Improving Black-Box Generative Attacks via Generator Semantic Consistency
Authors: Jongoh Jeong
Hunmin Yang
Jaeseok Jeong
Kuk-Jin Yoon
Venue: ICLR 2026 Poster (2026)
Keywords: adversarial transferability
transferable adversarial attacks
generative models
Primary area: applications to computer vision, audio, language, and other modalities
TL;DR: We improve adversarial transferability of generative attacks by explicitly targeting the generator internals, unlike existing approaches, to enforce semantic consistency across adversarial perturbation synthesis stage.

Abstract: Transfer attacks optimize on a surrogate and deploy to a black-box target. While iterative optimization attacks in this paradigm are limited by their per-input cost limits efficiency and scalability due to multistep gradient updates for each input, generative attacks alleviate these by producing adversarial examples in a single forward pass at test time. However, current generative attacks still adhere to optimizing surrogate losses (e.g., feature divergence) and overlook the generator’s internal dynamics, underexploring how the generator’s internal representations shape transferable perturbations. To address this, we enforce semantic consistency by aligning the early generator’s intermediate features to an exponential moving average (EMA) teacher, stabilizing object-aligned representations and improving black-box transfer without inference-time overhead. To ground the mechanism, we quantify semantic stability as the standard deviation of foreground IoU between cluster-derived activation masks and foreground masks across generator blocks, and observe reduced semantic drift under our method. For more reliable evaluation, we also introduce Accidental Correction Rate (ACR) to separate inadvertent corrections from intended misclassifications, complementing the inherent blind spots in traditional Attack Success Rate (ASR), Fooling Rate (FR), and Accuracy metrics. Across architectures, domains, and tasks, our approach can be seamlessly integrated into existing generative attacks with consistent improvements in black-box transfer, while maintaining test-time efficiency.

Published as a conference paper at ICLR 2026
IMPROVING BLACK-BOX GENERATIVE ATTACKS VIA GENERATOR SEMANTIC CONSISTENCY
Jongoh Jeong', Hunmin Yang Jaeseok Jeong', and Kuk-Jin Yoon',
Visual Intelligence Lab., Korea Advanced Institute of Science and Technology (KAIST)
2 Ageney for Defense Development (ADD)
(jeong,, hmyang, jason. jeong, kjycon akaist.ac... + Project Page
ABSTRACT
Transfer attacks optimize surrogate and deploy black-box target. While iterative optimization attacks in this paradigm are limited by their per-input cost limits efficiency and scalability due multistep gradient updates for each input, generative attacks alleviate these by producing adversarial examples in a single forward pass at test time. However, current generative attacks still adhere to op- timizing surrogate losses (e.g., feature divergence) and overlook the generator's s internal dynamics, underexploring how the generator's internal representations shape transferable perturbations. To address this, we enforce semantic consistency by aligning the early generator's intermediate features to an exponential moving average (EMA) teacher, stabilizing object-aligned representations and improving black-box transfer without inference-time overhead. To ground the mechanism, we quantify semantic stability as the standard deviation of foreground IoU between cluster-derived activation masks and foreground masks across generator blocks, and observe reduced semantic drift under our method. For more reliable evaluation, we also introduce Accidental Correction Rate (ACR) to separate inadvertent correc- tions from intended miselassifications, complementing the inherent blind spots in traditional Attack Success Rate (ASR), Fooling Rate (FR), and Accuracy metrics. Across architectures. domains, and tasks, our approach can be seamlessly integrated into existing generative attacks with consistent improvements in black-box transfer, while maintaining test-time efficiency. Code at https://gitub..oo/andde 1/scga
INTRODUCTION
Deep neural networks have driven advances in computer vision, natural language processing, and medical diagnosis by learning rich hierarchical representations. At the same time, they remain vulner- able to small human- impprreippeeee perturbations known adversarial examples (AE) Szegedy et al. (2013), which can induce confident misclassification and raise safety concerns in real deployments. The risk is amplified in black-box settings, where an attacker has no access to the parameters or architecture of model. In these scenarios, transfer- based attacks craft perturbations on a surrogate and deploy them against unseen targets, enabling single perturbation strategy threaten diverse safety-critical systems such as self-driving and biometrics.
Early boite-box iterative attacks (for example, FGSM and its multistep variants Zhang al. (2021); Dong et al. (2018); Xie et al. (2019); Dong et al. (2019)) rely on direct gradient access. Transfer-based attacks extend this idea by seeking perturbations that generalize across models, often using iterative optimization in the white-box regime Madry et al. (2017); Carlini et al. (2019); Zhang et al. (2021). While effective, they require per-example iterative optimization, whereas generative attacks amortize this cost by producing perturbations in single forward pass.
Generative transfer attacks train a feedforward perturbation generator against a surrogate and then produce adversarial noise with one forward pass at the test time Xiao et al. (2018); Wang et al. (2018); Baluja & Fischer (2017; 2018); Poursaeed et al. (2018); Naseer et al. (2019); Nakka & Salzmann (2021); Zhang al. (2022); Aich et al. (2022); Yang et al. (2024a;b); Nakka & Alahi (2025). This design yields fast inference and strong scalability. However, current generative attacks centered around optimizing the surrogate-leva objectives and treat the generator merely

---

Published as a conference paper at ICLR 2026
tool to generate adversarial examples given the adversarial objective, overlooking the progressive AE synthesis process in which perturbations are incrementally formed block by block within the generator. This oversight leaves potential for improving transferability, as the intermediate blocks of the generator are where semantic structure, such as the contour of the object and the coarse shape, is preserved or degraded during synthesis Zhang et al. (2022). As result, perturbations may disperse onto object-irrelevan regions that are relatively less victim model -agnostic, weakening adversarial transferability. This critically raises the following questions:
Q1. At what stage of perturbation synthesis do semantic cues deteriorate? Q2. Which generator blocks most influence transferability?
To investigate the perturbation synthesis in detail, we partition the six intermediate blocks in the generator into three split blocks-early, mid, and late-and find that the early blocks better preserve object-aligned structure than later ones. We substantiate this claim with a diagnostic analysis of the stability of object-aligned perturbation semantics within the generator intermediate blocks As in Fig. 1, lower cross- block- variability, and thus higher consistency of object semantics, is associated with higher transferability of AEs.
Guided by this observation, we propose a semantically consistent generative attack (SCGA) that explicitly targets semantic consistency during perturbation synthesis within the generator. Concretely, we use a Mean Teacher pathway in which an Exponential Moving Average (EMA)-updated teacher provides temporally smoothed reference features, and self-feature consistency loss aligns the student's early generator block actívations with these references while keeping the adversarial objective on the surrogate features unchanged, as shown in Fig. 2. This guidance operates only during training without additional test-time cost, and integrates with existing generative attacks.
Finally, we broaden the evaluation beyond misclassification -bsedd metries (ASR, FR) and a correction- based metric (Accuracy) to include our proposed Accidental Correction Rate (ACR). For reliable evaluations, ACR complements these conventional metrics by identifying cases that are inherently likely to be overlooked, such as unintended corrections of initially wrong benign predictions. In comprehensive evaluation setting, we demonstrate that the internal dynamics within the generator play critical role in enhancing adversarial transferability between domains, models, and even tasks. We summarize our main contributions as follows:
Generator-internal evidence for perturbation semantics. To investigate perturbation semantics within the generator, we partition the generator into early/mid/llae blocks and quantify object- aligned semanties per block. Our analysis reveals that methods with lower variability in the foreground IoU across the intermediate blocks exhibit higher adversarial transfer. ($2.2)
Generator-level semantic consistency guidance. By enforcing training-only semantic consistency at the generator's early intermediates, we achieve improved adversarial transfer while keeping the adversarial objective on the surrogate unchanged. The guidance can be seamlessly integrated into existing generative attacks without altering the test pipeline at no additional inference cost, ($3)
Comprehensive evaluation with an added reliability measure. We conduct comprehensive transferability evaluation spanning classification (CLS) across architectures, domains, and dense prediction tasks (SS, OD). We also complement conventional Accuracy, ASR, and FR metrics by introducing a novel ACR metric to assess the attack reliability, measured by inadvertent corrections from intended misclassifications, ($4.2).
2
BACKGROUND AND MOTIVATION
2.1 PRELIMINARIES
Given a pre-trained victim model FF)-) evaluated on a test distribution Diea, the objective is to synthesize hupen-lmperceptible perturbations that transfer across models, domains, and tasks, using only a source domain Dace and its pre-trained models substitutes. Generative attack framework employs a generator Go(-) that maps a benign imput r to an unconstrained adversarial candidate andv followed by a projector P(-)) that enforces the foc budget, i..., || x lloe S Training of G.).) supervised in woite-box fashion by a surrogate model F*).) trained on De enabling gradient- based updates via backpropagation. The adyersarial loss leverages surrogate logits or intermediate
2

