PaperlayerView exact revision on arXiv

Source-linked AI summary

Boosting the Transferability of Adversarial Attacks with Reverse Adversarial Perturbation

Zeyu Qin, Yanbo Fan, Yi Liu, Li Shen, Yong Zhang, Jue Wang, Baoyuan Wu

arXiv:2210.05968v1cs.CVcs.CRcs.LG

TL;DR

Transfer attacks can be limited by adversarial examples overfitting their surrogate models, a concern when target models are hidden. RAP uses local worst-case perturbations to seek flatter, low-loss regions; the paper reports improved transferability, including a 22.0% performance improvement in targeted attacks against Google Cloud Vision API over MTDAI.

  • Problem

    Adversarial examples can overfit surrogate models, limiting transfer to different target models in black-box settings where model details are hidden.

    Source: §1 · p. 1, §3.2 · p. 4

  • Method

    RAP uses a min-max optimization that injects a worst-case local perturbation while seeking adversarial examples with low loss across their neighborhoods.

    Source: §1 · p. 2, §3.2 · p. 4

  • Results

    22.0% performance improvement: RAP-LS successfully attacked 342 images against Google Cloud Vision API, compared with 232 for MTDAI.

    Source: §4.7 · p. 10

  • Takeaways & Limitations

    RAP can be combined with existing transfer-attack techniques, and the paper reports improvements across targeted and untargeted attacks and varied networks.

    Source: §1 · p. 2

Abstract

from arXiv · show

Deep neural networks (DNNs) have been shown to be vulnerable to adversarial examples, which can produce erroneous predictions by injecting imperceptible perturbations. In this work, we study the transferability of adversarial examples, which is significant due to its threat to real-world applications where model architecture or parameters are usually unknown. Many existing works reveal that the adversarial examples are likely to overfit the surrogate model that they are generated from, limiting its transfer attack performance against different target models. To mitigate the overfitting of the surrogate model, we propose a novel attack method, dubbed reverse adversarial perturbation (RAP). Specifically, instead of minimizing the loss of a single adversarial point, we advocate seeking adversarial example located at a region with unified low loss value, by injecting the worst-case perturbation (the reverse adversarial perturbation) for each step of the optimization procedure. The adversarial attack with RAP is formulated as a min-max bi-level optimization problem. By integrating RAP into the iterative process for attacks, our method can find more stable adversarial examples which are less sensitive to the changes of decision boundary, mitigating the overfitting of the surrogate model. Comprehensive experimental comparisons demonstrate that RAP can significantly boost adversarial transferability. Furthermore, RAP can be naturally combined with many existing black-box attack techniques, to further boost the transferability. When attacking a real-world image recognition system, Google Cloud Vision API, we obtain 22% performance improvement of targeted attacks over the compared method. Our codes are available at https://github.com/SCLBD/Transfer_attack_RAP.

1 Introduction

Transfer attacks matter when target models are hidden, but adversarial examples can overfit their surrogate and transfer poorly. RAP seeks low-loss adversarial examples in flatter local regions to improve transferability.

1 Introduction

  • In black-box settings, transferability lets attackers use adversarial examples generated on surrogate models against hidden target models [2] [3] [18] [32].The paper notes that DNNs are vulnerable to imperceptible perturbations that can cause erroneous predictions [12] [27] [32] [35] [45] [50].Source: §1 · pp. 1–2
  • Gradient-based attacks such as PGD perform well white-box but often transfer poorly, which prior work attributes to overfitting the surrogate [5] [24] [48].A sharp local minimum can make attack loss rise sharply after a slight change to surrogate parameters.Source: §1 · p. 2
  • Despite methods including input transformation, gradient calibration, feature-level attacks, and generative models, a large transfer-versus-white-box performance gap remains, especially for targeted attacks.The paper identifies this gap as motivating further work on transferability.Source: §1 · p. 2
  • RAP seeks adversarial examples whose neighborhoods also have low loss, using a min-max procedure that injects a worst-case local perturbation at each optimization step.Its late-start variant delays RAP, and the method can be combined with existing black-box attack techniques.Source: §1 · p. 2
  • The paper reports that RAP boosts transferability for untargeted and targeted attacks across varied networks, including defense models, and can combine with existing transfer-attack techniques.It describes these as three main contributions alongside an experimental study.Source: §1 · p. 2

2 Related Work

Prior transfer-attack work spans input transformations, gradient modifications, feature-space attacks, and generative methods. The paper frames its approach around flatness as a way to address the remaining transfer-attack performance gap, especially for targeted attacks.

