Research map / Adversarial robustness and security / Black-box and transfer attacks
Improving Integrated Gradient-based Transferable Adversarial Examples by Refining the Integration Path
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Refines integrated-gradients integration paths for transferable adversarial attacks via multiple, monotonic (Lower Bound Quantization baselines), and diversified (composite random transformations) paths, yielding the MuMoDIG attack.
Problem
Existing integrated-gradients (IG)-based transferable attacks use a single straight integration path from a black baseline, which limits transferability to unseen CNN/ViT models and defenses.
Approach
Treats the IG integration path as the key design lever: uses multiple baselines, enforces monotonic paths via a Lower Bound Quantization baseline generator so gradient signs align with path signs, and diversifies paths with composite random transformations (resizing-padding and affine), discarding non-monotonic paths.
Key results
- MuMoDIG reaches 73.9% mean attack success rate with RN-18 surrogate, versus 50.8% for MIG on the same setting.
- Outperforms the latest IG-based attack MIG by up to 37.3% and other state-of-the-art attacks by 8.4%, per the abstract.
- On Baidu Cloud API, MuMoDIG achieves 91.0% ASR on 100 images versus 74.0% for GRA and 87.0% for SIA.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| refine the integration path with multiplicity, monotonicity, and diversity | MuMoDIG · ImageNet-1k val; RN-18 surrogate; target-model mean | attack success rate: 67.2 -> 73.9 | Helped |
| use arbitrary multiple baselines rather than monotonic baselines (ablation) | IG-based transferable attacks · ImageNet-1k val; RN-18 surrogate; target-model mean | attack success rate: 50.8 -> 13.6 | Hurt |
| add multiple monotonic integration paths (ablation) | MIG · ImageNet-1k val; RN-18 surrogate; target-model mean | attack success rate: 50.8 -> 53.0 | Helped |
| increase the number of monotonic baselines (ablation) | MuMoIG · ImageNet-1k val; RN-18 surrogate; target-model mean | attack success rate: 53.0 -> 56.4 | Helped |
| retain non-monotonic paths from transformed inputs (ablation) | MuMoDIG · ImageNet-1k val; RN-18 surrogate; target-model mean | attack success rate: 61.6 -> 73.9 | Hurt |
| increase sampled transformations from 1 to 50 (ablation) | MuMoDIG · ImageNet-1k val; seven target models | attack success rate: 59.2 -> 82.8 | Helped |
| increase baselines from 1 to 50 (ablation) | MuMoDIG · ImageNet-1k val; seven target models | attack success rate: 59.2 -> 75.0 | Helped |
| increase interpolation points from 1 to 50 (ablation) | MuMoDIG · ImageNet-1k val; seven target models | attack success rate: 59.2 -> 67.9 | Helped |
| remove either affine transformation or resizing and padding (ablation) | MuMoDIG · ImageNet-1k val; CNN and ViT target models | attack success rate: 82.1 / 53.1; 85.4 / 57.1 -> 90.0 / 62.3 | Hurt |
| combine MuMoDIG with SGM | MuMoDIG · ImageNet-1k val; CNN and ViT target models | attack success rate: 90.0 -> 91.1; 62.3 -> 66.3 | Helped |
| combine MuMoDIG with PNAPO | MuMoDIG · ImageNet-1k val; CNN and ViT target models | attack success rate: 81.4 -> 83.4; 79.4 -> 82.0 | Helped |
Surprising findings
- Naively using multiple arbitrary baselines (MuIG) severely harms transferability, dropping mean ASR to 13.6% from MIG's 50.8%.
- Increasing the number of interpolation points N_I is the least effective way to boost transferability, since interpolated points differ only by pixel scaling.
Limitations
- Non-monotonic paths from input transformations are discarded, which the authors note gives a trade-off; MuMoDIG with all paths (MuMoDIG_all) performs worse.
- Gains on some defenses (e.g., adversarial training, AT) remain small, with ~51.9% ASR.
Experimental setup
Datasets: ImageNet (ILSVRC2012 validation subset, 1k images)
Benchmarks: ImageNet (ILSVRC2012 validation, 1k images) Baidu Cloud API
Metrics: attack success rate
Baselines: MIG GRA SSA SIA SGM PNAPO PAM NAA MuIG MuMoIG
Builds on: Integrated Gradients MIG Momentum Iterative Method Randomized Quantization SIA
Closest papers by meaning
- Enhancing Adversarial Transferability with Adversarial Weight Tuning (AAAI 2025 · similarity 0.86)
- Understanding Model Ensemble in Transferable Adversarial Attack (ICML 2025 · similarity 0.86)
- Enhancing Adversarial Transferability with Checkpoints of a Single Model's Training (CVPR 2025 · similarity 0.86)
- Rethinking Model Ensemble in Transfer-based Adversarial Attacks (ICLR 2024 · similarity 0.86)
- Boosting Adversarial Transferability through Augmentation in Hypothesis Space (CVPR 2025 · similarity 0.86)
- Transferability Bound Theory: Exploring Relationship between Adversarial Transferability and Flatness (NeurIPS 2024 · similarity 0.85)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.