PaperlayerView exact revision on arXiv

Source-linked AI summary

Boosting Adversarial Transferability by Achieving Flat Local Maxima

Zhijin Ge, Hongying Liu, Xiaosen Wang, Fanhua Shang, Yuanyuan Liu

arXiv:2306.05225v2cs.CVcs.CRcs.LG

TL;DR

Transfer-based attacks are useful because surrogate-generated adversarial examples can target other models, but transferability remains limited. PGN penalizes gradient norms to find flat local regions, approximating Hessian/vector products with interpolated gradients. It improves transferability across normally and adversarially trained models, though the relationship between flatness and transferability remains theoretically unresolved.

  • Problem

    White-box attacks often transfer poorly to black-box models, particularly advanced defenses, limiting transfer-based attacks despite their practical use without target-model access.

    Source: §1 · p. 2

  • Method

    PGN penalizes gradient norms to seek flat local regions, approximating Hessian/vector products with interpolated first-order gradients and averaging sampled gradients.

    Source: §1 · p. 2, §3.2 · p. 4, §3.3 · pp. 4–5

  • Results

    PGN improves transferability on normally and adversarially trained models; from Inc-v3 to Inc-v4, it achieves 90.6% attack success, 6.1% above RAP.

    Source: §1 · p. 2, §4.3 · p. 7

  • Takeaways & Limitations

    PGN can be combined with existing gradient-based and input transformation-based attacks to further improve adversarial transferability.

    Source: §1 · p. 2, §3.3 · p. 5

    The relationship between flatness and adversarial transferability still lacks theoretical analysis.

    Source: §6 · p. 10

Abstract

from arXiv · show

Transfer-based attack adopts the adversarial examples generated on the surrogate model to attack various models, making it applicable in the physical world and attracting increasing interest. Recently, various adversarial attacks have emerged to boost adversarial transferability from different perspectives. In this work, inspired by the observation that flat local minima are correlated with good generalization, we assume and empirically validate that adversarial examples at a flat local region tend to have good transferability by introducing a penalized gradient norm to the original loss function. Since directly optimizing the gradient regularization norm is computationally expensive and intractable for generating adversarial examples, we propose an approximation optimization method to simplify the gradient update of the objective function. Specifically, we randomly sample an example and adopt a first-order procedure to approximate the curvature of Hessian/vector product, which makes computing more efficient by interpolating two neighboring gradients. Meanwhile, in order to obtain a more stable gradient direction, we randomly sample multiple examples and average the gradients of these examples to reduce the variance due to random sampling during the iterative process. Extensive experimental results on the ImageNet-compatible dataset show that the proposed method can generate adversarial examples at flat local regions, and significantly improve the adversarial transferability on either normally trained models or adversarially trained models than the state-of-the-art attacks. Our codes are available at: https://github.com/Trustworthy-AI-Group/PGN.

1 Introduction

The introduction frames transferability as the practical value of surrogate-based attacks, while noting that existing approaches still leave a gap between white-box and transfer-based black-box attacks. It proposes Penalizing Gradient Norm (PGN), which targets flat local regions and is evaluated on normally and adversarially trained models.

1 Introduction

  • Transfer-based attacks can target models without access to their internals, but existing white-box methods often transfer poorly, especially against advanced defenses.Prior work attributes weak transferability to poor local maxima or overfitting the surrogate model.Source: §1 · pp. 1–2
  • PGN penalizes gradient norms to steer adversarial examples toward flat local regions, using interpolated first-order gradients to approximate Hessian/vector products.It averages gradients from randomly sampled data points to reduce approximation error and stabilize updates.Source: §1 · p. 2
  • Evaluations report that PGN improves transferability on normally and adversarially trained models and can combine with prior attacks for further gains.The introduction also reports that it can generate adversarial examples at flat local regions.Source: §1 · p. 2

2 Related Work

Related work reviews white-box and black-box adversarial attacks, approaches for improving transferability, and research connecting flat minima with model generalization.

