Source-linked AI summary
On Success and Simplicity: A Second Look at Transferable Targeted Attacks
Zhengyu Zhao, Zhuoran Liu, Martha Larson
TL;DR
Targeted attack transferability is widely regarded as difficult, with leading methods requiring target-specific training and additional data. This paper reexamines that assumption using simple attacks, broader transfer settings, and longer optimization, finding strong performance from a simple logit loss and motivating more meaningful evaluation.
Problem
Targeted transferability has been considered extremely difficult, and state-of-the-art results have relied on target-specific training with additional data.
Method
The paper evaluates simple transferable attacks across conventional and three challenging realistic settings, including longer optimization and a simple logit loss.
Results
Simple transferable attacks achieve surprisingly strong targeted transferability, and the simple Logit attack is superior across transfer scenarios to resource-intensive approaches.
Takeaways & Limitations
Meaningful targeted-transfer evaluation should include sufficiently converged attacks and challenging settings rather than relying only on commonly adopted easy scenarios.
Takeaways & Limitations
The methodology may be misused by malicious actors to break legitimate systems.
Abstract
from arXiv · showhide
Achieving transferability of targeted attacks is reputed to be remarkably difficult. Currently, state-of-the-art approaches are resource-intensive because they necessitate training model(s) for each target class with additional data. In our investigation, we find, however, that simple transferable attacks which require neither additional data nor model training can achieve surprisingly high targeted transferability. This insight has been overlooked until now, mainly due to the widespread practice of unreasonably restricting attack optimization to a limited number of iterations. In particular, we, for the first time, identify that a simple logit loss can yield competitive results with the state of the arts. Our analysis spans a variety of transfer settings, especially including three new, realistic settings: an ensemble transfer setting with little model similarity, a worse-case setting with low-ranked target classes, and also a real-world attack against the Google Cloud Vision API. Results in these new settings demonstrate that the commonly adopted, easy settings cannot fully reveal the actual properties of different attacks and may cause misleading comparisons. We also show the usefulness of the simple logit loss for generating targeted universal adversarial perturbations in a data-free and training-free manner. Overall, the aim of our analysis is to inspire a more meaningful evaluation on targeted transferability. Code is available at https://github.com/ZhengyuZhao/Targeted-Tansfer
1 Introduction
The paper argues that simple targeted transferable attacks can be much stronger than prior work suggests, while resource-intensive methods are not necessary. It attributes overlooked performance partly to overly short optimization and proposes broader, more realistic evaluation settings.
- Simple attacks requiring neither model training nor additional data can achieve surprisingly strong targeted transferability.
- The paper identifies a simple logit loss as competitive with, and even superior to, resource-intensive state-of-the-art approaches.
- Targeted transferability is evaluated in standard settings and three more challenging scenarios: dissimilar ensembles, low-ranked target classes, and Google Cloud Vision API attacks.
- Results suggest that evaluations using only commonly adopted easy scenarios may misrepresent the actual strength of different attacks.
2 Related Work
Prior work combines iterative transfer techniques and specialized losses, while resource-intensive approaches train target-specific models or generators with additional data. The paper contrasts these methods with simple attacks that use iterative optimization on one image without training or extra data.
- Simple Transferable Attacks: Simple transferable attacks use iterative optimization on a single original image without model training or additional data.
- Simple Transferable Attacks: I-FGSM-based attacks constrain perturbations with an Lp distance, commonly L∞, while targeted optimization uses the target class label.
- Simple Transferable Attacks: Po+Trip combines a Poincaré-based loss with a triplet loss, but its prior evaluation used an easy ensemble setting containing similar architectures.
- Simple Transferable Attacks: MI-FGSM accumulates previous gradients for more stable update directions, while TI-FGSM and DI-FGSM use image transformations to reduce source-model overfitting.
- Resource-Intensive Transferable Attacks: FDA and TTP require target-specific training and additional data, whereas simple attacks can achieve even better performance without those resources.
