Research map / Adversarial robustness and security / Black-box and transfer attacks
A Little Robustness Goes a Long Way: Leveraging Robust Features for Targeted Transfer Attacks
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's title only (no summary yet). Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Adversarially train the source ResNet50 with small robustness ε=0.1 rather than ε=0 | TMDI-FGSM targeted attacks · ImageNet classifiers | targeted attack success rate: 45.9 -> 77.2 (Xception); 3.9 -> 33.4 (ViT); 0.4 -> 11.2 (CLIP) | Helped |
| Increase source robustness from ε=0.1 to ε=1 (ablation) | TMDI-FGSM Logit targeted attacks · ImageNet ViT and CLIP | targeted attack success rate: 33.4 -> 36.0 (ViT); 11.2 -> 26.7 (CLIP) | Helped |
| Increase source robustness from ε=0.1 to ε=1 (ablation) | TMDI-FGSM Logit targeted attacks · ImageNet convolutional classifiers | targeted attack success rate: 77.2 -> 56.1 (Xception); 78.8 -> 62.4 (VGG16); 84.0 -> 67.0 (DN121) | Hurt |
| Use slightly robust sources, ε=0.1, instead of non-robust sources, ε=0 | TMDI-FGSM targeted attacks · ImageNet transformer destinations ViT and CLIP | targeted attack success rate: 3.9 -> 33.4 (ViT); 0.4 -> 11.2 (CLIP) | Helped |
| Use slightly robust sources instead of non-robust sources | TMDI-FGSM targeted attacks · Adversarially trained ImageNet destination classifiers | targeted attack success rate | Helped |
| Use slightly robust source ResNet50 models | Representation-targeted attacks · ImageNet destination networks | cosine similarity: 0.462 -> 0.594 (Xception); 0.066 -> 0.206 (ViT); 0.529 -> 0.613 (CLIP) | Helped |
| Increase source robustness past the slight-robustness range (ablation) | Representation-targeted attacks · ImageNet destination networks | cosine similarity: 0.594 -> 0.404 (Xception, ε=0.1 to ε=5); 0.206 -> 0.086 (ViT, ε=0.5 to ε=5) | Hurt |
| Use Logit loss instead of Xent loss (ablation) | TMDI-FGSM targeted attacks with ε=0 source · ImageNet destinations | targeted attack success rate: 10.4 -> 45.9 (Xception); 0.8 -> 3.9 (ViT) | Helped |
| Use Logit loss instead of Po+Trip loss (ablation) | TMDI-FGSM targeted attacks with ε=0.1 source · ImageNet destinations | targeted attack success rate: 77.2 -> 59.1 (Xception); 84.0 -> 78.4 (DN121) | Mixed |
| Remove the TI gradient-filtering step (ablation) | Representation-targeted TMDI-FGSM attacks · ImageNet representation transfer | transferability | Helped |
| Use slightly robust rather than non-robust source models | Targeted and untargeted transfer attacks · CIFAR-10 classifiers | transferability | Helped |
Closest papers by meaning
- Towards Transferable Targeted Attack (CVPR 2020 · similarity 0.92)
- Towards Transferable Targeted Adversarial Examples (CVPR 2023 · similarity 0.91)
- Delving into Transferable Adversarial Examples and Black-box Attacks (ICLR 2017 · similarity 0.91)
- Evading Defenses to Transferable Adversarial Examples by Translation-Invariant Attacks (CVPR 2019 · similarity 0.90)
- On Adversarial Training without Perturbing all Examples (ICLR 2024 · similarity 0.90)
- Rethinking Model Ensemble in Transfer-based Adversarial Attacks (ICLR 2024 · similarity 0.88)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.