2 Related Work

  • Transfer attacks generate examples on surrogate models, but existing algorithms can overfit those models and transfer poorly [5] [6] [13] [14] [17] [19] [20] [24] [41] [43] [48].The paper distinguishes transfer attacks from query-based attacks, which use iterative feedback from target-model queries.Source: §2 · pp. 2–3
  • Prior approaches include input transformations such as resizing and padding [48], gradient modifications such as momentum [5], feature-space constraints [17] [19] [20], and generative models [28] [30] [31].Other examples include translation [6], scaling [24], adversarial mixup [41], and EOT [1].Source: §2 · p. 3
  • Some approaches have specific burdens: architecture-specific gradient designs can be hard to extend, feature attacks require layer selection or classifiers, and generators require nontrivial training [14] [17] [19] [20] [30].The paper also notes that iterative attacks with more iterations and logit loss can exceed feature-based attacks in targeted transferability [49].Source: §2 · p. 3
  • The paper characterizes transfer-attack performance as unsatisfactory, especially for targeted attacks, and studies whether flat local minima yield more transferable examples.It proposes an algorithm to seek adversarial examples at flat local minima.Source: §2 · p. 3

3 Methodology

The methodology formulates transfer attacks on a white-box surrogate and seeks adversarial examples that remain low-loss across a local neighborhood. RAP uses an inner worst-case perturbation step and an outer attack update; a late-start variant and flatness visualizations further examine the approach.

3.1 Preliminaries of Transfer Adversarial Attack

  • Transfer attacks construct an adversarial example within an input neighborhood using a white-box surrogate, then transfer it to a black-box target for untargeted or targeted prediction changes.The attack loss may be cross-entropy or logit loss; untargeted formulations replace the loss and target label as described.Source: §3.1 · p. 3
  • Existing attack methods and transfer techniques fit the formulation through a choice of transformation, including identity, resizing and padding, translation, scaling, or adversarial mixup.Examples include I-FGSM, MI-FGSM [5], DI [48], TI [6], SI [24], and Admix [41].Source: §3.1 · p. 3

3.2 Reverse Adversarial Perturbation

  • RAP seeks a flat local region by minimizing the maximum attack loss around the adversarial example; its inner step searches a local perturbation region, with corresponding untargeted formulations replacing the loss and label.The method is formulated as min-max bi-level optimization and uses projected gradient ascent for the inner maximization.Source: §3.2 · p. 4
  • After the inner perturbation is found, the outer adversarial-example update can use an existing attack algorithm, allowing RAP to combine with input-transformation methods.The paper gives one-step projected gradient descent as an example of the outer update.Source: §3.2 · p. 4
  • RAP-LS delays RAP because its early-stage performance can be slightly lower than the baseline; the proposed strategy first minimizes attack loss, then starts RAP.The preliminary Figure 2 comparison uses ResNet-50 as surrogate and MI and Admix baselines; RAP surpasses them later, while RAP-LS is presented as a strategy to improve early-stage efficiency and effectiveness.Source: §3.2 · p. 5, Figure 2 · p. 5

3.3 A Closer Look at RAP

  • RAP helps adversarial examples occupy flatter loss regions than I-FGSM, MI, DI, and MI-TI-DI in untargeted attacks on ResNet-50.The visualization varies examples along random directions with different magnitudes.Source: §3.3 · p. 5, Figure 3 · p. 6

4 Experiments

RAP and RAP-LS improve transfer-attack success across baseline and combinational methods, diverse architectures, defense models, and a real-world image recognition API. The experiments also examine hyperparameters and compare RAP with other attack types.