---

Published as a conference paper at ICLR 2026
features of F*)... e.g. at layer k. capture model-shared characteristics known to enhance black-box transferability Naseer et al. (2019); Nakka & Salzmann (2021); Zhang et al. (2022); Aich et al. (2022);
Yang et al. (2024a;b). Formally, Go(-) is optimized to generate AEs that maximize evaluation metrics against victim models (.) and/or relative to ground-truth labels y with:
Metric 2, Eadu; Iodu ((..)) with |Fade = S,
(See $4.2 for metric details.)
(I)
where 6 denotes the maximum perturbation budget that guarantees minimal change in z. Here, Metric refers to ASR, FR, Acc., and ACR for classification (CLS); mloU and mAP50 for semantic segmentation (SS) and object detection (OD), respectively.
2.2 PERTURBATION SEMANTICS IN GENER AETEATTOR-INNNNN DYNAMICS
Inprz
Fecture Cluster
Poreqrourd
Earty
Intrrmediste black
(Varishilit))
Method
Earty
Mid
Late
Baseline W/ Ours
A5 Geoornne Pob
Mbl
CDA
32,4828.16
28.16
2.59
2.98
36.17
30.30
2.80
2,06
Latt
GAMA
36.55 35.95
31.57
2.46
1.41
FACI-
36.48 34.35
31.76
2.19
1.17
CDA 1TP
BIA
GAMA
FACT.
POCT.
PDCL
35.31
53.59
31.00
2.08
0.71
(a)
(b)
(c)
Figure 1: Our observation on the semantic variability within the perturbation generator. (a) Generator intermediate feature maps for cach block partition, (b) predicted masks from intermediate feature clusters on ImageNet-S Gao al. (2022) from the baseline Zhang al. (2022), and (c) quantified variability in foreground IoU.
We observe that intermediate features progressively lose semantic recognizability across residual blocks. Figure shows that early maps preserve object contours, while mid and late maps blur them. Using k-means clustering to separate the foreground and background, attacks preserve the coarse shape earlier and more consistently in stages. To better quantify how much semantic information is retained throughout the intermediates, we define semantic variability as the cross-block standard deviation of foreground IoU between clustered activation masks and foreground masks along perturbation trajectories, where advanced attacks achieve lower variability, suggesting more stable overlap with foreground. These findings consistent with the well-established premise that the majority of noise being synthesized in the intermediate stage Zhang et al. (2022); Naseer et al. (2019); Nakka & Salzmann (2021); Zhang al. (2022); Aich et al. (2022); Yang al. (2024a;b). Based on this evidence, we apply a lightweight EMA teacher to early blocks, leaving inference unchanged, so that subsequent blocks concentrate perturbations on salient regions and black-box transfer improves. Further analysis is provided in Supp. $D.
also find that stronger
Crucially, these findings motivate our design to enforce semantic consistency in the intermediate stages of the generator, using an EMA teacher applied in the early blocks to curb semantic drift while leaving the inference path unchanged. By anchoring perturbations to early, semantically consistent features, the later blocks naturally concentrate the generated perturbations in salient object regions, thereby improving black-box transfer between models while preserving internal semantics.
SEMANTICALLY CONSISTENT GENERATIVE ATTACK
Our semantically consistent generative attack, as described in Alg. 1, augments standard generative adversarial attack with two key components: a Mean Teacher-based feature smoothing and self- feature consistency loss that enforces semantic preservation across the intermediate layers of the generator. We base our approach on the baseline work BIA Zhang et al. (2022) as all subsequent works GAMA Aich al. (2022), FACI. Yang et al. (2024a), PDCI. Yang al. (2024b) base their losses on its feature similarity- bbasdd adversarial loss, and thus it is adequate to serve as a solid bascline. See Supp. $C for the method distinction.
Role of Mean Teacher. The Mean Teacher (MT) framework Tarvainen & Valpola (2017); Deng et al. (2021); Li et al. (2022); Zhao et al. (2022); Cao et al. (2023); Döbler et al. (2023) has consistently demonstrated robustness in tasks characterized by significant domain shifts between
3

---

Published as a conference paper at ICLR 2026
Tokning Stage
Erauuriin Stage
G
Sarmggtt Model r())
Viettim Model
ACR
Congrabatsioe Evclustion
Intecmediate Maps
(b)
G
Leone (Sec. 3)
60
Teacher Ci
(0)
18
Tryls
Downsampling
Residual I Learning
Upeampling
w/ Our
Figure Overview our proposed SCGA framework. Given a benign input image, perturbation generator produces an adversarial output under the supervision of Mean Teacher (MI) structure. The student and teacher share the generator architecture, with the teacher updated via EMA. Semantic consistency is enforced by aligning their intermediate features, selectively applied to the early blocks to effectively preserve structural information from the benign input across the residual blacks. The adversarial example is then evaluated against victim models according the four evaluation metrics. This based design further promotes semantic alignment, combining consistency and integrity, thereby enhancing adversarial transferability across diverse victims.
training and testing. Its core mechanism of updating the teacher's 's parameters with EMA of the student's parameters provides form of temporal ensemble that naturally suppresses instance-specific noise. Intuitively, this EMA update smooths out high-frequency perturbation artifacts, enriching the semantic consistency and stability of the teacher's intermediate feature maps. As result, these smoothed features serve as a reliable reference for the student, helping preserve object contours and shapes throughout adversarial synthesis. To integrate MT, we maintain two generators: a student Ge(+) that is trained via gradient descent, and teacher Gø (-). We set these mean teacher features as a reference for our felfufeature consistency matching. We update 8', per training step t, as follows:
6, + n + (1 (1-1)
(2)
where 7) [0, 1] is smoothing coefficient hyperparameter.
Self-feature consistency. Object-salient intermediate representations have been shown to be critical for adversarial transfer in black-box settings Wu al. (2020); Byun al. (2022); Kim al. (2022); Zhang et al. (2022), and recent work has explored manipulating input or surrogate-level features to this end Huang et al. (2019); Li al. (2023); Nakka Alahi (2025). In our generative framework. however, naïve generator progressively loses semantic integrity in its intermediate layers (Fig. 1), scattering perturbations away from object-salient regions. preserve these crucial object cues, we introduce self-feature consistency mechanism grounded in the MT paradigm Grill et al. (2020); Caron et al. (2021): Lee et al. (2023). Concretely, we treat the EMA teacher as the source of temporally smoothed, semantically rich features. At each training iteration, extract early block activations from both the student and the teacher and enforce semantic consistency via a hinge- based feature consistency loss follows:
Leads
Leons.
Weuns.
where |++ := max(0,-) and t is the similarity threshold. This loss anchors the student's edges and shape prior to the smoothed semantics of the teacher, ensuring that subsequent perturbations focus object-centric regions. Weuss. L denotes the softmax output of a learnable parameter
4

---

Published as a conference paper at ICLR 2026
Algorithm 1: Pseudo-cnde of SCGA
Data: Training dataset Dare
Input:
Generator G-().. surrogate model trained source data (-). projector P(-), perturbation
budget
Output:
Optimized teacher perturbation generator Gor
Initialize generators: student Go(-) + random init., teacher Gor (-) - (. repeat
Randomly sample mini-batch æ; from De
Acquire student generalor intermediate features:
E <- gene (2x)
Acquire teacher generator intermediate features:
g + Ger (2x)
Generate unbounded adversarial examples from student generator intermediate features:
_ud + _ (gi)
Bound (project) a.th using P within the perturbation budget such that [|((2,)) - zz 11o S c to obtain x
Forward pass r; and a; through the surrogate model, FF at layer k. to acquire S phamien 1:
Compute loss using phemig f g. g..g: == Ludv + Auvas. Leons.
// Eq.5
10
Update student generator parameters via backpropagation
11
EMA update teacher weights with student weights: 0 +
11 Eq.
until (-(-) converges
for intermediate block-wise loss weighting. When combined with the adversarial objective, these semantically consistent perturbations that are highly transferable and tightly aligned with the core structure of the image. For fair comparisons with state-of-the-art methods, we adopt adversarial loss in the surrogate feature space as practiced in the baseline, c.g. BIA Zhang et al. (2022):
Lady (O (x), Fz
where cos(,) :) denotes cosine similarity.
Final loss objective. Putting the proposed and baseline losses together on the MT framework, we formulate the final loss objective with Acons. weight term for Leons. as follows:
C Ladv + Asons. Leons.-
(5)
EXPERIMENTS
We refer to Supp. $E.3 for training implementations and computational complexity. For evaluation (Supp. $-.1-2), we conduct cross-setting tests under two black-box protocols. In the cross-model setting, perturbations are crafted on surrogate models trained with the same data distribution (i.e., ImageNet- IK Russakovsky et al. (2015)) and then tested on unseen target model architectures. In the cross-domain/task settings, adversarial examples are to generalize across domain/task shifts without access to any target- dintrr-tittiittoonnn samples.
4.1 LIMITATIONS IN EXISTING EVALUATION PROTOCOL
Although developing an effective at- tack mechanism is crucial, it must be validated by fair and comprehen- sive evaluations. The current evalu- ation protocols adopted by previous works GAP Poursaeed et (2018), CDA Naseer et al. (2019), LTP Nakka Salzmann (2021), BIA Zhang et al. (2022), GAMA Aich et al. (2022), FACL Yang et al. (2024a), PDCL Yang et al. (2024b) exhibit three key limitations. (LI) Most studies report only pri- mary metric (either ASR, FR, or Acc.), offering only a one-dimensional view of attack robustness and neglecting other aspects such unintended corrections in predictions. (I.2) Data sets and sample
Table 1: Examples of real-world impacts on predictions with different evaluation metries and attack reliability concerns.
Real-wurld cxamploc
Sassariu a
GT Label
Renign pool.
Ads, pred.
Inpurtt
Captunel by
cat van
cativ bua
Camaat Correct
Eruck K
Bacomrect Ofter incomeet
FR only
pet Tapto
pa aag
albatcoos
Inconee: Connect
ACR, FR. Aet.
Rellable attack example:
Cress-Seting
GT Label
Benign poal.
Intended Albokk
Unrdiable Alback
ImageNei RIVC Airrrat
Ropeor
RapEdr
Rornet
RapECr
5