- Universal Adversarial Perturbations: Targeted universal perturbation methods generally rely on large-scale optimization over image data, motivating data-free alternatives.
3 New Insights into Simple Transferable Attacks
Simple transferable attacks can achieve strong targeted transferability when optimized for enough iterations, while a simple logit loss improves performance over CE and Po+Trip. The analysis explains these gains through transfer-method choices, convergence behavior, and gradient dynamics.
- 3.1 Existing Transfer Methods with More Iterations Yield Good Results: Combining TI, MI, and DI yields the best targeted transfer performance, while DI alone provides substantial gains and TI or MI alone changes little.DI may improve transfer by randomizing image augmentation parameters across iterations, producing more generic target-class gradients.
- 3.1 Existing Transfer Methods with More Iterations Yield Good Results: Targeted attacks require far more than the commonly used 20 iterations to converge, making few-iteration comparisons potentially misleading.The paper contrasts slow targeted convergence with fast non-targeted convergence and notes that non-converged optimization processes are not meaningfully comparable.
- 3.2 A Simple yet Strong Logit Attack: Po+Trip can overshoot minima because its aggressively increasing gradient magnitude produces overly large steps, especially on non-smooth loss surfaces.The reported ensemble-transfer results support this explanation by showing Po+Trip performing worse than CE in diverse architectures.
- 3.2 A Simple yet Strong Logit Attack: The logit loss removes CE’s final softmax and backpropagates directly from the target-class logit.The target-class logit is denoted by l_t(·).
- 3.2 A Simple yet Strong Logit Attack: CE gradients tend to vanish as target probability rises, whereas the logit loss preserves stronger gradients and can continue improving with more iterations.The paper attributes CE’s weakening gradient to the softmax probability approaching 1 during optimization.
4 Experimental Evidence on Simple Transferable Attacks
The experiments evaluate simple transferable attacks across standard and newly introduced challenging transfer settings, using ImageNet-compatible images and multiple classifier architectures. Across these settings, the Logit attack generally provides the strongest targeted transferability, including against Google Cloud Vision and resource-intensive baselines.
- Evaluation settings: The evaluation covers single-model transfer, easy and architecture-disjoint ensemble transfer, low-ranked target classes, Google Cloud Vision, and targeted universal perturbations.The experiments use 1000 images from the ImageNet-Compatible Dataset and consider ResNet, DenseNet, VGGNet, and Inception architectures.
- Evaluation settings: 300 iterations were used by default to ensure convergence, with a moderate step size of 2 and batch processing taking about three seconds per image.The attacks use TI, MI, and DI with hyperparameters from prior work.
- Single-model transfer: The Logit loss outperformed CE and Po+Trip by a large margin in almost all single-model transfer cases.Transfer from VGGNet16 or Inception-v3 was weaker than transfer from ResNet50 or DenseNet121.
- Ensemble transfer: In easy ensemble transfer, all three attacks saturated with enough iterations, while Po+Trip’s advantage over CE appeared only under the restricted 20-iteration setting.This indicates that comparisons based on few iterations can misrepresent relative attack performance.
- Ensemble transfer: In the architecture-disjoint ensemble setting, Logit largely outperformed CE and Po+Trip, while CE and Logit improved substantially over single-model transfer.The authors attribute Po+Trip’s weaker performance in some cases to gradient overshooting on a less smooth loss surface caused by model diversity.
- Worse-case transfer: Targeted transfer became increasingly difficult as the target class moved down the prediction list, and high-ranked targets could yield misleading comparisons.The authors argue that evaluations should extend beyond best- and average-case target rankings.
- Real-world transfer: On Google Cloud Vision, Logit achieved the best targeted transferability with quasi-imperceptible perturbations and required no query interaction.The results reveal potential vulnerability of the API to simple transfer-based attacks.
