Research map / Adversarial robustness and security / Black-box and transfer attacks
Strong Transferable Adversarial Attacks via Ensembled Asymptotically Normal Distribution Learning
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes MultiANDA, a transfer-based black-box attack that learns a mixture-of-Gaussians distribution over adversarial perturbations from SGA iterate statistics plus deep ensembles, enabling unlimited sampled adversarial examples.
Problem
Transfer-based black-box adversarial attacks overfit the source model and transfer poorly to unknown and defended architectures, with deterministic single-example optimization failing to explore the perturbation space.
Approach
Treat stochastic gradient ascent iterates (with random image augmentations) as samples from an asymptotically normal stationary distribution, estimate its mean and covariance from gradient statistics (ANDA), and average K such runs from random initializations as a deep-ensemble mixture of Gaussians (MultiANDA) to sample diverse adversarial perturbations.
Key results
- MultiANDA reaches 95.2% average black-box success rate from ResNet-50 on normally trained models versus 78.4% for the best baseline VMI-FGSM.
- On defense models from ResNet-50, MultiANDA averages 50.1% versus 36.4% for VMI-FGSM.
- Sampled adversaries from the learned distribution achieve success rates competitive with the single adversary on defense models.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use MultiANDA instead of ANDA | ImageNet1k attacks from ResNet-50 source · Normally trained models (Avg.) | success rate: 94.5 -> 95.2 | Helped |
| Use MultiANDA instead of ANDA | ImageNet1k attacks from ResNet-50 source · Defense models (Avg.) | success rate: 41.6 -> 50.1 | Helped |
Surprising findings
- VGG-19 as source model yields much weaker transfer for all baselines (average 28.3% success on defenses)
- Non-trivial transfer from ResNet-50 is best across defenses, consistent with skip-connection effects
Limitations
- Gains concentrate in the transfer setting; ANDA is competitive rather than dominant on Inc-v3 source
- Evaluated on only 1000 ImageNet images
- Overhead scales with number of augmentation samples
Experimental setup
Datasets: ImageNet
Benchmarks: ImageNet
Metrics: attack success rate
Baselines: BIM TIM SIM DIM FIA TAIG NI-FGSM MI-FGSM VMI-FGSM VNI-FGSM
Builds on: BIM SWAG Deep ensembles MI-FGSM VMI-FGSM
Closest papers by meaning
- Ensemble Adversarial Training: Attacks and Defenses (ICLR 2018 · similarity 0.90)
- Are Adversarial Examples Created Equal? A Learnable Weighted Minimax Risk for Robustness under Non-uniform Attacks (AAAI 2021 · similarity 0.89)
- Ensemble Diversity Facilitates Adversarial Transferability (CVPR 2024 · similarity 0.88)
- Rethinking Model Ensemble in Transfer-based Adversarial Attacks (ICLR 2024 · similarity 0.88)
- Enhancing Adversarial Transferability with Checkpoints of a Single Model's Training (CVPR 2025 · similarity 0.88)
- Understanding the Robustness of Randomized Feature Defense Against Query-Based Adversarial Attacks (ICLR 2024 · similarity 0.87)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.