---

Published as a conference paper at ICLR 2026
sizes are often arbitrarily or limited to single scale, preventing a fair comparison between attacks and undermining statistical significance. (L3) Evaluations in previous work commonly target a narrow set of victim architectures (c.g., mostly CNN-based), lacking the diversity of modern model families, including vision transformers (ViT) and state-space models (SSM), and thus overstating robustness. Although conventional work frames the success of attacks as fooling the target classifier, we contend that evaluation facets should be expanded for a reliable assessment of attacks.
To address these shortcomings, we introduce, in $4.2 (LI), Accidental Correction Rate (ACR) as a complementary metric that captures the proportion of AEs that inadveriently restore correct predictions, enriching the evaluation of attack efficacy alongside conventional measures (i.e. ASR, FR. Acc.) as demonstrated with practical examples in Table 1. ACR measures nuanced model behavior often missed by ASR and FR, which crucial for a complete understanding of robustness in safety-critice
systems where any unreliable response to perturbation may pose risk. We also evaluate AEs on the entire validation set in $4.3 (1.2, L3),, instead of arbitrary subsets, and cover a wide range of victim models for the classification task. We provide further details in Supp. $E.
4.2 EVALUATION METRICS
We tested the effectiveness and transferability of adversarial attacks across model architectures and domain shifts using four key metrics. For notational convenience here, let fxx) denote the predicted label for input x, f(z + 5) the prediction after applying adversarial perturbation 8, and the ground- truth label. The evaluation set is indicated by D. with C {x E D | f(x) = y} representing correctly classified samples, and I = fz E D fxx) * y) denoting misclassified samples under clean inference. We formally define our evaluation metrics (%) as follows:
Acc.
1 E D f(z + w/l / (D). + f(x+
ASR | E C f(x) = AA f(x + 0 + yا CC),
FR- f E D ffx)
ACR = fr E I (())+uff()
- [Z]
(6)
where Top-1 Accuracy Zhang et al. (2022); Yang et al. (2024a;b) measures the overall proportion of correctly classified samples under clean or adversarial conditions. It serves as a global performance indicator to assess degraded performance after the attack, orthogonal to FR, ASR, and ACR. Attack Success Rate (ASR) Poursaeed et al. (2018); Naseer et al. (2019) is a subset of FR, which measures the proportion of samples originally correctly classified that are misclassified by adversarial attack. It directly reflects the targeted misclassification. Fooling Rate (FR) Nakka & Salzmann (2021); Nakka & Alahi (2025) quantifies the proportion of adversarial examples that cause change in the model's 's prediction, regardless of correctness. It reflects how often the attack disrupts the original decision and is used as a transferability measure. ACR, also a subset of FR, is novel metric that quantifies how often misclassified samples are "accidentally" corrected by adversarial perturbations. This unintended side effect provides insight into the nuanced model uncertainty and behavior at the decision boundarics. For SS and OD, we use the standard mIoU and mAP50 metrics, respectively.
4.3 EXPERIMENTAL RESULTS
We demonstrate enhanced cross-model attacks in Table 2, wherein augmenting each baseline genera- tive attack with our method yields consistent improvements across various architectures. Although these results confirm the orthogonality and efficacy of our framework, we observe that CLIP-based approaches with objectives similar to ours, e.g. PDCL Yang et al. (2024b), yield only marginal improvements when combined with our method. We conjecture that optimizing for divergence in CLIP's high-dimensional semantic embedding space may override or dilute the local structural consistency enforced by our early block semantic consistency, thus attenuating incremental gains from preserving fine-graine grained object contours and textures (see Supp $D for detailed explanation).
Table 3 presents the black-box cross-domain transferability results. In both cross-domain and task, the transfcrability enhancements become more pronounced. Incorporating MT smoothing and early block consistency steadily enhances the attack performance across unseen domains, architectures, and tasks, demonstrating the broad applicability beyond the source data distribution and task.
With measurable gains in attack accuracy. we visually verify whether method actually induces the generator to pay more attention to the object-salient regions in Fig. 3. Through Grad-CAR Selvaraju et al. (2017) comparisons against the baseline, ours either reinforces confusion or flips the correctly

---

Published as a conference paper at ICLR 2026
Table 2: Quantitative cross-model transferability results. We report the improvements (A &p) of our method relative to each baseline, with better results marked a darker color. 'Avg.' corresponds black- box average.
C2055-mo6e1
CNN
Trunsformer
Mixer
Mamba
Avg.
Mithod
Metric
64)
69
64)
(1
(5)
(1)
(
(6)
(1
(H))
(5)
(o)
(0)
(9)
30
(8)
09
(v)
Betign
Acc. (1014
74.00
77.33
74.23
75.74
76.19
77.95
66.50
55.91
79.12
$1,49
75.42
80.67
79.28
81.19
50,48
19.10
57.91
09.90
66.53
06.53
73.21
13.77
Acc. (1lip):
11.93
-8.99
.1295
-1270
-.41
-1..1
5500
6646
-1017
-5.91
-19.44
4..2
2014
+0.72
40.01
40.6
+0.00
40.5
+0.75
40.06
40.20
4.89
ASR (18p))
41033
+1652-1596
442.13
424.3
4005
4.23
-1.04
w/ Ones
(oNip)
+17.39
+14.24
-1380
+8.56
+1191
+11,49
+21.57
+0.9
-0.30
ACR (18pp)
-3.58
-1.72
-2.59
-2.19
-2.52
-7.04
.4.57
-0.24
2031
-0.38
40.05
-012
40.20
40.00
20.11
-0.29 -1.57
Acc. (
8.71
9.52
8,45
10.24
4.62
10.00
5.59
9.00
9.57
5.57
5.93
1.23
1.27
7.87
1.74
3.57
5.85
5,87
9,05
3.13
5,95
46.34
CTP
ASR (otipt
+11.11-11
+11.92
+10.87
-12.92
+5.50
+12.27
-8.04
+5.88
+11.
+5.55
+7.50
+1
06
+2.57
+8.63
+2.38
+6.71
+9
+8.22
-1305
+1.64
+7.97 -8.47
Ouss
FR (-S5p)
+9.53
+10.58
+9.35
-11.
30
+5.32
+10
70
-6.
12.25
411.
665
+5.15
+6.
54
+2.
+2.60
+8.71
+0.70
10
+8.95
47.63
-11
100
+1
87
47.27
-7.65
(.Sp):
-1.65
-1,48
-0.53
-0.76
-0.77
+0.52
(0.91
0..5
-0.44
-1.04
.0.53
.0.70
Acc. (:lig)
-2.23
40.56
-0:45
-0.58
BIA
ASR (19ip)
+2.8%
+2:46
+0.56
+1.31
+0.02
+0.89
+1.01
+2.05
+0.58
+0.03
-1.47
PR (:S0))
+2.57
+2.28
+1.48
0..0
+4.20
+1.73
-3.78
+3.69
+0.55
3.10
+0.69
+1.01
+0.54
+1.00
+0.57
+1.41
+1.02
+1.82
+0.31
+0.35
+0.01
-1.28
ACR (+Rp))
-0:45
-0.36
-0.78
-0.00
1.00
40.27
-0.53
-0.35
40.24
+0.35
-0.37
40.53
-0.27
-0.29
-0.45
-0.30
40.06
-0.12
+0.40
.0.03
40.10 -0.21
Acc. (1
2.54
2.46
2.65
2.15
2.49
2.19
0.24
0.17
0.97
2.49
2.94
+0.07
+0.03
0.24
0.00
0.15
0.51
+0.07
0.48
0.59
0.41 -1.12
ASR (stppt
+5.22
+3.40
+3.14
-0.54
+1.22
+3.67
0.00
0.05
13
0.17
+0.35
+0.75
+0.52-1.41
wr Whss FR cosip):
+2.81
+2.87
+2.91
+2.56
+2.53
+1.20
+0.20
-0.73
+0.73
+0.59
ACR (:Pp) -0.58
-0.14
-0.51
-0.43
-0.02
-0.56
40:31
20.11
.0.53
.0.27
40.00
-0.16
+0.30
.0.29
.0.14
Acc. (:8ig) +0.10
0.59
-3.55
-1.97
-.50
0.50
33.99
-0.69
2.01
-191
2.64
+0.1
0.33
+0.21
0051
+0.55
0.18
0.50
+0.45
0..90
.0.17 -1.07
FACE ASR 1:
-0.20
+0.74
+4.30
30
+2.46
+6.15
+0.75
-4.58
+1.25
+2.40
+2.25
+5.15
40.
10
+0.41
-0.34
-0.53
-0.69
-0.
+0.66
-0.73
-0.
34
+0.15
OuEs (USEp)
0.20
+0.64
+3.75
12.27
+5.37
+0.74
+3.97
+0.95
12.24
+2.05
12.75
0.52
+0.47
0.19
+0.47
0.67
+0.08
+0.72
0.64
+0.25
+0.14
+1,20
ACR (-99p)
-0.33
-0.09
-0.61
-0,46
-0.97
40.88
-0.54
0.00
-0.52
-0.41
-0.96
+0
-0.02
+0.05
40.65
+0.00
40.23
-0.09
40.00
40.24
-0.2 40.25
Acc. (1Rig)
+0.55
-0.31
-1.09
+0.79
00.07
00.11
H0.18
-0.34
+0.52
+0.00
+0.37
.000
POCL ASR (16pp) 0.73
+0.31
1.26
+0.56
+0.46
+1.19
+1.64
+0.07
+1.30
0.96
+0.08
0.14
+0.04
0.19
+0.05
0.12
0.64
0.06
0.43
PR (:Shp) .0.88
+0.27
11008
+0.36
+0.45
+1.09
-1,42
+0.13
+1.23
+0.81
0.88
+0.22
0.10
+0.09
0.00
+0.09
0.22
0..4
+0.05
0..33
0.10
-0.11
ACR (-Rp)) +0.03
-0.18
40.29
+0.09
40.18
-0.22
40.12
-0.05
-0.33
-0.22
40.21
40.06
2023
-0.42
-0.08
-0.47
.0.4
40.22
+0.15
40.27
40.15 -008
Table 3: Quantitative cross-domain/task transferability results. We report the average improvement (A %6) with ours added from each baseline for each domain. Better results in green boldface.
domein
Cross task
CUB-200-2011
Stanford Cars
FGVC Aireraft
Aug Acc.
SemsSeg (SS)
Objive (OD)
Method / Metric Acc ASR
[R ACK
| Arc L LAR
IRT T ACR J Are L ASR
PRT
ACRT
DeepLabV Segi Segloerrrreee mlo Tuper R CNNDDTR MAP50
Benign
76.21
71.50
74.05
62.36
CDA
65.23
21.48 14.16
26.66
77.68
21.88
15.8
24.07
66.2
27.51
14.55
31.13
00.91
23.63
20.16
22.00
32.78
26.29
29.54
w/ (APpp)
16692-2144-200
-3.94
-5.66
+2.38
+2.35
-0.34
-22.5
22,58-22777
-6.00
-18.12
-0.47
+0,10
40.18
-0.80
-6.61
-0.71
LTP
45.74
45.32 8.75
49.31
$7.98
39.02
13.03
40.85
45.01
54.15
8.35
56.45
40.91
23.71
26.97
25.34
29.39
22.41
25.90
W/ (235p)
10.43+11.722
10:37
4,59
10062
-2.16
.6.41
96.66
+6.35
-1.41
-9.15
-1.44
-0.29
-0.56
-2.54
-0.25
-1.39
DIX
67.92
46.13
8.54
50.26
39.89
37.22
13.56
38597
45.38
31.31
9:24
54.06
51.07
23.89
25.00
24.75
25.43
21.01
24.72
w/ ((3ippt
-0.92
+0.06
+0.09
+0.49
-6.59
+6.80
+6.70
-2.00
-4.98
+5.25
+4.89
-1.24
-3.96
-1.84
.0.85
-1.35
-0.09
-8.29
-4.20
GAMA
68.72
45.41
9.51
49.67
$4.59
42.58
11.94
40.28
42.37
54,46
1.69
56.77
43.56
23.67
25.95
24.31
28.01
20.71
24.36
wi (0as
-2.41
+2.59
+2.30
.0.67
-2.33
+2.24
+2.10
40.00
-2.65
43.06
+2.87
+0.14
-2.47
-0.43
-1.58
-1.01
-0.41
40.05
...16
FACE
54.36
5801
49.71
40.08
50
61.50
44.05
23.75
26.40
25.08
27.04
30:91
w/ Ours (SSipp)
+3.12
-3.99
-3.58
+0.70
-7.36
+2.34
+4.72
-1.89
-2.68
+0.60
+0.66
-0.24
-2:27
-0.37
-1.39
4.85
40.30
4.62
4..6
PICL
7,48
55.95
50.41
12.31
48.46
38.96
58.23
24.42
26.05
25.24
w/ Oare (136p))
+1.61
40.66
+0.40
-0.71
40.75
+0.69
-0.32
-1.38
+1.52
41.42
+0.14
-1.85
-1.91
4.17
-3.04
.0.65
.0.73
attending regions (similar to those of benign). Across unseen tasks, we also observe fewer pixels and instances with the correct classifications. We attribute this cross-task generalization to our label- agnostic training pipeline and further validate that our method can be integrated with alternative generator architectures beyond ResNet in Supp. $B.
Against robust training (i.e. adversarially trained V3 Kurakin et al. (2018), ViT Dosovitskiy et al. (2021), ConvNeXt Singh et al. (2023), and input pre-processing JPEG Guo et al. (2017) BDR Xu et al. (2018), R&P Xie al. (2018)) techniques, our methods demonstrate superior attacks compared to the baseline as shown in Ta- ble 4, reinforcing our hypothesis that enforcing semantic consistency in early generator blocks not only boosts transferability in standard black- box settings but also produces perturbations ca- pable of further enhancing attacks against defense mechanisms. By anchoring structural cues in the early stages, our self-feature consistency loss yields more potent and robust attacks against adversarially trained models and input pre- proppesessing defenses alike.
Table 4: Superior attack success with our method against robustly trained models including Adversari- ally trained (AT) models and robust input pre- procprocg methods. Better averaged results in green boldface.
Method
Metric Adv.ncV3AAdcviT Adv JPEC BDR R&P Arg.
Acc.
70:35
48:32
35.44
76.05 TEA6 70 70.5800.70 76
Arc: (55
45.64
33.68
44
Baseline
Zhang al. (DEE
FR
24.02
25.45
19.40
28.09
51.06-51.00222
ACR (17
13.30
4.56
11.3010.36 9.51
Arc: (511
63.32
4533
35.02
6081 64177
9001
ASR (54)
15:35
11.95
1885
45.37
JCR (963)
1523
4.57
3.38
11.48
10.29 9.06 S001"
7