4.1 Experimental Settings

  • Experiments use 1,000 ImageNet-compatible images, four surrogate architectures, and 400 iterations; RAP uses KLS=100 and α_n=2/255.Source: §4.1 · p. 6

4.2 The Evaluation of Untargeted Attacks

  • RAP beats I and MI by 9.6% and 16.3% in average attack success rate; RAP-LS reaches 95.4%, 97.6%, and 98.3% on MTDI, MTDSI, and MTDAI.For TI, DI, SI, and Admix, RAP improves by 10.2%, 10.9%, 9.3%, and 6.3%, respectively; RAP-LS further boosts almost all methods.Source: §4.2 · pp. 6–7, Table 1 · p. 7, Table 2 · p. 7

4.3 The Evaluation of Targeted Attacks

  • RAP improves targeted baseline attacks; RAP-LS exceeds RAP by 2.6% average attack success rate and improves over MTDI, MTDSI, and MTDAI by 14.2%, 11.8%, and 9.3%.For ResNet-50 and DenseNet-121 surrogates, RAP's average improvements are 5.0% (I), 8.1% (MI), 4.6% (TI), 10.4% (DI), 18.5% (SI), and 15.1% (Admix).Source: §4.3 · p. 7, Table 4 · p. 8, Table 3 · p. 8

4.4 The Comparison with Other Types of Attacks

  • MI-DI-RAP improves average targeted attack success rate by 33.5% over LinBP-MI-DI-SGM; MTDSI+RAP-LS beats TTP and MTDI by 14.9% and 25.7%.The LinBP comparison uses ResNet-50 as the surrogate; TTP is evaluated in its “10-Targets (all-source)” setting.Source: §4.4 · p. 8, Table 5 · p. 8, Table 6 · p. 8

4.5 The Evaluation on Diverse Network Architectures and Defense Models

  • Across Inception-ResNet-v2, NASNet-Large, and ViT-Base/16, RAP-LS improves all three combinational methods; MTDAI+RAP-LS performs best, with 5.9% untargeted and 7.8% targeted gains for MTDAI.Source: §4.5 · pp. 8–9, Table 7 · p. 9
  • On Inc-v3adv and IncRes-v2ens, RAP-LS improves average attack success by 9.8% and 14.1% for untargeted attacks, and 14.8% and 11.1% for targeted attacks, respectively.Source: §4.5 · p. 9, Table 7 · p. 9

4.6 Ablation Study

  • At fixed ε_n, more iterations improve attack performance; ε_n=12 or 16 is satisfactory in most cases, while KLS gains generally become mild above 100.The ablations use targeted attacks with ResNet-50 as surrogate; Figure 4 examines ε_n and T, and Figure 5 examines KLS.Source: §4.6 · p. 9, Figure 4 · p. 10, Figure 5 · p. 10

4.7 The Targeted Attack Against Google Cloud Vision API

  • On Google Cloud Vision API, RAP-LS attacked 342 images versus 232 for MTDAI, a reported 22.0% performance improvement.The evaluation used 500 randomly selected images and ResNet-50 as the surrogate model.Source: §4.7 · pp. 9–10

5 Conclusion

RAP seeks flatter adversarial-example loss regions to improve transferability, and experiments cover untargeted and targeted attacks, standard and defense models, and a real-world vision API. The authors describe transfer attacks as a serious threat and call for stronger defenses.

5 Conclusion

  • RAP seeks consistently low attack loss around adversarial examples through a min-max optimization that injects worst-case perturbations.The experiments cover untargeted and targeted attacks, standard and defense models, and Google Cloud Vision API.Source: §5 · p. 10
  • The authors report that RAP significantly boosts adversarial-example transferability across the evaluated settings.Source: §5 · p. 10

A Social Impact

  • The authors identify transfer attacks as serious threats and call for stronger defenses and robust models against black-box attacks.They also state that the work may contribute to understanding adversarial-example transferability.Source: §5 · p. 10, A Social Impact · p. 15

B Implementation Details

The implementation section reports the evaluated models, baseline settings, computational overhead, and procedure for visualizing loss flatness. It also introduces comparisons of RAP with several baseline attacks.

