text:
\section{Acknowledgements}

This publication has received funding from the Excellence Initiative of Aix-Marseille Université - A*Midex, a French ``Investissements d'Avenir programme'' (AMX-21-IET-017), the UnLIR ANR project (ANR-19-CE23-0009), and the CAS Project for Young Scientists in Basic Research (Grant YSBR-040). Part of this work was performed using HPC resources from GENCI-IDRIS (Grant 2020-AD011013110).
\section{Descriptions of Attacks and Defenses}
\label{app:att_def}
\subsection{Descriptions of Attacks}
   \noindent\textbf{Momentum Iterative (MI)}~\cite{dong2018boosting} integrates the momentum term into the iterative optimization of attacks, in order to stabilize the update directions and escape from poor local maxima. This momentum term accumulates a velocity vector in the gradient direction of the loss function across iterations.

   \noindent\textbf{Nesterov Iterative (NI)}~\cite{lin2020nesterov} is based on an improved momentum method that further also leverages the look ahead property of Nesterov Accelerated Gradient (NAG) by making a jump in the direction of previously accumulated gradients before computing the gradients in the current iteration. This makes the attack escape from poor local maxima more easily and faster.

   \noindent\textbf{Pre-gradient guided Iterative (PI)}~\cite{wang2021boosting} follows a similar idea as NI, but it makes a jump based on only the gradients from the last iteration instead of all previously accumulated gradients.

   \noindent\textbf{Diverse Inputs (DI)}~\cite{xie2019improving} applies random image resizing and padding to the input image before calculating the gradients in each iteration of the attack optimization. This approach aims to prevent attack overfitting (to the white-box, source model), inspired by the data augmentation techniques used for preventing model overfitting.

   \noindent\textbf{Translation Invariant (TI)}~\cite{dong2019evading} applies random image translations for input augmentation. It also introduces an approximate solution to improve the attack efficiency by directly computing locally smoothed gradients on the original image through the convolution operations rather than computing gradients multiple times for all potential translated images.

   \noindent\textbf{Scale Invariant (SI)}~\cite{lin2020nesterov} applies random image scaling for input augmentation. It scales pixels with a factor of $1/2^i$. In particular, in each iteration, it takes an average of gradients on multiple augmented images rather than using only one augmented image as in previous input augmentation attacks.

   \noindent\textbf{Variance Tuning (VT)}~\cite{wang2021enhancing} applies uniformly distributed additive noise to images for input augmentation and also calculates average gradients over multiple augmented images in each iteration.

   \noindent\textbf{Adversarial mixup (Admix)}~\cite{wang2021admix} calculates the gradients on a composite image that is made up of the original image and another image randomly selected from an incorrect class. The original image label is still used in the loss function.

   \noindent\textbf{Transferable Adversarial Perturbations (TAP)}~\cite{zhou2018transferable} proposes to maximize the distance between original images and their adversarial examples in the intermediate feature space and also introduces a regularization term for reducing the variations of the perturbations and another regularization term with the cross-entropy loss.

   \noindent\textbf{Activation Attack (AA)}~\cite{inkawhich2019feature} drives the feature-space representation of the original image towards the representation of a target image that is selected from another class. Specifically, AA can achieve targeted misclassification by selecting a target image from that specific target class.

   \noindent\textbf{Intermediate Level Attack (ILA)}~\cite{huang2019enhancing} optimizes the adversarial examples in two stages, with the cross-entropy loss used in the first stage to determine the initial perturbations, which will be further fine-tuned in the second stage towards larger feature distance while maintaining the initial perturbation directions.

   \noindent\textbf{Feature Importance-aware Attack (FIA)}~\cite{wang2021feature} proposes to only disrupts important features. Specifically, it measures the importance of features based on the aggregated gradients with respect to feature maps computed on a batch of transformed original images that are achieved by random image masking.

   \noindent\textbf{Neuron Attribution-based Attacks (NAA)}~\cite{zhang2022improving} relies on an advanced neuron attribution method to measure the feature importance more accurately. It also introduces an approximation approach to conducting neuron attribution with largely reduced computations.

   \noindent\textbf{Skip Gradient Method (SGM)}~\cite{wu2020skip} suggests using ResNet-like architectures as the source model during creating the adversarial examples. Specifically, it shows that backpropagating gradients through skip connections lead to higher transferability than through the residual modules.

   \noindent\textbf{Linear BackPropagation (LinBP)}~\cite{guo2020backpropagating} is proposed based on the new finding that the non-linearity of the commonly-used ReLU activation function substantially limits the transferability. To address this limitation, the ReLU is replaced by a linear function during only the backpropagation process.

   \noindent\textbf{Robust Feature-guided Attack (RFA)}~\cite{springer2021little} proposes to use an adversarially-trained model as the source model based on the assumption that modifying more robust features yields more generalizable (transferable) adversarial examples.

   \noindent\textbf{Intrinsic Adversarial Attack (IAA)}~\cite{zhu2021rethinking} finds that disturbing the intrinsic data distribution is the key to generating transferable adversarial examples. Based on this, it optimizes the hyperparameters of the Softplus and the weights of skip connections per layer towards aligned attack directions and data distribution.

     \noindent\textbf{Dark Surrogate Model (DSM)}~\cite{yang2022boosting} is trained from scratch with additional ``dark'' knowledge, which is achieved by training with soft labels from a pre-trained teacher model and using data augmentation techniques, such as Cutout, Mixup, and CutMix.

     \noindent\textbf{Generative Adversarial Perturbations (GAP)}~\cite{poursaeed2018generative} proposes a new attack approach that is based on generative modeling. Specifically, it uses the source classifier as the discriminator and trains a generator using the cross-entropy loss. Once trained, the generator can be used to generate an adversarial example for each input original image with only one forward pass.

   \noindent\textbf{Cross-Domain Attack (CDA)}~\cite{naseer2019cross} follows the GAP pipeline but uses a more advanced loss (i.e., relativistic cross entropy) to train the generator. This new loss explicitly enforces the probability gap between the clean and adversarial images, boosting the transferability, especially in cross-domain scenarios.

   \noindent\textbf{Transferable Targeted Perturbations (TTP)}~\cite{naseer2021generating} is focused on improving transferability of targeted attacks. It is based on learning target-specific generators, each of which is trained with the objective of matching the distribution of targeted perturbations with that of data from a specific target class. Specifically, input augmentation and smooth perturbation projection are used to further boost the performance.

   \noindent\textbf{Generative Adversarial Feature Perturbations (GAFP)}~\cite{kanth2021learning} follows the general pipeline of GAP but trains the generator using a loss that maximizes the feature map distance between adversarial and original images at mid-level CNN layers.

   \noindent\textbf{Beyond ImageNet Attack (BIA)}~\cite{zhang2022beyond} also follows the general pipeline of GAP and specifically introduces a random normalization module to simulate different training data distributions and also a feature distance loss that is only based on important/generalizable features.

\subsection{Descriptions of Defenses}

   \noindent\textbf{Bit-Depth Reduction (BDR)}~\cite{xu2017feature} pre-processes input images by reducing the color depth of each pixel while maintaining the semantics. This operation can eliminate pixel-level adversarial perturbations from adversarial images but have little impact on model predictions of clean images.

   \noindent\textbf{Pixel Deflection (PD)}~\cite{prakash2018deflecting} pre-processes input images by randomly replacing some pixels with randomly selected pixels from their local neighborhood. It is specifically designed to happen more frequently to non-salient pixels, and a subsequent wavelet-based denoising operation is used to soften the corruption.

   \noindent\textbf{Resizing and Padding (R\&P)}~\cite{xie2017mitigating} pre-processes input images by random resizing, which resizes the input images to a random size, and then random padding, which pads zeros around the resized input images.

   \noindent\textbf{High-level representation Guided Denoiser (HGD)}~\cite{liao2018defense} learns a purification network that can be used to purify/denoise the adversarial perturbations. Specifically, different from previous methods that focus on image-space denoising, HGD minimizes the difference between the clean image and the denoised image at intermediate feature layers.

   \noindent\textbf{Neural Representation Purifier (NRP)}~\cite{naseer2020self} learns a purification network using a combined loss that calculates both the image- and feature-space differences. Specifically, the adversarial images used for training the purification network are generated by feature loss-based adversaries, which are shown to be more effective in handling unseen attacks.

   \noindent\textbf{Diffusion Purification (DiffPure)}~\cite{nie2022diffusion} uses a diffusion model as the purification network. It diffuses an input image by gradually adding noise in a forward diffusion process and then recovers the clean image by gradually denoising the image in a reverse generative process.
  The reverse process is shown to be also capable of removing adversarial perturbations.

\noindent\textbf{$L_{\infty}$-Adversarial Training (AT$_{\infty}$)}~\cite{xie2019feature} follows the basic pipeline of adversarial training, which is to train the robust model on adversarial images. Specifically, these adversarial images are generated using the PGD targeted attacks with the $L_{\infty}$ distance, and the model is trained distributedly on 128 Nvidia V100 GPUs.

\noindent\textbf{$L_{\infty}$-Adversarial Training with Feature Denoising (FD$_{\infty}$)}~\cite{xie2019feature} modifies the standard model architecture by introducing new building blocks that are designed for denoising feature maps based on non-local means or other filters. This modification can help suppress the potential disruptions caused by the adversarial perturbations, and the modified model is trained end-to-end.

   \noindent\textbf{$L_{2}$-Adversarial Training (AT$_{2}$)}~\cite{robustness} trains the model on adversarial images that are generated using the PGD non-targeted attacks with the $L_{2}$ distance.

