PaperlayerView exact revision on arXiv

Source-linked AI summary

On Success and Simplicity: A Second Look at Transferable Targeted Attacks

Zhengyu Zhao, Zhuoran Liu, Martha Larson

arXiv:2012.11207v4cs.LGcs.CRcs.CV

TL;DR

Targeted transferability has been considered difficult, and state-of-the-art approaches require target-specific training and additional data. This paper evaluates simple attacks across varied transfer settings and finds that a simple Logit attack outperforms resource-intensive state-of-the-art approaches.

  • Problem

    Targeted attacks have been considered difficult to transfer, while state-of-the-art approaches require training models for each target class with additional data.

    Source: §1 · pp. 1–2

  • Method

    The paper evaluates simple, training- and data-free transferable attacks across common and three challenging scenarios, including low-similarity ensembles, low-ranked targets, and Google Cloud Vision.

    Source: §1 · p. 2

  • Results

    The simple Logit attack is superior in all transfer scenarios, outperforming resource-intensive state-of-the-art approaches.

    Source: §1 · p. 2, §5 · p. 10

  • Takeaways & Limitations

    The findings motivate more meaningful targeted-transferability evaluation because common, easy scenarios may not reveal attack strength and may lead to misleading comparisons.

    Source: §1 · p. 2

    The authors note that the methodology could be misused by malicious actors to break legitimate systems.

    Source: §5 · p. 10

Abstract

from arXiv · show

Achieving transferability of targeted attacks is reputed to be remarkably difficult. Currently, state-of-the-art approaches are resource-intensive because they necessitate training model(s) for each target class with additional data. In our investigation, we find, however, that simple transferable attacks which require neither additional data nor model training can achieve surprisingly high targeted transferability. This insight has been overlooked until now, mainly due to the widespread practice of unreasonably restricting attack optimization to a limited number of iterations. In particular, we, for the first time, identify that a simple logit loss can yield competitive results with the state of the arts. Our analysis spans a variety of transfer settings, especially including three new, realistic settings: an ensemble transfer setting with little model similarity, a worse-case setting with low-ranked target classes, and also a real-world attack against the Google Cloud Vision API. Results in these new settings demonstrate that the commonly adopted, easy settings cannot fully reveal the actual properties of different attacks and may cause misleading comparisons. We also show the usefulness of the simple logit loss for generating targeted universal adversarial perturbations in a data-free and training-free manner. Overall, the aim of our analysis is to inspire a more meaningful evaluation on targeted transferability. Code is available at https://github.com/ZhengyuZhao/Targeted-Tansfer

1 Introduction

The paper argues that simple, training- and data-free attacks can achieve strong targeted transferability, and that limited iteration budgets have obscured their performance.

1 Introduction

  • Targeted transferability remains difficult despite its importance in black-box settings, where an attack can force a model to predict a chosen, dangerous class.The passage contrasts early difficulties in targeted transfer with progress on non-targeted transfer attacks.Source: §1 · p. 1
  • Prior state-of-the-art targeted transfer attacks are resource-intensive: FDA trains target-specific auxiliary classifiers on labeled data, while TTP trains target-specific GANs.FDA models layer-wise feature distributions; TTP uses global and local distribution matching.Source: §1 · p. 1
  • Simple attacks requiring neither model training nor additional data achieve strong targeted transferability, and a simple logit loss can outperform resource-intensive state-of-the-art methods.The authors argue that this strength was overlooked because prior work restricted optimization to too few iterations.Source: §1 · pp. 1–2
  • Experiments span common transfer settings and three harder scenarios, showing that easy settings may mislead comparisons and motivating more meaningful evaluation.The new scenarios include transfer between dissimilar models, low-ranked target classes, and an attack on the Google Cloud Vision API.Source: §1 · p. 2
  • The simple Logit attack also generates targeted universal adversarial perturbations without data, unlike prior approaches that rely on large-scale optimization over additional data.This approach is motivated by the observation that generated perturbations reflect target semantics.Source: §1 · p. 2

2 Related Work

The section reviews simple and resource-intensive transferable attacks, then relates them to universal adversarial perturbations. It contrasts their data and training requirements and describes how simple Logit attacks can extend to targeted universal perturbations.

