Research map / Adversarial robustness and security / Black-box and transfer attacks
Power of Diversity: Enhancing Data-Free Black-Box Attack with Domain-Augmented Learning
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes domain-augmented learning (CLIP text-embedding-conditioned generator, competitive optimization, heterogeneity excitation) to make synthetic data more diverse for substitute-training data-free black-box attacks.
Problem
Data-free substitute-training black-box attacks produce synthetic data with limited diversity and coverage, especially for complex target models and large data domains, which lowers attack success rates.
Approach
Injects CLIP text-encoder semantic embeddings (shallow/middle/deep levels) into the generator for broader coverage, adds a self-competition loss between consecutive iterations' data, and a heterogeneity-excitation regularizer that maximizes distance ratios to noise and text embeddings to complement information-entropy diversity optimization.
Key results
- Non-targeted ASR on CIFAR-10 (probability setting) of 78.36% for the proposed method vs. prior SOTA by about 14 points per abstract.
- Targeted ASR on CIFAR-100 (ResNet-50 target) reaches 38.81% in the probability setting; method improves substitute accuracy by 15.53% over SOTA on CIFAR-100.
- Ablation: removing adaptive semantic embedding, competition optimization, or heterogeneity excitation each drops ASR noticeably (e.g., CIFAR-10 non-targeted 78.36 to 69-71).
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Add Adaptive Semantic Embedding (ablation) | Domain-Augmented Learning · CIFAR-10, non-targeted, probability output | ASR (%): 71.21 -> 78.36 | Helped |
| Add Competition Optimization (ablation) | Domain-Augmented Learning · CIFAR-10, non-targeted, probability output | ASR (%): 69.02 -> 78.36 | Helped |
| Add Heterogeneity Excitation (ablation) | Domain-Augmented Learning · CIFAR-10, non-targeted, probability output | ASR (%): 69.25 -> 78.36 | Helped |
| Add Adaptive Semantic Embedding (ablation) | Domain-Augmented Learning · CIFAR-100, non-targeted, probability output | ASR (%): 48.93 -> 57.36 | Helped |
| Add Competition Optimization (ablation) | Domain-Augmented Learning · CIFAR-100, non-targeted, probability output | ASR (%): 50.12 -> 57.36 | Helped |
| Add Heterogeneity Excitation (ablation) | Domain-Augmented Learning · CIFAR-100, non-targeted, probability output | ASR (%): 49.52 -> 57.36 | Helped |
| Add Adaptive Semantic Embedding (ablation) | Domain-Augmented Learning · CIFAR-10, non-targeted, label output | ASR (%): 67.47 -> 73.51 | Helped |
| Add Competition Optimization (ablation) | Domain-Augmented Learning · CIFAR-10, non-targeted, label output | ASR (%): 66.81 -> 73.51 | Helped |
| Add Heterogeneity Excitation (ablation) | Domain-Augmented Learning · CIFAR-10, non-targeted, label output | ASR (%): 64.05 -> 73.51 | Helped |
| Add Adaptive Semantic Embedding (ablation) | Domain-Augmented Learning · CIFAR-100, non-targeted, label output | ASR (%): 46.92 -> 52.73 | Helped |
| Add Competition Optimization (ablation) | Domain-Augmented Learning · CIFAR-100, non-targeted, label output | ASR (%): 45.65 -> 52.73 | Helped |
| Add Heterogeneity Excitation (ablation) | Domain-Augmented Learning · CIFAR-100, non-targeted, label output | ASR (%): 46.35 -> 52.73 | Helped |
Surprising findings
- Substitute training on real data (target training set or ImageNet) yields higher substitute accuracy but lower attack success rates than synthetic data domains.
Limitations
- Improvements in some settings are modest (e.g., VGG-19 CIFAR-100 non-targeted gains of about 1 point over EDD in label setting).
- Diversity measured via cosine-similarity-based MD and information entropy; no formal diversity theory provided.
Experimental setup
Datasets: MNIST CIFAR-10 CIFAR-100 Tiny-ImageNet ImageNet
Benchmarks: MNIST CIFAR-10 CIFAR-100 Tiny-ImageNet
Metrics: attack success rate (ASR) substitute model accuracy SSIM
Baselines: Knockoff DDG FE-DaST TEDF EDD Training data substitute ImageNet substitute
Builds on: DaST FE-DaST EDD TEDF DDG
Closest papers by meaning
- Revisiting Source-Free Domain Adaptation: Insights into Representativeness, Generalization, and Variety (CVPR 2025 · similarity 0.85)
- Understanding the Robustness of Randomized Feature Defense Against Query-Based Adversarial Attacks (ICLR 2024 · similarity 0.84)
- Impartial Adversarial Distillation: Addressing Biased Data-Free Knowledge Distillation via Adaptive Constrained Optimization (AAAI 2024 · similarity 0.84)
- Mind the Gap: Detecting Black-box Adversarial Attacks in the Making through Query Update Analysis (CVPR 2025 · similarity 0.84)
- Data-Free Universal Attack by Exploiting the Intrinsic Vulnerability of Deep Models (AAAI 2025 · similarity 0.84)
- Out of Thin Air: Exploring Data-Free Adversarial Robustness Distillation (AAAI 2024 · similarity 0.84)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.