[Paper Review] Boosting Adversarial Transferability via Fusing Logits of Top-1 Decomposed Feature

Juanjuan Weng, Zhiming Luo+3 more|arXiv (Cornell University)|May 2, 2023

Adversarial Robustness in Machine Learning4 citations

TL;DR

This paper proposes a novel SVD-based feature-level attack method that enhances adversarial transferability by fusing the top-1 singular value-decomposed feature with original logits. By leveraging the most generalizable and attention-prone components from intermediate layer features, the method boosts attack success rates across diverse models and defenses without additional computation for importance estimation, achieving state-of-the-art performance with minimal training cost.

ABSTRACT

Recent research has shown that Deep Neural Networks (DNNs) are highly vulnerable to adversarial samples, which are highly transferable and can be used to attack other unknown black-box models. To improve the transferability of adversarial samples, several feature-based adversarial attack methods have been proposed to disrupt neuron activation in the middle layers. However, current state-of-the-art feature-based attack methods typically require additional computation costs for estimating the importance of neurons. To address this challenge, we propose a Singular Value Decomposition (SVD)-based feature-level attack method. Our approach is inspired by the discovery that eigenvectors associated with the larger singular values decomposed from the middle layer features exhibit superior generalization and attention properties. Specifically, we conduct the attack by retaining the decomposed Top-1 singular value-associated feature for computing the output logits, which are then combined with the original logits to optimize adversarial examples. Our extensive experimental results verify the effectiveness of our proposed method, which can be easily integrated into various baselines to significantly enhance the transferability of adversarial samples for disturbing normally trained CNNs and advanced defense strategies. The source code of this study is available at https://github.com/WJJLL/SVD-SSA

Motivation & Objective

• To improve the transferability of adversarial examples in black-box attack settings without relying on expensive importance estimation.
• To explore whether the top-1 singular value decomposition (SVD) of intermediate features can enhance adversarial robustness and generalization.
• To develop a lightweight, efficient attack method that integrates SVD-derived features into the loss optimization process.
• To validate the method's effectiveness on both standard and adversarially trained models, including strong defense mechanisms.
• To demonstrate that the largest singular value component captures generalizable, attention-relevant features that improve cross-model transfer.

Proposed method

• The method applies Singular Value Decomposition (SVD) to intermediate feature maps from a surrogate model to extract the top-1 singular value and its associated left and right singular vectors.
• It constructs a modified feature representation using only the top-1 SVD component, which is then used to compute output logits.
• These SVD-derived logits are fused with the original model logits via a learnable weight parameter β during adversarial example optimization.
• The attack objective function combines the standard cross-entropy loss with a weighted sum of original and SVD-based logits to guide perturbation generation.
• The approach avoids costly gradient-based importance estimation by directly using the dominant SVD component, which inherently captures the most generalizable and attention-relevant features.
• The method is plug-and-play, compatible with existing attack baselines, and requires minimal additional computation.

Experimental results

Research questions

• RQ1 Can the top-1 singular value component of intermediate features improve adversarial transferability across different models?
• RQ2 Does fusing SVD-derived logits with original logits enhance attack success rates without increasing computational cost?
• RQ3 How does the proposed method compare to existing feature-based attacks in terms of transferability and efficiency?
• RQ4 What is the optimal trade-off between original and SVD-based logits in terms of attack performance?
• RQ5 Can the SVD-based feature fusion method effectively disrupt attention mechanisms across diverse models?

Key findings

• The proposed method achieves a 99.8% attack success rate on the Inception-V3 model as a source model, outperforming SOTA methods like FIA (98.3%) and NAA (98.1%) on undefended models.
• On adversarially trained models, the method achieves 64.2% success rate on Inc-v3-adv and 61.2% on Inc-v3-ens3, surpassing FIA (53.3% and 36.1%) and NAA (61.5% and 50.5%) respectively.
• The optimal hyperparameter β for logit fusion is around 0.5, where attack success rates peak, indicating a balanced use of original and SVD features.
• Using Top-1 SVD features boosts transferability significantly, but performance degrades when using Top-k features for k > 2, suggesting that only the dominant component is beneficial.
• The method requires only 1029 seconds of training time on a 2080Ti GPU, making it more efficient than FIA (7081s), NAA (7163s), and FDA (1421s).
• Visualization via Eigen-CAM confirms that adversarial examples generated with SVD effectively shift attention from the true object to trivial regions, indicating stronger feature-level disruption.