\subsection{Hyperparameter Settings}
\label{app:hyper}
The hyperparameter settings adopted in our evaluation for the attacks and defenses are described in Table~\ref{tab:hyperparameters}.

\begin{table}[!t]
\newcommand{\tabincell}[2]{\begin{tabular}{@{}#1@{}}#2\end{tabular}}
\caption{Hyperparameter settings of attacks and defenses.}

\renewcommand{\arraystretch}{1}
      \centering
      \resizebox{\columnwidth}{!}{
        \begin{tabular}{l|c}
\toprule[1pt]
Attacks&Hyperparameter settings\\

\midrule
MI~\cite{dong2018boosting}&decay factor $\mu=1$\\
NI~\cite{lin2020nesterov} &decay factor $\mu=1$\\
PI~\cite{wang2021boosting} &decay factor $\mu=1$\\
DI~\cite{xie2019improving} &\tabincell{c}{resize\&pad range $R=[1,~1.1]$\\transformation probability $p=0.7$}\\
TI~\cite{dong2019evading} &translation range $R=[-2,2]$\\
SI~\cite{lin2020nesterov} &scale range $R=[0.1,1]$\\
VT~\cite{wang2021enhancing} &noise range $R=[-1.5\epsilon,1.5\epsilon]$\\
Admix~\cite{wang2021admix} &mixing factor $\eta=0.2$ \\
TAP~\cite{zhou2018transferable} & $\lambda = 0.005$, $\eta = 0.01$, $\alpha = 0.5$\\
AA~\cite{inkawhich2019feature}& $20$ random target images from 4 classes\\
ILA~\cite{huang2019enhancing} & ILA projection loss\\
FIA~\cite{wang2021feature}& $N=30$, $P_\mathrm{drop}=0.3$\\
NAA~\cite{zhang2022improving} & $N=30$, $\gamma=1.0$, linear transformation\\
SGM~\cite{wu2020skip} &decay parameter $\gamma=0.5$\\
LinBP~\cite{guo2020backpropagating} &first residual unit in the third meta block\\
RFA~\cite{springer2021little} &$L_{\infty}$ $\epsilon=8$ PGD-AT, ResNet50\\
IAA~\cite{zhu2021rethinking} &$\beta=15$, ResNet50\\
DSM~\cite{yang2022boosting}&Cutout augmentation, ResNet18\\
GAP~\cite{poursaeed2018generative}&ResNet152 discriminator\\
CDA~\cite{naseer2019cross} &ResNet152 discriminator\\
GAPF~\cite{kanth2021learning} &ResNet152 discriminator\\
BIA~\cite{zhang2022beyond} &ResNet152 discriminator, RN module\\
TTP~\cite{naseer2021generating}&ResNet50 discriminator\\
\midrule

Defenses&Hyperparameter settings\\

\midrule
BDR~\cite{xu2017feature}&bit depth $D=2$\\
PD~\cite{prakash2018deflecting} &R-CAM: $k=5$, denoising: $\sigma=0.04$\\
R\&P~\cite{xie2017mitigating} &resize\&pad range $R=[1,~1.1]$\\
HGD~\cite{liao2018defense} &ResNet152-Wide\\
NRP~\cite{naseer2020self} &ResNet (1.2M parameters) \\
DiffPure~\cite{nie2022diffusion} & noise level $t=150$ WideResNet-50-2\\
AT$_{\infty}$~\cite{xie2019feature}&\tabincell{c}{$L_{\infty}$ $\epsilon=16$, PGD iters $n=30$, lr=$\alpha=1$}\\
FD$_{\infty}$~\cite{xie2019feature}&\tabincell{c}{$L_{\infty}$ $\epsilon=16$, PGD iters $n=30$, lr=$\alpha=1$}\\
AT$_{2}$~\cite{robustness} &\tabincell{c}{$L_{2}$ $\epsilon=3.0$, PGD iters $n=7$, lr=$\alpha=0.5$}\\
\bottomrule[1pt]
\end{tabular}
}
\label{tab:hyperparameters}
\end{table}

\section{Definitions of Imperceptibility Metrics}
\label{app:metric}
  \noindent\textbf{Peak Signal-to-Noise Ratio (PSNR)} measures the ratio of the maximum possible power of a signal (image $\boldsymbol{x}$) to the noise (perturbations $\boldsymbol{\sigma}$) power.
  It is calculated by:
  \begin{equation}\label{eq:psnr}
  \textrm{PSNR}(\boldsymbol{x},\boldsymbol{\sigma})=10\cdot\log_{10}\frac{\max(\boldsymbol{x})^2}{\textrm{MSE}(\boldsymbol{x},\boldsymbol{\sigma})},
  \end{equation}
where the Mean Squared Error (MSE) measures the average squared difference between the two inputs.

  \noindent\textbf{Structural Similarity Index Measure (SSIM)}~\cite{wang2004image} is used for measuring the perceptual quality of digital images. In our case, it measures the structural similarity between the original image $\boldsymbol{x}$ and adversarial image $\boldsymbol{x}'$, which is considered to be a degraded version of $\boldsymbol{x}$.
  It is calculated by:
    \begin{equation}\label{eq:ssim}
   \textrm{SSIM}(\boldsymbol{x},\boldsymbol{x}')=\frac{{ ( 2 \mu_{\boldsymbol{x}}\mu_{\boldsymbol{x}'}+ c_1 )+  (2 \sigma_{\boldsymbol{x}\boldsymbol{x}'}+c_2)}}
{(\mu_{\boldsymbol{x}}^2+\mu_{\boldsymbol{x}'}^2+c_1)(\sigma_{\boldsymbol{x}}^2+\sigma_{\boldsymbol{x}'}^2+c_2)}.
  \end{equation}
Descriptions of $c_1$ and $c_1$ and more technical details can be found in~\cite{wang2004image}.

  \noindent\textbf{$\Delta$\textit{E}}~\cite{luo2001development} refers to the CIE $\Delta E$ standard formula used for measuring the perceptual color distance between two pixels. We follow~\cite{zhao2020towards} to use the latest variant, CIEDE2000, since it is shown to align very well with human perception.
It is calculated in the CIELCH space by:
\begin{equation}
\label{eq:deltae}
\begin{gathered}
\Delta E=\sqrt{(\frac{\Delta L'}{k_LS_L})^2+(\frac{\Delta C'}{k_CS_C})^2+(\frac{\Delta H'}{k_HS_H})^2+\Delta R},\\
\Delta R=R_T(\frac{\Delta C'}{k_CS_C})(\frac{\Delta H'}{k_HS_H}),
\end{gathered}
\end{equation}
where $\Delta L'$, $\Delta C'$, $\Delta H'$ denotes the distance between two pixels in their lightness, chroma and hue channels, respectively. $\Delta R$ is an interactive term between chroma and hue differences.
Detailed definitions and explanations of the weighting functions ($S_L$, $S_C$, $S_H$ and $R_T$) and hyperparameters $k_L$, $k_C$ and $k_H$ can be found in~\cite{luo2001development}.
Further, Image-level perceptual color difference is obtained by computing the $L_{2}$ norm of the above $\Delta E$ for each pixel.

  \noindent\textbf{Learned Perceptual Image Patch Similarity (LPIPS)}~\cite{zhang2018unreasonable} is developed for measuring the perceptual similarity between two images. It computes the cosine distance (in
the channel dimension) between features at each given convolutional layer $l$ and averages the results across spatial dimensions $H\times W$ and layers of a specific network $f$:
  \begin{equation}
\label{eq:lpips}
  \textrm{LPIPS}=\sum_{l}\frac{1}{H_{l}W_{l}}\sum _{h,w} \cos(f^{l}_{hw}(\boldsymbol{x}),f^{l}_{hw}(\boldsymbol{x}')),
  \end{equation}
where AlexNet is adopted as $f$ for computational efficiency.

\noindent\textbf{Frechet Inception Distance (FID)}~\cite{szegedy2016rethinking} is originally used to assess the quality of images generated by a generative model and can also be used to assess the quality of adversarial images.
It compares the distribution of adversarial images to that of original images.
Specifically, the output features from the pool3 layer of an Inception-V3 for original and adversarial images are used to fit two multidimensional Gaussian distributions $\mathcal {N}(\mu,\Sigma )$ and $\mathcal {N}(\mu',\Sigma')$, and the FID is score is calculated by:
  \begin{equation}
\label{eq:fid}
  \textrm{FID}(\mathcal {N}(\mu,\Sigma),\mathcal {N}(\mu' ,\Sigma' ))=\|\mu– \mu'\|_2^2 + \textrm{tr}(\Sigma + \Sigma'- 2\sqrt{\Sigma\Sigma'}),
  \end{equation}
where $\textrm{tr}$ denotes the trace of the matrix.

\section{Additional Results}
\label{app:results}
\begin{figure}[h]
\centering
\includegraphics[width=\columnwidth]{figures/iterations_source_resnet_MNPI_final.pdf}
\caption{Transferability of gradient stabilization attacks.}
\label{fig:gradient_app}
\end{figure}

\begin{figure}[h]
\centering
\includegraphics[width=\columnwidth]{figures/iterations_source_resnet_final.pdf}

\caption{Transferability of input augmentation attacks.}
\label{fig:copy_5_app}
\end{figure}

\begin{figure*}[!t]
\centering
\includegraphics[width=0.9\textwidth,height=5.2cm]{figures/model_output_distribution_1.pdf}
\includegraphics[width=0.9\textwidth,height=5.2cm]{figures/model_output_distribution_2.pdf}
\includegraphics[width=0.9\textwidth,height=5.2cm]{figures/model_output_distribution_3.pdf}
\includegraphics[width=0.9\textwidth,height=6.3cm]{figures/model_output_distribution_4.pdf}

\caption{Top-5 frequent class predictions calculated over 5000 adversarial images for different attacks.}
\label{fig:dis}
\end{figure*}

\section{Systematic Analyses of Transfer Attacks}
\label{sec:ana}

In this section, we conduct systematic analyses of the five categories of attacks.
In each category, similar attacks are systematically compared along a single dimension with other fairly set factors.
In particular, each attack method is implemented with only its core algorithm, although it may integrate other algorithms for achieving better transferability when it was originally proposed.
These analyses also help us determine the attack hyperparameter settings required for our comprehensive evaluation in Section~\ref{sec:eva-res-trans}.