2.1 Simple Transferable Attacks

  • Simple transferable attacks use iterative optimization on one original image without extra data or training; most use CE, whose decreasing gradients are problematic in targeted attacks, prompting Po+Trip.Source: §2.1 · p. 2
  • MI-FGSM [4] stabilizes updates with accumulated gradients, TI-FGSM [6] smooths gradients to limit source-model overfitting, and DI-FGSM [8] randomizes resizing and padding across iterations.TI-FGSM was designed for adversarially trained targets; a smaller kernel was later recommended for normally trained targets [12].Source: §2.1 · p. 3

2.2 Resource-Intensive Transferable Attacks

  • FDA [14] uses target-specific, one-versus-all auxiliary classifiers trained on labeled data for each probed layer and target class; FDA(N)+xent [15] aggregates features across layers.Source: §2.2 · p. 3
  • The paper reports that simple transferable attacks requiring neither model training nor additional data can outperform FDA(N)+xent [15] and TTP [16], which use large-scale training and additional data.Source: §2.2 · pp. 3–4

2.3 Universal Adversarial Perturbations

  • Prior targeted universal perturbation methods generally require large-scale image-data optimization; the paper presents simple Logit attacks as a data-free alternative.A prior data-free method for non-targeted perturbations disrupts intermediate features, but does not address the targeted objective of moving toward a specific class.Source: §2.3 · p. 4

3 New Insights into Simple Transferable Attacks

The section argues that simple targeted transfer attacks can perform well when run long enough, and that a simple logit loss outperforms the commonly used cross-entropy loss. It attributes these findings to the transfer methods’ convergence behavior and to the logit loss maintaining stronger gradients during optimization.

3.2 A Simple yet Strong Logit Attack

  • Simple logit loss achieves much better targeted transfer results than the commonly used cross-entropy loss.The comparison covers simple transferable attacks in both non-targeted and targeted scenarios.Source: §3 · p. 4, Figure 1 · p. 5

3.1 Existing Transfer Methods with More Iterations Yield Good Results

  • Combining TI, MI, and DI gives the best performance; DI alone yields substantial targeted transferability, while TI or MI alone makes little difference.The authors suggest DI’s randomized image augmentations produce more generic target-directed gradients and reduce overfitting to the source model.Source: §3.1 · p. 4, Figure 1 · p. 5
  • Targeted attacks need far more iterations to converge than non-targeted attacks, so evaluating them after only a few iterations can mislead comparisons.The paper notes that common practice often limits optimization to 20 iterations or fewer, whereas practical attacks should not be artificially restricted to fewer than several thousand iterations.Source: §3.1 · pp. 4–5

3.2 A Simple yet Strong Logit Attack

  • Po+Trip’s aggressive gradient increase can overshoot minima, and it performs worse than CE in the diverse-architecture ensemble transfer scenario.The authors attribute this outcome to the relatively non-smooth loss surface in that setting.Source: §3.2 · p. 5
  • The logit loss maintains a constant gradient, whereas the cross-entropy gradient tends to vanish as the target-class probability rises, allowing optimization to keep improving with more iterations.The paper reports that comparisons of loss, gradient magnitude, and target-logit trends show better results for logit loss than for CE and Po+Trip.Source: §3.2 · p. 5

4 Experimental Evidence on Simple Transferable Attacks

The experiments evaluate simple transferable attacks across diverse transfer scenarios, compare them with resource-intensive methods, and test the Logit attack for data-free targeted UAPs.

4.1 Simple Transferable Attacks in Various Transfer Scenarios

  • In easy ensemble transfer, attack success saturated with enough iterations, while Po+Trip beat CE only at 20 iterations and performed worse after convergence.The authors warn that evaluations restricted to few iterations may produce misleading comparisons.Source: Table 2 · p. 7, §4.1 · p. 7
  • In the challenging ensemble setting, Logit largely outperformed CE and Po+Trip, while CE and Logit improved over single-model transfer.Po+Trip performed even worse in some cases, possibly because its gradient-magnitude increase caused overshooting on the less smooth loss surface; Inception-v3 remained the hardest target.Source: Figure 3 · p. 7, §4.1 · p. 7
  • As target classes moved lower in the prediction ranking, targeted transfer became harder, and evaluating only higher-ranked targets could mislead attack comparisons.The authors argue that meaningful evaluation should extend beyond the best and average cases to harder, lower-ranked targets.Source: Table 3 · p. 7, §4.1 · p. 8
  • On Google Cloud Vision, Logit achieved the best targeted transferability, demonstrating a vulnerability to simple transfer-based attacks without query interaction.Success was measured by whether the target label appeared among the API’s returned labels, and results were averaged over 100 originally correct images.Source: Table 4 · p. 8, §4.1 · p. 8

4.2 Simple vs. Resource-Intensive Transferable Attacks

  • Under ϵ = 16, Logit achieved results comparable to TTP; under ϵ = 8, Logit consistently surpassed TTP, especially in ensemble transfer.The differing comparisons across perturbation sizes suggest that evaluating attacks at only one norm bound may not reveal their characteristics.Source: Table 5 · p. 9, §4.2 · p. 9
  • In unbounded-image comparisons, all three simple attacks achieved stronger targeted transferability than FDA(N)+xent, and perturbations reflected target semantics.The results were averaged over 4,000 images optimized toward random target classes; the authors connect targeted transferability to robust semantic features.Source: Table 6 · p. 9, §4.2 · p. 9

4.3 Simple Logit Attack for Targeted UAPs in a Data-Free Manner

  • For targeted UAPs, Logit substantially outperformed CE and produced more semantically aligned perturbations.A single ϵ = 16 UAP per target class, generated in 300 iterations, was applied to all 1,000 dataset images; the mean image served as the original image.Source: Table 7 · p. 10, §4.3 · p. 10, Figure 6 · p. 10

5 Conclusion and Outlook

With enough iterations for convergence, simple transferable attacks—especially the Logit attack—achieve strong targeted transferability across transfer scenarios, including challenging settings. The findings motivate more meaningful evaluation and further study of transferability, resource use, and potential impacts.

