[Paper Review] Boosting Adversarial Transferability by Block Shuffle and Rotation

Kunyu Wang, Xuanran He+2 more|arXiv (Cornell University)|Aug 20, 2023

Adversarial Robustness in Machine Learning4 citations

TL;DR

This paper proposes Block Shuffle and Rotation (BSR), a novel input transformation method that enhances adversarial transferability by disrupting image structure through random block shuffling and rotation, enabling consistent attention heatmaps across models. BSR achieves state-of-the-art transferability on ImageNet, outperforming prior methods by up to 6.0% in attack success rate, especially effective against adversarially trained and defended models.

ABSTRACT

Adversarial examples mislead deep neural networks with imperceptible perturbations and have brought significant threats to deep learning. An important aspect is their transferability, which refers to their ability to deceive other models, thus enabling attacks in the black-box setting. Though various methods have been proposed to boost transferability, the performance still falls short compared with white-box attacks. In this work, we observe that existing input transformation based attacks, one of the mainstream transfer-based attacks, result in different attention heatmaps on various models, which might limit the transferability. We also find that breaking the intrinsic relation of the image can disrupt the attention heatmap of the original image. Based on this finding, we propose a novel input transformation based attack called block shuffle and rotation (BSR). Specifically, BSR splits the input image into several blocks, then randomly shuffles and rotates these blocks to construct a set of new images for gradient calculation. Empirical evaluations on the ImageNet dataset demonstrate that BSR could achieve significantly better transferability than the existing input transformation based methods under single-model and ensemble-model settings. Combining BSR with the current input transformation method can further improve the transferability, which significantly outperforms the state-of-the-art methods. Code is available at https://github.com/Trustworthy-AI-Group/BSR

Motivation & Objective

• To address the limited transferability of adversarial examples in black-box attacks, particularly due to inconsistent attention heatmaps across models.
• To investigate whether disrupting the intrinsic spatial structure of images can stabilize attention heatmaps and improve transferability.
• To develop a new input transformation-based attack that optimizes adversarial perturbations on multiple transformed images to reduce variance in attention maps.
• To evaluate the effectiveness of BSR against strong defenses, including certified and denoising defenses, to demonstrate robustness and real-world threat potential.

Proposed method

• BSR splits the input image into a fixed number of non-overlapping blocks to break spatial coherence.
• Each block is randomly shuffled and rotated by a random angle within a predefined range to generate multiple transformed images.
• The adversarial perturbation is optimized using the average gradient across N such transformed images to stabilize training and reduce variance.
• The method applies random transformations (shuffling and rotation) to disrupt attention maps on the source model while preserving semantic content for effective transfer.
• BSR is compatible with existing transfer-based attacks and can be combined with methods like TI-DIM or SIM to further boost performance.
• The number of blocks (n), number of transformed images (N), and rotation angle range (τ) are hyperparameters tuned via ablation to balance disruption and optimization stability.

Raw Image

Experimental results

Research questions

• RQ1 Can disrupting the intrinsic spatial structure of images through block shuffling and rotation lead to more consistent attention heatmaps across different models?
• RQ2 Does optimizing adversarial perturbations on multiple transformed images with varied attention maps improve transferability compared to standard input transformation methods?
• RQ3 How do hyperparameters such as the number of blocks, number of transformed images, and rotation angle range affect the performance of BSR?
• RQ4 Can BSR maintain high transferability against strong defenses, including adversarial training and certified defenses?
• RQ5 How does BSR compare to state-of-the-art transfer-based attacks in terms of attack success rate under both single-model and ensemble settings?

Key findings

• BSR achieves an average attack success rate of 98.4% on ImageNet against adversarially trained models, surpassing Admix-TI-DIM by at least 6.0%.
• When combined with scale-invariant methods (SIM), BSR-SI-TI-DIM achieves 94.1% attack success rate, outperforming Admix-TI-DIM by 5.0% on average.
• On the certified defense RS and powerful denoiser NRP, BSR-SI-TI-DIM achieves 83.9% and 84.2% success rates, respectively, exceeding Admix-TI-DIM by 11.3% and 3.8%.
• Ablation studies show that n=2 blocks, N=20 transformed images, and τ=24° rotation range yield optimal performance, balancing disruption and optimization stability.
• Block shuffle (BS) and block rotation (BR) alone improve transferability over MI-FGSM, but BSR—combining both—achieves the highest performance, confirming synergy.
• The method significantly reduces variance in attention heatmaps across models, validating the hypothesis that consistent attention patterns enhance transferability.

Shuffled Image