Research map / Adversarial robustness and security / Black-box and transfer attacks
Improving Transferable Targeted Adversarial Attacks with Model Self-Enhancement
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes SASD-WS, a source-model self-enhancement method (sharpness-aware self-distillation plus weight scaling) that flattens the loss landscape of the surrogate to make targeted transfer adversarial attacks more transferable.
Problem
Targeted transferability of adversarial perturbations is low because perturbations overfit mediocre-generalization source models; the paper aims to improve targeted black-box transfer attacks on ImageNet classifiers.
Approach
Fine-tune an auxiliary model with SAM, distill it into the source model while minimizing the distillation loss's sharpness (SASD), then approximate an ensemble of randomly pruned models by scaling the weights by p (WS), and attack with TI-DI-MI using the resulting SASD-WS model.
Key results
- Under black-box settings with a single source model, SASD-WS outperforms state-of-the-art baselines by 12.2% on average in targeted attack success rate.
- With an ensemble of six source models, SASD-WS improves targeted transfer success by 6.6% on average over baselines on adversarially trained and ViT/CLIP targets.
- Against Google Cloud Vision, SASD-WS achieves a 40.2% targeted transfer success rate versus 31.8% for LGV.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Add weight scaling to SASD (ablation) | ResNet-50 targeted transfer attack · NIPS17 targeted attack; target Inc-v3, Dense121, VGG16 | targeted attack success rate: 46.5 \pm 0.5 -> 70.3 \pm 0.8; 91.2 \pm 0.2 -> 93.0 \pm 0.2; 86.7 \pm 0.1 -> 88.7 \pm 0.4 | Helped |
| Add SASD to the normally trained source model (ablation) | ResNet-50 targeted transfer attack · NIPS17 targeted attack; target Inc-v3, Dense121, VGG16 | targeted attack success rate: 7.7 \pm 0.3 -> 46.5 \pm 0.5; 63.7 \pm 0.1 -> 91.2 \pm 0.2; 56.2 \pm 0.5 -> 86.7 \pm 0.1 | Helped |
| Fine-tune the auxiliary model before distillation (ablation) | SASD · NIPS17 targeted attack; target Inc-v3, Dense121, VGG16 | targeted attack success rate: 32.2 \pm 0.3 -> 46.5 \pm 0.5; 87.1 \pm 0.0 -> 91.2 \pm 0.2; 81.3 \pm 0.1 -> 86.7 \pm 0.1 | Helped |
| Distill the fine-tuned auxiliary model instead of using it directly (ablation) | SASD · NIPS17 targeted attack; target Inc-v3, Dense121, VGG16 | targeted attack success rate: 29.6 \pm 0.5 -> 46.5 \pm 0.5; 87.7 \pm 0.2 -> 91.2 \pm 0.2; 79.5 \pm 0.3 -> 86.7 \pm 0.1 | Helped |
| Use SASD rather than commonly used knowledge distillation (ablation) | SASD · NIPS17 targeted attack; target Inc-v3, Dense121, VGG16 | targeted attack success rate: 38.5 \pm 0.4 -> 46.5 \pm 0.5; 90.7 \pm 0.1 -> 91.2 \pm 0.2; 84.9 \pm 0.2 -> 86.7 \pm 0.1 | Helped |
Surprising findings
- RAP performs poorly under the ensemble source model setting, with average success of only 8.2%.
Limitations
- Relies on the approximation of ensemble by weight scaling, valid only when pruning probability is small (p=0.93 used).
- LGV cannot be applied to VGGNet-16, so some comparisons are missing.
Experimental setup
Datasets: ImageNet (ILSVRC 2012) NIPS17 targeted adversarial attack competition dataset
Benchmarks: NIPS17 targeted adversarial attack competition dataset ImageNet
Metrics: targeted attack success rate white-box attack success rate l2-norm of logit differences
Baselines: Pre-trained RAP GhostNet LGV SSA
Builds on: Sharpness-Aware Minimization knowledge distillation TI-DI-MI LGV RAP GhostNet attack
Closest papers by meaning
- Enhancing Adversarial Transferability with Adversarial Weight Tuning (AAAI 2025 · similarity 0.91)
- Towards Transferable Adversarial Attacks with Centralized Perturbation (AAAI 2024 · similarity 0.90)
- Boosting Adversarial Transferability through Augmentation in Hypothesis Space (CVPR 2025 · similarity 0.88)
- Improving Transferable Targeted Attacks with Feature Tuning Mixup (CVPR 2025 · similarity 0.88)
- LRS: Enhancing Adversarial Transferability through Lipschitz Regularized Surrogate (AAAI 2024 · similarity 0.87)
- Enhancing Adversarial Transferability with Checkpoints of a Single Model's Training (CVPR 2025 · similarity 0.87)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.