Research map / Adversarial robustness and security / Black-box and transfer attacks

Anchoring Adversarial Trajectories to Data Manifolds: A Bilevel Transfer Optimization Framework

NeurIPS 2026 · Adversarial robustness and security › Black-box and transfer attacks · approach: Transfer attacks on face recognition · 0 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes MABT, which anchors adversarial perturbation trajectories to the data manifold via a relaxed manifold-anchoring projector (e.g., resizing) and a Hessian-free distributional bilevel optimization over surrogate variants, improving transfer attack success across CNNs, ensembles, and ViTs.

Problem

Transfer-based adversarial attacks overfit surrogate-specific artifacts because iterative ambient-space gradients drift off the natural-image data manifold, weakening transferability to black-box victims.

Approach

A relaxed manifold-anchoring projector (MAP) is applied before surrogate evaluation to suppress off-manifold components, and the attack initialization is learned by a distributional bilevel optimization minimizing expected transfer risk over Gaussian-perturbed surrogate variants, solved with a Hessian-free gap-function gradient estimator.

Key results

• MABT raises overall average ASR from 22.52% to 39.28% (74.4% relative gain) over baseline attackers on ResNet-50 surrogate.
• With GAA, MABT increases average ASR from 33.26% (BETAK) to 49.33% on the CNN victim suite, a 48.32% relative improvement.
• Resize MAP alone roughly doubles PGD ASR (15.24% to 28.59% average untargeted on ResNet-50) with negligible overhead.

Surprising findings

• A simple resize operation as the manifold-anchoring projector yields most of the gain, with heavier diffusion-based purifiers adding only about 4-5 points at higher latency.
• DnCNN denoising MAP gives a weaker gain (21.28% avg for PGD) than resizing, suggesting learned denoising priors are less effective here.

Limitations

• Evaluation limited to image classification; dense prediction tasks not studied.
• Theoretical convergence result assumes smooth composite setting, while practical MAP instances are non-smooth and use surrogate-gradient approximations.
• Upper-level risk relies on a Gaussian approximation of surrogate uncertainty rather than the true victim distribution.

Experimental setup

Datasets: ImageNet

Benchmarks: ImageNet

Metrics: attack success rate (ASR) feature shift (1-cos)

Baselines: PGD MI VMI GAA SI DI TI GHOST MBA AWT BETAK

Builds on: PGD MI-FGSM BETAK MBA AWT

Closest papers by meaning

• AnchorRep: Defending LLMs Against Cross-Model Adversarial Transfer via Representation Repulsion (NeurIPS 2026 · similarity 0.87)
• Manifold Constraints for Imperceptible Adversarial Attacks on Point Clouds (AAAI 2024 · similarity 0.85)
• Enhancing Adversarial Transferability with Adversarial Weight Tuning (AAAI 2025 · similarity 0.84)
• LRS: Enhancing Adversarial Transferability through Lipschitz Regularized Surrogate (AAAI 2024 · similarity 0.84)
• Transferability Bound Theory: Exploring Relationship between Adversarial Transferability and Flatness (NeurIPS 2024 · similarity 0.84)
• PubDef: Defending Against Transfer Attacks From Public Models (ICLR 2024 · similarity 0.83)