[Paper Review] Intermediate Level Adversarial Attack for Enhanced Transferability

Qian Huang, Zeqi Gu+6 more|arXiv (Cornell University)|Nov 20, 2018

Adversarial Robustness in Machine Learning19 references4 citations

TL;DR

This paper proposes the Intermediate Level Attack (ILA), a method to enhance the black-box transferability of adversarial examples by fine-tuning them to maximize perturbation at a specific intermediate layer of the source model. By targeting layers with shared, generalizable features across models, ILA improves transfer success rates without requiring knowledge of target models, achieving state-of-the-art transferability on CIFAR-10 benchmarks.

ABSTRACT

Neural networks are vulnerable to adversarial examples, malicious inputs crafted to fool trained models. Adversarial examples often exhibit black-box transfer, meaning that adversarial examples for one model can fool another model. However, adversarial examples may be overfit to exploit the particular architecture and feature representation of a source model, resulting in sub-optimal black-box transfer attacks to other target models. This leads us to introduce the Intermediate Level Attack (ILA), which attempts to fine-tune an existing adversarial example for greater black-box transferability by increasing its perturbation on a pre-specified layer of the source model. We show that our method can effectively achieve this goal and that we can decide a nearly-optimal layer of the source model to perturb without any knowledge of the target models.

Motivation & Objective

• Address the limitation of existing adversarial attacks that overfit to source model architectures, reducing black-box transferability.
• Investigate whether perturbing intermediate layers—particularly those with shared, generalizable features—can improve transferability across diverse models.
• Develop a method to select an optimal intermediate layer for attack without requiring evaluation on target models during hyperparameter tuning.
• Demonstrate that targeting high-variance channels within intermediate layers further enhances transferability by disturbing shared information.

Proposed method

• Formulate an iterative optimization objective that maximizes the L2 norm of the activation difference at a specified intermediate layer while preserving the direction of the original perturbation.
• Define the loss function as a weighted sum of normalized perturbation magnitude and cosine similarity to the original perturbation direction, ensuring structural consistency.
• Apply the attack as a fine-tuning step on a pre-existing adversarial example, using iterative gradient updates to refine the perturbation at the chosen layer.
• Extend the method to channel-level targeting by replacing layer outputs with individual channel outputs, enabling selection of the most informative channels for attack.
• Use channel activation variance across the dataset as a proxy to identify high-information channels likely to be shared across models.
• Select the optimal layer for attack using only the source model’s layer disturbance statistics, avoiding costly evaluation on target models during hyperparameter search.

Experimental results

Research questions

• RQ1 Can targeting intermediate layers in a source model improve the black-box transferability of adversarial examples compared to standard attacks that focus on the final layer?
• RQ2 Is there a specific intermediate layer in a model where perturbation leads to greater transferability across diverse target models?
• RQ3 Can the optimal layer for transferability be selected using only the source model’s internal statistics, without requiring evaluation on target models?
• RQ4 Does targeting high-variance channels within intermediate layers further improve transferability by disturbing shared, generalizable features?
• RQ5 How does the direction-preserving component of the ILA loss affect the robustness and transferability of the refined adversarial example?

Key findings

• ILA significantly improves black-box transferability across multiple source-target model combinations, with transfer success rates increasing by up to 10.5 percentage points on average compared to baseline attacks.
• On ResNet18 as the source model, ILA achieved a 55.9% attack success rate on GoogLeNet, compared to 47.3% for standard I-FGSM, demonstrating a 8.6 percentage point improvement.
• When targeting the most informative channels (highest activation variance), adversarial examples generated via ILA achieved a 34.5% attack success rate on GoogLeNet, outperforming lower-variance channel attacks.
• The optimal layer for attack was consistently found to be one where feature representations are still general and shared across models, typically in the middle of the network, not the final layer.
• The method successfully identifies a near-optimal layer for transferability using only the source model’s layer disturbance curves, eliminating the need for target model evaluation during hyperparameter tuning.
• The direction-preserving component of the loss function ensures that the refined adversarial example maintains its original adversarial structure, preventing degradation in performance on the source model.