Research map / Adversarial robustness and security / Black-box and transfer attacks
PubDef: Defending Against Transfer Attacks From Public Models
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes the transfer-attacks-from-public-models (TAPM) threat model and PubDef, an adversarial-training-style defense that trains against transfer attacks from a small set of public surrogate models, keeping clean accuracy near undefended levels.
Problem
Defending image classifiers against transfer attacks generated from publicly available surrogate models, a realistic threat that existing white-box adversarial training handles only at a large cost to clean accuracy.
Approach
Frame the defense as a zero-sum game over (source model, attack) pairs and train one model against a mixture of transfer attacks, selecting one source model per training-procedure group (normal, l_inf-AT, l_2-AT, corruption-robust) instead of all public models.
Key results
- On CIFAR-10, PubDef reaches 88.6% adversarial accuracy vs 68.8% for the best white-box adversarially trained baseline, with 96.1% clean accuracy.
- On ImageNet, PubDef reaches 62.3% adversarial accuracy vs 36.2% for the best adversarially trained model, with 78.5% clean accuracy vs 80.4% undefended.
- Training only on PGD and 3-4 source models generalizes to the other 260 of 264 transfer attacks, losing only 1.7%, 1.8%, and 7.6% robustness across datasets.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| train with PubDef rather than the best white-box adversarial training | WideResNet-34-10 · CIFAR-10 transfer attacks (TAPM) | adversarial accuracy: 68.8 -> 88.6 | Helped |
| train with PubDef rather than the best white-box adversarial training | WideResNet-34-10 · CIFAR-100 transfer attacks (TAPM) | adversarial accuracy: 32.8 -> 50.8 | Helped |
| train with PubDef rather than the best white-box adversarial training | ResNet-50 · ImageNet transfer attacks (TAPM) | adversarial accuracy: 36.2 -> 63.0 | Helped |
| randomly select source models instead of using the default selection (ablation) | PubDef · CIFAR-10 transfer attacks (TAPM) | adversarial accuracy: 88.6 -> 62.9 | Hurt |
| randomly select one source model per group instead of the default selection (ablation) | PubDef · CIFAR-10 transfer attacks (TAPM) | adversarial accuracy: 88.6 -> 77.3 | Hurt |
| add an ℓ2-robust source model to the source set (ablation) | PubDef · CIFAR-10 transfer attacks (TAPM) | adversarial accuracy: 60.1 -> 88.6 | Helped |
| add a corruption-robust source model to the source set (ablation) | PubDef · CIFAR-10 transfer attacks (TAPM) | adversarial accuracy: 56.9 -> 88.6 | Helped |
| add a normal source model to the source set (ablation) | PubDef · CIFAR-10 transfer attacks (TAPM) | adversarial accuracy: 83.4 -> 88.6 | Helped |
| add an ℓ∞-robust source model to the source set (ablation) | PubDef · CIFAR-10 transfer attacks (TAPM) | adversarial accuracy: 80.6 -> 88.6 | Helped |
| use Top-1 loss instead of Random loss (ablation) | PubDef · CIFAR-10 transfer attacks (TAPM) | adversarial accuracy: 88.6 -> 87.0 | Hurt |
| use Top-2 loss instead of Random loss (ablation) | PubDef · CIFAR-10 transfer attacks (TAPM) | adversarial accuracy: 88.6 -> 86.1 | Hurt |
| use All loss instead of Random loss (ablation) | PubDef · CIFAR-10 transfer attacks (TAPM) | adversarial accuracy: 88.6 -> 86.8 | Hurt |
Surprising findings
- Training against a single l2-robust or corruption-robust source model gives over 55% accuracy against the best transfer attack on CIFAR-10.
- Adding more source models (8, 12, 24) gives only about 1% more adversarial accuracy and slightly lower clean accuracy.
Limitations
- Not robust to white-box attacks; PGD with enough steps drives accuracy to 0%.
- A dedicated attacker could train a private surrogate model and bypass the defense.
- Only evaluates l_inf-norm bounded attacks.
Experimental setup
Datasets: CIFAR-10 CIFAR-100 ImageNet
Benchmarks: CIFAR-10 CIFAR-100 ImageNet
Metrics: clean accuracy adversarial accuracy under worst-case transfer attack accuracy under Square attack (100 and 1000 queries)
Baselines: White-box adversarial training (RobustBench) DVERGE TRS No defense Square attack
Builds on: adversarial training PGD DVERGE TRS RobustBench
Closest papers by meaning
- Transferability Bound Theory: Exploring Relationship between Adversarial Transferability and Flatness (NeurIPS 2024 · similarity 0.88)
- AnchorRep: Defending LLMs Against Cross-Model Adversarial Transfer via Representation Repulsion (NeurIPS 2026 · similarity 0.88)
- LRS: Enhancing Adversarial Transferability through Lipschitz Regularized Surrogate (AAAI 2024 · similarity 0.88)
- Rethinking Model Ensemble in Transfer-based Adversarial Attacks (ICLR 2024 · similarity 0.88)
- Everywhere Attack: Attacking Locally and Globally to Boost Targeted Transferability (AAAI 2025 · similarity 0.88)
- Enhancing Adversarial Transferability with Adversarial Weight Tuning (AAAI 2025 · similarity 0.88)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.