Research map / Adversarial robustness and security / Black-box and transfer attacks
Understanding Model Ensemble in Transferable Adversarial Attack
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Gives a theoretical framework for transferable model ensemble adversarial attacks, decomposing transferability error into vulnerability and diversity and bounding it via ensemble Rademacher complexity and a Hellinger-integral dependency term, validated on 54 small MLP/CNN surrogates on MNIST, Fashion-MNIST and CIFAR-10.
Problem
Model ensemble adversarial attacks transfer well in practice, but there is no theoretical account of why; the paper asks what governs the transferability error of ensemble adversarial examples.
Approach
Defines transferability error relative to the most transferable example in the perturbation ball, prediction variance as ensemble diversity, and empirical model ensemble Rademacher complexity; shows a vulnerability-diversity decomposition and an upper bound that relaxes the independence assumption among surrogates via Hellinger integrals, yielding guidelines: more, more diverse, and less complex s
Key results
- Attack success rate and loss value improve steadily with more attack steps on all three datasets, while diversity (variance) is about ten times smaller than the loss magnitude, so vulnerability drives the decomposition.
- Increasing the number of ensemble models up to 18 in a single attack improves attack success rate, with vulnerability and (on MNIST and Fashion-MNIST) diversity also increasing.
- On CIFAR-10, diversity sometimes decreases but is roughly 100 times smaller than vulnerability, so its effect on attack success rate is minimal.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| increase the number of ensemble models | model ensemble attack · MNIST | attack success rate | Helped |
| increase the number of ensemble models | model ensemble attack · Fashion-MNIST | attack success rate | Helped |
| increase the number of ensemble models | model ensemble attack · CIFAR-10 | attack success rate | Helped |
| increase the number of attack steps | MI-FGSM ensemble attack · MNIST | attack success rate | Helped |
| increase the number of attack steps | MI-FGSM ensemble attack · Fashion-MNIST | attack success rate | Helped |
| increase the number of attack steps | MI-FGSM ensemble attack · CIFAR-10 | attack success rate | Helped |
| increase the number of attack steps | MI-FGSM ensemble attack · MNIST and Fashion-MNIST | prediction variance | Mixed |
| increase the number of attack steps | MI-FGSM ensemble attack with MLPs · CIFAR-10 | prediction variance | Helped |
| increase the number of attack steps | MI-FGSM ensemble attack with CNNs · CIFAR-10 | prediction variance | Mixed |
| increase weight decay, reducing model complexity | model ensemble attack · attack dynamics | prediction variance | Mixed |
| reduce surrogate model complexity when overfitting | model ensemble attack · ImageNet | adversarial transferability | Helped |
| increase surrogate model diversity | model ensemble attack · adversarial transferability | transferability error | Helped |
Surprising findings
- On MNIST and Fashion-MNIST diversity initially rises and then declines over attack steps, and on CIFAR-10 the trend depends on architecture and regularization strength.
Limitations
- Theory uses squared-error loss in the main results; the multi-class KL setting is only in the appendix.
- Experiments use small MLP and CNN surrogates on MNIST, Fashion-MNIST and CIFAR-10 with a ResNet-18 target rather than large modern models.
- Complexity-diversity trade-off is discussed qualitatively and not tightly quantified.
Experimental setup
Datasets: MNIST Fashion-MNIST CIFAR-10
Benchmarks: MNIST Fashion-MNIST CIFAR-10
Metrics: attack success rate loss value prediction variance
Baselines: MI-FGSM
Builds on: MI-FGSM Rademacher complexity bias-variance decomposition
Closest papers by meaning
- Rethinking Model Ensemble in Transfer-based Adversarial Attacks (ICLR 2024 · similarity 0.95)
- Ensemble Diversity Facilitates Adversarial Transferability (CVPR 2024 · similarity 0.91)
- Transferability Bound Theory: Exploring Relationship between Adversarial Transferability and Flatness (NeurIPS 2024 · similarity 0.90)
- Boosting Adversarial Transferability through Augmentation in Hypothesis Space (CVPR 2025 · similarity 0.90)
- Enhancing Adversarial Transferability with Adversarial Weight Tuning (AAAI 2025 · similarity 0.89)
- Enhancing Adversarial Transferability with Checkpoints of a Single Model's Training (CVPR 2025 · similarity 0.89)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.