Research map / Adversarial robustness and security / Black-box and transfer attacks
AIM: Additional Image Guided Generation of Transferable Adversarial Attacks
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes a plug-and-play Semantic Injection Module that feeds a guiding image of the target class into a ResNet adversarial generator via affine feature modulation, with new logit-contrastive and feature-similarity losses, to improve targeted and untargeted transferable attacks.
Problem
Generative targeted transferable adversarial attacks transfer poorly across architectures and domains because the generator overfits to the surrogate model and source data and has no target-class semantics to guide it.
Approach
Inject semantics from an additional guiding image (of the target class, or of incorrect classes for untargeted attacks) into intermediate generator layers through learned scale and shift (affine) modulation, paired with a logit contrastive loss and a feature similarity loss that pull adversarial features toward the guide and away from the source.
Key results
- Targeted cross-architecture attacks with ResNet-152 surrogate reach 61.51% average (lower-is-better) accuracy across targets versus 39.34% for CDA... with ViT targets averaging 20.95% vs 3.28% for CDA (as reported in the table; the paper reports higher-is-better accuracy for targeted attacks).
- Untargeted cross-architecture attack from VGG-16 achieves 38.78% average accuracy versus 46.24% for BIA.
- Untargeted cross-domain attack averages 40.34% accuracy across CUB-200, Stanford Cars and FGVC Aircraft, versus 52.69% for BIA on the same setup.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| add Semantic Injection Module and targeted losses | targeted generator with ResNet-152 surrogate · Targeted cross-architecture, Avg/All | top-1 accuracy: 42.61 -> 61.51 | Helped |
| add Semantic Injection Module and targeted losses | targeted generator with DenseNet-169 surrogate · Targeted cross-architecture, Avg/All | top-1 accuracy: 40.65 -> 61.23 | Helped |
| use AIM instead of CDA | untargeted generator with VGG-16 surrogate · Untargeted cross-domain, Avg/All | top-1 accuracy: 52.45 -> 40.34 | Helped |
| use AIM instead of PGD | untargeted generator with VGG-16 surrogate · Untargeted cross-architecture, Avg/All | top-1 accuracy: 42.49 -> 38.78 | Helped |
| add mid-layer similarity loss to logit contrastive loss (ablation) | targeted generator with ResNet-152 surrogate · Targeted attack, Avg/All | top-1 accuracy: 16.51 -> 61.51 | Helped |
| add logit contrastive loss to mid-layer similarity loss (ablation) | targeted generator with ResNet-152 surrogate · Targeted attack, Avg/All | top-1 accuracy: 42.08 -> 61.51 | Helped |
| add untargeted semantic injection loss to feature disruption loss (ablation) | untargeted generator with VGG-16 surrogate · Untargeted cross-domain, Avg/All | top-1 accuracy: 50.48 -> 40.34 | Helped |
| add feature disruption loss to untargeted semantic injection loss (ablation) | untargeted generator with VGG-16 surrogate · Untargeted cross-domain, Avg/All | top-1 accuracy: 65.62 -> 40.34 | Helped |
| add untargeted semantic injection loss to feature disruption loss (ablation) | untargeted generator with VGG-16 surrogate · Untargeted cross-architecture, Avg/All | top-1 accuracy: 44.67 -> 38.78 | Helped |
| add feature disruption loss to untargeted semantic injection loss (ablation) | untargeted generator with VGG-16 surrogate · Untargeted cross-architecture, Avg/All | top-1 accuracy: 47.70 -> 38.78 | Helped |
| select guiding images by minimum CLIP score instead of randomly (ablation) | targeted AIM · Great Grey Owl, Avg/All | top-1 accuracy: 57.16 -> 50.81 | Hurt |
| select guiding images by maximum CLIP score instead of randomly (ablation) | targeted AIM · Great Grey Owl, Avg/All | top-1 accuracy: 57.16 -> 51.20 | Hurt |
Surprising findings
- Per the paper, the proposed method is the first to achieve nontrivial targeted attack success on ViT architectures in this setting.
- CLIP-score-based guiding image selection performs worse than random selection, while manually chosen representative images perform better.
Limitations
- Untargeted attacks using guiding images from all incorrect classes were not explored due to cost.
- Targeted results are reported for only three ImageNet target classes.
- Adds parameters and computation (3.25e4 to 7.92e4 M params as reported in the table) relative to base generator.
Experimental setup
Datasets: ImageNet
Benchmarks: ImageNet CUB-200-2011 Stanford Cars FGVC Aircraft
Metrics: top-1 accuracy
Baselines: PGD DI-FGSM DR CDA BIA GAP TTP
Builds on: CDA BIA TTP GAP
Closest papers by meaning
- Enhancing Adversarial Transferability with Adversarial Weight Tuning (AAAI 2025 · similarity 0.88)
- Everywhere Attack: Attacking Locally and Globally to Boost Targeted Transferability (AAAI 2025 · similarity 0.87)
- Improving Transferable Targeted Adversarial Attacks with Model Self-Enhancement (CVPR 2024 · similarity 0.87)
- X-Transfer Attacks: Towards Super Transferable Adversarial Attacks on CLIP (ICML 2025 · similarity 0.87)
- Boosting the Transferability of Adversarial Attack on Vision Transformer with Adaptive Token Tuning (NeurIPS 2024 · similarity 0.87)
- Dual-Flow: Transferable Multi-Target, Instance-Agnostic Attacks via $\textit{In-the-wild}$ Cascading Flow Optimization (NeurIPS 2025 · similarity 0.87)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.