 citations
FDT-PC (Frequency Domain Transformation with Perceptual Constraints), a novel method that enhances adversarial transferability across different model architectures, is proposed, which achieves superior black-box attack performance on both CNNs and Vision Transformers, outperforming existing state-of-the-art input transformation methods.
Bo Li, Li Tang, Xin Jin et al.· ACM Transactions on Multimed...· 0 citations
While Large Vision-Language Models (LVLMs), represented by LLaVA and GPT-4V, have demonstrated remarkable capabilities, their visual inputs remain vulnerable to adversarial attacks, posing significant security risks. Existing defense methods predominantly target single-task scenarios (e.g., zero-shot classification) and consequently lack generalizability across various multimodal tasks. To address this limitation, we propose a dual adversarial fine-tuning framework that jointly optimizes visual and semantic supervision signals from two modalities, enhancing model robustness while generalizing across multiple downstream tasks. The proposed framework comprises two core components, i.e., $\textbf{Visual}$ supervision branch and $\textbf{Semantic}$ supervision branch. The former branch leverages features from clean images, extracted via a frozen original vision encoder, to guide adversarial robustness while the latter incorporates caption-image alignment as a contextual signal to preserve semantic coherence under attack. Moreover, our method achieves cross-task robustness by simply replacing the CLIP vision encoder in the original model, with no need of separate task-specific retraining or architecture modifications.Extensive experiments demonstrate that our approach outperforms the state-of-the-art method in adversarial robustness evaluation across zero-shot classification, image captioning, and visual question answering (VQA) tasks.
Sibo Wang, Jie Zhang, Shiguang Shan et al.· 0 citations