Conclusion and Outlook

  • The simple Logit attack outperforms state-of-the-art resource-intensive approaches across all tested transfer scenarios, including three newly introduced challenging scenarios.The paper attributes the strong results of simple attacks to allowing enough iterations for convergence.Source: §5 · p. 10
  • The Logit attack also shows potential for generating targeted universal adversarial perturbations in a data-free manner.Source: §5 · p. 10
  • Future work will examine how model architectures affect transferability, the low success rates against Inception-v3, and resource use across training, inference, hardware, and data.Source: §5 · p. 10
  • Strong transferability could benefit privacy-protecting black-box applications [42] [47] [48] and motivate stronger defenses, though the methodology could also be misused against legitimate systems.The authors judge that the paper’s help to researchers outweighs its potential help to malicious actors.Source: §5 · p. 10

A Logit Loss Vs. C&W Loss

The logit loss consistently outperformed C&W loss across tested confidence settings, while C&W’s performance depended on its confidence parameter and may have been hindered by suppressing other classes.

A Logit Loss Vs. C&W Loss

  • C&W [32] converged slowly and initially underperformed CE; increasing K generally helped until a point, while omitting K gave similarly good performance.Beyond a certain point, increasing K yielded worse results.Source: A Logit Loss Vs. C&W Loss · p. 13
  • C&W’s [32] suppression of other classes may hinder transfer by diverting optimization from raising the target logit.Source: A Logit Loss Vs. C&W Loss · p. 13
  • In single-model transfer, the logit loss consistently outperformed C&W loss [32] by a large margin across tested confidence settings.Figure 7 reports targeted transfer success rates; the passage gives no exact values.Source: Figure 7 · p. 13, A Logit Loss Vs. C&W Loss · p. 13

B Theoretical Analysis of Different Losses

The analysis argues that logit loss avoids the decreasing-gradient problem of CE and performs better than Po+Trip by sustaining relatively large gradients, allowing the target logit to keep increasing over iterations.

B Theoretical Analysis of Different Losses

  • Logit loss remains continuously minimizable with relatively large gradients, unlike CE, whose loss quickly approaches zero, and Po+Trip, whose loss stays nearly unchanged with a small oscillation.Figure 8 compares the losses in Res50→Dense121 transfer, averaging over 100 images; losses and gradients are normalized to their first-iteration values, and gradient magnitude uses the L1 norm.Source: B Theoretical Analysis of Different… · pp. 13–14, Figure 8 · p. 14
  • With logit loss, the target logit can increase continuously over iterations and finally reach a very high value.The analysis presents this sustained increase as a reason logit loss addresses CE’s decreasing-gradient problem and works better than Po+Trip.Source: B Theoretical Analysis of Different… · pp. 13–14

C Attacks with Varied Step Sizes

Across varied step sizes, targeted attacks are generally insensitive to the setting, with only slight improvement at larger steps; the logit attack consistently outperforms the other two attacks.

C Attacks with Varied Step Sizes

  • The logit attack consistently outperforms the other two attacks across all tested step sizes.The section investigates step size because prior work found that larger steps can improve non-targeted transferability by helping optimization escape poor local optima [12].Source: C Attacks with Varied Step Sizes · p. 14
  • All attacks are generally insensitive to step-size changes, with only slight improvement when using a larger step size.This contrasts with prior findings on non-targeted transferability, where larger steps can help optimization escape poor local optima [12].Source: C Attacks with Varied Step Sizes · p. 14

D Adversarial Images on Google Cloud Vision

This section presents adversarial images used to attack Google Cloud Vision.

D Adversarial Images on Google Cloud Vision

  • The section shows adversarial images for attacking Google Cloud Vision.Source: Figure 10 · p. 15

E Unbounded Adversarial Images

This section presents unbounded adversarial images targeting different classes.

E Unbounded Adversarial Images

  • Figure 11 presents unbounded adversarial images targeting different classes.Source: Figure 11 · p. 16

F Targeted Universal Adversarial Perturbations (UAPs)

Figure 12 presents targeted universal adversarial perturbations with ϵ = 16 for different classes.

F Targeted Universal Adversarial Perturbations (UAPs)

  • Figure 12 shows targeted universal adversarial perturbations (ϵ = 16) for different classes.Source: Figure 12 · p. 17

Related papers

Loading 2012.11207v4…