2 Related Work

  • The section surveys adversarial attack methods and studies of flat local minima in model generalization.This is the scope stated for the related-work section.Source: §2 · p. 2

2.1 Adversarial Attacks

  • Query-based black-box attacks can require hundreds or thousands of queries, whereas transfer-based attacks use surrogate-generated examples to attack other models without target-model access.The section also surveys gradient optimization, input transformation, ensemble, and adversarial transformation approaches to improve transferability.Source: §2.1 · pp. 2–3

2.2 Flat Minima

  • Prior work links flat minima with generalization and studies this relationship through optimization landscapes, sharpness, and gradient norms.Examples include SAM [14], which minimizes loss and sharpness, and Zhao et al. [66], who connect gradient norms with flatter minima.Source: §2.2 · p. 3

3 Methodology

The method frames transfer attacks as optimizing adversarial examples on an accessible surrogate, then proposes penalizing neighborhood gradients to seek flat local maxima. PGN approximates this optimization with finite differences and gradient averaging to improve efficiency and stability.

3.1 Preliminaries

  • Transfer-based attacks generate adversarial examples on an accessible surrogate because the target-model gradient is unavailable in black-box settings.I-FGSM is described as iteratively updating the adversarial perturbation within the allowed perturbation ball.Source: §3.1 · p. 3

3.2 Flat Local Maxima Tend to Improve Adversarial Transferability

  • The method assumes that adversarial examples in flatter local regions transfer better and penalizes the maximum gradient in a neighborhood to encourage flatness.The neighborhood maximum is approximated by randomly sampling an example in the ζ-ball during optimization.Source: §3.2 · p. 4
  • 5.3% for I-FGSM and 7.2% for MI-FGSM are the average attack success rate improvements from gradient regularization on seven black-box models.The adversarial examples were generated on Inc-v3.Source: §3.2 · p. 4, Figure 1 · p. 4

3.3 Finding Flat Local Maxima

  • Direct optimization is computationally expensive, so PGN uses finite differences to approximate the Hessian/vector product with first-order gradients.The gradient approximation interpolates two neighboring gradients to improve attack efficiency.Source: §3.3 · pp. 4–5
  • Averaging gradients from multiple randomly sampled neighborhood examples reduces sampling variance and yields a more stable gradient estimate.PGN is designed to integrate with existing gradient-based and input-transformation-based attacks.Source: §3.3 · p. 5

4 Experiments

Experiments evaluate PGN’s loss-surface behavior, transfer success, computational approximation, and hyperparameter choices on the ImageNet-compatible dataset. Across single-model, ensemble, and integrated-attack settings, the reported results show improved transferability.

4.1 Experimental Settings

  • Experiments use 1,000 ImageNet-compatible images and evaluate five normally trained models, three adversarially trained models, and five iterative gradient-based attack baselines.The ImageNet-compatible images are 299 × 299 × 3 and include ground-truth labels and target labels for targeted attacks.Source: §4.1 · p. 6

4.2 Visualization of Loss Surfaces for Adversarial Example

  • PGN examples occupy larger, smoother flat local maxima than baseline-generated examples in the visualized loss surfaces.The visualization compares two randomly selected images, with each adversarial example at the center of its loss-surface map.Source: §4.2 · pp. 6–7

4.3 Attack a Single Model

  • PGN reaches a 90.6% attack success rate on Inc-v4 using examples crafted on Inc-v3, surpassing RAP’s 84.5% by a margin of 6.1%.The reported results also show high white-box success alongside improved black-box success.Source: §4.3 · p. 7, Table 1 · p. 7

4.4 Attack an Ensemble of Models

  • PGN achieves a 92.78% average success rate in ensemble attacks, outperforming VMI-FGSM, EMI-FGSM, and RAP by 12.42%, 11.88%, and 7.37%, respectively.Against adversarially trained models, PGN exceeds RAP by over 18.4% on average.Source: §4.4 · p. 8, Table 2 · p. 8

4.5 Combined with Input Transformation Attacks

  • DIM+PGN achieves an 84.06% average success rate across seven models versus DIM’s 54.56%, a 29.5% increase.The experiments also report improvements when PGN is integrated with TIM, SIM, Admix, and SSA.Source: §4.5 · p. 8, Table 3 · p. 8

4.6 Ablation Study on Finite Difference Method

  • Finite differences approximate Hessian optimization with two gradient computations per iteration, reducing runtime and memory while better approximating its attack performance.The theoretical complexity is O(2n) for the finite-difference method versus O(n^2) for direct second-order optimization.Source: §4.6 · p. 9, Table 4 · p. 9