\subsection{Analysis of Gradient Stabilization Attacks}
\label{sec:attack-gs}
Figure~\ref{fig:gradient} (Top) shows the transferability of the three gradient stabilization attacks under various iterations.
As can be seen, all three attacks converge very fast, within 10 iterations, since they accumulate gradients with the momentum.
However, using more iterations does not improve and may even harm the performance.
This finding indicates that in practice, we should early stop such attacks in order to ensure optimal transferability.
More specifically, PI and NI perform better than MI due to the use of looking ahead, but NI is better only at the beginning.

The only difference between PI and NI is the maximum number of previous iterations used to look ahead.
To figure out the impact of the number of look-ahead iterations, we repeat the experiments with values from 1 (i.e., PI) to 100 (i.e., NI).
Figure~\ref{fig:gradient} (Bottom) shows that the performance drops more as more previous iterations are incorporated to look ahead, and the optimal performance is actually achieved by PI.

\begin{figure}[!t]
\centering
\includegraphics[width=\columnwidth]{figures/iterations_source_incv3_MNPI_final.pdf}
\includegraphics[width=\columnwidth]{figures/iterations_source_incv3_history_final.pdf}
\caption{\textbf{Results for gradient stabilization attacks.} \textbf{Top:} Transferability for various iterations.
\textbf{Bottom:} Influence of the number of look-ahead iterations.}
\label{fig:gradient}
\end{figure}

\begin{figure}[!t]
\centering
\includegraphics[width=\columnwidth]{figures/iterations_source_incv3_final.pdf}
\includegraphics[width=\columnwidth]{figures/source_incv3_copies_bar_final.pdf}
\caption{\textbf{Results for input augmentation attacks.} \textbf{Top:} Transferability for various iterations. All attacks are implemented with five random copies. \textbf{Bottom:} Impact of the number of transformed input copies.}
\label{fig:copy_5}
\end{figure}

\subsection{Analysis of Input Augmentation Attacks}
\label{sec:attack-ia}
Figure~\ref{fig:copy_5} (Top) shows the transferability of the five input augmentation attacks for various iterations.
Previous evaluations of input augmentation attacks often conduct unfair comparisons because different attacks may leverage a different number of random input copies~\cite{wang2021admix}.
Differently, we compare all attacks with the same number of random input copies.
Surprisingly, we find that the earliest method, DI, performs the best in all cases.
Another early method, TI, often achieves the second-best results.

To further explore the impact of the number of random input copies, we repeat the experiments with various numbers of random input copies.
In Figure~\ref{fig:copy_5} (Bottom), we see that the transferability of all attacks is improved when more copies are used.
In addition, the superiority of DI and TI consistently holds in all settings.
This suggests the superiority of spatial transformations (i.e. resizing\&padding in DI and translation in TI) over other transformations, such as pixel scaling in SI, additive noise in VT, and image composition in Admix.
Note that more copies generally consume  more computational resources.

\begin{figure}[!t]
\centering
\includegraphics[width=\columnwidth]{figures/Intermediate_Attacks_resnet50.pdf}
\includegraphics[width=\columnwidth]{figures/resnet50_layers_bar.pdf}
\caption{\textbf{Results for feature disruption attacks.} \textbf{Top:} Transferability for various iterations. TAP uses all layers and the others use ``conv3\_x''. \textbf{Bottom:} Impact of the layer choice.}
\label{fig:intermediate_resnet50}
\end{figure}

\subsection{Analysis of Feature Disruption Attacks}
Figure~\ref{fig:intermediate_resnet50} (Top) shows the transferability of the five feature disruption attacks for various iterations.
We see that FIA and NAA, which exploit feature importance, achieve the best results.
In addition, ILA and TAP perform well, by incorporating the CE loss into their feature-level optimizations.
Finally, AA performs worse than the baseline since it only uses a feature loss.

Since all these attacks, except TAP, only disrupt features in a specific layer, we explore the impact of layer choice.
In Figure~\ref{fig:intermediate_resnet50} (Bottom), we see that the last layer (``conv5\_x'') performs much worse than the early layers.
This might come from the last layer being too complex and model-specific, which results in poor generalizability to unseen models.
Moreover, the mid layer (``conv3\_x'') always achieves the best performance since it can learn more semantic features but earlier layers normally capture simple features, e.g., colors and textures~\cite{zeiler2014visualizing}.

\begin{figure}[!t]
\centering
\includegraphics[width=\columnwidth]{figures/iter_surrogateR_resnet.pdf}
\includegraphics[width=\columnwidth]{figures/model_property.pdf}
\caption{\textbf{Results for surrogate refinement attacks.} \textbf{Top:} Transferability for various iterations.
\textbf{Bottom:} Impact of the surrogate property. For all five metrics, higher is better.
}
\label{fig:surrogateR_resnet50}
\end{figure}

\subsection{Analysis of Surrogate Refinement Attacks}
Figure~\ref{fig:surrogateR_resnet50} (Top) shows the transferability of the five surrogate refinement attacks for various iterations.
Here ResNet-50~\cite{he2016deep} is used as the surrogate model for a fair comparison since SGM~\cite{wu2020skip} can only be applied to architectures with skip connections.
We see that IAA achieves the best results since it optimizes the hyperparameters of skip connections and continuous activation functions.
In addition, RFA achieves much lower performance (sometimes even lower than the baseline attack) since the standard target and robust surrogate models may rely on distinct features~\cite{ilyas2019adversarial}.

Model refinement opens a direct way to explore the impact of specific model properties of the surrogate on transferability.
Thus we look into model properties in terms of two common metrics: accuracy and interpretability, as well as model similarity to the target model.
Specifically, interpretability is measured by Average Drop/Increase~\cite{chattopadhay2018grad} based on GradCAM~\cite{selvaraju2017grad}, and model similarity is measured based on the Kullback-Leibler divergence of output features following~\cite{inkawhich2020transferable}.
Note that we additionally refine the surrogate models in LinBP and SGM during the forward pass following the same hyperparameters used in backpropagation.
Figure~\ref{fig:surrogateR_resnet50} (Bottom) shows that there is mostly a negative correlation between the transferability and all the other metrics.
Specifically, the accuracy and interpretability results indicate that transferability may be at odds with common model performance.
Moreover, the model similarity results indicate that high transferability does not necessarily come from high similarity.

\subsection{Analysis of Generative Modeling Attacks}
Generative modeling attacks can generate perturbations for any given image with only one forward pass.
These perturbations output from the generator are initially unbounded and then clipped to satisfy the imperceptibility.
This means that once trained, the generator can be used to generate perturbations under various constraints.
Figure~\ref{fig:gen_test} (Top) shows the transferability of the five generative modeling attacks under various perturbation bounds.
For the targeted attack TTP, we calculate its untargeted transferability over 5000 targeted adversarial images that are generated following the 10-Targets setting~\cite{naseer2021generating}.
As can be seen, the transferability generally increases as the perturbation constraint is relaxed.
It is also worth noting that under strict perturbation constraints, GAPF largely outperforms other attacks, probably due to the use of feature disruptions.

\begin{figure}[!t]
\centering
\includegraphics[width=\columnwidth]{figures/GAN_test_bound_curve_final.pdf}
\includegraphics[width=\columnwidth]{figures/GAP_train_test_bound_curve_final.pdf}
\caption{\textbf{Results for generative modeling attacks.} \textbf{Top:} Transferability for various perturbation budgets. \textbf{Bottom:} Impact of the training perturbation bound, for GAP attack.}
\label{fig:gen_test}
\end{figure}

When training the generator, existing work commonly adopts the perturbation bound $\epsilon_{\textrm{train}}=10$.
For this reason, it is worth exploring the impact of this training perturbation bound on attack transferability.
Thus, we re-train the GAP generator with various $\epsilon_{\textrm{train}}$ and test these generators across different perturbation bounds $\epsilon_{\textrm{test}}$.
Figure~\ref{fig:gen_test} (Bottom) shows that adjusting $\epsilon_{\textrm{train}}$ has a substantial impact in general.
Another unexpected finding is that using the same bound for training and testing (i.e., $\epsilon_{\textrm{train}}=\epsilon_{\textrm{test}}$) does not lead to better results, especially when the bound is large.
Instead, using a moderate $\epsilon_{\textrm{train}}$ (i.e. 8-16) leads to the best results, which also suggests that the commonly used 10 in existing work is indeed optimal.

\section{New Attack Categorization}
\label{sec:cate-trans-attack}

In this section, we categorize transfer attacks into five categories: gradient stabilization, input augmentation, feature disruption, surrogate refinement, and generative modeling.
These five categories are \emph{disjoint}, i.e., each attack falls into \emph{only one} category according to its core working mechanism.
In this way, attacks that share the same working mechanism can be systematically compared along a single dimension with other factors fairly controlled.
In contrast, existing work often combines attack methods from different categories for the best transferability but lacks systematic comparisons of similar attacks in the same category.
Note that our categorization does not include the surrogate ensemble attacks~\cite{liu2017delving,li2020learning} since they are generally applicable and normally require multiple surrogate models.

\subsection{Gradient Stabilization Attacks}
Different DNN model architectures tend to yield radically different decision boundaries, yet similar test accuracy, due to their high non-linearity~\cite{liu2017delving,somepalli2022can}.
For this reason, the attack gradients calculated on a specific model may cause the adversarial images to trap into local optima, resulting in low transferability to another, unseen model.
To address this issue, several studies adopt popular machine learning techniques for stabilizing iterative gradient updates.
Specifically, a momentum term can be integrated into the attack optimization to accumulate previous gradients~\cite{dong2018boosting}, and a Nesterov accelerated gradient (NAG) term can be integrated to look ahead~\cite{lin2020nesterov}.
The property of NAG is later examined in~\cite{wang2021boosting}, where using only the last gradient is found to be better than using all previous gradients.

