[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"doc-detail-85468-en":3,"doc-seo-85468-105":29,"detail-sidebar-cat-0-en-105":91},{"code":4,"msg":5,"data":6},0,"success",{"doc_id":7,"user_id":8,"nickname":9,"user_avatar":10,"doc_module":4,"category_id":11,"category_name":12,"doc_title":13,"doc_description":14,"doc_content":15,"file_id":16,"file_url":17,"file_type":18,"file_size":19,"view_count":20,"is_deleted":4,"is_public":20,"is_downloadable":20,"audit_status":20,"page_count":21,"language":22,"language_code":23,"site_id":24,"html_lang":23,"table_of_contents":25,"faqs":26,"seo_title":13,"seo_description":14,"update_tm":27,"read_time":28},85468,549758146520,"Patrick","https://ap-avatar.wpscdn.com/avatar/80002397d8c0411e94?_k=1775819394049821470",8,"Research & Report","Frontend Response-Oriented Input Transformation for Transferable Adversarial Attacks","A Frontend Response-Oriented (FRO) approach reframes input-transformation adversarial attacks as an implicit ensemble of pre-model operators. Each transformed view yields a distinct surrogate frontend response, enabling gradient aggregation from complementary operator-induced behaviors rather than relying on visual diversity alone. Local scaling (block stretch-and-shrink) and projection (global spatial deformation) enrich responses. Experiments on an ImageNet subset show consistent gains in black-box transferability across CNN and Vision Transformer targets, while unified ensemble analysis clarifies the role of implicit ensemble size and transformation choice.","Frontend Response-Oriented Input Transformation for Transferable  \nAdversarial Attacks  \nQuan Liu Feng Ye Chenhao Lu Shuming Zhen Guanliang Huang  \nLunzhe Chen Xudong Ke  \narXiv :2511 . 17688v2 [ cs .LG] 13 Jul 2026  \nJuly 14, 2026  \nAbstract perspective of front-end response ensembles.  \nInput transformation-based attacks improve adver  \nsarial transferability by aggregating gradients over 1 Introduction  \ntransformed inputs. Existing analyses mainly explain  \ntheir efficacy from image diversity, semantic preserva- Deep Neural Networks (DNNs) have achieved retion, attention variance or hypothesis space augmen- markable performance in visual tasks such as image tation, yet overlook the critical role of model frontend classification [18], object detection [37], and semanresponses. In this paper, we revisit transformation- tic segmentation [39] . However, DNNs remain vulbased attacks from an implicit ensemble perspec- nerable to adversarial examples [11, 19], where small tive: each transformation can be viewed as a pre- and often imperceptible perturbations can mislead processing operator before the surrogate model, in- well-trained models. This vulnerability raises secuducing a distinct frontend response for gradient ag- rity concerns in safety-critical applications, including gregation. Based on this view, we propose FRO, autonomous driving [58], medical image analysis [30], a Frontend Response-Oriented input transformation and identity verification [38] . Studying adversarial method that enriches such responses through two examples is therefore important for evaluating and complementary operators. The Local Scaling Op- improving model robustness.  \nerator perturbs local content sampling via block- Adversarial attacks are broadly divided into whitewise stretch-and-shrink operations, while the Pro- box and black-box attacks. In white-box settings, jection Operator modifies global spatial organization attackers have full access to the target model and through coherent perspective deformation. Together, can directly optimize perturbations using model grathey produce structured transformed views to opti- dients. Representative methods include FGSM [11], mize transferable adversarial perturbations. Exper- MI-FGSM [7], and C&W [1] . In black-box settings, iments on an ImageNet subset show that FRO con- attackers have limited or no access to the targetsistently improves black-box transferability across di- model, which better reflects practical attack scenarverse CNN and Vision Transformer models. We fur- ios [35, 53] . A common black-box strategy is to exther analyze the effect of implicit ensemble size and ploit adversarial transferability, whereby adversarial evaluate different transformation-based methods un- examples crafted on an accessible source model can der a unified ensemble scale, demonstrating the su- also fool unseen target models [27, 31] . Since stanperiority of designing input transformations from the dard white-box attacks often exhibit limited trans-  \nferability [34], improving cross-model transferability remains an important problem.  \nFollowing the taxonomy of a recent comprehensive survey [49], existing transfer-based attacks can be broadly categorized into gradient-based attacks [20], input transformation-based attacks [51, 12], advanced-objective-function attacks [26], generationbased attacks [2], model-related attacks [25], and ensemble-based attacks [43] . Among these approaches, input transformation-based attacks are particularly attractive because of their simplicity, flexibility, and compatibility with standard gradientbased attacks. They construct multiple transformed versions of the current adversarial input and aggregate the gradients calculated from these transformed views, thereby reducing over-reliance on a single input representation of the source surrogate model.  \nExisting studies mainly explain input transformations from the perspectives of transformed-image diversity, attention-response divers","cbCaichwGdVD4qfV","https://ap.wps.com/l/cbCaichwGdVD4qfV","pdf",1951925,1,25,"English","en",105,"# Abstract\n# Introduction\n## Threat model and adversarial attack taxonomy\n## Transformation-based transfer attacks and limitations\n# Method: Frontend Response-Oriented (FRO)\n## Implicit ensemble perspective\n## Transformation operators (local scaling and projection)\n# Experiments and findings","[{\"question\":\"What does the FRO method propose for improving transferable adversarial attacks?\",\"answer\":\"FRO treats input transformations as pre-model operators and aggregates gradients from multiple transformed views based on the diversity of induced frontend responses, not just visual diversity.\"},{\"question\":\"How are the Local Scaling Operator and Projection Operator used in FRO?\",\"answer\":\"The Local Scaling Operator perturbs local content through block stretch-and-shrink operations, while the Projection Operator modifies global spatial organization via coherent perspective deformation.\"},{\"question\":\"Why do transformation-induced frontend responses matter for transferability?\",\"answer\":\"If transformed views produce nearly identical frontend responses, their gradients become redundant even when images look different. Complementary frontend responses yield more diverse optimization signals that generalize to unseen target models.\"}]",1784203783,63,{"code":4,"msg":30,"data":31},"ok",{"site_id":24,"language":23,"slug":32,"title":13,"keywords":33,"description":14,"schema_data":34,"social_meta":86,"head_meta":88,"extra_data":90,"updated_unix":27},"frontend-response-oriented-input-transformation-for-transferable-adversarial-attacks","",{"@graph":35,"@context":85},[36,53,68],{"@type":37,"itemListElement":38},"BreadcrumbList",[39,43,47,50],{"item":40,"name":41,"@type":42,"position":20},"https://docshare.wps.com","Home","ListItem",{"item":44,"name":45,"@type":42,"position":46},"https://docshare.wps.com/document/","Document",2,{"item":48,"name":12,"@type":42,"position":49},"https://docshare.wps.com/document/research-report/",3,{"item":51,"name":13,"@type":42,"position":52},"https://docshare.wps.com/document/frontend-response-oriented-input-transformation-for-transferable-adversarial-attacks/85468/",4,{"url":51,"name":13,"@type":54,"author":55,"headline":13,"publisher":57,"fileFormat":60,"inLanguage":23,"description":14,"dateModified":61,"datePublished":62,"encodingFormat":60,"isAccessibleForFree":63,"interactionStatistic":64},"DigitalDocument",{"name":9,"@type":56},"Person",{"url":40,"name":58,"@type":59},"DocShare","Organization","application/pdf","2026-07-17","2026-07-16",true,{"@type":65,"interactionType":66,"userInteractionCount":20},"InteractionCounter",{"@type":67},"ViewAction",{"@type":69,"mainEntity":70},"FAQPage",[71,77,81],{"name":72,"@type":73,"acceptedAnswer":74},"What does the FRO method propose for improving transferable adversarial attacks?","Question",{"text":75,"@type":76},"FRO treats input transformations as pre-model operators and aggregates gradients from multiple transformed views based on the diversity of induced frontend responses, not just visual diversity.","Answer",{"name":78,"@type":73,"acceptedAnswer":79},"How are the Local Scaling Operator and Projection Operator used in FRO?",{"text":80,"@type":76},"The Local Scaling Operator perturbs local content through block stretch-and-shrink operations, while the Projection Operator modifies global spatial organization via coherent perspective deformation.",{"name":82,"@type":73,"acceptedAnswer":83},"Why do transformation-induced frontend responses matter for transferability?",{"text":84,"@type":76},"If transformed views produce nearly identical frontend responses, their gradients become redundant even when images look different. Complementary frontend responses yield more diverse optimization signals that generalize to unseen target models.","https://schema.org",{"og:url":51,"og:type":87,"og:title":13,"og:site_name":58,"og:description":14},"article",{"robots":89,"canonical":51},"index,follow",{"doc_id":7,"site_id":24},{"code":4,"msg":5,"data":92},[93,97,101,105,110,115,120,123,128,131,135],{"id":20,"doc_module":4,"doc_module_name":45,"category_name":94,"show_sort_weight":95,"slug":96},"Story & Novel",90,"story-novel",{"id":46,"doc_module":4,"doc_module_name":45,"category_name":98,"show_sort_weight":99,"slug":100},"Literature",80,"literature",{"id":52,"doc_module":4,"doc_module_name":45,"category_name":102,"show_sort_weight":103,"slug":104},"Exam",70,"exam",{"id":106,"doc_module":4,"doc_module_name":45,"category_name":107,"show_sort_weight":108,"slug":109},5,"Comic",60,"comic",{"id":111,"doc_module":4,"doc_module_name":45,"category_name":112,"show_sort_weight":113,"slug":114},6,"Technology",50,"technology",{"id":116,"doc_module":4,"doc_module_name":45,"category_name":117,"show_sort_weight":118,"slug":119},7,"Healthcare",40,"healthcare",{"id":11,"doc_module":4,"doc_module_name":45,"category_name":12,"show_sort_weight":121,"slug":122},30,"research-report",{"id":124,"doc_module":4,"doc_module_name":45,"category_name":125,"show_sort_weight":126,"slug":127},9,"Religion & Spirituality",20,"religion-spirituality",{"id":126,"doc_module":4,"doc_module_name":45,"category_name":129,"show_sort_weight":126,"slug":130},"World Cup","world-cup",{"id":132,"doc_module":4,"doc_module_name":45,"category_name":133,"show_sort_weight":132,"slug":134},10,"Lifestyle","lifestyle",{"id":136,"doc_module":4,"doc_module_name":45,"category_name":137,"show_sort_weight":106,"slug":138},19,"General","general"]