[Paper Review] Enhancing Adversarial Example Transferability with an Intermediate Level Attack

Qian Huang, Isay Katsman+4 more|arXiv (Cornell University)|Jul 23, 2019

Adversarial Robustness in Machine Learning31 references40 citations

TL;DR

ILA fine-tunes existing adversarial examples by emphasizing perturbations at a pre-specified intermediate layer to boost black-box transferability across models.

ABSTRACT

Neural networks are vulnerable to adversarial examples, malicious inputs crafted to fool trained models. Adversarial examples often exhibit black-box transfer, meaning that adversarial examples for one model can fool another model. However, adversarial examples are typically overfit to exploit the particular architecture and feature representation of a source model, resulting in sub-optimal black-box transfer attacks to other target models. We introduce the Intermediate Level Attack (ILA), which attempts to fine-tune an existing adversarial example for greater black-box transferability by increasing its perturbation on a pre-specified layer of the source model, improving upon state-of-the-art methods. We show that we can select a layer of the source model to perturb without any knowledge of the target models while achieving high transferability. Additionally, we provide some explanatory insights regarding our method and the effect of optimizing for adversarial examples using intermediate feature maps. Our code is available at https://github.com/CUVL/Intermediate-Level-Attack.

Motivation & Objective

• Motivate and address poor transferability of white-box adversarial attacks in black-box settings.
• Introduce Intermediate Level Attack (ILA) to tune existing adversarial examples via intermediate-layer perturbations.
• Provide layer-selection strategy that does not require access to target models.
• Offer theoretical and empirical insights into why intermediate representations affect transferability.

Proposed method

• Define two ILA variants: ILAP (projection-based loss) and ILAF (flexible loss that also controls magnitude and direction).
• Operate as a fine-tuning step: start from a pre-generated adversarial example x' from a baseline attack A and optimize within an epsilon-ball to maximize perturbation at a chosen layer l.
• ILAP loss: L = -Δy_l'' · Δy_l' where Δy_l' and Δy_l'' are layer l outputs differences for x' and x'' respectively.
• ILAF loss: L = -α * ||Δy_l''||_2 / ||Δy_l'||_2 - (Δy_l'' / ||Δy_l''||_2) · (Δy_l' / ||Δy_l'||_2).
• Layer selection guidance: identify the layer that yields the latest peak in disturbance values across layers, which correlates with higher transferability.
• Evaluation across CIFAR-10 and ImageNet on multiple models (e.g., ResNet18, SENet18, DenseNet121, GoogLeNet) and against baselines like I-FGSM, MI-FGSM, and CARLINI-WAGNER variants.

Experimental results

Research questions

• RQ1 Can perturbing an intermediate layer of the source model increase black-box transferability of adversarial examples?
• RQ2 Is there a layer-wise disturbance pattern that can be pre-identified without transfer-model access to maximize transferability?
• RQ3 How do ILAP and ILAF compare to existing transfer-focused attacks (e.g., TAP, DI2-FGSM) on standard datasets and ImageNet?
• RQ4 Does selecting a near-optimal intermediate layer generalize across different target models and architectures?

Key findings

• ILA improves transferability over baseline attacks across several models and datasets.
• Targeting specific intermediate layers (notably certain later layers) yields stronger transfer, with layer selection achievable without target-model access.
• ILAP often outperforms baseline attacks and can surpass some state-of-the-art transfer attacks like TAP and DI2-FGSM in ImageNet settings.
• ILAF can further improve transferability but requires model-specific hyperparameter tuning to outperform ILAP.
• The proposed layer-selection heuristic correlates with higher transferability and can be used to pick a near-optimal layer without evaluating on transfer models.