Source-linked AI summary
Cross-Domain Transferability of Adversarial Perturbations
Muzammal Naseer, Salman H. Khan, Harris Khan, Fahad Shahbaz Khan, Fatih Porikli
TL;DR
Adversarial attacks often rely on source-domain data, limiting transferability when the target domain is unknown or unavailable. This paper learns domain-agnostic adversarial functions with relativistic supervision, achieving strong cross-domain transfer and outperforming instance-specific attacks in reported comparisons.
Problem
Existing attacks rely directly or indirectly on source-domain data, while scalable instance-agnostic attacks typically have weaker transferability, limiting practical cross-domain black-box use.
Method
The framework learns a universal adversarial function with a generative network and relativistic loss to enforce domain-invariant perturbation patterns without using the target domain during training.
Results
The learned universal function transfers across domains and outperforms a state-of-the-art instance-specific attack by average fooling-rate gains of 46.6% and 86.5% on naturally and adversarially trained models, respectively.
Takeaways & Limitations
Cross-domain black-box attacks can be learned without access to the target model, training distribution, or label space, while remaining scalable through universal inference.
Takeaways & Limitations
The cross-domain black-box setting assumes the attacker can learn from a model pretrained on a possibly different distribution, while the target domain is not used during training.
Abstract
from arXiv · showhide
Adversarial examples reveal the blind spots of deep neural networks (DNNs) and represent a major concern for security-critical applications. The transferability of adversarial examples makes real-world attacks possible in black-box settings, where the attacker is forbidden to access the internal parameters of the model. The underlying assumption in most adversary generation methods, whether learning an instance-specific or an instance-agnostic perturbation, is the direct or indirect reliance on the original domain-specific data distribution. In this work, for the first time, we demonstrate the existence of domain-invariant adversaries, thereby showing common adversarial space among different datasets and models. To this end, we propose a framework capable of launching highly transferable attacks that crafts adversarial patterns to mislead networks trained on wholly different domains. For instance, an adversarial function learned on Paintings, Cartoons or Medical images can successfully perturb ImageNet samples to fool the classifier, with success rates as high as $\sim$99\% ($\ell_{\infty} \le 10$). The core of our proposed adversarial function is a generative network that is trained using a relativistic supervisory signal that enables domain-invariant perturbations. Our approach sets the new state-of-the-art for fooling rates, both under the white-box and black-box scenarios. Furthermore, despite being an instance-agnostic perturbation function, our attack outperforms the conventionally much stronger instance-specific attack methods.
1 Introduction
The paper identifies source-domain reliance and weak transferability as barriers to scalable black-box attacks. It introduces a domain-agnostic generative framework that learns transferable adversarial patterns across different image domains.
- Transferable adversarial examples enable attacks without access to a target network’s internal parameters, creating security concerns for deployed DNNs.
- Instance-agnostic attacks scale better than instance-specific attacks but generally show weaker transferability.
- Existing attacks rely directly or indirectly on source-domain data, limiting transfer to unseen domains and motivating cross-domain black-box attacks.
- The proposed framework learns adversarial patterns from paintings, comics, or medical images that fool classifiers trained on different domains.
- The method uses a relativistic loss to enforce domain-invariant patterns and learns a universal adversarial function without expensive instance-specific optimization.
- ∼86.46% average fooling-rate increase is reported from naturally trained Inception-v3 to adversarially trained models versus the state-of-the-art baseline.
2 Related Work
Prior adversarial-attack methods depend on data distributions, labels, or per-instance optimization. The paper positions its distribution-agnostic relativistic-loss approach as addressing these dependencies while achieving state-of-the-art transferability.
- Image-dependent Perturbations: Image-dependent attacks compute perturbations separately for each data point, often using gradient ascent or complex optimization.
- Universal Adversarial Perturbation: Universal adversarial perturbations use one noise vector across inputs, but their success can depend on target samples used during crafting.
- Universal Adversarial Perturbation: Data-independent activation-maximization methods reduce sample dependence but have lower attack success than seminal universal perturbations.
- Generator-oriented Perturbations: Generative perturbation methods can avoid per-instance optimization, but prior approaches may depend on data distributions, labels, or unconstrained perturbation magnitude.
- The proposed distribution-agnostic approach incorporates relativistic loss and reports state-of-the-art results in both white-box and black-box settings.
3 Cross-Domain Transferable Perturbations
The framework trains a generator to create bounded perturbations using a pretrained, fixed discriminator, while relativistic objectives compare clean and perturbed predictions to encourage transferability.
- The generator learns a universal perturbation function on a source domain, while the target domain is excluded from training.Training uses unlabelled source data; target-domain samples are not used.
- The framework fixes the pretrained discriminator and trains only the generator, whose output is scaled and clipped to a prescribed perturbation bound.The generator produces perturbed inputs x′, while discriminator parameters remain unchanged.
- The discriminator processes clean and perturbed images as class-probability vectors rather than merely distinguishing real from fake inputs.This design supports adversarial classification objectives based on the network’s class responses.
- The attack seeks a high fooling ratio by making perturbed inputs change the classifier’s predicted label, without necessarily requiring source-domain ground-truth labels.The fooling ratio measures the fraction of examples whose predictions are altered.
