Research map / Adversarial robustness and security / Attacks on text and graphs
Transferable Structural Sparse Adversarial Attack Via Exact Group Sparsity Training
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes EGS-TSSA, a generator-based transferable sparse adversarial attack that learns structural (group-level plus pixel-level) perturbation positions via exact top-k group sparsity training, a masked quantization network, and multi-stage optimization.
Problem
Sparse adversarial attacks constrain perturbation magnitude and count but ignore perturbation location, which limits their transferability to black-box target models.
Approach
Introduces exact group sparsity (top-k groups ranked by Grad-CAM-based group feature importance) into a generative sparse attack, with a masked quantization network to make discrete positions trainable and a two-stage schedule to avoid perturbation vanishing.
Key results
- Under l_inf=10 non-targeted attack with IncV3 surrogate, EGS-TSSA-soft reaches 47.95% average ASR vs 41.56% for TSAA at similar sparsity.
- Under l_inf=255 with Res50 surrogate, EGS-TSSA-soft averages 67.56% vs 57.35%...
- Targeted attack (bubble, l_inf=255) with Res50 surrogate: EGS-TSSA average ASR 28.74% vs 8.02% for TSAA; transfer to ViT improves ASR on IncV3 surrogate (18.44 vs 16.40 average).
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Add structural group sparsity training with soft masked smoothness instead of TSAA's pixel-level sparsity | Sparse adversarial attack using Inception-V3 · ImageNet, ℓ∞=10 non-targeted black-box models | Averagebb ASR (%): 41.56 -> 47.95 | Helped |
| Add structural group sparsity training with soft masked smoothness instead of TSAA's pixel-level sparsity | Sparse adversarial attack using ResNet50 · ImageNet, ℓ∞=10 non-targeted black-box models | Averagebb ASR (%): 33.29 -> 39.10 | Helped |
| Add structural group sparsity training with soft masked smoothness instead of TSAA's pixel-level sparsity | Sparse adversarial attack using Inception-V3 · ImageNet, ℓ∞=255 non-targeted black-box models | Averagebb ASR (%): 65.31 -> 67.20 | Helped |
| Add structural group sparsity training with soft masked smoothness instead of TSAA's pixel-level sparsity | Sparse adversarial attack using ResNet50 · ImageNet, ℓ∞=255 non-targeted black-box models | Averagebb ASR (%): 57.35 -> 62.05 | Helped |
| Add structural group sparsity training instead of TSAA's pixel-level sparsity | Targeted sparse attack using Inception-V3 · ImageNet targeted attack, target Bubble (ID: 971) | Averagebb ASR (%): 7.71 -> 37.65 | Helped |
| Add structural group sparsity training instead of TSAA's pixel-level sparsity | Targeted sparse attack using ResNet50 · ImageNet targeted attack, target Bubble (ID: 971) | Averagebb ASR (%): 6.47 -> 17.25 | Helped |
| Add structural group sparsity training instead of TSAA's pixel-level sparsity | Sparse adversarial attack using Inception-V3 · ViT models, ℓ∞=255 untargeted | Average ASR (%): 16.40 -> 18.44 | Helped |
| Add structural group sparsity training instead of TSAA's pixel-level sparsity | Sparse adversarial attack using ResNet50 · ViT models, ℓ∞=255 untargeted | Average ASR (%): 11.43 -> 14.08 | Helped |
| Add structural group sparsity training rather than TSAA's pixel-level sparsity | Sparse attack using Inception-V3 · VOC2012 validation semantic segmentation | Average mIoU: 37.90 -> 36.51 | Helped |
| Add structural group sparsity training rather than TSAA's pixel-level sparsity | Sparse attack using ResNet50 · COCO validation object detection | Average AP: 23.29 -> 20.79 | Helped |
| Use hard rather than soft masked smoothness (ablation) | EGS-TSSA using Inception-V3 · ImageNet non-targeted black-box attack, ℓ∞=10 and ℓ∞=255 | Averagebb ASR (%): 47.95 vs 45.23; 67.20 vs 65.39 | Mixed |
Surprising findings
- Overly strong structural sparsity constraints cause perturbations to vanish, motivating the multi-stage schedule.
- Under l_inf=10 with Res50 surrogate, EGS-TSSA underperforms TSAA on black-box Dense161, attributed to the altered perturbation pattern.
Limitations
- Transferability to ViT and segmentation/detection is significantly reduced for the structural sparse perturbations.
- Performance on black-box Dense161 under l_inf=10 with Res50 surrogate is worse than TSAA.
- Sparsity hyperparameters (lambda1, lambda2, top-k ratio, stride, Bernoulli probability) require per-setting tuning.
Experimental setup
Datasets: ImageNet VOC2012 COCO
Benchmarks: ImageNet VOC2012 COCO
Metrics: attack success rate perturbation rate (sparsity) mIoU AP AR
Baselines: PGD0 SparseFool GreedyFool TSAA
Builds on: TSAA Grad-CAM C&W loss sparse training
Closest papers by meaning
- GSE: Group-wise Sparse and Explainable Adversarial Attacks (ICLR 2025 · similarity 0.92)
- Sparse and Imperceptible Adversarial Attack via a Homotopy Algorithm (ICML 2021 · similarity 0.89)
- Towards Transferable Adversarial Attacks with Centralized Perturbation (AAAI 2024 · similarity 0.87)
- Towards Efficient Training and Evaluation of Robust Models against $l_0$ Bounded Adversarial Perturbations (ICML 2024 · similarity 0.86)
- Enhancing Adversarial Transferability with Checkpoints of a Single Model's Training (CVPR 2025 · similarity 0.86)
- Strong Transferable Adversarial Attacks via Ensembled Asymptotically Normal Distribution Learning (CVPR 2024 · similarity 0.86)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.