# Enhancing targeted transferability via feature space fine-tuning Source: [Enhancing targeted transferability via feature space fine-tuning]() Collection index: [llms.txt]() Data updated: 2025-10-26T02:12:32.787Z Authors: Hui Zeng, Biwei Chen, Anjie Peng Published: 2024-01-05T09:46:42.000Z ## Abstract Adversarial examples (AEs) have been extensively studied due to their potential for privacy protection and inspiring robust neural networks. Yet, making a targeted AE transferable across unknown models remains challenging. In this paper, to alleviate the overfitting dilemma common in an AE crafted by existing simple iterative attacks, we propose fine-tuning it in the feature space. Specifically, starting with an AE generated by a baseline attack, we encourage the features conducive to the target class and discourage the features to the original class in a middle layer of the source model. Extensive experiments demonstrate that only a few iterations of fine-tuning can boost existing attacks' targeted transferability nontrivially and universally. Our results also verify that the simple iterative attacks can yield comparable or even better transferability than the resource-intensive methods, which rest on training target-specific classifiers or generators with additional data. The code is available at: github.com/zengh5/TA\_feature\_FT. ## Recorded benchmark results A research result applies to its stated dataset, split, metric and evaluation configuration. Compare like-for-like settings, preserve the metric's unit and direction, and distinguish paper-reported results from independent reproduction. The best result recorded here is not a claim of exhaustive, current global coverage. - [Targeted Adversarial Attack on ImageNet (test) - Model Suite VGG/ResNet/Transformer Mix](): Targeted Adversarial Attack; ImageNet (test); Model Performance: VGG16: 9.72. ## Original sources and implementation [Original paper]() [PDF]()