Research map / Adversarial robustness and security / Black-box and transfer attacks
Boosting Adversarial Transferability across Model Genus by Deformation-Constrained Warping
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes DeCoWA, an input-transformation adversarial attack using adaptively constrained elastic warping (DeCoW) to improve transferability across model genera (CNN to ViT and vice versa) on image, video, and audio.
Problem
Adversarial examples from a surrogate model transfer poorly across different model genera (e.g., CNN to Transformer), where existing augmentation methods fail.
Approach
Augment inputs with thin-plate-spline elastic warping whose control-point perturbations are optimized by a min step to a constrained point, so local shapes change while global semantics are preserved; integrate this into MI-FGSM with multiple warps per iteration.
Key results
- With Inception-v3 surrogate, DeCoWA reduces average accuracy on eight ViTs to 33.97%, versus 48.62% for the best prior method S2IM.
- With ResNet-50 surrogate, DeCoWA reaches 21.99% average accuracy on eight ViTs, versus 28.84% for S2IM.
- On video recognition, DeCoWA lowers accuracy on TimeSformer and Swin-S targets when attacking CNN-based I3D and SlowFast surrogates, outperforming BIM, DIM and SIM in the reported transfer settings.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Replace S²IM with DeCoWA | MI-FGSM using Inception-v3 as surrogate · ImageNet-compatible images, ViT targets (average) | classification accuracy (%): 48.62 -> 33.97 | Helped |
| Replace S²IM with DeCoWA | MI-FGSM using ResNet-50 as surrogate · ImageNet-compatible images, ViT targets (average) | classification accuracy (%): 28.84 -> 21.99 | Helped |
| Replace S²IM with DeCoWA | MI-FGSM using Inception-v3 as surrogate · ImageNet-compatible images, CNN targets | classification accuracy (%): 36.20 -> 28.80 | Helped |
| Replace S²IM with DeCoWA | MI-FGSM using Inception-v3 as surrogate · ImageNet-compatible images, CNN targets | classification accuracy (%): 18.80 -> 12.80 | Helped |
Surprising findings
- Warping that preserves global semantics while altering local shape transfers better across model genera than global affine or intensity augmentations.
Limitations
- Adds N=15 warping transformations and an inner optimization step per iteration, increasing attack cost.
- Video and audio experiments use a subset (469 videos, 2,518 audios) and mostly compare against few baselines.
Experimental setup
Datasets: ImageNet-compatible dataset (NIPS17) Kinetics-400 TUT Urban Acoustic Scenes 2018
Benchmarks: ImageNet-compatible dataset (NIPS17) Kinetics-400 TUT Urban Acoustic Scenes 2018
Metrics: classification accuracy (%)
Baselines: DIM TIM SIM Admix S2IM BIM SI-FGSM
Builds on: MI-FGSM DIM TIM SIM Admix S2I-FGSM thin-plate spline
Closest papers by meaning
- Learning to Transform Dynamically for Better Adversarial Transferability (CVPR 2024 · similarity 0.85)
- Boosting the Transferability of Adversarial Attack on Vision Transformer with Adaptive Token Tuning (NeurIPS 2024 · similarity 0.84)
- Boosting Adversarial Transferability through Augmentation in Hypothesis Space (CVPR 2025 · similarity 0.84)
- X-Transfer Attacks: Towards Super Transferable Adversarial Attacks on CLIP (ICML 2025 · similarity 0.84)
- Enhancing Adversarial Transferability with Adversarial Weight Tuning (AAAI 2025 · similarity 0.84)
- Harnessing the Computation Redundancy in ViTs to Boost Adversarial Transferability (NeurIPS 2025 · similarity 0.84)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.