Research map / Adversarial robustness and security / Black-box and transfer attacks

Boosting Adversarial Transferability through Augmentation in Hypothesis Space

CVPR 2025 · Adversarial robustness and security › Black-box and transfer attacks · approach: Transferable adversarial examples · 8 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes OPS, an augmentation-based transfer attack that samples neighbors of the surrogate model in hypothesis space via input-transformation operators composed with random perturbations, and solves the resulting stochastic optimization with MI; also builds a 3D point cloud transfer benchmark (3DTAB).

Problem

Transferability of adversarial examples from a surrogate to unseen target models is limited, and existing methods add complex mechanisms with modest gains that transfer poorly across modalities.

Approach

Draws a mirror between model generalization (data augmentation) and adversarial transferability, and performs "model augmentation" on the surrogate by composing it with input transformation operators and adding fixed-radius random perturbations, then averages gradients over these sampled neighbor models.

Key results

• On ImageNet ResNet-18 to ViT, OPS(10,30,30) reaches 76.3% attack success rate vs. 59.1%-ish for the best prior baseline range (L2T 64.7%, DeCoWA 65.2%) and 82.1% for OPS(10,5,5)'s counterpart; OPS(10,30,30) reaches 97.1% on ResNet-101 vs. 90.0% for L2T.
• On eight defended ImageNet models, OPS(10,30,30) achieves 86.4% on ResNet-101 (HGD) and 97.8% on Inc-v3 ens3 variants, exceeding SIA and L2T on most targets.
• On 3D point clouds (PointNet surrogate, budget 0.06), OPS_pc achieves up to 76.8% on PointConv and 67.5% on PT-v1 versus 68.3% for PF-Attack on the best baseline column, and 88.0% on Dup-Net defense in the white-box setting.

Measured effects reported in the paper

Surprising findings

• Point-PN attack success rate decreases as computation increases, opposite to other models.
• Attack success rate increases with the number of operator/perturbation samples but plateaus around 20 samples.

Limitations

• Gains depend on number of sampled operators and perturbations; compute grows as T*(Np*Ne+1).
• Operators for point clouds are mostly rigid transformations, leading to homogenized neighbors and weaker transferability.
• Theoretical hypothesis-space topology argument relies on assumptions (e.g., Lipschitz condition) and is only sketched.

Experimental setup

Datasets: ImageNet ModelNet40

Benchmarks: ImageNet (TransferAttack benchmark, 1000 images) ModelNet40 (1000 test samples) 3DTAB

Metrics: attack success rate (%) running time memory overhead

Baselines: VMI GRA PGN NCS SIA DeCoWA BSR L2T KNN GeoA3 HiT-ADV AdvPC

Builds on: MI DIM SIM I-FGSM VMI

Closest papers by meaning

• Improving Adversarial Transferability with Local Perturbation Augmentation (CVPR 2026 · similarity 0.91)
• Evading Defenses to Transferable Adversarial Examples by Translation-Invariant Attacks (CVPR 2019 · similarity 0.91)
• Enhancing Adversarial Transferability with Adversarial Weight Tuning (AAAI 2025 · similarity 0.90)
• Understanding Model Ensemble in Transferable Adversarial Attack (ICML 2025 · similarity 0.90)
• Transferability Bound Theory: Exploring Relationship between Adversarial Transferability and Flatness (NeurIPS 2024 · similarity 0.89)
• Rethinking Model Ensemble in Transfer-based Adversarial Attacks (ICLR 2024 · similarity 0.89)