---

Published as a conference paper at ICLR 2026
2012
100 Ad
Canearsia
Bovizn
14
24
kd
10
ATP
Figure 3: Qualitative results. Our semantically consistent generative attack successfully guides the generator to focus perturbations particularly on the semantically salient regions, effectively fooling the victim classifier. D: (a) benign input image, (b) generated perturbation (normalized for visual purposes only), (c) unbounded adversarial image, and (d) bounded adversarial image across CUB-200-2011 I Wah et al. (201 1), Stanford Cars Krause et al. (2013), FGVC Aircraft Maji et al. (2013), and ImageNet-1K I Russakovsky et al. (2015). The label on top (green) and bottom (orange) denotes the correct label and prediction after the attack, respectively. @:: We highlight that our method induces Grad-CAM Selvaraju et al. (2017) to focus on drastically different regions our adversarial examples compared to both the benign image and the adversarial examples crafted by the baseline Zhang et al. (2022). Moreover, our approach noticeably spreads and reduces the high activation regions observed in the benign and baseline cases, enhancing the transferability of our adversarial perturbations. ②: Cross-task prediction results (SS on top, OD on bottom). Our approach further disrupts the victim models by triggering higher false positive rates and wrong class label predictions. See Supp. $F.4 for additional visualizations.
Interplay with the baselines. The pattern of gains across baselines in Table is largely determined by the level at which each method probes the surrogate (logits, frequency domain, or intermediate features). By enforcing early-block semantic anchoring, our generator produces locally structured, object-aware perturbations. These perturbations move energy away from degenerate frequerryyncy noise and toward low- and mid-frequency components that align with objects and boundaries. This structural regularization couples most strongly with CNN-centric objectives. When combined with CDA, whose relativistic loss is defined directly on CNN logits, and with frequency- or CNN- --N--or based baselines such as FACL and PDCL., our semantics-enhanced perturbations yield the largest improvements on CNN victims. ViT victims, whose global attention patterns and feature geometry differ more from the CNN surrogate, tend show smaller more localized changes.
In contrast, mid-layer feature-based at- tacks such as LTP, BIA, and GAMA rely on intermediate surrogate features that transfer more readily across archi- tectures. These methods benefit more uniformly. Our generator-side semanties act as a complementary regularizer that sharpens feature-space separability on both CNN and ViT targets, with broadly positive or neutral effects. On image classification, the additional gains when combining with PDCL are modest. This behavior is consistent with satura- tion regime in which the strong CLIP- space objective already induces power- ful global semantic shifts and dominates the joint gradient. Even in this setting, our anchor still rebalances the perturbation spectrum. For docalization-oriemee downstream tasks such as detection and segmentation, the same local structural consistency produces noticeably larger cross-tast improvements. This behavior suggests that Ours refines the global
Table 5: Ablation study on the targeted generator interme- diate block and the proposed components. Our self-feature consisteney strategy on the carly intermediate block outperforms matching other block features (a), and the generator trained with all of our components together performs best (b).
Endv
Cross
Bloch
Farly
Late
AlI
Task Metrie
Acc. (S)
45.1345.7644.79
44.13
48, 23
45
11
46.49
45.17
Model
CLS ASR (%)
33.37
42.55
FR (S) 1
50.66 48.71
48.75
50.66
44.08
49
46.99
49.38
ACR (8)
8.32
3,59
8.66 8.60
8.32 8.71 8.43
8.68
8.53
Task Dousin
Acc. (5k)
47.10
53.3511133
47.10 46.544446555111
CLS ASR (5)
49.02
44.91
47.02
49.02 47.60
46.35544.17777
44.99
(So 1
51.66
49.75 47,50
51.66 50.30
40. 47.76
ACR (%)
9.66
10.57 10.36
9.66 9.99
10.73 10.58
$8
mioo. +
23.40 24. 22.82 23,92
23,40 23,96 24.83 23.73 24.75
OD
MAP50 1
24.5224.53 24.69 24.52
24.52 24.75 24.55 24.41 24.72
semantic direction rather than competing with it.
Ablation studies. We conducted ablation studies on the intermediate block and our proposed components in Table 5. Across all cross-settings, we observe the highest gains with self felture
8

