Research map / Adversarial robustness and security / Black-box and transfer attacks
Pixel2Feature Attack (P2FA): Rethinking the Perturbed Space to Enhance Adversarial Transferability
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes P2FA, a transfer-based black-box attack that moves perturbation from pixel space to feature space, iteratively perturbing intermediate features along BFA-derived feature importance with momentum and then inverting them to pixels.
Problem
Feature-level adversarial attacks transfer poorly because, as the paper argues, multiple pixel-space perturbations are equivalent to a single feature-space step along feature importance, which is inefficient at disrupting shared critical features.
Approach
Optimize the intermediate feature map directly (not the input pixels) with several momentum-guided steps along dynamically recomputed BFA feature importance, then map the perturbed features back to pixels via feature inversion.
Key results
- P2FA reaches 95.7% average attack success on normally trained models when surrogate is Inc-v3, versus 93.6% for BFA.
- With PIM and DIM integrated, PIDI-P2FA achieves 97.7% average success on normally trained models (Inc-v3 surrogate) versus 94.2% for PIDI-BFA.
- On defense models with PIM and DIM, P2FA averages 62.6% (Inc-v3 surrogate) and surpasses baselines by over 7%; on vision transformers it averages 74.9%, over 15% above baselines per the paper.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use P2FA instead of the strongest baseline, BFA | Feature-level transfer attacks · ImageNet-NIPS, normally trained models | average attack success rate: 2.1% | Helped |
| Combine P2FA with PIM and DIM instead of combining BFA with PIM and DIM | Feature-level transfer attacks · ImageNet-NIPS, normally trained models | average attack success rate: 97.4%; 93.3% | Helped |
| Use P2FA instead of the strongest baseline | Transfer attacks against defense models · ImageNet-NIPS defense models | average attack success rate: 62.6%; over 7.0% | Helped |
| Use P2FA instead of the strongest baseline | Transfer attacks against vision transformers · ImageNet-NIPS vision transformers | average attack success rate: 74.9%; over 15% | Helped |
| Vary the feature-space step size; use 105 (ablation) | P2FA · ImageNet-NIPS | attack success rate | Mixed |
| Vary the number of feature-space perturbations; use 3 (ablation) | P2FA · ImageNet-NIPS | attack success rate | Mixed |
| Use BFA-derived feature importance instead of other feature-importance methods (ablation) | P2FA · ImageNet-NIPS | attack success rate | Helped |
Surprising findings
- Feature-level attacks that perturb multiple times in pixel space produce nearly identical perturbations (SSIM > 0.99) and comparable success rates to a single feature-space step along feature importance.
Limitations
- Relies on feature inversion (Du et al., 2018) to map perturbed features back to pixels, whose fidelity is not analyzed in the main text.
- Evaluated only on ImageNet-NIPS with CNN surrogates and a fixed set of intermediate layers per model.
- Hyperparameters (step size 10^5, 3 perturbations) selected on Inc-v3 surrogate and applied across settings.
Experimental setup
Datasets: ImageNet-NIPS
Benchmarks: ImageNet-NIPS
Metrics: attack success rate SSIM
Baselines: FIA RPA NAA DANAA SFVA BFA PIDI-FIA PIDI-BFA
Builds on: FIA BFA DIM PIM feature inversion
Closest papers by meaning
- Breaking Barriers in Physical-World Adversarial Examples: Improving Robustness and Transferability via Robust Feature (AAAI 2025 · similarity 0.88)
- Towards Transferable Adversarial Attacks with Centralized Perturbation (AAAI 2024 · similarity 0.88)
- Boosting Adversarial Transferability through Augmentation in Hypothesis Space (CVPR 2025 · similarity 0.87)
- PubDef: Defending Against Transfer Attacks From Public Models (ICLR 2024 · similarity 0.87)
- Mutual-Modality Adversarial Attack with Semantic Perturbation (AAAI 2024 · similarity 0.87)
- Enhancing Adversarial Transferability with Adversarial Weight Tuning (AAAI 2025 · similarity 0.87)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.