- Comparison with resource-intensive attacks: At ϵ = 16, Logit achieved results comparable to TTP, while at ϵ = 8 it consistently surpassed TTP, especially for ensemble transfer.The comparison suggests that perturbation size affects the relative performance of these attacks.
5 Conclusion and Outlook
The paper concludes that targeted transferability can be strong for simple attacks when optimization is allowed to converge, and that challenging transfer scenarios better expose differences among attacks. It identifies Logit as superior across the evaluated scenarios while calling for more meaningful evaluation and further study of architectural effects.
- Conclusion: Simple transferable attacks achieved surprisingly strong targeted transferability when given enough iterations for convergence.The paper validates this finding across standard and three newly introduced challenging transfer scenarios.
- Conclusion: The Logit attack was superior in all evaluated transfer scenarios, including comparisons with resource-intensive state-of-the-art approaches.The paper also reports its usefulness for generating targeted universal adversarial perturbations in a data-free manner.
- Outlook: The authors hope these findings will inspire more meaningful evaluation of targeted transferability and future investigation of architecture-dependent transferability.They specifically identify very low success rates when targeting Inception-v3 as an area for further study.
- Broader implications: Strong transferability may benefit black-box privacy applications, motivate stronger defenses, and potentially be misused to attack legitimate systems.The authors state that the research benefits outweigh the possible assistance to malicious actors.
A Logit Loss Vs. C&W Loss
The appendix compares Logit with C&W under varied confidence parameters and finds that Logit consistently performs better. It also shows that C&W’s convergence behavior depends non-monotonically on its confidence parameter.
- Comparison: Logit consistently outperformed C&W by a large margin across varied settings of C&W’s confidence parameter K.The comparison concerns targeted transferability in the single-model transfer scenario.
- C&W behavior: Increasing K generally improved C&W until a threshold, after which performance worsened.C&W also converged slowly and performed worse than CE at an early optimization stage.
B Theoretical Analysis of Different Losses
The analysis examines loss, gradient, and target-logit trends over attack iterations to explain why Logit avoids the decreasing-gradient behavior associated with CE. Logit maintains relatively large gradients and continuously increases the target logit during optimization.
- Analysis setup: The analysis tracks loss, gradient magnitude, and target-logit trends over iterations for three losses in a Res50→Dense121 transfer setting.Results are averaged over 100 randomly selected images, with gradients normalized by their first-iteration values and measured using the L1 norm.
- Step-size analysis: Targeted transferability of CE-TMDI, Po+Trip-TMDI, and Logit-TMDI was also examined across varied step sizes S.The figure compares how the three simple attacks respond to step-size changes.
- Gradient behavior: Logit can be minimized continuously with relatively large gradients, unlike the contrasting behavior observed for the other losses.The analysis uses these trends to examine decreasing gradients in CE and the behavior of Po+Trip.
- Target-logit behavior: The Logit loss continuously increases the target logit over iterations until it reaches a very high value.This provides the paper’s stated explanation for Logit’s optimization behavior in targeted attacks.
C Attacks with Varied Step Sizes
The attacks are generally insensitive to step-size changes, with only slight improvement from larger steps; the logit attack consistently performs best.
- All attacks show little sensitivity to step-size changes, with only slight improvement when using a larger step size.
- The logit attack consistently outperforms the other two attacks across all tested step-size settings.
D Adversarial Images on Google Cloud Vision
The figure presents adversarial images used to attack the Google Cloud Vision service.
- Adversarial images are shown for attacking Google Cloud Vision.
E Unbounded Adversarial Images
The figures show unbounded adversarial images targeting different classes.
- The depicted target classes include goldfish, ostrich, box turtle, thunder, and snake.
- Unbounded adversarial images are shown for different target classes.
F Targeted Universal Adversarial Perturbations (UAPs)
The figure shows targeted universal adversarial perturbations generated for different classes with ϵ = 16.
- Targeted universal adversarial perturbations are shown for different classes at ϵ = 16.