Research map / Adversarial robustness and security / Black-box and transfer attacks
Enhancing Adversarial Transferability with Checkpoints of a Single Model's Training
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes a black-box transfer attack that builds an ensemble from importance-weighted training checkpoints of a single surrogate model, selected by a train-validation accuracy-gap criterion, instead of ensembling multiple architectures.
Problem
Ensemble-based transfer attacks need multiple pre-trained surrogate models of diverse architectures, which are costly to obtain for niche datasets; the paper asks whether a single model's training trajectory can match this transferability.
Approach
Treat checkpoints from one model's training run as a diverse ensemble; weight them by an accuracy-gap-based importance score (softmax of negative scaled train-val gap) and select those with minimal overfitting, then run a multi-iteration I-FGSM ensemble attack over them.
Key results
- On ImageNet with ResNet-18 plus ViT-Tiny checkpoints, the method reaches 91.1% average ASR on CNN targets and 61.8% on ViT targets, beating Ens by 38.7% and 24.2% on those groups.
- On CIFAR-10, the method reaches 99.9% average ASR on four CNN targets versus 91.7% for Ens and 92.9% for AdaEA.
- Using only 10% of CIFAR-10 training data (5,000 images) for the surrogate still yields 98.4% average ASR.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use training checkpoints from one ResNet-18 with importance-based selection instead of LGV variants | Black-box attack on ImageNet CNN targets · ImageNet CNN targets (average) | ASR: 85.2 -> 89.1 | Helped |
| Combine ResNet-18 and ViT-Tiny checkpoint sets | Black-box attack on ImageNet ViT targets · ImageNet ViT targets (average) | ASR: 38.4 -> 61.8 | Helped |
| Use single-model training checkpoints instead of AdaEA's four-surrogate ensemble | Black-box attack on CIFAR-10 CNN targets · CIFAR-10 CNN targets (average) | ASR: 92.9 -> 99.9 | Helped |
| Use importance-based checkpoint selection instead of random selection (ablation) | Ours · ImageNet target models (average across eight) | ASR: 48.9% -> 61.2% | Helped |
| Use importance-based checkpoint selection instead of uniform-random selection (ablation) | Ours · ImageNet target models (average across eight) | ASR: 54.3% -> 61.2% | Helped |
| Replace I-FGSM with MI-FGSM (ablation) | Ours · ImageNet CNN targets (average) | ASR: +6.1% | Helped |
| Replace I-FGSM with MI-FGSM (ablation) | Ours · ImageNet ViT targets (average) | ASR: +19.9% | Helped |
| Replace I-FGSM with DIM-FGSM (ablation) | Ours · ImageNet CNN targets (average) | ASR: +8.3% | Helped |
| Replace I-FGSM with DIM-FGSM (ablation) | Ours · ImageNet ViT targets (average) | ASR: +27.7% | Helped |
| Limit checkpoint ensembling to 4 checkpoints per iteration (ablation) | Ours vertical ensemble · ImageNet CNN targets (average) | ASR: 89.1 -> 82.1 | Hurt |
| Limit checkpoint ensembling to 4 checkpoints per iteration (ablation) | Ours vertical ensemble · ImageNet ViT targets (average) | ASR: 33.3 -> 26.8 | Hurt |
| Increase conventional ensemble size to 40 models (ablation) | Ens+ compared with Ens · CIFAR-10 CNN targets (average) | ASR: +6.4% | Helped |
Surprising findings
- Adding heterogeneous surrogates (ResNet-18 plus ViT-Tiny) gives LGV no improvement, while the proposed method gains substantially.
- Adding low-importance (high-overfitting) checkpoints reduces transferability.
Limitations
- Transfer across heterogeneous architectures (CNN to ViT) remains weaker than ensemble baselines when using a single architecture as surrogate.
- Checkpoint selection relies on a validation-accuracy threshold (60% of final performance) and scaling factor k that were set by the authors.
Experimental setup
Datasets: ImageNet-compatible dataset CIFAR-10 CINIC-10
Benchmarks: ImageNet-compatible dataset CIFAR-10
Metrics: attack success rate
Baselines: Ens AdaEA LGV MI-FGSM DIM-FGSM
Builds on: I-FGSM Ensemble attack (Liu et al.) LGV AdaEA MI-FGSM DI
Closest papers by meaning
- Ensemble Diversity Facilitates Adversarial Transferability (CVPR 2024 · similarity 0.91)
- Boosting the Transferability of Adversarial Attacks with Reverse Adversarial Perturbation (NeurIPS 2022 · similarity 0.91)
- Enhancing Adversarial Transferability with Adversarial Weight Tuning (AAAI 2025 · similarity 0.90)
- LRS: Enhancing Adversarial Transferability through Lipschitz Regularized Surrogate (AAAI 2024 · similarity 0.89)
- Rethinking Model Ensemble in Transfer-based Adversarial Attacks (ICLR 2024 · similarity 0.89)
- Understanding Model Ensemble in Transferable Adversarial Attack (ICML 2025 · similarity 0.89)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.