---

Published as a conference paper at ICLR 2026
consistency applied to the earty block compared to those other and all locations. insinuating the early block matching triggers generator features to place stricter constraint such that perturbations are progressively focused on around the object.
We also observe performance gains with each component: Ladv, MT, and Leom.., wherein our consis- tency of self-features the intermediate features of the generator serves widen the transferability gap even further. We attribute this improvement to explicit semantic alignment in the early blocks which complements the effect of implicit smoothing with MT. We also compare against the plain student-copy teacher, as indicated by plain teacher (PT), with and without Loons, which under- performs our MT configuration. These results validate our hypothesis that anchoring perturbation synthesis on the early intermediate blocks consistently preserves the object semantics the most, and thus guides later blocks to concentrate noise on object-centric regions, maximizing transferability.
4.4 GENERATOR INTERMEDIATE BLOCK-LEVEL, ANALYSIS
tope
16:12
&
Baseline
Figure 4: Visualization of generator intermediate block-level differences with the baseline Zhang et al. (2022): raw feature differences on bottom, and thresholded on top (normalized for illustration purposes only). With our cenerator-interus semantic consistency mechanism, progressively guide adversarial perturbation to focus on the salient object regions initially and gradually disperse to surrounding background regions. See Supp. S10.S10 for other baseline comparisons.
Feature difference. Following Zhang et al. (2022); Yang et al. (2024a) but generalizing the procedure all generator layers as follows, for each layer I:
Diff B Bbaseline p.pooledd
ppooted
1,
Bouts gbaseline > Tairs,
L-pooted pooled
with 8()
-pooled
Σ Go (x)
0,
else,
visualized generator block-wiss feature difference maps between each baseline with and without our method. At each block, we computed the difference by applying cross-channel average pooling to the activation tensor and then thresholding the resulting map to qualitatively emphasize the added perturbations. As shown in Fig. 4, the thresholded mask (row 1) and the raw feature difference map (row 2) jointly illustrate that, specifically within the targeted resbl bokk layers in our design, the adversarial signal concentrates on object-salient regions extracted by the preceding downsam- pling stages. Gradually into the later blocks, the generator learns craft perturbation not only on object-salient regions but also regions closer to the background, generating more transferable noise. Compared to each baseline alone, our approach more strongly induces perturbations to better align with the semantic characteristics primarily in the intermediate residual blocks.
Table 6: Spectral energy by band (Baseline >w/ Ours).
Spectral energy comparisons. To validate the carly-block semantic anchoring hypothesis, we conducted a frequency-domat energy analysis of intermediate feature activations in Table 6, ex- ploiting the link between spectral content and vi- sual structure: low-frequency (LF) components encode coarse shapes and layouts, whereas high frequencies (HF) capture fine texture. By tracking the normalized low-band energy in every block before and after our method, we obtained quan- titative measure of how strongly each block pre- serves the coarse structure. Anchoring on the early blocks, rather than mid or late, consistently raises freeuuncyuny energy and suppresses superfluous noise downstream, confirming that method targeting semantic consistency in the early intermediates more effectively propagates the same semantic scaffold through later blocks, yielding higher adversarial transferability.
Band
Early
Mid
Late
CDA
Low (1)
0.82-30.11
0.75 0.75-000 -0.97
0.77-00.9
Ours
High
0.18->0.09
0.25
0.23-
LTP
Low (t)
0.73-v0.72
0.78
-0.79
0.95-
- w// Ours
High (1)
0,27-+0.28
0.22
0.22-0:21
0.05--0.25
BIA
Low (t)
0,56-+0.56
0,53
0.53--0.58
w/ Ours
High (4)
0.44-30.44
0.47
0.47-30.42
GAMA
Low (f)
0,57-
0.54-0.60
0.36-00.59
Ours
High
0.43->0.21
0.46-00.0
0.44--0.41
FACL
Low (t)
0.57-10.73
0.54
ww// Ours
High (1)
0.43-x0.27
0.48
0.46-0..5
PDCL
Low (f)
0.54->0.62
0.51 -0.59
0.58
-/ Ours
High (4)
0.46-10.38
0.49-90.41
0.42

---

Published as a conference paper at ICLR 2026
The pattern reveals how anchoring affects generator's frequency bias. For band wise relatively balanced models such as GAMA, the early-block anchor sharply increases low- lowffrquuncc energy (0.57 - 0.79 1), giving later blocks a clearer structural blueprint. When a baseline already over- emphasizes low frequencies, as in LTP whose late-block LF reaches 0.95, our method lowers that value 0.75 4, restoring HF detail. This spectral analysis thus reveals that anchoring on the early intermediate features results in perturbations that remain coarse semantic structures aligned and intact within the generator, thereby enhancing transfer effectively across unseen domains and architectures.
Hyperparameter sensitivity. We vary the EMA coefficient (1) and the consistency weight Acons. and report the cross-setting transfer performance in Table 7. We observe trade-off between optimiz- ing classification and cross-task scores for both hyperparameters, as no single combination uniformly outperforms the rest. However, maintaining relatively high values for both tends to yield better perfor- mance, indicating that each module sufficiently contributes to the overall self-consistency mechanism. Based on this observation, we select Acons. = 0.7 and v 0.999 as our default configuration, which provides the best overall balance across all cross-setting scenarios.
We define the "carly", "mid", and "late" stages of the generator intermediates by grouping two consecutive residual blocks based on the observation that perturbations undergo the most noticeable qualitative changes over every two blocks. As illustrated in Fig. 2. the first two blocks (rows (a)-(b) still closely track the benign image: coarse object shape, grregrondd-bacgren large-scale texture are clearly preserved. The next two blocks (rows (c) begin introduce more pronounced distortions and fine-grained variations, while the final two blocks (rows (e)-(f) predominantly add high-frequency details and noise-like patterns that as object-level structure. This makes the first two blocks a natural choice for enforcing semantic consistency: they are structurally well-formed and dominantly encode benign scene semantics, before most of the perturbation mass emerges in later stages.
separation, and
longer easily interpretable
Applying the temporal self-consistency loss only to block 1 or only to block 2 yields some benefits, but using both early blocks jointly provides a better balance across domains, models, and tasks. This pattern aligns with our intuition: anchor- ing both early blocks preserves coarse se- mantics at the onset of perturbation gen- eration, which in turn biases later blocks to place perturbations along near-object re-
Table Hyperparameter (Aoess 7) sensitivity and early- block selection. (Domain (Acc.), Model (Acc.), SS (mloU), OD (mAP50)).
Accns
0.1
0.3
0.5
0.7
0.9
Domain
49.55
48.29
48.49
47.10
50.08
Model
44,84
44.80
44.68
44.13
45.89
Task (SS)
22.59
23.63
23.82
23.40
22.79
Task (OD)
23.96
24.36
24.78
24.52
24.19
0.9
0.95
0.98
0.99
0.998
0,999
Model
23.02
24.34
gions rather than injecting unconstrained noise, As a consequence, the resulting per- turbations align more closely with shared, object-level structure across architectures and datasets, thereby enhancing model- and data-agnostic black-box transfer. See Supp.$E for ablations of other components.
24.51
Block
1
2
1 2
Domain Model
49.13
49.8% 39.88
47.10
47.62
48.88
44.13
Task (SS)
23.78
22.57
23.40
Task (OD)
24.47
24.15
24.52
(8) Cross-Doman Domain
(b) Cross: Cross-Model
Crose Model
CDA
CONCLUSION
LPP
BiA
635
GANAN
In this paper, we introduce a semantically con- sistent generative attack leveraging the Mean
FAGL
ACR (56)
POCL
Teacher and carly-block semantic consistency to
preserve the object semantics during perturba- tion generation, thus guiding it towards object- salient regions to markedly improve black-box transferability in Fig. 5. With comprehensive evaluations across various models, domains, and tasks, we demonstrate object salient regions play a crucial role within the generator. See Supp. $E.6 for limitations and broader societal impact.
GAMA
Ficl
P3C.
ASR (%)
ASR (%)
Figure 5: Our semantically consistent generative attack effectively exploits the generator intermediates to craft adversarial examples to enhance transferability from the baselines
T) across domains (a) and models (b).
10

---

Published as a conference paper at ICLR 2026
ACKNOWLEDGMENTS
This work was supported by the Technology Innovation Program (2410013617,200244)) Devel- opment of autonomous driving connectivity technology based on cansor-ifrrastruttrr cooperation) funded By the Ministry of Trade, Industry & Energy (MOTIE, Korea) and the Institute of Information communications Technology Planning & Evaluation (IIPP) grant funded by the Korea government (MSIT) (No. RS-2024-00457788, Al Research Hub Project).
REFERENCES
Abhishek Aich, Calvin-Khang Ta, Akash Gupta, Chengyu Song, Srikanth Krishnamurthyy Salman Asif, and Amit Noy-Chowdhury. Gama: Generative adversarial multi-object attacks. Ad- vances in Neural Information Processing Systems, 35:36914-36999 14-36930, 2022. 1, 3,5
Shumeet Baluja and lan Fischer. Adversarial transformation networks: Learning to generate adversar- ial examples. arXiv preprint arXiv:1703.093877 2017.
Shumeet Baluja and Ian Fischer. Learning to attack: Adversarial transformation networks. In Proceedings of the AAAI Conference Artificial Intelligence, volume 32, 2018. 1
Junyoung Byun, Seungju Cho, Myung-Joon Kwon, Hee-Seon Kim, and Changick Kim. Improving the transferability targeted adversarial examples through object-based diverse input. Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 15244-15253, 2022.
Shengcao Cao, Dhiraj Joshi, Liang-Yo Yan Gui, and Yu-Xiong Wang. Contrastive mean teacher for domain adaptive object detectors. Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pp. 23839-23848, 2023.
Nicholas Carlini, Anish Athalye, Nicolas Papernot, Wieland Brendel, Jonas Rauber, Dimitris Tsipras, Ian Goodfellow, Aleksander Madry, and Alexey Kurakin. On evaluating adversarial robustness. arXiv preprint arXiv:1902.0670000 2019.
Mathilde Caron, Hugo Touvron, Ishan Misra, Hervé Jégou, Julien Mairal, Piotr Bojanowski, and Armand Joulin. Emerging properties in self-supervised vision transformers. In Proceedings the IEEE/CVF international conference on computer vision, pp. (650-9660 2021. 4
Jinhong Deng, Wen Li, Yuhua Chen, and Lixin Duan. Unbiased mean teacher for cross- doms-domain object detection. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pp. 4091-4101 2021. 3
Mario Döbler, Robert A Marsden, and Bin Yang. Robust mean teacher for continual and gradual test-time adaptation. In Proceedings of the IEEE/CVE Conference on Computer Vision and Pattern Recognition, pp. 7704-7714, 2023. 3
Yinpeng Dong, Fangzhou Liao, Tianyu Pang, Hang Su, Jun Zhu, Xiaolin Hu, and Jianguo Li. Boosting adversarial attacks with momentum. Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 1198-199,,,111 2018.
Yinpeng Dong, Tianyu Pang. Hang Su, and Jun Zhu. Evading defenses to transferable adversarial ex- amples by translation-invariant attacks. In Proceedings of the IEEE/CVF Conference Computer Vision and Pattern Recognition, pp. 4312-4321, 2019.
Alexey Dosovitskiy, Lucas Beyer, Alexander Kolesnikov, Dirk Weissenborn, Xiaohua Zhai, Thomas Unterthiner, Mostafa Dehghani, Matthias Minderer, Georg Heigold, Sylvain Gelly, Jakob Uszkoreit, and Neil Houlsby. An image is worth 16x16 words: Transformers for image recognition scale. ICLR, 2021. 7
Shanghua Gao, Zhong- Yu Li, Ming-Hsuan Yang, Ming-Ming Cheng, Junwei Han, and Philip Torr. Large-scale unsupervised semantic segmentation. 2022. 3