B Implementation Details

  • Experiments were run three times and averaged over three random seeds; ImageNet is licensed for noncommercial use, while the two other datasets are MIT-licensed.Source: B Implementation Details · p. 15
  • Experiments use torchvision pretrained ResNet-50, DenseNet-121, VGG-16, and Inception-v3 models, alongside other provided pretrained models.The other models are Inception-ResNet-v2, NASNet-Large, ViT-Base/16, adv-Inc-v3, and ens-adv-Inc-Res-v2.Source: B Implementation Details · p. 15
  • Baseline implementations use specified settings for MI, TI, DI, SI, Admix, ILA, LinBP, and TTP attacks.For example, MI uses decay 1.0, TI uses kernel size 5, and DI uses transformation probability 0.7.Source: B Implementation Details · p. 15
  • RAP-LS requires K + (K − KLS) × T forward and backward calculations, with an extra (K − KLS) × T compared with the original attack.Source: B Implementation Details · p. 15
  • The flatness visualization measures loss change as xadv moves along a normalized random direction and averages results over 20 directions.The loss change is defined as f(a) = L(Ms(G(xadv + a · d); θ), yt) − L(Ms(G(xadv); θ), yt).Source: B Implementation Details · p. 15

C Experimental Results about More baseline attacks

C.1 Experimental Results about VT and EMI

RAP-LS improves on the MI-TI-DI baseline comparisons with VT and EMI, with a reported targeted-attack gain over VT.

C.1 Experimental Results about VT and EMI

  • 6.7% higher average success rate for targeted attacks than VT is reported for RAP-LS using the MI-TI-DI baseline.The tables report untargeted and targeted attack success rates for VT, EMI, and RAP-LS.Source: §C.1 · p. 16, Table 9 · p. 16, Table 8 · p. 16
  • RAP-LS achieves better performance than the compared methods, especially for targeted attacks.Source: §C.1 · p. 16
  • The reported tables cover untargeted and targeted attack success rates for VT, EMI, and RAP-LS with MI-TI-DI as the baseline.Source: Table 8 · p. 16, Table 9 · p. 16

C.2 Experimental Results about Ghost Net attack

The experiments report that Ghost Net improves transfer attack performance and that combining it with RAP-LS can improve targeted transferability further, particularly on Inception-v3.

C.2 Experimental Results about Ghost Net attack

  • Ghost Net perturbs ResNet skip connections by multiplying them by a random scalar sampled from a uniform distribution.Source: §C.2 · pp. 16–17
  • Combining Ghost Net with RAP-LS further improves targeted transferability, especially on Inception-v3.The results use the MI-TI-DI baseline, and Table 10 reports targeted attack success rates.Source: §C.2 · p. 17, Table 10 · p. 17
  • The reported comparison evaluates targeted attack success rates for Ghost Net and RAP-LS with the MI-TI-DI baseline.Source: Table 10 · p. 17, §C.2 · p. 17

C.3 Experimental Results about EOT attack

The EOT comparison tests repeated random resizing and padding within each iteration, rather than applying input transformation once. RAP outperforms EOT, and combining the methods gives the strongest reported performance.

C.3 Experimental Results about EOT attack

  • EOT moderately improves attack performance over MI-TI-DI by sampling random resizing and padding transformations 10 times per iteration.Unlike DI, the transformations are sampled repeatedly in each iteration.Source: §C.3 · p. 17
  • RAP surpasses EOT by a large margin, especially on Inc-v3 and VGG-16 targets.The table reports targeted attack success rates with the MI-TI-DI baseline.Source: §C.3 · p. 17, Table 11 · p. 17
  • Combining RAP with EOT further boosts EOT attack performance and achieves the best performance among the compared methods.The authors describe the methods as complementary.Source: §C.3 · p. 17

D Experimental Results about More Defense Models

Across additional defense models, RAP-LS improves baseline transferability, though the reported gain is smaller for Feature Denoising. The appendix also introduces further experiments on targeted attacks, diverse architectures, and iteration counts.