\subsection{Input Augmentation Attacks}
Learning adversarial images that can transfer to unseen models follows a similar principle to learning models that can generalize to unseen test images~\cite{liang2021uncovering}.
For this reason data augmentation, as a common technique for improving model generalizability, is exploited to improve attack transferability.
To this end, several studies force the adversarial effects to be invariant to
certain semantic-preserving image transformations, such as geometric transformations (e.g., resizing \& padding~\cite{xie2019improving} and translation~\cite{dong2019evading}), pixel value scaling~\cite{lin2020nesterov}, random noise~\cite{wang2021enhancing}, and mixed images from other classes~\cite{wang2021admix}.
Several recent studies also explore more complex methods that refine the above transformations~\cite{zou2020improving,yuan2022adaptive}, leverage regional (object) information~\cite{li2020regional,byun2022improving,wei2022incorporating}, or rely on frequency-domain image transformations~\cite{long2022frequency}.

\subsection{Feature Disruption Attacks}
Conventional attacks naturally adopt the output-level, cross-entropy (CE) loss since they aim at misclassification.
However, the output-level information is often model-specific.
In contrast, features extracted from DNN intermediate layers are known to be more generic~\cite{yosinski2014transferable,kornblith2019similarity}.
Inspired by this fact, several studies propose to improve attack transferability based on feature disruptions.
The general objective is to modify the image such that its feature is pushed away from the original feature.
Specifically, early attacks treat all features indiscriminately~\cite{naseer2018task,zhou2018transferable,ganeshan2019fda,huang2019enhancing,liu2019s,li2020yet}, which is shown to cause sub-optimal attack transferability because the model decision may only depend on a small set of important features~\cite{zhou2016learning}.
For this reason, later attacks~\cite{wu2020boosting,wang2021feature,zhang2022improving} instead calculate the feature distance only on important features that are computed based on model interpretability techniques~\cite{selvaraju2017grad,sundararajan2017axiomatic}.
Feature disruption is also explored for targeted attacks, where the image is modified such that its feature becomes more similar to a target image~\cite{inkawhich2019feature} or image distribution~\cite{inkawhich2020transferable,inkawhich2020perturbing}.

\begin{table*}[!t]
\caption{Overview of the selected attacks.}
\newcommand{\tabincell}[2]{\begin{tabular}{@{}#1@{}}#2\end{tabular}}

\renewcommand{\arraystretch}{1}
      \centering
      \resizebox{\textwidth}{!}{
        \begin{tabular}{ccccc}
\toprule[1pt]
\tabincell{c}{Gradient\\Stabilization}&\tabincell{c}{Input\\Augmentation}&\tabincell{c}{Feature\\Disruption}&\tabincell{c}{Surrogate\\Refinement}&\tabincell{c}{Generative\\Modeling}\\
\midrule

&DI~\cite{xie2019improving} (CVPR'19)&TAP~\cite{zhou2018transferable} (ECCV'18)&SGM~\cite{wu2020skip} (ICLR'20)&GAP~\cite{poursaeed2018generative} (CVPR'18)\\
MI~\cite{dong2018boosting} (CVPR'18)&TI~\cite{dong2019evading} (CVPR'19)&AA~\cite{inkawhich2019feature} (CVPR'19)&LinBP~\cite{guo2020backpropagating} (NeurIPS'20)&CDA~\cite{naseer2019cross} (NeurIPS'19)\\
NI~\cite{lin2020nesterov} (ICLR'20)&SI~\cite{lin2020nesterov} (ICLR'20)&ILA~\cite{huang2019enhancing} (ICCV'19)&RFA~\cite{springer2021little} (NeurIPS'21)&TTP~\cite{naseer2021generating} (ICCV'21)\\
PI~\cite{wang2021boosting} (BMVC'21)&VT~\cite{wang2021enhancing} (CVPR'21)&FIA~\cite{wang2021feature} (ICCV'21)&IAA~\cite{zhu2021rethinking} (ICLR'22)&GAPF~\cite{kanth2021learning} (NeurIPS'21)\\
&Admix~\cite{wang2021admix} (ICCV'21)&NAA~\cite{zhang2022improving} (CVPR'22) &DSM~\cite{yang2022boosting} (arXiv'22)&BIA~\cite{zhang2022beyond} (ICLR'22)\\
\bottomrule[1pt]
\end{tabular}
}
\label{tab:attack}
\end{table*}

\begin{table}[!t]
\caption{Overview of the selected defenses.}
\newcommand{\tabincell}[2]{\begin{tabular}{@{}#1@{}}#2\end{tabular}}

\renewcommand{\arraystretch}{1}
      \centering
      \resizebox{1\columnwidth}{!}{
        \begin{tabular}{ccc}
\toprule[1pt]

\tabincell{c}{Input\\Pre-processing}&\tabincell{c}{Purification\\Network}&\tabincell{c}{Adversarial\\Training}\\
\midrule
BDR~\cite{xu2017feature} (NDSS'18)&HGD~\cite{liao2018defense} (CVPR'18)&AT$_{\infty}$~\cite{xie2019feature} (CVPR'19)\\
PD~\cite{prakash2018deflecting} (CVPR'18)&NRP~\cite{naseer2020self} (CVPR'20)&FD$_{\infty}$~\cite{xie2019feature} (CVPR'19)\\
R\&P~\cite{xie2017mitigating} (ICLR'18)&DiffPure~\cite{nie2022diffusion} (ICML'22)&AT$_{2}$~\cite{salman2020adversarially} (NeurIPS'20) \\

\bottomrule[1pt]
\end{tabular}}
\label{tab:defense}
\end{table}

\subsection{Surrogate Refinement Attacks}
The current CNN models are commonly optimized towards high prediction accuracy but with much less attention given to transferable representations.
Several recent studies find that adversarial training can help pre-trained models better transfer to downstream tasks, although it inevitably trades off model accuracy in the source domain~\cite{salman2020adversarially,deng2021adversarial,utrera2021adversarially}.
This finding encourages researchers to explore how the attack transferability can be improved based on refining the surrogate model in diverse aspects, such as training procedures~\cite{springer2021little,zhang2021early,yang2022boosting}, local architectures~\cite{wu2020skip,zhu2021rethinking}, and activation functions~\cite{guo2020backpropagating,zhang2021backpropagating,zhu2021rethinking}.
This line of research also leads to rethinking the relation between the accuracy of the surrogate model and the transferability~\cite{zhang2021early,zhu2021rethinking}.

\subsection{Generative Modeling Attacks}
In addition to the above iterative attacks, existing work also uses generative models to improve transferability.
Basically, an image generator is learned on additional data such that it can take as input any original image and outputs an adversarial image with only one forward pass.
During training, the generator is optimized to fool a discriminator, which is a pre-trained fixed classifier.
Specifically, the earliest generative attack~\cite{poursaeed2018generative} adopts the widely-used cross-entropy loss.
Later studies improve it by adopting a relativistic cross-entropy loss~\cite{naseer2019cross} or intermediate-level, feature losses~\cite{kanth2021learning,zhang2022beyond}.
In particular, to improve targeted transferability, class-specific~\cite{naseer2021generating} and class-conditional~\cite{yangx2022boosting} generators are also explored.
In general, a clipping operation is applied during training to constrain the perturbation size.

\section{Conclusion}
\label{sec:conc}

In this paper, we have designed good practices in evaluating transfer adversarial attacks.
First, a new attack categorization is proposed to facilitate our systematic and fair analyses of transfer attacks.
The analyses also provide interesting observations that complement or even challenge existing knowledge.
Furthermore, we present a comprehensive evaluation of 23 representative transfer attacks against 9 defenses on ImageNet.
Our extensive evaluation results lead to valuable new insights into both attack transferability and stealthiness.
Our work aims to give a thorough picture of the current progress of transfer attacks, and we hope that it can guide future research towards a more meaningful evaluation of transfer adversarial attacks.

\section{Evaluation Methodology}
\label{sec:eva-met}
In this section, we present data, models, attack/defense methods, as well as evaluation metrics for transferability and stealthiness.

\subsection{Evaluation Settings}
\noindent\textbf{Data and models.}
We focus our evaluation on the challenging dataset ImageNet, because attack transferability on small datasets (e.g., MNIST and CIFAR) has been well solved~\cite{inkawhich2019feature}, and it is interesting to explore the visual characteristics of large-resolution (adversarial) images.
We consider four different model architectures: Inception-V3~\cite{szegedy2016rethinking}, ResNet-50~\cite{he2016deep}, DenseNet-121~\cite{huang2017densely}, and VGGNet-19~\cite{simonyan2015very}.
We randomly select 5000 images (5 per class\footnote{Several classes contain fewer than 5 eligible images.}) from the validation set that are correctly classified by all the above four models.
All original images are resized and then cropped to the size of 299$\times$299 for Inception-V3 and 224$\times$224 for the other three models.
Note that we do not pre-process the adversarial images as we discuss input pre-processing as a defense in the evaluation.

\noindent\textbf{Attacks and defenses.} For each of the five attack categories presented in Section~\ref{sec:cate-trans-attack}, we select 5 representative attacks (but only 3 for gradient stabilization), resulting in a total number of 23 attacks, as summarized in Table~\ref{tab:attack}.
Following the common practice, the $L_{\infty}$ norm bound is set to $\epsilon=16/255$.
In addition to testing against standard models, we also consider 9 representative defenses from three different categories, as summarized in Table~\ref{tab:defense}.
Note that these defenses are not designed against specific (categories of) attacks but is generally applicable.
Detailed descriptions and hyperparameter settings of the selected attacks and defenses can be found in Appendix~\ref{app:att_def}.