---

Published as a conference paper at ICLR 2026
Jean-Bastiens Grill, Florian Strub, Florent Altché, Corentin Tallec, Pierre Richemond, Elena Buchatskaya, Carl Doersch, Bernardo Avila Pires, Zhaohan Guo, Mohammad Gheshlaghi Azar, et al. Bootstrap your own latent-a approach to self-supervised learning. Advances in neural information processing systems, 33:21271-21284 2020. 4
Chuan Guo, Mayank Rana, Moustapha Cisse, and Laurens Van Der Maaten. Countering adversarial images using input transformations. arXiv preprini arXiv:1711.0011 17, 2017.
Qian Huang, Isay Katsman, Horace He, Zeqi Gu, Serge Belongie, and Ser-Nam Lim. Enhancing adversarial example transferability with an intermediate level attack. In Proceedings of the IEEE/CVF international conference on computer vision, pp. 4733-4742, 2019. 4
Woo Jae Kim, Seunghoon Hong, and Sung-Fui Yoon. Diverse generative perturbations attention space for transferable adversarial attacks. In 2022 IEEE international conference on image processing (ICIP), pp. 281-285. IEEE, 2022. 4
Jonathan Krause, Michael Stark, Jía Deng, and Li Fei-Fei. 3d object representations for fine-grained categorization. In 2013 IEEE International Conference on Computer Vision Workshops, pp. 554-561, 2013. doi: 10. 109/CCC/W.201.77.
Alexey Kurakin, Ian J Goodfellow, and Samy Bengio. Adversarial examples in the physical world. In Artificial intelligence safety and security, pp. 99-112. Chapman and Hal//CRC, 2018. 7
Youngwan Lee, Jeffrey Ryan Willette, Jonghee Kim, Juho Lee, and Sung Ju Hwang, Exploring the role of mean teachers in self-supervised masked auto-encoders. The Eleventh International Conference on Learning Representations, 2023. URL https:/ /wwp///eweee.eeeeeeeee hwwp:/.eetoorooee formm Fid=7sn6Vxxp222
Qizhang Li, Yiwen Guo, Wangmeng Zuo, and Hao Chen. Improving adversarial transferability via intermeciiae--evel perturbation decay. Advances in Neural Information Processing Systems, 36: 32900-3299 2023. 4
Yu-Jhe Li, Xiaoliang Dai, Chih- Yao Ma. Yen-Cheng Liu, Kan Chen, Bichen Wu, Zijian He, Kris Kitani, and Peter Vajda. Cross-domain adaptive teacher for object detection. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pp. 7581-7590, 2022. 3
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. arXiv preprint arXiv: 1706006083 2017.
Subhransu Maji, Esa Rahtu, Juho Kannala, Matthew B. Blaschko, and Andrea Vedaldi. Fine- grnener visual classification of aircraft. ArXiv, abs/1306.5151, 2013. URL https: / //pii.p... semantic wwtr/orrrsooooooooeeooooo Corpus ID: 2118703.
scholarz org/
Krishna Nakka and Mathieu Salzmann. Learning transferable adversarial perturbations. In Beygelz- imer, Y. Dauphin, P. Liang, and J. Wortman Vaughan (eds.), Advances in Neural Information Processing Systems, 2021. URL htttps://openrviieee net http://orrriiddsdiiisss 1,6,5,
Krishna Kanth Nakka and Alexandre Alahi. Nat: Learning to attack neurons for enhanced adversarial transferability, In 2025 IEEE/CVF Winter Conference on Applications of Computer Vision (WACV), pp. 7593-7604 IEEE, 2025. 1, 4,
Muhammad Muzammal Nascer, Salman H Khan, Muhammad Haris Khan, Fahad Shahbaz Khan, and Fatih Porikli. Cross-domain transfcrability of adversarial perturbations. Advances in Neural Information Processing Systems, 32, 2019. 1, 3,
Omid Poursaced, Isay Katsman, Bicheng Gao, and Serge Belongie. Generative adversarial pertur- bations. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 4422 4431, 2018. 5,
Olga Russakovsky, Jia Deng, Hao Su, Jonathan Krause, Sanjeev Satheesh, Sean Ma, Zhiheng Huang, Andrej Karpathy, Aditya Khosla, Michael S. Bernstein, Alexander C, Berg, and Fei-Fei Li. Imagenet large scale visual recognition challenge. I/C,, 2015. 5,
12

---

Published as a conference paper at ICLR 2026
Ramprasaath R Selvaraju, Michael Cogswell, Abhishek Das, Ramakrishna Vedantam, Devi Parikh, and Dhruv Batra. Grad-cam: Visual explanations from deep networks via gradient- localiza- tion. In Proceedings of the IEEE international conference computer vision, pp. 618-626, 2017. 6,
Naman D Singh, Francesco Croce, and Matthias Hein. Revisiting adversarial training for imagenet: Architectures, training and generalization across threat models. In NeurIPS, 2023.
Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. Intriguing properties of neural networks. arXiv preprint arXiv:1312.6199, 2013.
Antti Tarvainen and Harri Valpola. Mean teachers are better role models: Weight-averaged consistency targets improve semi-supervised deep learning results. Advances in neural information processing systems, 30, 2017. 3
C. Wah, S. Branson, P. Welinder, P. Perona, and S. Belongie. The Caltech-UCSD 200-201 Dataset. Technical report, California Institute of Technology. 2011.
Chaoyue Wang, Chang Xu, Chaohui Wang, and Dacheng Tao. Perceptual adversarial networks for image-to-image transformation. IEEE Transactions Image Processing, 27(8):4066-4079) 2018.
Weibin Wu, Yuxin Su, Xixian Chen, Shenglin Zhao, Irwin King, Michael Lyu, and Yu-Wing Tai.
Boosting the transferability of adversarial samples via attention. In Proceedings of the IEFF/CVF Conference on Computer Vision and Pattern Recognition, pp. 1161-1170, 2020. 4
Chaowei Xiao, Bo Li, Jun-Yan Zhu, Warren He, Mingyan Liu, and Dawn Song. Generating adversarial examples with adversarial networks. arXiv preprint arXiv: 008.00000111 2018.
Cihang Xie, Jianyu Wang, Zhishuai Zhang, Zhou Ren, and Alan Yuille. Mitigating adversarial effects through randomization. In International Conference Learning Representations, 2018. URL
/tttp:://pperreee
net/ fort/foouuue forum? wow.miiddSkkyuuueeeoo.o
Cihang Xie, Zhishuai Zhang, Yuyin Zhou, Song Bai, Jianyu Wang, Zhou Ren, and Alan L Yuille.
Improving transferability of adversarial examples with input diversity. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pp. 2730-2736 2019, 1
Weilin Xu, David Evans, and Yanjun Qi. Feature squeezing: Detecting adversarial examples in deep neural networks. NDSS, 2018. doi: 10. 20.14722/dss..218..o 2.3295. URL https :
//wwww ndss- sympos um. org nase- fewture-teeeeeeee sttesapppppeettttteeesseeeeeeeee seuueziingddeeettnnnn
Hunmin Yang, Jongoh Jeong, and Kuk-Jin Yoon. Facl-attack: Frequency-aware contrastive learn-
ing for transferable adversarial attacks. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 38, pp. 6494-6502, 2024a. 3, 6,9
Hunmin Yang, Jongoh Jeong, and Kuk-Jin Yoon. Prompt-driven contrastive learning for transferable adversarial attacks. In European Conference on Computer Vision, pp. 36-53. Springer, 2024b. 1,
3, 6
Chaoning Zhang, Adil Karjauv, Philipp Benz, Soomin Ham, Gyusang Cho, Chan-Hyun Youn, and In So Kweon. Is fgsm optimal or necessary for loo adversarial attack? In Workshop on Adversarial Machine Learning in World Computer Vision Systems and Online Challenges (AML-CV). Computer Vision Foundation (CVF), IÉEE Computer Society, 2021.
Qilong Zhang, Xiaodan Li, Yuefeng Chen, Jingkuan Song, Lianli Gao, Yuan He, and Hui Xue. Beyond imagenet attack: Towards crafting adversarial examples for black-box domains. In International Conference on Learning Representations, 2022. 2, 3, 4, 5, 6, 7, 8.9
Shiji Zhao, Jie Yu, Zhenlong Sun, Bo Zhang, and Xingxing Wei. Enhanced accuracy and robustness via multi-teacher adversarial distillation. In European Conference on Computer Vision, pp. 585-602 Springer, 2022. 3
13