- Relativistic adversarial training compares clean and perturbed predictions, reducing confidence on perturbed images while maintaining high confidence on clean samples.The resulting fooling gap is intended to enforce transferability beyond conventional generator objectives.
- The framework supports both untargeted and targeted attacks, with targeted attacks requiring perturbed predictions to match a specified target class.The overall generator training procedure alternates perturbation generation, projection, loss computation, and generator updates.
4 Gradient Perspective of Relativistic Cross-Entropy
Relativistic Cross-Entropy (RCE) compares perturbed and clean predictions, making its gradient depend on their difference rather than perturbed scores alone. The resulting gradients are stronger than those from standard Cross-Entropy, including when the input is already misclassified.
- RCE uses the difference between perturbed and clean true-class logits, rather than perturbed scores alone, in its gradient.
- RCE measures relative prediction change by comparing the perturbed and clean responses for the ground-truth class.
- RCE back-propagates larger gradients than CE, producing more efficient training and stronger adversaries.
- When the clean input is already misclassified, RCE still provides stronger gradients than CE, whose noise update becomes weaker.
5 Experiments
Experiments evaluate the proposed attack across white-box, black-box, and cross-domain black-box settings, using generators trained on multiple image domains. Results show strong cross-domain transferability, with performance shaped by training regime and Gaussian smoothing.
- Experimental Settings: Cross-domain black-box attacks use generators trained on Paintings, Comics, or ChestX and are evaluated on ImageNet without access to the target model, label space, or training distribution.The evaluation uses ImageNet validation data and fooling rate as a primary metric.
- Experimental Settings: The generator uses a ResNet architecture and is trained against pretrained ImageNet models including VGG, Inception, ResNet, and ChexNet.Training datasets include Paintings, Comics, ImageNet, and ChestX.
- Results: The proposed attack achieves higher transferability than other universal methods in both white-box and black-box settings, including on naturally and adversarially trained models.Gaussian smoothing further increases transferability against adversarially trained models.
- Comparison with State-of-the-Art: 46.6% and 86.5% average absolute fooling-rate gains over an instance-specific translation-invariant attack are reported on naturally and adversarially trained models, respectively.The comparison uses ImageNet-NeurIPS validation images with generators trained against naturally trained Inception-v3.
- Transferability: Naturally Trained vs. Adversarially Trained: Training longer increases transferability against naturally trained models but decreases it against adversarially trained models.The authors attribute this contrast to reliance on different feature sets and use early stopping for adversarially trained targets.
- Transferability: Naturally Trained vs. Adversarially Trained: Gaussian smoothing strengthens adversaries against adversarially trained models but weakens them against naturally trained models, with kernel size 3 and σ = 1 used for the former.Larger kernels smooth the generator output more strongly before projection into the valid l∞ range.
6 Conclusion
The conclusion presents cross-domain transferable adversaries as feasible and describes a relativistic generative framework that can outperform instance-specific attacks.
- 6 Conclusion: ∼88% and ∼72% success rates are reported for generators trained on Chest X-ray and Comics images against VGG-16, ResNet50, and Dense-121 models.The attacks require no knowledge of the target data distribution or label space.
- 6 Conclusion: The proposed universal adversarial function outperforms previously stronger instance-specific attack methods in transferability.The framework uses a relativistic discriminator to learn strong adversaries.
Supplementary: Cross Domain Transferability of Adversarial Perturbations
The supplementary material evaluates relativistic cross-entropy against conventional cross-entropy using accuracy, logit differences, and transfer to unseen classes. RCE performs significantly better across these criteria.
- Supplementary: Cross Domain Transferability of Adversarial Perturbations: RCE performs significantly better than CE on Top-5 adversarial accuracy, normalized l2 logit difference, and transferability to unseen classes.Lower Top-5 accuracy is better, while higher normalized logit difference is better.
1 Comparison with GAP [16]
The section compares GAP with the proposed method using fooling rate and Top-1 accuracy on 50k ImageNet validation images in a white-box setting.
- 1 Comparison with GAP [16]: The GAP comparison reports untargeted attack success through fooling rate and Top-1 accuracy on 50k validation images.Higher fooling rate and lower Top-1 accuracy indicate stronger attacks.
2 Effect of Training Time and Gaussian Kernel Size
Training time and Gaussian smoothing shape which model types the generated adversaries transfer to. Early training and smaller smoothing kernels favor adversarially trained models, while later training favors naturally trained models.
- At initial epochs, smoother adversaries transfer better to adversarially trained models.
- As training progresses, the generator converges to locally strong patterns that transfer better to naturally trained models.
- As Gaussian kernel size increases, adversary transferability decreases.
3 Examples
The examples visualize how the generator’s adversaries alter model attention and remain effective across training distributions and architectures. They include projected and unprojected perturbations evaluated under an l∞≤10 budget.
- Gaussian-kernel examples show unrestricted adversaries before and after smoothing alongside projected adversaries.
- Attention maps compare clean and adversarial images for ResNet-152 when the generator is trained on Paintings.
- Examples for VGG-16, VGG-19, Inception-v3, and ResNet-152 compare adversaries trained on Paintings, Comics, and ImageNet.
- The examples show untargeted adversaries before and after projection, using an l∞≤10 perturbation budget and reporting fooling rates on ImageNet validation data.