\subsection{Evaluation Metrics for Transferability}
We measure the attack transferability at both the coarse- and fine-grained levels.
At the coarse level, we follow the common practice to measure the (untargeted) attack success rate.
Given an attack $\mathcal{A}$ that generates an adversarial image $\boldsymbol{x}'_i$ for its original image with the true class label $y_i$, and the target classifier $f$, the success rate is defined as:
\begin{gather}\label{eq:suc}
     \mathrm{Suc}(\mathcal{A})=\frac{1}{N}\sum_{i=1}^{N}\mathbf{1}\big(f(\boldsymbol{x}'_i)\neq y_i\big),
\end{gather}
where $N$ is the size of the test set, and $\mathbf{1}(\cdot)$ is the indicator function.
At the fine-grained level, we measure the ranking position $p$ (starting from 1) of the true class label $y_i$ in the prediction list $\boldsymbol{R}$ of the target classifier~\cite{ganeshan2019fda,zhang2022investigating}:
\begin{gather}\label{eq:rank}
     \mathrm{Rank}(\mathcal{A})=\frac{1}{N}\sum_{i=1}^{N}\{p|\boldsymbol{R}_p(\boldsymbol{x}'_i)=y_i\}.
\end{gather}

\subsection{Evaluation Metrics for Stealthiness}

The imperceptibility is measured by a variety of advanced perceptual metrics, such as Root Mean Squared Error (RMSE), Peak Signal-to-Noise Ratio (PSNR), Structural Similarity Index Measure (SSIM)~\cite{wang2004image}, $\Delta E$~\cite{luo2001development,zhao2020towards}, Learned Perceptual Image Patch Similarity (LPIPS)~\cite{zhang2018unreasonable}, and Frechet Inception Distance (FID)~\cite{szegedy2016rethinking}.
Detailed definitions of these metrics can be found in Appendix~\ref{app:metric}.
Beyond imperceptibility, we also look into other, finer-grained stealthiness characteristics regarding the perturbation and misclassification (see Section~\ref{sec:eva-res-stea} for details).

\section{Introduction}
\label{sec:intro}
\renewcommand{\thefootnote}{\arabic{footnote}}
Deep Neural Networks (DNNs) have achieved great success in various machine learning tasks.
However, they are known to be vulnerable to \textit{adversarial attacks}, which intentionally perturb model inputs to induce prediction errors~\cite{biggio2013evasion,szegedy2014intriguing}.
Adversarial attacks have been explored in white-box scenarios to evaluate worst-case model robustness as well as the black-box scenarios to understand real-world adversarial threats.

Black-box attacks can be divided into query-based and transfer-based attacks.
Query-based~\cite{chen2017zoo,brendel2018decision,ilyas2018black,guo2019simple,chen2020hopskipjumpattack} attacks need to sequentially query the target model multiple times.
Since these queries are near-duplicates, the attack is easy to expose by simply monitoring the query history~\cite{chen2020stateful}.
In a more realistic scenario, transfer attacks can work without accessing the target model but only transfer their adversarial effects from a local surrogate model.
As a result, studying transfer attacks is more appropriate to understand real-world adversarial threats.

However, we find that existing evaluations of transfer attacks are limited in two main aspects.
First, existing evaluations are often \emph{unsystematic} and sometimes even \emph{unfair}.
Specifically, existing evaluations often simply add new attack methods to old ones to achieve the best transferability but with limited comparisons to similar methods.
Even when similar methods are compared, existing evaluations sometimes lack fair hyperparameter settings (see details in Section~\ref{sec:eva-res-trans}).
In addition, existing evaluations mainly focus on relatively simple attack settings involving only standard target models and weak defenses, such as the FGSM-based adversarial training~\cite{tramer2017ensemble}).
Second, existing evaluations mainly focus on the attack strength, i.e. \emph{transferability}, but largely overlook another key attack property: \emph{stealthiness}.
Specifically, the stealthiness is addressed only by the $L_p$-based imperceptibility of image perturbations.
Using only $L_p$ norms may be sufficient for evaluating white-box attacks but becomes less meaningful when larger perturbations are required~\cite{sharif2018suitability,tramer2020fundamental}, as in transfer attacks.
In particular, a recent study~\cite{chen2021measuring} notices that the transferability of $L_{\infty}$-bounded attacks is actually highly correlated with the $L_{\infty}$ norms of their image perturbations.
Moreover, other stealthiness measures beyond imperceptibility are not well explored.

In this work, we address the above limitations by designing good practices in evaluating transfer adversarial attacks.
We first introduce a new attack categorization to systematically and fairly analyze similar attack methods following specific criteria in each category.
Our analyses lead to new findings that complement or even challenge existing knowledge.
For example, we find that for input augmentation attacks, the early attack method Diversity Input (DI)-FGSM~\cite{xie2019improving} surprisingly outperforms all subsequent methods by a large margin when they are compared fairly with the same number of input copies.
Furthermore, we present a comprehensive evaluation of 23 representative attacks against 9 defenses on 5000 ImageNet images.
In particular, we pay large attention to attack stealthiness, by adopting five diverse imperceptibility metrics beyond the $L_p$ norms and also deeply investigating the finer-grained characteristics of the perturbation and misclassification.

Our evaluation results lead to new important insights:
Regarding transferability, the optimal attack performance against one specific defense may not generalize to another.
In particular, some defenses may largely overfit to the attacks that are used in defense optimization.
For example, DiffPure~\cite{nie2022diffusion}, which claims high white-box robustness, is actually vulnerable to (black-box) transfer attacks with robust perturbations.
Regarding stealthiness,~\emph{all} transfer attacks are indeed less imperceptible than the baseline PGD attack.
Moreover, attacks under the same $L_{\infty}$ bound yield dramatically different imperceptibility scores and finer-grained stealthiness characteristics.

\subsection{Stealthiness Results}
\label{sec:eva-res-stea}

Table~\ref{tab:imper} reports the imperceptibility results for different attacks following five perceptual metrics.
We make the following observations.
\textbf{All existing attacks indeed sacrifice imperceptibility to improve transferability.} Although all attacks share the same $L_{\infty}$ norm, all transfer attacks lead to more perceptible perturbations than the PGD baseline in almost all cases.
One exception is that RFA achieves the highest SSIM score since it introduces semantics-aligned perturbations rather than disrupting the image structures like DI, as shown in  Figure~\ref{fig:vis} left.
\textbf{Generative modeling attacks are the most perceptible.} In particular, their high FID scores suggest the dramatic distribution shift between their adversarial and original images.
This property can also be confirmed by Figure~\ref{fig:vis} right, where different CDA images actually lead to similar, image-agnostic perturbations.

\begin{figure}[!t]
\centering
\includegraphics[width=\columnwidth]{figures/confusion_matrix.pdf}
\caption{Results of attack perturbation classification.
}
\label{fig:confusion}
\end{figure}

\begin{figure}[!t]
\centering
\includegraphics[width=\columnwidth,height=3.5cm]{figures/model_output_distribution_main.pdf}
\caption{Top-5 frequent class predictions calculated over 5000 adversarial images for five categories of attacks. The complete results of all attacks can be found in Appendix~\ref{app:results}.
}
\label{fig:dis_main}
\end{figure}

In order to shed more light on the perturbation characteristics, we further explore whether different attacks can be simply differentiated based only on their perturbations.
To this end, we select 500 adversarial images per attack with 400 for training a ResNet18 classifier and the rest 100 for testing.
Figure~\ref{fig:confusion} shows that the perturbations generated by different attacks are indeed well separable.
This separability implies that it is possible to trace back the root cause of a successful attack by analyzing its left image perturbations, as in image forensics~\cite{fridrich2009digital}.
We can also find that attacks within the same category are less separable from each other compared to those in different categories.

In addition to the perturbation characteristics, we also look into the characteristics of misclassification for different attacks.
As can be seen from Figure~\ref{fig:dis_main}, different attack categories lead to different patterns in their resulting model prediction results.
Specifically, gradient stabilization and input augmentation attacks lead to relatively uniform class distributions, and the most frequent class is usually related to semantics that reflect textural patterns, such as ``brain coral''.
In contrast, the other three categories of attacks yield more concentrated class predictions, and especially, generative modeling attacks (e.g., CDA) fool the model to misclassify almost all images into ``harp''.
Such obvious differences also imply the possibility of attack traceback, based on misclassification patterns.

\section{Threat Model}
\label{sec:thr}
Adversarial attacks on image classification can be briefly formulated as follows.
Given a classifier $f(\boldsymbol{x}):\boldsymbol{x}\in\mathcal{X}\to y\in\mathcal{Y}$ that predicts a label $y$ for an original image $\boldsymbol{x}$, an adversary generates an adversarial image $\boldsymbol{x}'$ by perturbing $\boldsymbol{x}$.
Following the common practice~\cite{papernot2016limitations,biggio2018wild,carlini2019evaluating}, we specify our threat model from three dimensions: adversary's knowledge, adversary's goal, and adversary's capability,

\subsection{Adversary's Knowledge}
An adversary can have various levels of knowledge about the target model.
In the ideal, white-box scenario, an adversary has full control over the target model.
In the realistic, black-box scenario, an adversary has either query access to the target model or in our transfer setting, no access but can only leverage a surrogate model.
In this work, we focus on the most common transfer setting in which the surrogate and target models are trained on the same public dataset (here ImageNet) but with different architectures.
Note that there are also a few studies exploring cross-dataset transferability~\cite{naseer2019cross,zhang2022beyond}, which is beyond the scope of this work.

\subsection{Adversary's Goal}
An adversary focuses on one of two types of misclassification: \textit{untargeted} or \textit{targeted}.
An untargeted attack aims to fool the classifier into predicting any incorrect class other than the original one, i.e. $f(\boldsymbol{x}')\neq{y}$.
A targeted attack aims at a specific incorrect class $t$, i.e. $f(\boldsymbol{x}')=t$.
The targeted goal is strictly more challenging because a specific (target) direction is required, while many (including random) directions suffice for untargeted success.
In this work, we follow most existing work to focus on the untargeted goal since targeted transferability remains an open problem~\cite{zhao2021success,naseer2021generating}.
Beyond misclassification, we further consider a fine-grained metric that reports the ranking position of the true class in the target model's prediction list.

\subsection{Adversary's Capability}
In practice, the capability of an adversary should be the constraint of staying stealthy.
Most existing research addresses this constraint by pursuing small, imperceptible image perturbations following specific metrics: typically $L_p$ norms~\cite{carlini2017towards,goodfellow2014explaining,kurakin2016adversarial,szegedy2013intriguing,papernot2016limitations} but sometimes other metrics~\cite{rozsa2016adversarial,Croce_2019_ICCV,luo2018towards,zhang2020smooth,xiao2018spatially,kanbak2018geometric,alaifari2018adef,wong2019wasserstein,zhao2020towards}.
In this work, we follow the common practice to impose the $L_{\infty}$ norm bound to achieve imperceptible perturbations.
Moreover, we measure the perturbation size based on more advanced perceptual metrics.
Beyond imperceptibility, we further look into other aspects of attack stealthiness, such as perturbation characteristics and misclassification characteristics.
Note that there are also other recent studies exploring the transferability of ``perceptible yet stealthy'' adversarial images~\cite{bhattad2020Unrestricted,shamsabadi2020colorfool,zhao2020adversarial_arxiv}, which is beyond the scope of this work.