Reviews:
[{"review_id": "5PoFwNwbJH", "reviewer": "Reviewer_y2kS", "summary": "This paper focuses on the intermediate features within the perturbation generator that are often overlooked in previous generative adversarial attacks.  The authors first note that a stronger attack better preserves the coarse shape from the early layers in the generator. Based on the observation, the authors introduce a lightweight EMA teacher to the early blocks during generator training, which regulates the features to maintain object contours and shapes. Extensive experiments show that the proposed strategy can serve as a plug-and-play technique to improve existing attack methods.", "questions": "See weaknesses.", "limitations": "", "rating": 2, "confidence": 4, "soundness": 2, "presentation": 3, "contribution": 2, "strengths": "1. The paper is well-written and easy to follow.\n2. The proposed method is simple and intuitive.\n3. The authors provide sufficient experiments across different models and data domains to prove the effectiveness of their method.\n4. Experiments about the intermediate block-level analysis are interesting and provide evidence of preserving image contours and shapes.", "weaknesses": "1. The designed method is simple and intuitive, which somewhat lacks novelty as feature-level guidance has been widely investigated in various existing studies.\n2. As shown in Table 2, the proposed method only brings marginal improvements for powerful attacks such as PDCL, raising concerns about its necessity and effectiveness.\n3. Lack experiments against input-processing-based defense methods.\n4. In line 69, a missing full stop after \"generator intermediate blocks\".", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "56lMFM7BdL", "reviewer": "Reviewer_acvB", "summary": "This paper presents a new augmentation for generative adversarial attacks aimed at improving their transferability in black-box settings. The core idea is to enforce semantic consistency in the generator's early blocks using a EMA framework with a self-feature consistency loss, thereby stabilizing object-aligned intermediate representations. Then the authors  introduce a new evaluation metric called ACR to detect unintended benign corrections, aiming to provide a more comprehensive view of attack reliability beyond conventional metrics. Through extensive quantitative and qualitative evaluations, including ablation studies and spectral analysis, they demonstrate systematic improvements across diverse architectures, domains, and tasks.", "questions": "1. Why does the work only consider untargeted attacks as baselines? It seems that targeted attack methods (e.g., [1]) could also be included for a more comprehensive comparison.\n\n2. How Spectral energy by band is defined and calculated in  Table 6?\n\n3. How would the method compare against the strongest black-box transfer attacks that do not rely on generator-based pipelines (e.g., [2]) ? \n\n\n\n[1] Fang, Hao, et al. \"Clip-guided generative networks for transferable targeted adversarial attacks.\" European Conference on Computer Vision. Cham: Springer Nature Switzerland, 2024.\n\n[2] Wang, Xiaosen, et al. \"Admix: Enhancing the transferability of adversarial attacks.\" Proceedings of the IEEE/CVF international conference on computer vision. 2021.", "limitations": "", "rating": 6, "confidence": 3, "soundness": 3, "presentation": 2, "contribution": 3, "strengths": "1. The self-feature consistency loss is well-motivated and mathematically specified.\n\n2.  The experiments are comprehensive, including multiple model architectures,  cross-domain and cross-task scenarios and fine-grained ablation.\n\n3. The finding of  the semantic drift across generator layers that degrades black-box transferability is novel.", "weaknesses": "1. The baseline methods should be introduced before presenting the experimental results, as omitting this order significantly reduces readability.\n\n2. Although the method claims to be architecture-agnostic, there is room for a stronger demonstration across more varied generator or victim types (e.g., diffusion)", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "Xutaq3kZMt", "reviewer": "Reviewer_7rta", "summary": "The paper proposes Semantic-Consistency guided Generative Attack (SCGA ) for transfer-based black-box image attacks. Instead of only optimizing a surrogate loss (e.g., cross-entropy / feature divergence) on a perturbation generator, the authors align early generator features to an EMA “mean-teacher” copy to preserve object-aligned structure while crafting perturbations. They also introduce Accidental Correction Rate (ACR) to quantify cases where an attack fixes a model’s original mistake—arguably a blind spot of common metrics like FR/ASR/Accuracy. Empirically, the method plugs into several generative baselines and improves transfer across architectures (CNN/ViT/Mixer/Mamba), domains, and tasks (classification, segmentation and detection) without test-time overhead.", "questions": "1.\tHow sensitive are results to η (EMA smoothing), τ (similarity threshold), and the choice/number of early blocks? Any principled way to select them across generator backbones?\n2.\tSince training doubles generator passes (student+teacher), could you provide full wall-clock with backward, peak memory, accelerator type/count, batch size, and total steps/epochs—along with a forward vs. backward breakdown?\n3.\tCould you add side-by-side feature/attribution visualizations against the baseline (the Figure-3.1 setting) to substantiate “object-aligned” perturbations ?\n4.\tWhen SCGA is combined with PDCL/FACL, what specifically conflicts—frequency bands, spatial regions, or representation space mismatch (CLIP vs. surrogate)? Any mitigation (e.g., decoupled schedules)?\n5.\tWhat exact transform and banding do you use (e.g., 2-D FFT magnitude, radial frequency masks, normalized cutoffs), and are energies computed on perturbations or activations (per-channel or aggregated)? Please include explicit formulas and thresholds to ensure reproducibility.\n6.\tTo disentangle the effect of the EMA teacher from $\\mathcal{L}_{cons.}$, could you add a variant that applies the consistency loss without EMA (e.g., a frozen or lagged snapshot of the student as the target)? This would clarify the unique contribution of temporal ensembling.", "limitations": "", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1.\tSimple, orthogonal mechanism: The EMA teacher + early-block consistency integrates into several strong generative baselines without test-time overhead; the approach is easy to adopt.\n2.\tClear, generator-internal motivation: The diagnostic showing that early generator features retain object contours while later ones blur them is compelling and grounded in measurable variability (foreground-IoU std across blocks).\n3.\tBroad evaluation: Cross-model results span CNN, ViT, Mixer, and SSM/Mamba families, with consistent average gains; the method also improves cross-domain (CUB, Cars, FGVC Aircraft) and cross-task transfer to SS/OD models.\n4.\tRobust-model/defense stress tests. The method improves over baseline against adversarially trained models and input preprocessing defenses (JPEG, bit-depth reduction, randomization & padding).", "weaknesses": "1.\tScope of gains & negative deltas. While averages improve, several cells in Table 2 are near-zero or negative (notably for certain transformer targets and PDCL).\n2.\tFrequency analysis lacks operational detail. The spectral-energy analysis is interesting but currently underspecified. Precisely define the transform (e.g., 2-D FFT with magnitude spectrum), the radial banding scheme (cutoffs in normalized frequency), and whether energies are computed on perturbations or activations. Provide explicit formulas (e.g., radial masks in the Fourier plane) and thresholds so others can reproduce the plots.\n3.\tCompute disclosure is incomplete. Training doubles forward passes (student+teacher), but only forward overhead is reported. Please report end-to-end training wall-clock, backward cost, peak memory, GPU/TPU model & count, and batch/step counts.\n4.\tInterplay with CLIP-driven baselines: The authors themselves note only marginal improvements when stacking on PDCL-style CLIP objectives, and briefly speculate that optimizing in CLIP's high-dimensional space may \"override or dilute\" the structural consistency enforced by SCGA. This explanation is underdeveloped and warrants a deeper investigation.\n5.\tInsufficient Ablation: While the ablation study in Table 5 is useful, it is incomplete. It demonstrates that applying the consistency loss to early blocks is optimal and that all proposed components contribute positively. However, it fails to fully disentangle the benefits of the EMA-updated teacher from the consistency loss itself. The reported gain from \"MT\" could stem from the general smoothing effect of weight averaging, or it could be that the consistency loss is only effective when provided with a stable teacher target. A crucial missing experiment would be to apply $\\mathcal{L}_{cons.}$ without the EMA teacher (e.g., by using a frozen copy of the student from a previous iteration as the target). This would isolate the unique contribution of the temporal ensembling.\n6.\tNo hyperparameter sensitivity. The paper introduces at least two critical hyperparameters, the EMA smoothing coefficient $\\eta$ in Eq. 2 and the consistency loss weight $\\lambda_{cons.}$ in Eq. 5. There are no analysis of the method's sensitivity to their values.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "dbwMWkGpRj", "reviewer": "Reviewer_foEg", "summary": "This paper proposes SCGA, a method for improving black-box adversarial transferability in generative attack frameworks. The approach employs a Mean Teacher architecture with EMA-updated weights to align intermediate features from the generator's early blocks with a teacher network, while maintaining the standard adversarial loss on surrogate model features. The authors partition the generator into early, mid, and late blocks and quantify semantic stability using foreground IoU variability across these blocks. Experimental evaluation is conducted across classification, semantic segmentation, and object detection tasks, with the introduction of an Accidental Correction Rate (ACR) metric alongside traditional ASR, FR, and accuracy measurements.", "questions": "Please see Weaknesses.", "limitations": "", "rating": 2, "confidence": 5, "soundness": 3, "presentation": 2, "contribution": 1, "strengths": "The paper is well-written and carefully structured. I commend the authors for the high-quality figures and tables, which significantly contribute to the clear presentation of the research.", "weaknesses": "Regretfully, after careful reading and consideration, I found the contributions of this paper to be predominantly incremental. The work applies established techniques without providing sufficient theoretical insights or novel algorithmic advancements to meet the high standard of ICLR.\n\n=====Lack of technical novelty=====\n1. The proposed attack techniques are quite similar to previous ones, making this paper seems like a patchwork. \nTo name a few:\n- Adversarial Loss Design: The adversarial loss formulation in SCGA directly corresponds to in Zhang et al. \"Beyond ImageNet Attack\" (ICLR 2022). Both employ identical surrogate feature-based similarity metrics in their loss functions.