Source-linked AI summary
Boosting Adversarial Transferability by Block Shuffle and Rotation
Kunyu Wang, Xuanran He, Wenxuan Wang, Xiaosen Wang
TL;DR
Existing attacks can perform strongly in white-box settings yet transfer relatively poorly, limiting their efficacy for black-box attacks. BSR shuffles and rotates image blocks for gradient calculation, and ImageNet evaluations report better transferability than state-of-the-art attacks across settings.
Problem
Existing attacks can perform strongly in white-box settings yet transfer relatively poorly, limiting their efficacy when target-model access is limited.
Source: §1 · p. 1Method
BSR divides images into blocks, randomly shuffles and rotates them, and averages gradients over transformed images to stabilize optimization.
Source: §1 · p. 2Results
ImageNet evaluations show BSR achieves better transferability than state-of-the-art attacks under various attack settings.
Source: §5 · p. 8Takeaways & Limitations
BSR can be combined with other transfer-based attacks to further improve transferability.
Source: §1 · p. 2
Abstract
from arXiv · showhide
Adversarial examples mislead deep neural networks with imperceptible perturbations and have brought significant threats to deep learning. An important aspect is their transferability, which refers to their ability to deceive other models, thus enabling attacks in the black-box setting. Though various methods have been proposed to boost transferability, the performance still falls short compared with white-box attacks. In this work, we observe that existing input transformation based attacks, one of the mainstream transfer-based attacks, result in different attention heatmaps on various models, which might limit the transferability. We also find that breaking the intrinsic relation of the image can disrupt the attention heatmap of the original image. Based on this finding, we propose a novel input transformation based attack called block shuffle and rotation (BSR). Specifically, BSR splits the input image into several blocks, then randomly shuffles and rotates these blocks to construct a set of new images for gradient calculation. Empirical evaluations on the ImageNet dataset demonstrate that BSR could achieve significantly better transferability than the existing input transformation based methods under single-model and ensemble-model settings. Combining BSR with the current input transformation method can further improve the transferability, which significantly outperforms the state-of-the-art methods. Code is available at https://github.com/Trustworthy-AI-Group/BSR
1. Introduction
Adversarial examples threaten deep neural networks, while attacks with strong white-box performance can transfer relatively poorly, limiting their efficacy in black-box applications.
1. Introduction
- Existing input-transformation attacks produce different attention heatmaps across models, a discrepancy that could limit adversarial transferability.The authors note that heatmaps highlight classification-critical regions.Source: §1 · p. 2
- BSR randomly divides images into blocks, shuffles and rotates them, then averages gradients across transformed images to stabilize optimization.The authors propose this transformation to reduce variance among attention heatmaps across models.Source: §1 · p. 2
- Randomly shuffling image blocks disrupts the raw image’s attention heatmap, motivating BSR’s use of transformed images for gradient calculation.The authors describe this as breaking the image’s intrinsic relations.Source: §1 · p. 2
- BSR achieves much better transferability than state-of-the-art input-transformation attacks on ImageNet and can combine with other transfer-based attacks for further gains.The authors report these as contributions of the method.Source: §1 · p. 2
2. Related Work
The section surveys adversarial attacks and defenses and introduces attention heatmaps as an interpretability tool used to investigate transferability.
2.1. Adversarial Attacks
- Adversarial attacks include gradient-based white-box methods and score-, decision-, and transfer-based black-box methods; transfer attacks use surrogate examples without target-model access.The section also notes that iterative FGSM improves white-box performance but transfers poorly.Source: §2.1 · p. 2
- Transferability methods add momentum, attack multiple models, disrupt feature space, or transform inputs through resizing, translation, scaling, admixing, and augmentation.BSR is presented as an input transformation that breaks intrinsic semantic relations for more diverse images and better transferability.Source: §2.1 · p. 2
2.2. Adversarial Defenses
- Defenses include adversarial training, denoising and purification, input transformations, and certified methods that provide guarantees within a specified radius.Examples include ensemble adversarial training, feature squeezing, IBP, CROWN-IBP, and randomized smoothing.Source: §2.2 · pp. 2–3
2.3. Attention Heatmaps
- Attention heatmaps interpret deep models; Grad-CAM uses gradient information to generate heatmaps, which this paper adopts to investigate transferability.Source: §2.3 · p. 3
3. Methodology
The methodology frames transferability around cross-model consistency in adversarial-example attention heatmaps, then introduces BSR to vary those heatmaps using a single source model. BSR integrates shuffled and rotated image blocks into gradient-based attack updates, and differs from RLFAT in its goal and use.
