Notice: The reproducibility variables underlying each score are classified using an automated LLM-based pipeline, validated against a manually labeled dataset. LLM-based classification introduces uncertainty and potential bias; scores should be interpreted as estimates. Full accuracy metrics and methodology are described in Coakley et alK. L. Coakley, T. Snelleman, H. Hoos, and O. E. Gundersen, "The embrace of open science: An analysis of a decade of AI research and 56 800 conference papers," Under Review, 2026..
IMPACT: Irregular Multi-Patch Adversarial Composition Based on Two‑Phase Optimization
Authors: Zenghui Yang, Xingquan Zuo, Hai Huang, Gang Chen, Xinchao Zhao, Tianle Zhang
NeurIPS 2025 | Venue PDF | LLM Run Details
| Reproducibility Variable | Result | LLM Response |
|---|---|---|
| Research Type | Experimental | Extensive experiments demonstrate that our method significantly outperforms several state-of-the-art approaches, highlighting the critical benefit of jointly optimizing all patch factors in adversarial patch attacks. |
| Researcher Affiliation | Academia | Zenghui Yang1,5, Xingquan Zuo2,5 , Hai Huang2,5, Gang Chen3, Xinchao Zhao4, Tianle Zhang1,5 1Shool of Cyberspace Security, Beijing University of Posts and Telecommunications 2School of Computer Science, Beijing University of Posts and Telecommunications 3School of Engineering and Computer Science, Victoria University of Wellington 4School of Science, Beijing University of Posts and Telecommunications 5Key Laboratory of Trustworthy Distributed Computing and Service EMAIL EMAIL |
| Pseudocode | Yes | Algorithm 1 Irregular Multi-Patch Adversarial Attack Based on Two-Phase Optimization |
| Open Source Code | Yes | Our source code is available at https://yangzh216.github.io/IMPACT. |
| Open Datasets | Yes | Following previous works [8, 43, 27], we use Image Net [9] for evaluation due to its diverse object categories and real-world scenarios, enabling a comprehensive assessment of our method s effectiveness. Additional experiments on more datasets are provided in Appendix E.5. Following the same setup as Patch-RS [8], we randomly select a subset of 500 images from the validation set of Image Net for our experiments. For the victim models, we employ three widely adopted architectures: Res Net50 [17], VGG16 [32], and Vi T-B [11]. These models encompass diverse architectural designs, enabling a comprehensive evaluation of IMPACT s effectiveness across varying network architectures. All input images are resized to a standard size of 224 224, consistent with the requirements of the experimented models. The models are officially pre-trained on the full Image Net training set, ensuring a robust and reliable baseline for evaluation. All experiments were conducted on a system equipped with an NVIDIA Ge Force RTX 4090 GPU. The detail parameter settings are provided in Appendix E.1. |
| Dataset Splits | Yes | Following the same setup as Patch-RS [8], we randomly select a subset of 500 images from the validation set of Image Net for our experiments. |
| Hardware Specification | Yes | All experiments were conducted on a system equipped with an NVIDIA Ge Force RTX 4090 GPU. |
| Software Dependencies | No | The paper does not explicitly mention specific software dependencies with version numbers. |
| Experiment Setup | Yes | The detail parameter settings are provided in Appendix E.1. Black-box Comparison: We evaluate IMPACT under different perturbation areas, with parameters n = 32, 64 controlling perturbation areas of 1% and 2%, respectively. The remaining parameters of IMPACT are set as follows: k = 3, N = 50, Td = 150, and Te = 2500. |