Research map / Adversarial robustness and security / Black-box and transfer attacks
Improving Transferable Targeted Attacks with Feature Tuning Mixup
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes Feature Tuning Mixup (FTM), a targeted transfer attack that optimizes learnable feature-space perturbations with a momentum-based stochastic update, plus an ensemble variant FTM-E, on the NIPS 2017 ImageNet-compatible dataset.
Problem
Targeted transfer-based adversarial attacks overfit to surrogate models and transfer poorly to black-box target models; existing feature-level clean mixup uses attack-agnostic clean features and adds cost.
Approach
Combine random clean-feature mixup (CFM) with learnable, attack-specific feature perturbations optimized jointly with the adversarial image in a single forward/backward pass, using a momentum-initialized stochastic layer-update scheme to keep compute low.
Key results
- RN-50 source with RDI-FTM-E reaches 79.5% average targeted success across 10 CNN targets vs 74.6% for RDI-CFM.
- Inc-v3 source with RDI-FTM-E averages 51.2% vs 39.2% for CFM (+12.0%), and 69.3% vs 59.3% on IR-v2/Inc-v4 averages reported.
- RDI-FTM adds only about 10.8% compute over CFM (1.54 s vs 1.39 s per image on RN-50 source) on a single NVIDIA 3090.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Add FTM feature perturbations to RDI-CFM | RDI targeted attack with RN-50 source · ImageNet-compatible, CNN targets (10-model average) | targeted attack success rate (%) | Helped |
| Ensemble two FTM-perturbed surrogate models | RDI-FTM with RN-50 source · ImageNet-compatible, CNN targets (10-model average) | targeted attack success rate (%) | Helped |
| Add FTM feature perturbations to RDI-CFM | RDI targeted attack with Inc-v3 source · ImageNet-compatible, CNN targets (10-model average) | targeted attack success rate (%): +12.0% | Helped |
| Add FTM feature perturbations to RDI-CFM | RDI targeted attack with RN-50 source · ImageNet-compatible, transformer targets (5-model average) | targeted attack success rate (%): 4.9% | Helped |
| Add FTM feature perturbations to RDI-CFM | RDI targeted attack with Inc-v3 source · ImageNet-compatible, transformer targets (5-model average) | targeted attack success rate (%) | Helped |
| Add FTM to RDI-SI | Targeted attack using RN-50 + Inc-v3 ensemble source · ImageNet-compatible, CNN and transformer targets | targeted attack success rate (%) | Helped |
| Use the FTM-perturbed model ensemble instead of a single FTM-perturbed model (ablation) | FTM targeted attack · ImageNet-compatible, target models across ensemble sizes | targeted attack success rate (%) | Helped |
| Increase mixing ratio β above 0.04 (ablation) | FTM · ImageNet-compatible, five target models | targeted attack success rate (%) | Hurt |
| Vary mixing ratio β below 0.02 (ablation) | FTM · ImageNet-compatible, five target models | targeted attack success rate (%) | No clear effect |
| Update all feature perturbation layers by setting p = 1.0 while using clean-feature mixup (ablation) | FTM · ImageNet-compatible, RN-50 source | targeted attack success rate (%) | Hurt |
| Remove clean-feature mixup from FTM (ablation) | FTM · ImageNet-compatible, RN-50 source | targeted attack success rate (%) | Mixed |
| Add clean-feature mixup to learnable feature perturbations (ablation) | FTM · ImageNet-compatible, RN-50 source, p = 1.0 | clean accuracy (%): 65.3% -> 3.8% | Hurt |
Surprising findings
- Clean-feature mixup becomes unstable when many layers are perturbed: at p=1.0 the perturbed surrogate's clean accuracy drops to 3.8%, collapsing attack success.
- Learnable perturbations without clean features remain stable across p values, while adding clean features degrades performance as p increases.
Limitations
- Ensemble variant FTM-E uses only two perturbed models due to computational cost.
- Performance is sensitive to the perturbation probability p; high p collapses surrogate accuracy when clean features are used.
Experimental setup
Datasets: NIPS 2017 adversarial attack challenge ImageNet-compatible dataset
Benchmarks: NIPS 2017 ImageNet-compatible dataset (targeted attack success rate on 10 CNNs and 5 ViT-style models)
Metrics: targeted attack success rate (%) computation time per image (s)
Baselines: DI RDI SI VT Admix ODI SU CFM RAP Logit
Builds on: MI-FGSM Clean Feature Mixup logit loss Diverse Inputs Translation-Invariant attack
Closest papers by meaning
- Introducing Competition To Boost the Transferability of Targeted Adversarial Examples Through Clean Feature Mixup (CVPR 2023 · similarity 0.91)
- Enhancing the Transferability of Adversarial Attacks Through Variance Tuning (CVPR 2021 · similarity 0.89)
- Enhancing Adversarial Transferability with Adversarial Weight Tuning (AAAI 2025 · similarity 0.88)
- Improving Transferable Targeted Adversarial Attacks with Model Self-Enhancement (CVPR 2024 · similarity 0.88)
- Towards Transferable Adversarial Attacks with Centralized Perturbation (AAAI 2024 · similarity 0.87)
- Breaking Barriers in Physical-World Adversarial Examples: Improving Robustness and Transferability via Robust Feature (AAAI 2025 · similarity 0.86)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.