It is worth noting that the constraint on the attack budget is also important.
In particular, unreasonably limiting the iteration number of attacks is shown to be one of the major pitfalls in evaluating adversarial robustness~\cite{carlini2019evaluating,tramer2020adaptive,zhao2021success}.
In this work, to avoid this problem, we ensure attack convergence by using enough iterations for iterative attacks and training epochs for generative attacks.

\section{Comprehensive Evaluation Results}
\label{sec:eva-res-trans}

In this section, we evaluate all 23 attacks on their transferability against both standard and defended target models, as well as stealthiness regarding diverse metrics.
Specifically, for gradient stabilization attacks, we set the iteration number to 10 for early stopping, while for the other three categories of iterative attacks, we set the iteration number to 50 to ensure attack convergence.
For input augmentation attacks, we set the number to 5 to offer a good trade-off between performance and computations.

\subsection{Transferability Results}
Table~\ref{tab:transfer} summarizes the evaluation results in both the standard transfer and defense settings.
In general, we find that the optimal performance of one category of attack/defense against one category of defense/attack may not  generalize well to another.
Moreover, we make the following specific observations.

From the attack perspective: \textbf{New model design largely boosts attack performance.}
The generative modeling and surrogate refinement attacks, which design new (surrogate or generative) models, achieve the best results in almost all cases, in contrast to the other attacks, which instead use off-of-shelf surrogate models.
In particular, IAA performs much better than the other methods in terms of pushing down the ranking positions of the true label since it fundamentally disrupts the data distribution~\cite{zhu2021rethinking}.
\textbf{Transferring from ResNet50 to Inception-v3 is harder than to other architectures.} This is consistent with previous findings in~\cite{inkawhich2020transferable,inkawhich2020perturbing,zhao2021success} and might be due to the fact that the Inception architecture contains relatively complex components, e.g., multiple-size convolution and two auxiliary classifiers.

From the defense perspective: \textbf{Adversarial training is generally effective but input pre-processing is not.} Both the two $L_{\infty}$ adversarial training defenses, AT$_{\infty}$ and FD$_{\infty}$, are consistently effective against all attacks except RFA, which uses an adversarially-trained surrogate model for generating robust perturbations.
The performance of AT$_{2}$ is also not sensitive to the attack method but sub-optimal due to the use of a different, $L_2$ norm.
In contrast, input pre-processing defenses are generally not useful, although they are known to be effective against white-box attacks where the perturbations are much smaller~\cite{xu2017feature,xie2017mitigating}.
\textbf{Defenses may severely overfit to the type of perturbations that are seen during their optimization.}
First, we notice that NRP is very effective in mitigating smooth perturbations (e.g., generative perturbations) but performs much worse against other attacks that generate high-frequency, structured perturbations, see Figure~\ref{fig:vis} and our GitHub repository for perturbation visualizations.
In fact, the NRP purification network is also trained on relatively smooth perturbations that are optimized in the feature space ~\cite{naseer2020self}.
Second, DiffPure is originally claimed to provide state-of-the-art white-box robustness~\cite{nie2022diffusion}.
However, we find that surprisingly, black-box transfer attacks (e.g., RFA and CDA) can effectively mitigate DiffPure.
This might be because the Gaussian noise used in the diffusion model of DiffPure is not capable of denoising the semantic perturbations generated by RFA and CDA.
More generally, our finding suggests that \textit{DiffPure provides a false sense of security and requires a rightful evaluation following recommendations from}~\cite{athalye2018obfuscated,carlini2019evaluating,tramer2020adaptive}.
The superiority of NRP over DiffPure in denoising the smooth, CDA perturbations is also confirmed by the visualizations in Figure~\ref{fig:pure}.

\begin{figure}[!t]
\centering
\begin{subfigure}[b]{0.16\columnwidth}
\includegraphics[width=\columnwidth]{figures/data_resnet152_CDA_ILSVRC2012_val_00043962_adv.png}
\caption*{CDA}
\end{subfigure}
\hspace{-0.15cm}
\begin{subfigure}[b]{0.16\columnwidth}
\includegraphics[width=\columnwidth]{figures/data_resnet152_CDA_ILSVRC2012_val_00043962_adv_NRP.png}
\caption*{NRP}
\end{subfigure}
\hspace{-0.15cm}
\begin{subfigure}[b]{0.16\columnwidth}
\includegraphics[width=\columnwidth]{figures/CDA_ILSVRC2012_val_00043962_adv_DiffPure.png}
\caption*{DiffPure}
\end{subfigure}
\hspace{0.1cm}
\begin{subfigure}[b]{0.16\columnwidth}
\includegraphics[width=\columnwidth]{figures/data_resnet152_CDA_ILSVRC2012_val_00025507_adv.png}
\caption*{CDA}
\end{subfigure}
\hspace{-0.15cm}
\begin{subfigure}[b]{0.16\columnwidth}
\includegraphics[width=\columnwidth]{figures/data_resnet152_CDA_ILSVRC2012_val_00025507_adv_NRP.png}
\caption*{NRP}
\end{subfigure}
\hspace{-0.15cm}
\begin{subfigure}[b]{0.16\columnwidth}
\includegraphics[width=\columnwidth]{figures/CDA_ILSVRC2012_val_00025507_adv_DiffPure.png}
\caption*{DiffPure}
\end{subfigure}

\caption{NRP can effectively denoise the CDA perturbations but DiffPure cannot.}
\label{fig:pure}
\vspace{-0.5cm}
\end{figure}

redpajama_set_name: RedPajamaArXiv


Our customer needed a shell scheme centred in one of the several rooms reserved for their recruitment expo at the Assembly Rooms in Edinburgh.
They preferred our panels due to the attractive finish, neutral grey colour, and flexibility and sturdiness.
The final set up requirements had to be changed a couple of times due to changes with exhibitors, but this is always to be expected, and our customer had a very successful event.


This is something to celebrate, not just me, a lot of female artists, we are having visibility and a moment.
As a songwriter, as a producer, not just as a musician, not just as an artist who goes on stage and sings, I feel proud. I feel happy.


text:
CEO To Rain Maker
About Host
Host Info
During his distinguished forty year business career, Gene Valdez has successfully started and operated two businesses. He currently is operating his third business , The Loan Doctor Associates, Inc, which is a business coaching, business finance and strategic planning firm. These services are marketed to CEO's of privately owned small businesses in So. Cal.
Addtionally, Mr.Valdez recently started another business called , Rainmaker Podcast Productions.
This company presents a weekly business educational podcast operating under the name of CEO To Rainmaker.
In addition to his entrepreneurial endeavors, Mr. Valdez was a senior commercial banking executive for 20 years working for such banks as Wells Fargo, Bank of California and Citizens Business Bank.
Mr. Valdez is also a public speaker , business author and adjunct business professor. He has been a guest speaker at several SBA and other business organization conferences. He has written numerous articles on the subject of entrepreneurship for magazines and newspapers such as the LA Times. He was business professor at Oak Valley College in Rialto , California where he taught several entrepreneurship courses and also taught an entrepreneurship course at USC
He earned his BA in psychology from UCLA and an MBA from USC. Mr. Valdez and his wife Anne reside in Upland, CA. and have five children and six grandchildren. Both he and his wife are avid tennis players.
Listen With Your Favorite Podcast App Or Service
gene@ceo2rainmkr.com
Upland, CA 91784 United States of America
Copyright © 2021 | Ceo To Rainmaker | All Rights Reserved
GENE CASTERS
You wouldn't want to skip an update, would you?
How about leaving us with your details now?
Do you wish to receive updates about our new episodes? Do you wish to subscribe to our newsletter?

