{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/improving-the-transferability-of-adversarial-7","title":"Improving the Transferability of Adversarial Examples with Arbitrary Style Transfer","arxiv_id":"2308.10601","date":"2023-08-21","proceeding":null,"authors":["Zhijin Ge","Fanhua Shang","Hongying Liu","Yuanyuan Liu","Liang Wan","Wei Feng","Xiaosen Wang"],"abstract":"Deep neural networks are vulnerable to adversarial examples crafted by applying human-imperceptible perturbations on clean inputs. Although many attack methods can achieve high success rates in the white-box setting, they also exhibit weak transferability in the black-box setting. Recently, various methods have been proposed to improve adversarial transferability, in which the input transformation is one of the most effective methods. In this work, we notice that existing input transformation-based works mainly adopt the transformed data in the same domain for augmentation. Inspired by domain generalization, we aim to further improve the transferability using the data augmented from different domains. Specifically, a style transfer network can alter the distribution of low-level visual features in an image while preserving semantic content for humans. Hence, we propose a novel attack method named Style Transfer Method (STM) that utilizes a proposed arbitrary style transfer network to transform the images into different domains. To avoid inconsistent semantic information of stylized images for the classification network, we fine-tune the style transfer network and mix up the generated images added by random noise with the original images to maintain semantic consistency and boost input diversity. Extensive experimental results on the ImageNet-compatible dataset show that our proposed method can significantly improve the adversarial transferability on either normally trained models or adversarially trained models than state-of-the-art input transformation-based attacks. Code is available at: https://github.com/Zhijin-Ge/STM.","url_abs":"https://arxiv.org/abs/2308.10601v1","url_pdf":"https://arxiv.org/pdf/2308.10601v1.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"improving-the-transferability-of-adversarial-7","repo_url":"https://github.com/zhijin-ge/stm","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":1,"framework":"pytorch","reach":{"status":"ok"}},{"paper_slug":"improving-the-transferability-of-adversarial-7","repo_url":"https://github.com/Trustworthy-AI-Group/TransferAttack","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"pytorch","reach":null}],"tasks":[{"task_slug":"domain-generalization","task_name":"Domain Generalization"},{"task_slug":"style-transfer","task_name":"Style Transfer"},{"task_slug":"unsupervised-domain-adaptation","task_name":"Unsupervised Domain Adaptation"}],"methods":[],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"syntology_url":"https://syntology.ai/paper/2308.10601","atlas_url":"https://app.syntology.ai/?focus=2308.10601","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2308.10601"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-25T09:33:49+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/Trustworthy-AI-Group/TransferAttack","reach":null},{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/zhijin-ge/stm","reach":{"status":"ok"}}],"summary":{"ran_draft_wrong":1,"ran":2,"unverified":2},"by_repo_kind":{"official":{"samples":5,"ran":3,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":5,"samples":[{"code_sha256_prefix":"11d8e1b97b2f5801","entry":"clip_by_tensor","repo":"zhijin-ge/stm","repo_kind":"official","path":"Incv3_STM_attacks.py","file_url":"https://github.com/zhijin-ge/stm/blob/HEAD/Incv3_STM_attacks.py","link_basis":"plan_row","language":"python","status":"ran_draft_wrong","verification_level":2,"contract_check":"MISDECLARED","metamorphic_tier":"invariant","behaviour_fingerprint":true,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"11d8e1b97b2f5801"}},{"code_sha256_prefix":"b5d488add95432e1","entry":"Admix","repo":"zhijin-ge/stm","repo_kind":"official","path":"attack_methods.py","file_url":"https://github.com/zhijin-ge/stm/blob/HEAD/attack_methods.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":true,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"b5d488add95432e1"}},{"code_sha256_prefix":"00e00d6e3d7ea75c","entry":"gkern","repo":"zhijin-ge/stm","repo_kind":"official","path":"attack_methods.py","file_url":"https://github.com/zhijin-ge/stm/blob/HEAD/attack_methods.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":true,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"00e00d6e3d7ea75c"}},{"code_sha256_prefix":"f4c0b217b3db3917","entry":"DI","repo":"zhijin-ge/stm","repo_kind":"official","path":"attack_methods.py","file_url":"https://github.com/zhijin-ge/stm/blob/HEAD/attack_methods.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"f4c0b217b3db3917"}},{"code_sha256_prefix":"1d26f359c8e9c2ea","entry":"MIFGSM","repo":"zhijin-ge/stm","repo_kind":"official","path":"Incv3_STM_attacks.py","file_url":"https://github.com/zhijin-ge/stm/blob/HEAD/Incv3_STM_attacks.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"1d26f359c8e9c2ea"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}