Research map / Adversarial robustness and security / Black-box and transfer attacks
Dual-Flow: Transferable Multi-Target, Instance-Agnostic Attacks via $\textit{In-the-wild}$ Cascading Flow Optimization
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes Dual-Flow, a two-stage ODE flow (pretrained Stable Diffusion forward flow plus a LoRA-finetuned adversarial velocity field trained with Cascading Distribution Shift Training) that generates multi-target, instance-agnostic transferable adversarial perturbations.
Problem
Multi-target generative adversarial attacks suffer low black-box transferability and weak robustness against defenses, given limited generator capacity when conditioned on many target classes.
Approach
Combine a pretrained diffusion ODE that maps clean images to an intermediate perturbed distribution with a LoRA-fine-tuned reverse velocity field trained by cascading distribution shift, using a CE loss on clipped predictions at each reverse step and dynamic gradient clipping to satisfy the l_inf budget.
Key results
- Multi-target Dual-Flow from Inc-v3 reaches 73.96% average black-box ASR versus 52.80% for CGNC on ImageNet-NeurIPS (eps=16/255).
- From Inc-v3 to Inc-Res-v2 / ResNet-152, the paper reports gains such as increasing success rate by 34.58% (abstract example).
- Against six robust models with Inc-v3 source, average ASR rises from 28.60% (CGNC) to 62.28%.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use Dual-Flow instead of CGNC | Multi-target attack, Inc-v3 source · ImageNet NeurIPS val, black-box average | ASR (%): 52.80 -> 73.96 | Helped |
| Use Dual-Flow instead of CGNC | Multi-target attack, Res-152 source · ImageNet NeurIPS val, black-box average | ASR (%): 58.40 -> 70.76 | Helped |
| Use Dual-Flow† instead of CGNC† | Single-target attack, Inc-v3 source · ImageNet NeurIPS val, black-box average | ASR (%): 70.00 -> 76.79 | Helped |
| Use Dual-Flow† instead of CGNC† | Single-target attack, Res-152 source · ImageNet NeurIPS val, black-box average | ASR (%): 68.84 -> 76.12 | Helped |
| Use Dual-Flow instead of CGNC | Attack against robust models, Inc-v3 source · ImageNet NeurIPS val, robust models, average | ASR (%): 28.60 -> 62.28 | Helped |
| Replace Cascading ODE with Cascading SDE and DDPM (ablation) | Dual-Flow, Res-152 source · ImageNet NeurIPS val, multi-target black-box average | ASR (%): 70.76 -> 46.04 | Hurt |
| Replace Cascading ODE with Cascading SDE and DDIM (ablation) | Dual-Flow, Res-152 source · ImageNet NeurIPS val, multi-target black-box average | ASR (%): 70.76 -> 40.12 | Hurt |
| Replace Cascading ODE with Random SDE and DDPM (ablation) | Dual-Flow, Res-152 source · ImageNet NeurIPS val, multi-target black-box average | ASR (%): 70.76 -> 14.86 | Hurt |
| Replace Cascading ODE with Random SDE and DDIM (ablation) | Dual-Flow, Res-152 source · ImageNet NeurIPS val, multi-target black-box average | ASR (%): 70.76 -> 33.00 | Hurt |
Surprising findings
- Random SDE variant performs worst, with success dropping as inference steps increase, because noise injection leaves the intermediate distribution unchanged and causes distribution mismatch.
- Cascading SDE variants underperform the cascading ODE, with sampling instability growing with step size.
Limitations
- Multi-target training is costly (about 48 GPU hours), and single-target variants require additional fine-tuning per class (about 4 GPU hours each).
- Cascading SDE has not surpassed the ODE variant; SDE-based sampling is unstable at larger step sizes.
- Performance drops under DiffPure purification at higher t* values, though it still exceeds CGNC.
Experimental setup
Datasets: ImageNet training set
Benchmarks: ImageNet NeurIPS 2017 adversarial competition dataset (1k) ImageNet validation set
Metrics: attack success rate
Baselines: MIM TI-MIM SI-MIM DIM TI-DIM SI-DIM Logit SU C-GSP CGNC GAP CD-AP
Builds on: Stable Diffusion CGNC LoRA DiffPure
Closest papers by meaning
- Rethinking Adversarial Transferability from a Data Distribution Perspective (ICLR 2022 · similarity 0.88)
- AIM: Additional Image Guided Generation of Transferable Adversarial Attacks (AAAI 2025 · similarity 0.87)
- Enhancing Adversarial Transferability with Checkpoints of a Single Model's Training (CVPR 2025 · similarity 0.86)
- Enhancing Adversarial Transferability with Adversarial Weight Tuning (AAAI 2025 · similarity 0.85)
- Improving Transferable Targeted Adversarial Attacks with Model Self-Enhancement (CVPR 2024 · similarity 0.85)
- Towards Transferable Adversarial Attacks with Centralized Perturbation (AAAI 2024 · similarity 0.84)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.