redpajama_set_name: RedPajamaCommonCrawl


The new Standard is effective for annual reporting periods beginning on or after January 1, 2019, with early application permitted but only if the entity is also applying IFRS 15, Revenue from contracts with customers.
The FASB decided that its lease standard will be effective for public companies with fiscal years (and interim periods within those fiscal years) beginning on or after December 15, 2018. For private companies, the standard will be effective one year later.
Under the new Standard, IFRS 16, Leases, a lessee recognizes a right-of-use asset and a lease liability. The right-of-use asset is treated similarly to other non-financial assets and depreciated accordingly. The liability accrues interest. This will typically produce a front-loaded expense profile (whereas operating leases under IAS 17 would typically have had straight-line expenses).
A front-loaded expense profile arises, for example, when a lessee recognizes: (i) a right of use (ROU) asset which is typically amortized on a straight line basis; and (ii) a liability to pay lease rentals, which would be accounted for like a mortgage loan with higher interest charges in the early years. The combined effect is a front-loaded expense in the income statement, even if the lessee pays the same amount of rent each period.
The lease liability is initially measured at the present value of the lease payments payable over the lease term, discounted at the rate implicit in the lease if that can be readily determined. If that rate cannot be readily determined, the lessee shall use their incremental borrowing rate.
With respect to identifying a lease, a contract is, or contains, a lease if it conveys the right to control the use of an identified asset for a period of time in exchange for consideration. Control is conveyed where the customer has both the right to direct the identified asset's use and to obtain substantially all the economic benefits from that use.
The new Standard includes certain recognition exemptions. Instead of applying the recognition requirements of IFRS 16 described above, a lessee may elect to account for lease payments as an expense on a straight-line basis over the lease term or another systematic basis for the following two types of leases: (i) leases with a lease term of 12 months or less and containing no purchase options – this election is made by class of underlying asset; and (ii) leases where the underlying asset has a low value when new (such as personal computers or small items of office furniture) – this election can be made on a lease-by-lease basis.
IFRS 16 is effective for annual reporting periods beginning on or after January 1, 2019. Earlier application is permitted if IFRS 15, Revenue from Contracts with Customers, has also been applied.
In June 2016, the AcSB included IFRS 16 in the CPA Canada Handbook.
On January 13, 2016, the IASB published a new Standard, IFRS 16, Leases. The new Standard brings most leases on-balance sheet for lessees under a single model, eliminating the distinction between operating and finance leases. Lessor accounting however remains largely unchanged and the distinction between operating and finance leases is retained. The FASB is currently finalizing its new leases standard and is expected to issue it in February 2016. We expect the FASB's new standard on lease accounting will be effective for public business entities for annual periods beginning after December 15, 2018 (i.e., calendar periods beginning on January 1, 2019), and interim periods therein. For all other entities, the standard would be effective for annual periods beginning after December 15, 2019 (i.e., calendar periods beginning on January 1, 2020), and interim periods thereafter. Early adoption would be permitted for all entities. The AcSB currently expects to include IFRS 16 in the CPA Canada Handbook during Q2/2016.
In December 2015, the IASB announced that the final standard is expected on January 13, 2016.
On November 11, 2015, the FASB decided that the upcoming US lease standard will be effective for public companies with fiscal years (and interim periods within those fiscal years) beginning on or after December 15, 2018. For private companies, the standard will be effective one year later. Early adoption will be permitted for all companies and organizations upon issuance of the standard. It is expected that the final standard will be published in early 2016. While the IASB requires early adopters to adopt the revenue standard at the same time as the lease standard, the FASB decided to allow for independent adoption. While the final IASB and the FASB are not expected to be fully converged, both standards will require leased obligations to be added to the statement of financial position.
On October 29, 2015, the IASB staff published a short project update providing an overview of how a lease will be defined in the IASB's new standard on leases. It also includes a working draft of the application guidance and accompanying illustrative examples to be included in the forthcoming standard on the definition of a lease.
On October 21, 2015, the IASB voted on an effective date of January 1, 2019; with early application permitted but only if the entity is also applying IFRS 15, Revenue from contracts with customers.
On March 16, 2015, the IASB published a document that provides an overview of (i) the likely practical effects of the new standard on leases and (ii) the similarities and differences between the IASB's requirements and those of the FASB.
On February 24, 2015, in the interests of providing feedback to stakeholders, the IASB staff published a short Project Update: Definition of a Lease (February 2015). This document explains how a lease would be defined in the new Leases Standard based on the IASB's decisions in redeliberations.
On August 7, 2014, the IASB staff published a document that provides an update on the most important tentative decisions reached on the Leases project during the first half of 2014. The document also explains the IASB's reasons for reaching those decisions and the remaining work to be done in completing the project.
On August 8, 2013, the AcSB issued a revised ED that corresponds to the IASB's 2013 ED.
On May 16, 2013, the IASB and the FASB published for public comment a re-exposure draft (the 2013 ED) of joint proposals to improve the reporting of lease contracts.
On July 2011, the Boards unanimously agreed to re-expose the revised proposals for a common Leases standard. The main areas of change include the lessee accounting model-specifically, how the lessee recognizes lease expense in its statement of comprehensive income for some leases; the lessor accounting model; the accounting for variable lease payments and renewal options; and the definition of a lease.
In October 2010, the AcSB issued an ED that corresponds to the IASB's 2010 ED.
On August 17, 2010, the IASB and the FASB published for public comment an ED of joint proposals to improve the reporting of lease contracts (the 2010 ED).
For a summary of these proposed accounting changes, including the tentative decisions reached to date, refer to the attached link to the Deloitte IFRS Project Insights Summary.
At its meeting on February 15, 2018, the AcSB discussed the IFRS® Discussion Group's recommendation from its January 2018 meeting to consider whether to refer the issue, "IFRS 16: Lease Incentive," to the International Accounting Standards Board (IASB) or IFRS® Interpretations Committee. The Board agreed with the Group that there is a conflict between paragraph 24(b) and Illustrative Example 13 of IFRS 16. The Board also considered the additional information that it directed staff to obtain about the potential effect the issue "IFRS 16 and IAS 34: Variable Lease Payments" could have on entities when adopting IFRS 16. The Board agreed there is merit to the issue and that clarifying the interaction between paragraph 38(b) of IFRS 16, Leases and paragraph B7 of IAS 34 Interim Financial Reporting (i.e., accompanying illustrative example) would help with implementation efforts in practice. For both issues, the AcSB will explore options with the IASB to determine what is the most efficient and effective way to clarify the interaction between the authoritative text in IFRS 16 and the non-authoritative illustrative examples of both IFRS 16 and IAS 34.
At its meeting on November 29, 2016, the IFRS Discussion Group (IDG) considered various transition issues related to the adoption and implementation of IFRS 16. Group members observed that the IASB provided practical expedients to reduce the cost and effort of adopting IFRS 16. While the practical expedients appear to simplify the requirements, for a larger organization with a number of leases there will potentially be a significant number of decision points in going through the transition. Accordingly, preparers could consider modelling the different possible combinations provided under the IFRS 16 transition provisions. The Group's discussion raises awareness about this item. No further action was recommended to the AcSB.
At its meeting on October 20, 2015, the IASB met to finalize deliberations on the new Leases Standard. The IASB specifically discussed: (i) sweep issues that arose as part of the drafting process; and (ii) the effective date of the new Leases Standard. The IASB tentatively decided: (i) to require an entity to apply the new Leases Standard for annual periods beginning on or after January 1, 2019; and (ii) to permit an entity to apply the new Leases Standard early if the entity also applies IFRS 15, Revenue from Contracts with Customers at or before the date of early application. Also, the IASB tentatively decided not to require any disclosures for leases within the scope of IFRS 5, Non-current Assets Held for Sale and Discontinued Operations beyond those required by that Standard. This meeting concluded the deliberations on the new Leases Standard. The staff will proceed to balloting the new Standard.
Most recently, at its meeting on March 17-19, 2015, the IASB continued its redeliberations on the proposals in the 2013 ED, specifically discussing: (i) disclosures on transition (a sweep issue); and (ii) due process, re-exposure and permission to ballot. The IASB members confirmed that they are satisfied that the IASB has completed all of the necessary due process steps on the project to date. The staff will start the balloting process for the new Leases standard and the IASB will discuss the effective date and any sweep issues that arise at a future Board meeting.
At their meeting on July 22-24, 2014, the IASB and the FASB continued redeliberating the proposals in the 2013 ED, specifically discussing the following topics: (i) sale and leaseback transactions; and (ii) lessor disclosure requirements.


I am working on the storm water management of a city, through SWMM. For this to be possible, I need to have the elevation of every drainage element, which I actually do not have. However, I do have the topography of the area I am modelling. If we make the assumption that the drainage elements are situed more or less close to the surface (depending on the elements), is it possible to attribute and interpolate the elevations of my drainage elements with reference to the topography information, or my DEM ?


text:
Q: Select record from table where user is the owner of the company Hi I have this stupid problem but I cannot find a solution.
I want to select a user from the database that is the owner of a provided company.
So it needs to have meta_key = 'owner' and meta_value = '1' but it needs also to have meta_key = 'company' and meta_value = 'company_name'
This is what I came up with and obviously it is not working:
SELECT user_id FROM wp_usermeta
WHERE meta_key = 'owner'
AND meta_value = '1'
AND (meta_key = 'company' AND meta_value = 'company_name');

This is a screen of the table:

A: I can't write a comment, but the meta_key is most likely the column name so this might work:
SELECT
    user_id
FROM wp_usermeta
WHERE owner = '1'
AND company = 'company_name';

A: How about query like this
SELECT
   a.user.id, b.meta_value as company, c.meta_value as owner
FROM
   wp_usermeta a
   JOIN wp_usermeta b ON a.user_id = b.user_id where meta_key=company
   JOIN wp_usermeta c on a.user_id = c.user_id WHERE meta_key=owner

WHERE
   company = 'company_name' AND owner='1'

A: I suspect that you want:
SELECT uo.user_id
FROM wp_usermeta uo JOIN
     wp_usermeta uc
     ON uo.user_id = uc.user_id
WHERE uo.meta_key = 'owner' AND uo.meta_value = '1' AND
      uc.meta_key = 'company' AND uc.meta_value = 'company_name';

redpajama_set_name: RedPajamaStackExchange


Science is supposed to be free from prejudice, but in practice the majority of scientists harbour some taken for granted beliefs. This is what links science to a particular ideological view, with the consequence that it can sometimes become dogmatic and impede rather than further the evolution of human knowledge. Not surprisingly, materialism is the usual choice.
This statement may look scientific but, in fact, it is an ideological statement that contradicts good science. An honest scientist should approach the subject of his research with an open mind, and try to find the most probable explanation for a phenomenon observed. A proper scientific approach cannot demand that phenomena fit into the pre-assumptions of the researcher. The quote shows that the author is more interested in confirming his own views than providing the best possible explanation. Such a demand is not based on any evidence or reasoning, but it presupposes where to look for answers and where not, and rejects a priori any other possibility. This attitude relies on faith as much as any religious attitude. There is nothing more scientific in believing that life is only a complex chemical reaction than in believing that life is more than that. Not surprisingly, materialistic ideology seems to inherit the framework of thinking established by its antecedents. The agency of God is replaced by the deity of chance, but neither of them have a significant explanatory power, they are just an easy way out of difficulties. A religious person may claim that a complex and intricate thing, such as a flower, was engineered by God, a materialist may claim that it is a result of chance mutations. Neither, in fact, explains much.
The likely reason why so many scientists are prepared to accept materialistic ideology without much reflection is because it is convenient. Reducing all the phenomena to 'solid' matter makes their lives much easier. Otherwise, scientists would be forced to concede that their method is not always adequate or sufficient, and they are understandably reluctant to do so. However, as with other rigid frameworks, materialism is not only restraining, but becomes restrictive, which limits science itself. The guardian (against superstition and prejudice) becomes a jailer.
. As Brian Silver, a scientist himself (and an atheist), puts it: 'There is more faith involved in science than many scientists would be prepared to admit' (1998, p. xvi).
. In The Ascent of Science the above writer comments: 'Many of the heroes of the sixteenth- and seventeenth-century scientific revolution were deeply interested in the occult, in the so-called Hermetic writings, and in magic in general; one only has to look at the lives of John Dee, Boyle, Bruno, Paracelsus, Kepler, and many others... Newton, the herald of the Age of Reason himself, believed firmly in the mystic aspects of alchemy and of Pythagorean thought' (Silver, 1998, p.495).
. This may be contrasted, for example, with indeterminacy in quantum physics. Although the idea is not without controversy, it does have an explanatory power.
. This is reflected in the persistency of the mechanistic view of the world: 'With the Einsteinian revolution at the turn of the century physicists had moved irrevocably beyond the mechanistic paradigm. Then, some two decades later, with the advent of quantum theory, they abandoned the last vestiges of classical mechanistic thinking. Yet many scientists, especially in the human, social and engineering fields, remained fascinated by the simplicity and power of the Newtonian formulas' (Laszlo, 1993, p.35).


