Research map / Adversarial robustness and security / Black-box and transfer attacks
Enhancing Adversarial Transferability with Adversarial Weight Tuning
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes Adversarial Weight Tuning (AWT), a data-free method that adaptively tunes surrogate-model parameters using intermediate adversarial examples to seek flat local maxima and smoothness, improving black-box transferability on ImageNet.
Problem
Transferable adversarial examples generated on a surrogate model often fail on black-box target models; prior explanations of transferability are empirical, and model-based smoothing methods need extra in-distribution data.
Approach
Combine input-space flat-maxima optimization (NCS/PGN-style sampling) with data-free surrogate parameter tuning, using intermediate AEs as the tuning signal in a max-min bi-level scheme that promotes both flat AE maxima and model smoothness; also proposes a parameter-perturbation-based transferability score.
Key results
- On Transformer targets with RN50 surrogate, AWT reaches 59.0% ASR on ViT-B/16 vs 49.2% for the second-best PGN (10-run mean).
- On CNN targets with RN50 surrogate, AWT achieves 77.0% on Inc-v4 vs 73.2% for PGN.
- The proposed transferability score correlates negatively with experimental transferability on VGG16 (Pearson -0.64, Spearman -0.68).
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Apply AWT instead of PGN | RN50-surrogate attack · ImageNet-compatible, ViT-B/16 target | attack success rate (%): 49.2±0.4 -> 59.0±0.3 | Helped |
| Apply AWT instead of PGN | RN50-surrogate attack · ImageNet-compatible, Swin-T target | attack success rate (%): 66.0±0.1 -> 72.5±0.3 | Helped |
| Apply AWT instead of PGN | RN50-surrogate attack · ImageNet-compatible, Inc-v4 target | attack success rate (%): 73.2±0.3 -> 77.0±0.3 | Helped |
| Apply AWT instead of PGN | RN50-surrogate attack · ImageNet-compatible, Inc-v3 target | attack success rate (%): 75.3±0.3 -> 79.1±0.3 | Helped |
| Add AWT to DIM | DIM with RN50 surrogate · ImageNet-compatible, Inc-v4 target | attack success rate (%): 43.3 to 48.5 | Helped |
| Add AWT to TIM | TIM with RN50 surrogate · ImageNet-compatible, Inc-v3 target | attack success rate (%): 34.0 to 41.3 | Helped |
| Use AWT rather than the other listed attacks | RN50 surrogate · Parameter perturbation ε=0.001 | transferability metric: 0.193 -> 0.184 | Helped |
Surprising findings
- PGN and NCS sometimes have larger proposed-metric values than VMI/VNI despite higher attack success rates, which the authors attribute to insufficient metric sampling.
Limitations
- Transferability metric assumes surrogate and target share architecture; ignores differences in training data or hyperparameters.
- AWT adds computational overhead from two backward passes per iteration.
- Reported metric is not fully aligned with experimental ASR for some attacks (PGN, NCS).
Experimental setup
Datasets: ImageNet-compatible dataset (1,000 images)
Benchmarks: ImageNet-compatible dataset
Metrics: attack success rate transferability score
Baselines: MI NI VMI VNI EMI RAP PGN NCS DIM TIM Admix SIM
Builds on: MI-FGSM NCS PGN VMI EMI
Closest papers by meaning
- Boosting the Transferability of Adversarial Attack on Vision Transformer with Adaptive Token Tuning (NeurIPS 2024 · similarity 0.91)
- Improving Transferable Targeted Adversarial Attacks with Model Self-Enhancement (CVPR 2024 · similarity 0.91)
- Towards Transferable Adversarial Attacks with Centralized Perturbation (AAAI 2024 · similarity 0.90)
- Enhancing Adversarial Transferability with Checkpoints of a Single Model's Training (CVPR 2025 · similarity 0.90)
- Boosting Adversarial Transferability through Augmentation in Hypothesis Space (CVPR 2025 · similarity 0.90)
- LRS: Enhancing Adversarial Transferability through Lipschitz Regularized Surrogate (AAAI 2024 · similarity 0.90)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.