Research map / Adversarial robustness and security / Black-box and transfer attacks
Transferability Bound Theory: Exploring Relationship between Adversarial Transferability and Flatness
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Derives a theoretical bound on adversarial transferability showing flatness alone does not guarantee better transfer, and proposes TPA, an attack optimizing a first-order gradient-norm surrogate of the bound.
Problem
Whether flat adversarial examples necessarily transfer better; the theoretical relationship between adversarial transferability and flatness has not been established, and directly optimizing the second-order bound is computationally prohibitive.
Approach
Derives a transferability bound with first-order and second-order gradient components, showing flatness is only one contributing term; proposes TPA, which penalizes gradient norms of samples around the adversarial example (estimating Hessian-vector products via a finite-difference of first-order gradients) as a first-order surrogate.
Key results
- TPA reaches 99.85% ASR on ResNet50 proxy-to-ResNet50 and about 93.5% on ViT and 91% on Swin, with about 9% average gain over SSA on normal models with ResNet50 proxy.
- On targeted attacks with ResNet50 proxy, TPA achieves 31.9% on DenseNet121 vs 22.0% for Self-Universality.
- Human-rated real-world tests give ASRs of about 70% (classification) and 80% (object detection) on Google Cloud Vision, and up to 56% and 62% on GPT-4 and Claude3.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Optimize the TPA surrogate instead of using BSR | ImageNet transfer attack with ResNet50 proxy · ViT target | ASR (%): 82.32 -> 93.52 | Helped |
| Optimize the TPA surrogate instead of using BSR | ImageNet transfer attack with ResNet50 proxy · Swin target | ASR (%): 77.05 -> 90.98 | Helped |
| Optimize the TPA surrogate instead of using BSR | ImageNet transfer attack with ResNet50 proxy · EfficientNet target | ASR (%): 95.16 -> 99.52 | Helped |
| Use TPA instead of BSR | Transfer attack from ResNet50 · AdvIncV3 robust target | ASR (%): 64.02 -> 74.57 | Helped |
| Use TPA instead of BSR | Transfer attack from ResNet50 · SIN robust target | ASR (%): 88.47 -> 99.52 | Helped |
| Use TPA instead of Self-Universality | Targeted attack from ResNet50 · DenseNet121 target | targeted ASR (%): 22.00 -> 31.90 | Helped |
| Increase iterations from 10 to 20 (ablation) | TPA transfer attack with ResNet50 proxy · DenseNet121 target | ASR (%): 99.08 -> 99.69 | Helped |
| Increase iterations from 10 to 20 (ablation) | TPA transfer attack with ResNet50 proxy · EfficientNet target | ASR (%): 99.25 -> 99.52 | Helped |
| Increase the flatness penalty weight λ (ablation) | TPA · ImageNet transfer | ASR | Mixed |
| Increase the sampled neighborhood width b (ablation) | TPA · ImageNet transfer | ASR | Helped |
| Increase b from 14 to 16 (ablation) | TPA with ResNet50 proxy and EfficientNet target · ImageNet transfer | ASR | Hurt |
| Increase the finite-difference step k (ablation) | TPA · ImageNet transfer | ASR | Hurt |
Surprising findings
- Flatness of adversarial examples does not necessarily imply better transferability, contrary to the prevailing belief.
- Penalizing only the gradient norm at the adversarial point does not control the second-order term, so the surrogate must use samples around the point.
Limitations
- Theorem relies on several assumptions (e.g., bounded density gradient, Taylor expansion for small perturbations) that are only loosely justified.
- Approximation error of the finite-difference Hessian estimate is O(k) and sensitive to k.
- Real-world evaluation uses a single volunteer rater and 100 samples, and reports no compute cost details.
Experimental setup
Datasets: ImageNet
Benchmarks: ImageNet Google Cloud Vision Google/Bing/Yandex/Baidu reverse image search GPT-4 Claude3
Metrics: attack success rate human-rated attack score (1-5)
Baselines: BIM MI NI DI TI VT SSA RAP BSR Self-Universality
Builds on: sharpness-aware minimization RAP Admix Mixup
Closest papers by meaning
- Understanding Model Ensemble in Transferable Adversarial Attack (ICML 2025 · similarity 0.90)
- Enhancing Adversarial Transferability with Adversarial Weight Tuning (AAAI 2025 · similarity 0.89)
- Boosting Adversarial Transferability through Augmentation in Hypothesis Space (CVPR 2025 · similarity 0.89)
- Rethinking Model Ensemble in Transfer-based Adversarial Attacks (ICLR 2024 · similarity 0.89)
- PubDef: Defending Against Transfer Attacks From Public Models (ICLR 2024 · similarity 0.88)
- LRS: Enhancing Adversarial Transferability through Lipschitz Regularized Surrogate (AAAI 2024 · similarity 0.88)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.