4.7 Ablation Study on Hyper-parameters

  • Transferability peaks at δ = 0.5 when ζ is fixed at 3.0 × ϵ, so the experiments use δ = 0.5.The passage attributes the peak to averaging the two gradients.Source: §4.7 · p. 9
  • With increasing ζ, success peaks on normally trained models at ζ = 3.0 × ϵ, while adversarially trained-model success continues rising until performance decreases when ζ > 4.5 × ϵ.The authors choose ζ = 3.0 × ϵ as a trade-off; uniform sampling is used to reduce bias from uneven sample distribution.Source: §4.7 · pp. 9–10, Figure 3 · p. 10

5 Conclusion

The conclusion presents PGN as an approximation-based attack for generating adversarial examples in flat local regions. Experiments support improved transferability and integration with other attack methods.

5 Conclusion

  • The authors hypothesize and empirically validate that adversarial examples in flat local regions tend to have better transferability.Source: §5 · p. 10
  • PGN approximates the Hessian/vector product by interpolating first-order gradients from two samples and updates perturbations using averaged gradients from randomly sampled points.Source: §5 · p. 10
  • ImageNet-compatible dataset experiments show flatter generated regions and better transferability than existing transfer-based attacks.PGN can also be integrated with gradient-based and input transformation-based attacks to further improve transferability.Source: §5 · p. 10

6 Limitation

The paper reports experimental evidence linking flat local regions to better adversarial transferability, but identifies the relationship’s theoretical basis as unresolved.

6 Limitation

  • The relationship between flatness and adversarial transferability lacks theoretical analysis in this work.Source: §6 · p. 10
  • The authors identify theoretical study of the flatness-transferability connection as future work.Source: §6 · p. 10
  • The authors frame flat local maxima as a potential avenue for transferable adversarial examples and further exploration of adversarial attacks.Source: §6 · p. 10

A Proof of Corollary 1

PGN uses a gradient-norm penalty and an approximation to produce adversarial examples in flatter regions. The section presents evidence that this approach improves transferability and can be combined with existing attacks.

A Proof of Corollary 1

  • PGN samples a neighboring point and adds a gradient-norm penalty to the loss objective to seek flatter adversarial regions.Direct optimization is computationally expensive because it requires calculating the Hessian; the proposed approximation uses finite differences.Source: A Proof of Corollary 1 · p. 15

A.1 Proof of Theorem 1

  • The Hessian/vector product is approximated using first-order gradients at neighboring points, yielding an interpolated gradient update for the objective.The derivation uses a small step along a normalized gradient direction and introduces δ = λα as a balancing coefficient.Source: §A.1 · p. 15, §A.2 · p. 15

B Visualization of Loss Surfaces

  • On five selected images, PGN produces visually similar adversaries while guiding examples toward larger, smoother flat regions.Three selected examples transferred with PGN but not with the other baseline methods; Figure 4 shows loss surfaces on Inc-v3.Source: B Visualization of Loss Surfaces · pp. 15–16

C.1 Gradient-based Attacks

  • PGN’s gradient interpolation also improves transferability when incorporated into I-FGSM, MI-FGSM, NI-FGSM, VMI-FGSM, EMI-FGSM, and RAP.The experiments replace the methods’ gradient-update process with the proposed strategy and omit random sampling.Source: §C.1 · p. 16, Table 5 · p. 16
  • RAP’s average success rate across seven models rises from 68.80% alone to 73.91% with PGN, a 5.11% improvement.The experiments integrate PGN’s gradient-update strategy into several existing gradient-based attacks.Source: §C.1 · p. 16, Table 5 · p. 16

C.2 Skip Gradient Method

PGN can be combined with the Skip Gradient Method (SGM). In the reported comparison, PGN-SGM outperforms either method alone.