\n- Generator Architecture and Training Pipeline: The generator block division (early/mid/late) and associated weighting strategy in SCGA replicate in Zhang et al. \"Beyond ImageNet Attack\" (ICLR 2022), including hyperparameter configurations and EMA implementation details.\n- Domain-Invariant Generation Strategy: The domain-invariant generator objective in SCGA mirrors in Naseer et al. \"Cross-Domain Transferability of Adversarial Perturbations\" (NeurIPS 2019), sharing fundamental algorithmic approaches and frequency-domain processing methods.\n- Intermediate Feature Alignment: The self-feature consistency mechanism (Equation 3) in SCGA substantially overlaps with in Krishna Nakka & Salzmann \"Learning Transferable Adversarial Perturbations\" (NeurIPS 2021). Both utilize intermediate layer feature similarity metrics with comparable layer selection strategies, differing only in the shift from direct alignment to EMA teacher alignment.\n- Generator Training Framework: The generator training flow, architecture diagram, and projection operator P(·) in SCGA correspond to **Technical Point C** in Poursaeed et al. \"Generative Adversarial Perturbations\" (CVPR 2018), sharing norm constraint implementations and projection procedures.\n- Semantic Clustering Methodology: The semantic region clustering and attention-based masking approach in SCGA duplicates **Technical Point C** in Aich et al. \"GAMA: Generative Adversarial Multi-object Scene Attacks\" (NeurIPS 2022), particularly in feature-clustering and Grad-CAM attention operations.\n- Contrastive Learning Integration: The contrastive learning objective and frequency-domain randomization in SCGA overlap with **Technical Point C** in Yang et al. \"FACL/PDCL\" (2024), employing nearly identical CLIP-driven prompt mechanisms and domain robustness strategies.\nTo address this weakness, I strongly urge the authors set the core contribution apart from baseline techniques of others and switch the focus of this paper on the core contribution instead of these standardly adopted baseline techniques.\n\n=====Lack of theoretical insights=====\n2. This paper brings almost no theoretical insights. As a reader, I get no takeaways after reading this paper. All the mechanistic analysis methods in the paper are just standard techniques used in previous works and appeared to be included merely to pad out the content. \nSpecifically:\n- Figure 1 (Semantic Variability): The visualization of intermediate feature maps and foreground IoU variability is purely descriptive. It shows that early blocks retain more structure, but offers no theoretical explanation for why this occurs or how it fundamentally relates to transferability. The connection between \"lower variability\" and \"higher transferability\" is asserted, not derived from any theoretical principle.\n- Figure 3 (Qualitative Results): The Grad-CAM comparisons and perturbation visualizations merely demonstrate that the method works—not why it works from a theoretical standpoint. Showing that perturbations align more with object regions is an empirical outcome, not an insight into the underlying mechanisms of adversarial generalization.\n- Figure 4 (Feature Differences): The thresholded difference maps are visually intuitive but theoretically shallow. Highlighting where perturbations are added does not explain the fundamental reasons for improved transferability, such as the relationship between feature semantics and model decision boundaries.\n- Spectral Energy Analysis (Table 6): The analysis of low-frequency and high-frequency energy across blocks is a measurement, not an insight. The authors note that their method alters spectral distributions but fail to explain how this connects to theoretical properties of adversarial examples (e.g., spectral bias, frequency-based generalization). The observations are correlational, not causal.\n- Generator Intermediate Analysis: The partitioning of the generator into early/mid/late blocks is an architectural choice, not a theoretical contribution. The analysis does not provide a theoretical model for how or why semantic consistency in early blocks should propagate to enhance transferability—it only shows that it does so in practice.\n- Loss Formulations: The consistency loss (Eq. 3) is a technical implementation detail. The paper does not justify it from a theoretical perspective (e.g., information theory, optimization theory, or generalization bounds). It is presented as a heuristic.\n\n\n=====Incremental experimental improvements=====\n3. Compared to the latest baseline PDCL and FACL, the cross-modal & cross-domain attack performance gain (Tab. 2 & Tab. 3) in average is only ~1%, a very incremental improvement. Comparatively, PDCL improves ~3%.\n4. The baseline setup when evaluating the attack against defense models is very doubtful (Tab. 4). Only Zhang et al, 2022 is adopted as baseline. Why not also compare with PDCA, FACL, and GAMA? \n5. The fooling rate (FR) and accidental correction rate (ACR) is redundant and is not enough to be counted as a contribution.\nIndeed, previous works usually adopt only one metric (e.g. PDCL adopts only accuracy) in evaluation. However, it is reasonable and fair as long as all the attacks are evaluated using the same metric. There is unnecessary to evaluate attacks using too many metrics, as the final conclusion does not change at all no matter which metric you use.\n6. (Suggestion) Craft targeted adversarial examples to see whether the proposed SCGA can improve targeted transfer-based attack.\n7. (Suggestion) The following two references are suggested to be cited since they are also generative-model-based cross-domain transfer attacks.\nLi M, Deng C, Li T, et al. Towards transferable targeted attack. Proceedings of the IEEE/CVF conference on computer vision and pattern recognition. 2020: 641-649.\nWang Z, Yang H, Feng Y, et al. Towards transferable targeted adversarial examples. Proceedings of the IEEE/CVF conference on computer vision and pattern recognition. 2023: 20534-20543.\n\n=====Awful writing=====\n8. This paper did not cite the reference paper of each compared baseline to their acronyms. For the convenience of review discussion, I list them here:\n[CDA] Naseer M M, Khan S H, Khan M H, et al. Cross-domain transferability of adversarial perturbations. Advances in Neural Information Processing Systems, 2019, 32.\n[LTP] Salzmann M. Learning transferable adversarial perturbations. Advances in Neural Information Processing Systems, 2021, 34: 13950-13962.\n[BIA] Zhang Q, Li X, Chen Y, et al. Beyond imagenet attack: Towards crafting adversarial examples for black-box domains. ICLR, 2022\n[GAMA] Aich A, Ta C K, Gupta A, et al. Gama: Generative adversarial multi-object scene attacks. Advances in Neural Information Processing Systems, 2022, 35: 36914-36930.\n[FACL] Yang H, Jeong J, Yoon K J. Facl-attack: Frequency-aware contrastive learning for transferable adversarial attacks. AAAI, 2024\n[PDCL] Yang H, Jeong J, Yoon K J. Prompt-driven contrastive learning for transferable adversarial attacks. ECCV, 2024\n9. In the abstract, what is “EMA”?\n10. The font size of Fig.2 is too small, especially for the characters in the “residual learning” and “Upsampling” part. Please improve it.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "o0t0FGFfDP", "reviewer": "Reviewer_GNru", "summary": "This paper proposes Semantically Consistent Generative Attack (SCGA), to enhance black-box transferability of generative adversarial attacks. While existing generative attacks optimize surrogate losses, the authors focus on the generator’s internal dynamics. They empirically observe that semantic recognizability degrades from early to late blocks and hypothesize that enforcing semantic consistency in early blocks improves transferability.\nTo achieve this, the authors apply the EMA Teacher to stabilize internal generator features that encode object semantics and a self-feature consistency loss that encourages student early-layer features to be similar to teacher’s features. Additionally, they propose a new evaluation metric, Accidental Correction Rate (ACR), to capture cases where adversarial perturbations inadvertently correct misclassified inputs, improving the interpretability of attack reliability. Extensive experiments across multiple architectures, domains, and tasks demonstrate consistent performance improvements over strong baselines.", "questions": "1. Could the authors provide deeper theoretical intuition or analysis on why early-layer semantic anchoring leads to improved transferability?\n2. Table 2 shows that the proposed method generally enhances transferability. However, for some cases such as the integration of the proposed method with the baseline CDA and FACL on Transformers (p), there is a decrease in attack performance. Could the authors briefly discuss the potential cause? \n3. Have the authors considered evaluating the proposed method against diffusion-based purification defenses (e.g., DiffPure[1]) to test its robustness against strong modern preprocessing defenses?\n\n[1] Nie W, Guo B, Huang Y, et al. Diffusion models for adversarial purification[J]. arXiv preprint arXiv:2205.07460, 2022.", "limitations": "", "rating": 8, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1. The paper presents a clear empirical motivation by analyzing semantic drift across generator blocks for the proposed semantic consistency at the generator’s early intermediates.\n2. The proposed method integrates the Mean Teacher mechanism with a self-feature consistency loss during training, which increases semantic consistency while not introducing no additional inference cost.\n3. The introduction of the Accidental Correction Rate (ACR) metric provides an insightful perspective on attack reliability.\n\nThe paper conducts comprehensive experiments across multiple model families, datasets, and tasks, establishing strong empirical credibility.", "weaknesses": "Main concerns: \n1. The paper lacks theoretical analysis or formal justification for why enforcing early-layer feature consistency enhances cross-model transferability, relying mainly on empirical evidence.\n2. In Table 2, the integration of the proposed method with the baseline leads to a slight drop in attack performance for some Transformer models (such as CDA and FACL with the proposed method on model p). Could the authors provide a brief analysis on the potential reasons for this performance degradation in these cases?\n3. The paper does not evaluate against diffusion-based purification defenses, which are currently regarded as strong pre-processing defenses in adversarial robustness research. Including such a comparison would strengthen the work’s comprehensiveness.\nMinor weakness:\n1. In Figure 2, the snowflake symbol may unintentionally suggest that the teacher generator is entirely frozen; however, as it is updated iteratively via the EMA rule rather than by backpropagation, clarifying this distinction in the caption or text would avoid confusion.\n2. In the ablation of the similarity threshold (shown in the supplementary material), the evaluation metric is not explicitly specified.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Poster)