Research map / Adversarial robustness and security / Black-box and transfer attacks
LRS: Enhancing Adversarial Transferability through Lipschitz Regularized Surrogate
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes Lipschitz Regularized Surrogate (LRS), which fine-tunes a pretrained surrogate model for 10 epochs with first- and second-order input-space Lipschitz regularization so any transfer attack (PGD, TIM, Admix, etc.) yields more transferable adversarial examples.
Problem
Transfer-based black-box adversarial attacks have limited transferability because adversarial examples overfit to the blind spots of a fixed pretrained surrogate model, and the surrogate's internal properties have been overlooked.
Approach
Instead of attacking a given surrogate, transform the surrogate by briefly fine-tuning it with a regularizer that penalizes the squared input-gradient norm (LRS-1) and/or squared input-Hessian norm (LRS-2, via finite differences), yielding smoother loss landscapes and smaller local Lipschitz constants; any existing transfer attack can then run on it unchanged.
Key results
- On ImageNet with ResNet-50 surrogate at eps=8/255, LRS-F with PGD achieves average ASR 69.91% vs 62.89% for ILA++ (best baseline) across 10 targets.
- On CIFAR-10 at eps=4/255, LRS-F raises PGD's average ASR from 38.84% to 68.94%.
- Empirical local Lipschitz constant of DenseNet100 drops from 5.53 to 0.59 under LRS-F, and ResNet50's from 976.59 to 49.64.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Transform the surrogate with first-order Lipschitz regularization | PGD using DenseNet · CIFAR-10, ε=4/255, average over target models | attack success rate: 38.84% -> 58.87% | Helped |
| Transform the surrogate with second-order Lipschitz regularization | PGD using DenseNet · CIFAR-10, ε=4/255, average over target models | attack success rate: 38.84% -> 64.21% | Helped |
| Combine first- and second-order Lipschitz regularization | PGD using DenseNet · CIFAR-10, ε=4/255, average over target models | attack success rate: 38.84% -> 68.94% | Helped |
| Combine first- and second-order Lipschitz regularization | PGD using DenseNet · CIFAR-10, ε=8/255, average over target models | attack success rate: 64.85% -> 95.48% | Helped |
| Apply LRS-F to transfer-based attacks | TIM, Admix, and TAIG using DenseNet · CIFAR-10, ε=4/255, average over target models | attack success rate: TIM 41.89% -> 75.87%; Admix 49.43% -> 80.14%; TAIG 47.78% -> 77.99% | Helped |
| Apply LRS-F to the surrogate | PGD using ResNet-50 · ImageNet, ε=8/255, average over target models | attack success rate: 27.69% -> 69.91% | Helped |
| Apply LRS-F to the surrogate | PGD using ResNet-50 · ImageNet secure target models, ε=16/255, average | attack success rate: 3.87% -> 31.35% | Helped |
| Use both regularization orders rather than LRS-1 alone (ablation) | PGD using DenseNet · CIFAR-10, ε=4/255, average over target models | attack success rate: 58.87% -> 68.94% | Helped |
| Use both regularization orders rather than LRS-2 alone (ablation) | PGD using DenseNet · CIFAR-10, ε=4/255, average over target models | attack success rate: 64.21% -> 68.94% | Helped |
| Vary the regularization coefficient λ and finite-difference step size h over the tested ranges (ablation) | LRS using PGD · CIFAR-10, ε=4/255, average over five target models | attack success rate | No clear effect |
| Set λ=0 instead of applying LRS regularization (ablation) | LRS using PGD · CIFAR-10, ε=4/255, average over five target models | attack success rate | Hurt |
Surprising findings
- LRS-2 (second-order, Hessian-based regularization) boosts transferability more than LRS-1 (first-order) on CIFAR-10 (average ASR 64.21% vs 58.87%).
Limitations
- Requires an additional offline fine-tuning stage of the surrogate model before attacking.
- Computing exact local Lipschitz constants is intractable, so the method relies on finite-difference approximations with a sensitive step size h.
Experimental setup
Datasets: CIFAR-10 ImageNet
Benchmarks: CIFAR-10 ImageNet adversarially trained and defended models (Inc-v3_ens3, Inc-v3_ens4, IncRes-v2_ens, JPEG, R&P, NRP)
Metrics: attack success rate
Baselines: PGD TIM SIM LinBP Admix TAIG ILA++ LGV
Builds on: PGD MIM TIM Admix ILA++
Closest papers by meaning
- Enhancing Adversarial Transferability with Adversarial Weight Tuning (AAAI 2025 · similarity 0.90)
- Enhancing Adversarial Transferability with Checkpoints of a Single Model's Training (CVPR 2025 · similarity 0.89)
- X-Transfer Attacks: Towards Super Transferable Adversarial Attacks on CLIP (ICML 2025 · similarity 0.88)
- PubDef: Defending Against Transfer Attacks From Public Models (ICLR 2024 · similarity 0.88)
- Transferability Bound Theory: Exploring Relationship between Adversarial Transferability and Flatness (NeurIPS 2024 · similarity 0.88)
- Boosting Adversarial Transferability through Augmentation in Hypothesis Space (CVPR 2025 · similarity 0.88)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.