D Experimental Results about More Defense Models

  • RAP-LS boosts baseline average attack success rate by 5.5% across the additional defense models evaluated, including adversarially trained models and Feature Denoising.The evaluation uses the models and settings described for this appendix experiment.Source: D Experimental Results about More… · p. 18, Table 12 · p. 18
  • Against NRP combined with adversarially trained models, RAP-LS improves performance by 0.8% despite the stronger defense setting.The comparison reports untargeted attack performance.Source: D Experimental Results about More… · p. 18, Table 13 · p. 18
  • Against R&P combined with adversarially trained models, RAP-LS increases average attack success rate by 9.1%.The comparison reports untargeted attack performance.Source: D Experimental Results about More… · p. 18, Table 14 · p. 18
  • RAP is less effective against Feature Denoising, which the authors attribute mainly to its non-local block and perturbation-size settings.They suggest the block smooths the decision boundary, making some local minima harder to escape, especially with small attack perturbations.Source: D Experimental Results about More… · pp. 18–19
  • With a 20/255 attack perturbation, MI-TI-DI+RAP-LS reaches 50.7% against Feature Denoising, versus 48.3% for MI-TI-DI; the reported relative improvement is 2.4%.At 16/255, the reported relative improvement is 0.3%; the authors suggest the larger perturbation may help escape local minima.Source: D Experimental Results about More… · p. 19

E Additional Experimental Results

  • The additional experiments cover targeted attacks with CE loss, ensemble attacks on diverse architectures, and varying iteration counts.These topics are introduced as Sections E.1, E.2, and E.3, respectively.Source: E Additional Experimental Results · p. 19

E.1 The Results of Targeted Attacks with CE Loss

The section evaluates targeted attack success with CE loss across four target architectures. RAP-LS outperforms the compared combinational methods on the average attack success rate.

E.1 The Results of Targeted Attacks with CE Loss

  • RAP-LS outperforms all evaluated combinational methods in the targeted-attack comparison.The table reports CE-loss results with 400 iterations.Source: §E.1 · p. 19, Table 15 · p. 19
  • The average attack success rate is computed across four target models: ResNet-50, DenseNet-121, VGG-16, and Inception-v3.The experiment follows the main-submission settings.Source: §E.1 · p. 19
  • RAP-LS improves average attack success rate by 20.9% over MTDI, 18.4% over MTDSI, and 15.1% over MTDAI.The evaluation covers ResNet-50, DenseNet-121, VGG-16, and Inception-v3 targets.Source: Table 15 · p. 19, §E.1 · p. 19

E.2 The Results of Ensemble Attacks on Diverse Network Architectures

The ensemble experiments show RAP-LS improving transferability across targeted and untargeted attacks on diverse architectures. Separately, attack performance generally rises with more iterations in most cases.

E.2 The Results of Ensemble Attacks on Diverse Network Architectures

  • Ensemble attacks perform better than single-model attacks, and RAP-LS further boosts baseline transferability for both targeted and untargeted attacks.The section evaluates transfer to diverse architectures.Source: §E.2 · p. 19
  • On ViT targets, RAP-LS improves ensemble untargeted attack performance by 19.2% and targeted attack performance by 10.4%.The ensemble averages logits from ResNet-50, DenseNet-121, VGG-16, and Inception-v3 surrogates.Source: §E.2 · p. 19, Table 16 · p. 20

E.3 The Experimental Results w.r.t Different Value of Iterations

  • Attack performance generally increases as the iteration count K rises in most cases.The appendix reports targeted and untargeted results for K values of 10, 100, 200, 300, and 400.Source: Table 17 · p. 20, §E.3 · p. 20, Table 18 · p. 23
Loading 2210.05968v1…