One common feature of all independent nation-states—both Western and non-Western—is that they possess unique national symbols such as a national flag, a national anthem, a coat of arms, and other banal insignia and emblems to distinguish them from other nation-states. For the newly independent countries that want to emerge from international obscurity, the creation of unique symbols of nationhood is even more pressing. Cerulo notes, "Since the inception of nations, national leaders have embraced and adopted national flags and anthems, using them to create bonds, motivate patriotic action, honor the efforts of citizens, and legitimate formal authority."1 As Ghana prepared to join the dysfunctional family of nations-states in the late 1950s, Kwame Nkrumah utilized the time-tested symbols of nationhood to announce its entry onto the world stage. The Convention People's Party cabinet proposed, commissioned, and supervised the design and selection of official symbols for the party and the nation. These included everything from the party and national flags, anthem, pledge of allegiance, coat of arms, crest, public seal, National Assembly speaker's chair and desk, to police officers' badges and insignia.


text:
Funleader 18mm F/8 Cap Lens Review
https://i0.wp.com/casualphotophile.com/wp-content/uploads/2020/11/fun-leader-cap-lens-review-5-of-7.jpg?fit=2000%2C1125&ssl=1 2000 1125 Dario Veréb Dario Veréb https://casualphotophile.com/wp-content/uploads/2020/11/dario-author-1-of-1.jpg December 2, 2020 November 30, 2020
Dario reviews the inexpensive and suprisingly good Funleader 18mm F/8 Cap Lens, a lo-fi lens that's about the size of a body cap!
Dario Veréb
Legacy Lens
M Mount
Sony E 18-135mm F/3.5-5.6 OSS Lens Review
https://i0.wp.com/casualphotophile.com/wp-content/uploads/2020/11/Sony-18-135mm-f3.5-5.6-OSS-8-of-12.jpg?fit=2000%2C1125&ssl=1 2000 1125 Clayton D'Arnault Clayton D'Arnault https://casualphotophile.com/wp-content/uploads/2020/08/clayton-darnault-1-of-1.jpg November 16, 2020 November 12, 2020
Clayton reviews the Sony E 18-135mm f/3.5-5.6 OSS zoom lens for Sony APS-C mirrorless cameras, and it's a kit lens to impress.
Clayton D'Arnault
Sony A6000 Review – a Modern Classic in 2020?
https://i1.wp.com/casualphotophile.com/wp-content/uploads/2020/08/Sony-a6000-review-4-of-13.jpg?fit=1800%2C1013&ssl=1 1800 1013 Clayton D'Arnault Clayton D'Arnault https://casualphotophile.com/wp-content/uploads/2020/08/clayton-darnault-1-of-1.jpg August 10, 2020 August 9, 2020
The Sony a6000 debuted in 2014, and quickly became Sony's best-selling camera. Six years later, they still sell it new! Here's our review.
Japanese Cameras
Choosing a DSLR in the Era of the Mirrorless Camera
https://i1.wp.com/casualphotophile.com/wp-content/uploads/2020/07/nikon-d850-1-of-4.jpg?fit=1800%2C1013&ssl=1 1800 1013 Yuan Oliver Jin Yuan Oliver Jin https://casualphotophile.com/wp-content/uploads/2020/07/yuan-oliver-jin-1-of-1.jpg July 29, 2020 July 29, 2020
Oliver chose a DSLR. In the year 2020. According to most, this is madness. But here's his argument for the DSLR in the era of the mirrorless camera.
Yuan Oliver Jin
Sony FE 100mm F/2.8 STF (Smooth Trans Focus) Lens Review
https://i1.wp.com/casualphotophile.com/wp-content/uploads/2020/07/Sony-100mm-STF-lens-product-1-of-8.jpg?fit=1800%2C1013&ssl=1 1800 1013 James Tocchio James Tocchio https://casualphotophile.com/wp-content/uploads/2020/01/james-square.jpg July 7, 2020 July 19, 2020
James reviews one of the most interesting lenses being manufactured today, the Sony FE 100mm F/2.8 STF Smooth Trans Focus lens.
James Tocchio
Portrait Lens
Near and Far in Bowling Green, Ohio – a Story of Pandemics and Protests and Photography
https://i1.wp.com/casualphotophile.com/wp-content/uploads/2020/06/Ohio-6-of-10.jpg?fit=1800%2C1194&ssl=1 1800 1194 Stephen Hennessy Stephen Hennessy https://casualphotophile.com/wp-content/uploads/2020/06/stephen-hennessy-1-of-1.jpg June 17, 2020 June 17, 2020
One photographer's story of the way he experienced his home town and photography during the pandemic, and later, the anti-racism protests.
Stephen Hennessy
The Minolta a7 is the Perfect Film SLR for Shooters Who Want it All
https://i1.wp.com/casualphotophile.com/wp-content/uploads/2017/11/Minolta-Alpha-Maxxum-7-FIlm-Camera-product-shot-1.jpg?fit=2200%2C1238&ssl=1 2200 1238 James Tocchio James Tocchio https://casualphotophile.com/wp-content/uploads/2020/01/james-square.jpg November 22, 2017 June 5, 2020
James reviews a Minolta AF SLR that's so damn good it feels like launching into DOOM and instantly typing IDDQD.
Five Photography Products We Want to See Rise From The Dead
https://i2.wp.com/casualphotophile.com/wp-content/uploads/2017/10/zombie-cameras-2-of-2.jpg?fit=2000%2C1125&ssl=1 2000 1125 James Tocchio James Tocchio https://casualphotophile.com/wp-content/uploads/2020/01/james-square.jpg October 30, 2017 July 19, 2020
It's Halloween, All Hallows' Eve, that ghoulish night of the year dedicated to remembering the dead. It's also the night of the year in which the unlikely reanimation of rotting corpses seems most possible. Zombies…
Minolta AF Macro 100mm F/2.8 A Mount Lens Review – Spoiler : It's Perfect
https://i2.wp.com/casualphotophile.com/wp-content/uploads/2017/06/minolta-a7-100mm-macro-lens-product-photos-1.jpg?fit=2000%2C1125&ssl=1 2000 1125 James Tocchio James Tocchio https://casualphotophile.com/wp-content/uploads/2020/01/james-square.jpg June 28, 2017 June 6, 2020
Photography is a fluid craft. The light, our subjects, and even our interests are always in flux. So it helps when our gear can keep up. And it's this uncommon versatility (combined with amazing image…
Carl Zeiss Planar 50mm F/1.4 C/Y Mount – Lens Review
https://i0.wp.com/casualphotophile.com/wp-content/uploads/2017/04/Zeiss-Planar-50mm-1.4-bproduct-photos-1.jpg?fit=2000%2C1125&ssl=1 2000 1125 James Tocchio James Tocchio https://casualphotophile.com/wp-content/uploads/2020/01/james-square.jpg April 4, 2017 June 6, 2020
Today's lens review isn't going to change the way you take photos, and if you're already shooting a fast fifty don't expect to be surprised. Today's lens review, while certainly worth reading (don't you dare),…
Zeiss Ikon
SMC Pentax M 40mm F/2.8 Pancake Lens Review
https://i1.wp.com/casualphotophile.com/wp-content/uploads/2017/02/Pentax-40mm-pancake-review-3.jpg?fit=1280%2C720&ssl=1 1280 720 James Tocchio James Tocchio https://casualphotophile.com/wp-content/uploads/2020/01/james-square.jpg February 9, 2017 June 6, 2020
Lilliputian. Svelte. Teensy and weensy, and of course, teensy-weensy. All words I'd never expect to write in a lens review, yet here we all are and I might as well get these silly synonyms for…
Why Everyone Should Shoot a Wide Angle Lens
https://i1.wp.com/casualphotophile.com/wp-content/uploads/2018/05/nikon-FM-review-2.jpg?fit=2200%2C1467&ssl=1 2200 1467 James Tocchio James Tocchio https://casualphotophile.com/wp-content/uploads/2020/01/james-square.jpg November 2, 2015 June 11, 2020
One of the simplest ways to increase the dynamism and visual interest of our images is by using a wide-angle lens. By widening our angle of view, we're able to capture shots of the world around us…
5 Best Travel Cameras – Digital Edition
https://i1.wp.com/casualphotophile.com/wp-content/uploads/2014/11/five-best-travel-cameras-digital-scaled.jpg?fit=2560%2C1440&ssl=1 2560 1440 James Tocchio James Tocchio https://casualphotophile.com/wp-content/uploads/2020/01/james-square.jpg November 15, 2014 June 11, 2020
The last time we talked about travel cameras we focused on making a list of five retro machines. It was a pretty excellent list. Picking any one of the cameras on it would serve any…
Five Female Film Photographers to Follow - January 2021
Ten Great Point and Shoot Film Cameras From $25 to $99
Five Best Digital Cameras for People Who Love Film Cameras
A Quick Guide to Kodak Film