Research map / Adversarial robustness and security / Black-box and transfer attacks
Boosting Adversarial Transferability with Spatial Adversarial Alignment
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes Spatial Adversarial Alignment (SAA), which fine-tunes a surrogate CNN/ViT toward a witness model using global+local (spatial) KL/CE alignment plus self-generated adversarial examples, to produce more transferable MI-style attacks, especially CNN-to-ViT.
Problem
Adversarial examples crafted on a surrogate model transfer poorly across architectures, especially from CNNs to ViTs, because surrogate and target features differ structurally.
Approach
Extends Model Alignment by aligning surrogate features to a witness model both globally and per spatial location (pseudo-label cross-entropy on patch-level logits), and additionally aligning on adversarial examples generated by the surrogate, so the surrogate learns shared features before attacking.
Key results
- With Res50 surrogate and ViT-B witness, SAA raises average ASR under MI from 42.2% (no alignment) and 53.5% (MA) to 63.9%.
- SAA combined with SSA-DI-TI-MI reaches 88.2% average ASR across targets, versus 86.2% for the base attack.
- Against 12 defenses with an ensemble surrogate, SSA-DI-TI-MI-SAA achieves 85.9% average ASR versus 81.5% for SSA-DI-TI-MI on the same setup.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use SAA instead of MA for Res50-to-ViT-B alignment | Res50 surrogate, ViT-B witness, MI attack · ImageNet-compatible | Avg. ASR (%): 53.5 -> 63.9 | Helped |
| Add local alignment to global alignment (ablation) | SAA, Res50 surrogate and ViT-B witness · ImageNet-compatible | Avg. ASR (%): 45.8 -> 50.1 | Helped |
| Add adversarial alignment to global alignment (ablation) | SAA, Res50 surrogate and ViT-B witness · ImageNet-compatible | Avg. ASR (%): 45.8 -> 58.4 | Helped |
| Add local alignment to global and adversarial alignment (ablation) | SAA, Res50 surrogate and ViT-B witness · ImageNet-compatible | Avg. ASR (%): 58.4 -> 63.9 | Helped |
| Use TV distance instead of KL for global feature alignment (ablation) | SAA, Res50 surrogate and ViT-B witness · ImageNet-compatible | Avg. ASR (%): 63.9 -> 46.7 | Hurt |
| Use JS distance instead of KL for global feature alignment (ablation) | SAA, Res50 surrogate and ViT-B witness · ImageNet-compatible | Avg. ASR (%): 63.9 -> 61.4 | Hurt |
| Use NCE loss instead of KL for global feature alignment (ablation) | SAA, Res50 surrogate and ViT-B witness · ImageNet-compatible | Avg. ASR (%): 63.9 -> 59.3 | Hurt |
| Use witness features rather than surrogate features to supervise self-adversarial examples (ablation) | SAA, Res50 surrogate and ViT-B witness · ImageNet-compatible | Avg. ASR (%): 59.6 -> 63.9 | Helped |
| Use hard local pseudo-labels instead of soft labels (ablation) | SAA, Res50 surrogate and ViT-B witness · ImageNet-compatible | Avg. ASR (%): 57.8 -> 63.9 | Helped |
| Use SAA rather than no alignment | Res50 surrogate with Res50, DN121, ViT-B, or Swin-B witness · ImageNet-compatible | Avg. ASR (%): 42.2 -> 58.8; 42.2 -> 75.8; 42.2 -> 63.9; 42.2 -> 57.5 | Helped |
Surprising findings
- Self-alignment (surrogate and witness being the same architecture) gives only minor gains, while cross-architecture alignment helps more.
- Alignment-based surrogates can underperform the unaligned surrogate on some targets when relying only on global alignment (e.g., DN121 with Swin-B witness).
Limitations
- Large architectural gaps still limit transferability; SAA does not fully resolve them.
- Alignment adds computational cost, dominated by generating adversarial examples during training.
- No theoretical analysis is provided.
Experimental setup
Datasets: ImageNet-compatible dataset ImageNet
Benchmarks: ImageNet-compatible dataset
Metrics: average attack success rate (Avg. ASR %) cosine similarity of global features Grad-CAM heatmaps
Baselines: MI Model Alignment (MA) NI GI DI TI SSA SGM PatchOut PNA TGR FDA
Builds on: Model Alignment MI-FGSM Skip Gradient Method DI TI
Closest papers by meaning
- Boosting Adversarial Transferability through Augmentation in Hypothesis Space (CVPR 2025 · similarity 0.87)
- Enhancing Adversarial Transferability with Adversarial Weight Tuning (AAAI 2025 · similarity 0.87)
- Adversarial Attacks against Closed-Source MLLMs via Feature Optimal Alignment (NeurIPS 2025 · similarity 0.87)
- Everywhere Attack: Attacking Locally and Globally to Boost Targeted Transferability (AAAI 2025 · similarity 0.86)
- Enhancing Adversarial Transferability with Checkpoints of a Single Model's Training (CVPR 2025 · similarity 0.86)
- Transferability Bound Theory: Exploring Relationship between Adversarial Transferability and Flatness (NeurIPS 2024 · similarity 0.86)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.