3.1. Preliminaries
- The attack objective is to find an adversarial example that fools the model while remaining within a perturbation budget; the methodology adopts ℓ∞ distance.The preliminaries introduce loss maximization, FGSM’s gradient-sign update, and iterative FGSM; MI-FGSM adds momentum to improve transferability.Source: §3.1 · p. 3
3.2. Motivation
- Existing input-transformation attacks produce different attention heatmaps across models, motivating the question of how to make them consistent using one source model.The paper notes that accessing multiple models for an ensemble attack can be challenging and costly.Source: §3.2 · pp. 3–4, Figure 2 · p. 4
3.3. Block Shuffle and Rotation
- BSR splits an image into n × n blocks, randomly shuffles them, and independently rotates each block within −τ to τ degrees before gradient calculation.Parts extending beyond image boundaries are removed and gaps are filled with zero.Source: §3.3 · p. 4
- BSR integrates the transformation into MI-FGSM, averaging gradients over N transformed images before updating momentum and the adversarial example.The transformation is general to existing attacks; the paper notes transformed images are not always correctly classified, reporting approximately 86.8% on Inc-v3.Source: §3.3 · pp. 4–5
3.4. BSR Vs. RLFAT
- BSR targets transferable adversarial examples, whereas RLFAT [32] targets adversarial-training generalization; BSR shuffles and rotates blocks for gradient calculation, while RLFAT only shuffles as a regularizer.The paper distinguishes the methods by goal, transformation strategy, and usage.Source: §3.4 · p. 5
4. Experiments
Experiments on ImageNet evaluate BSR against single-model and ensemble attacks, defenses, and alternative input transformations. BSR improves transferability alone and in combination, while ablations examine how block shuffling, rotation, and averaging affect performance.
4.1. Experimental Setup
- The evaluation uses 1,000 ImageNet validation images and compares four standard and three adversarially trained victim models against five input-transformation baselines.All transformations are integrated into MI-FGSM; BSR uses 2 × 2 blocks, a maximum rotation angle of 24°, and 20 transformed images.Source: §4.1 · p. 5
4.2. Evaluation on Single Model
- BSR reaches 93.8% average attack success on standard-trained models, improving over Admix by at least 6.5%, and 56.2% on adversarially trained models, beating PAM by 11.0%.It surpasses existing input-transformation attacks while maintaining comparable white-box performance.Source: §4.2 · p. 5, Table 1 · p. 6
4.3. Evaluation on Combined Input Transformation
- Adding BSR improves attack success rates by 16.7%–52.0%; BSR-TI-DIM also beats Admix-TI-DIM by 2.6% in average attack success rate.On adversarially trained models, combining BSR with input transformations improves attack performance by 22.8%–52.0%.Source: Table 2 · p. 6, §4.3 · p. 7
4.4. Evaluation on Ensemble Model
- In ensemble attacks, BSR-SI-TI-DIM achieves 98.4% average attack success on adversarially trained models, exceeding PAM-TI-DIM by at least 3.1%.BSR also exceeds PAM by 6.3%–8.1% on those models while maintaining comparable white-box performance with Admix.Source: Table 3 · p. 7, §4.4 · p. 7
4.5. Evaluation on Defense Method
- Against eight defenses, BSR-SI-TI-DIM achieves 94.1% average attack success, beating PAM-TI-DIM by 2.5% on average.It reaches 83.9% on RS and 84.2% on NRP, exceeding PAM-TI-DIM by 9.9% and 0.4%, respectively.Source: Table 4 · p. 7, §4.5 · p. 8
4.6. Ablation Study
- The ablations favor moderate disruption: one block only rotates the image, while more than three blocks introduce excess variance; the experiments set n = 2.The study also finds that N = 5 already beats MI-FGSM, performance stabilizes above N = 20, and τ = 24° balances increasing disruption against the loss from excessive rotation.Source: Figure 4 · p. 8, §4.6 · p. 8
- Block shuffle and block rotation each transfer better than MI-FGSM, and their combination in BSR achieves the best transferability.The comparison supports using both transformations together.Source: Figure 3 · p. 8, §4.6 · p. 8
5. Conclusion
The conclusion links cross-model attention-heatmap inconsistency with limited transferability and presents BSR as an approach that optimizes perturbations across transformed images to reduce heatmap variance.
5. Conclusion
- BSR optimizes perturbations across transformed images with different attention heatmaps to reduce variance across models.The paper reports better transferability than state-of-the-art attacks under various ImageNet attack settings.Source: §5 · p. 8
- Existing input-transformation attacks often produce inconsistent attention heatmaps across models, which the paper says limits transferability.Source: §5 · p. 8
- The paper concludes that generating adversarial examples with more stable cross-model attention heatmaps may improve transferability.Source: §5 · p. 8
6. Appendix
The appendix adds combined-transformation evaluations on three source models and visualizes attention heatmaps across source and target models.
6. Appendix
- The appendix extends combined-transformation evaluations to adversaries crafted on Inc-v4, IncRes-v2, and Res-101, and adds further heatmap comparisons.Source: §6 · p. 12
6.1. More Evaluations on Combined Input Transformation
- BSR combined with DIM, TIM, Admix, and PAM boosts transferability across Inc-v4, IncRes-v2, and Res-101; BSR-SI-DI-TIM beats PAM-TI-DIM by at least 6.4% on adversarially trained models.The reported comparisons are in Tables 5–7.Source: §6.1 · p. 12, Table 5 · p. 13, Table 6 · p. 13
6.2. Visualization on Attention Heatmaps
- In Figure 5, BSR’s source-model adversarial heatmaps are reported as more similar to target-model heatmaps than those from other attacks.The visualization compares attention heatmaps on source Inc-v4 and target Inc-v3.Source: §6.2 · p. 12, Figure 5 · p. 14