Research map / Adversarial robustness and security / Black-box and transfer attacks
Rethinking Model Ensemble in Transfer-based Adversarial Attacks
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes Common Weakness Attack (CWA), which reduces second-order loss-landscape terms across an ensemble of surrogate models via Hessian-Frobenius-norm minimization, implemented with SAM- and CSE-style optimizers, to boost transfer-based adversarial attacks.
Problem
Transfer-based black-box adversarial attacks rely on ensembles of surrogate models, but prior work simply averages model outputs or losses, which is suboptimal for transferability to unseen target models.
Approach
Uses a quadratic approximation of each model's loss to show the second-order term is upper bounded by the Frobenius norm of the Hessian times the distance to each model's local optimum, and seeks a "common weakness" across ensemble members by minimizing this bound, via sharpness-aware minimization (SAM) and a first-order cosine-similarity gradient alignment (CSE) method.
Key results
- Averaged over black-box models, MI-CWA reaches 90.76% attack success rate versus 71.65% for MI, and CSE alone reaches 85.85% versus 63.71% for BIM.
- SSA-CWA achieves more than 99% attack success rate on most normal models, per the authors' rebuttal discussion.
- Against white-box adversarially trained models at epsilon 4/255, MI-CWA reaches 47.0% on the Salman et al. ResNet50 versus 28.0% for MI-FGSM.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use SAM, CSE, or CWA instead of the baseline attack | Transfer-based attacks · Black-box models (average) | attack success rate (%): 71.65 -> 73.38; 71.65 -> 85.85; 71.65 -> 82.55 | Helped |
| Combine MI with SAM, CSE, or CWA | Transfer-based attacks · Black-box models (average) | attack success rate (%): 71.65 -> 77.92; 85.85 -> 90.68; 82.55 -> 90.76 | Helped |
| Combine MI-FGSM with CWA | Transfer-based attacks · ResNet50 (Salman et al. (2020)), epsilon 16/255 | attack success rate (%): 41.9 -> 91.1 | Helped |
| Combine MI-FGSM with CWA | Transfer-based attacks · XCiT-S12 (Debenedetti et al. (2023)), epsilon 16/255 | attack success rate (%): 27.0 -> 92.2 | Helped |
| Combine MI-FGSM with CWA | Transfer-based attacks · ResNet50 (Salman et al. (2020)), epsilon 4/255 | attack success rate (%): 28.0 -> 47.0 | Helped |
| Combine MI-FGSM with CWA | Transfer-based attacks · XCiT-S12 (Debenedetti et al. (2023)), epsilon 4/255 | attack success rate (%): 16.2 -> 39.1 | Helped |
Surprising findings
- Plain averaging of ensemble models tends to be dominated by easier normally trained models, which overwhelms gradient information useful for attacking adversarially trained models.
Limitations
- Third-order derivatives needed for alternative norms make other Hessian norms intractable for deep networks.
- Initially reported VMI-CWA numbers in Table 1 were wrong and had to be corrected in rebuttal, showing sensitivity to implementation versions.
Experimental setup
Datasets: ImageNet
Benchmarks: ImageNet
Metrics: attack success rate
Baselines: FGSM BIM MI-FGSM VMI SSA PGD
Builds on: MI-FGSM sharpness-aware minimization VMI SSA first-order meta-learning (Reptile)
Closest papers by meaning
- Understanding Model Ensemble in Transferable Adversarial Attack (ICML 2025 · similarity 0.95)
- Ensemble Diversity Facilitates Adversarial Transferability (CVPR 2024 · similarity 0.90)
- Enhancing Adversarial Transferability with Adversarial Weight Tuning (AAAI 2025 · similarity 0.89)
- Enhancing Adversarial Transferability with Checkpoints of a Single Model's Training (CVPR 2025 · similarity 0.89)
- Transferability Bound Theory: Exploring Relationship between Adversarial Transferability and Flatness (NeurIPS 2024 · similarity 0.89)
- Boosting Adversarial Transferability through Augmentation in Hypothesis Space (CVPR 2025 · similarity 0.89)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.