C.2 Skip Gradient Method

  • Figure 4 includes three examples that transfer with PGN but not with the other baseline methods, alongside their Inc-v3 loss surfaces.The figure visualizes five randomly selected images and their corresponding loss surfaces along two random directions.Source: Figure 4 · p. 17
  • PGN-SGM outperforms both PGN and SGM, and PGN consistently performs better than SGM in the single-model comparison.The comparison uses MI-FGSM as the backbone and crafts examples on ResNet-18.Source: §C.2 · p. 18, Table 6 · p. 18

D.1 The Number of Sampled Examples, N

The number of sampled examples affects PGN’s transferability. Increasing N improves transferability until results gradually converge for normally trained models.

D.1 The Number of Sampled Examples, N

  • Transferability improves rapidly as N increases up to 12, then gradually converges for normally trained models; the study uses N = 20 to balance transferability and computational overhead.When N > 12, a slight further improvement remains possible; N = 1 gives the lowest transferability.Source: §D.1 · p. 18, Figure 5 · p. 18

D.2 Finite Difference Step-size α

The authors use a finite-difference step size of α = 1.6/255 and report that smaller tested step sizes do not improve transferability. They also compare the resulting approximation with the Hessian/vector product.

D.2 Finite Difference Step-size α

  • Smaller step sizes of 1e-4 and 1e-5 cannot improve transferability; with smaller steps, neighboring gradients become closer and the method degrades to MI-FGSM.The selected step size is α = 1.6/255 ≈ 6.27e-3; the results are reported in Table 7.Source: §D.2 · pp. 18–19, Table 7 · p. 19
  • The finite-difference approximation’s perturbations have an average cosine similarity of about 0.9035 with those from the Hessian/vector product across 1,000 images.The authors note that existing attacks typically rely on the gradient sign rather than an exact gradient value.Source: §D.2 · p. 19

E Differences between Our method and Related Works

The section distinguishes PGN from RAP by its approach to flat local optima and from GNP by focusing on adversarial transferability rather than training generalization. It also reports empirical verification of the flat-region transferability link and lower runtime than RAP.

E.1 Differences with RAP

  • PGN and RAP both target flat local optima, and this work provides the first empirical verification that adversarial examples there are more transferable.RAP injects worst-case perturbations to maximize loss, whereas PGN adds a gradient norm to the loss.Source: §E.1 · p. 19
  • PGN uses 29.85s per batch versus RAP’s 207.19s under the reported setup, with 10 outer and 20 inner loops rather than 400 and 8.The comparison used Inc-v3, batch size 10, and an RTX 2080 Ti with CUDA.Source: §E.1 · p. 19

E.2 Compared with Gradient Norm Penalty

  • Unlike Zhao et al. [66], which targets flat local minima during model training for generalization, PGN studies their potential effect on adversarial transferability.The authors describe this relationship as receiving limited attention in prior adversarial-attack research.Source: §E.2 · pp. 19–20
  • PGN emphasizes gradient information around adversarial examples and approximates the second-order Hessian using finite differences; Zhao et al. [66] provides theoretical foundations for this approach.The paper also describes PGN as the first work to penalize gradient norm in adversarial attacks.Source: §E.2 · pp. 19–20

F Additional Experimental Results

Additional experiments report PGN’s performance on Transformer models, several defenses, and CIFAR-10. Across these settings, the supplied results describe improved transferability, including higher average success rates against six defense models.

F.1 Evaluated on Transformer-based Models

  • On Transformer-based models, PGN consistently outperforms the baselines when adversarial examples are generated on Inc-v3.The evaluated architectures are ViT, PiT, Visformer, and Swin.Source: §F.1 · p. 20, Table 8 · p. 20

F.2 Attack Defense Models

  • 77.08% average success rate against six defense models for PGN exceeds VMI’s 54.91%, EMI’s 61.59%, and RAP’s 69.94%.The reported gains are 22.17%, 15.49%, and 7.14%, respectively; adversarial examples were generated on an ensemble of Inc-v3, Inc-v4, and IncRes-v2.Source: §F.2 · p. 20, Table 9 · p. 21

F.3 Attack Success Rates on CIFAR-10

  • On CIFAR-10, PGN enhances transferability for attacks crafted on VGG-16, ResNet-50, and DenseNet-121.The experiments use maximum perturbation ϵ = 8/255, T = 10 iterations, and step size α = 1/255; Table 10 reports untargeted attack success rates.Source: §F.3 · pp. 20–21, Table 10 · p. 21
Loading 2306.05225v2…