[Paper Review] Understanding and Enhancing the Transferability of Adversarial Examples

Lei Wu, Zhanxing Zhu+2 more|arXiv (Cornell University)|Feb 27, 2018

Adversarial Robustness in Machine Learning24 references95 citations

TL;DR

The paper analyzes how model-specific factors and loss-surface smoothness affect adversarial example transferability, and proposes a variance-reduced gradient attack to boost transferability across models and architectures.

ABSTRACT

State-of-the-art deep neural networks are known to be vulnerable to adversarial examples, formed by applying small but malicious perturbations to the original inputs. Moreover, the perturbations can extit{transfer across models}: adversarial examples generated for a specific model will often mislead other unseen models. Consequently the adversary can leverage it to attack deployed systems without any query, which severely hinder the application of deep learning, especially in the areas where security is crucial. In this work, we systematically study how two classes of factors that might influence the transferability of adversarial examples. One is about model-specific factors, including network architecture, model capacity and test accuracy. The other is the local smoothness of loss function for constructing adversarial examples. Based on these understanding, a simple but effective strategy is proposed to enhance transferability. We call it variance-reduced attack, since it utilizes the variance-reduced gradient to generate adversarial example. The effectiveness is confirmed by a variety of experiments on both CIFAR-10 and ImageNet datasets.

Motivation & Objective

• Investigate how architecture, test accuracy, and capacity of source models influence adversarial transferability.
• Examine how local smoothness of the loss function impacts transferable perturbations.
• Propose and evaluate a variance-reduced attack to improve cross-model transferability.

Proposed method

• Study transferability across architectures (ResNet, DenseNet, VGG) on ImageNet and other datasets.
• Analyze role of model capacity and accuracy in transferability via FGSM/IGSM attacks.
• Introduce loss-smoothing via convolutional (Gaussian) smoothing of the loss to derive a transferable gradient G_sigma.
• Define and implement variance-reduced iterative gradient sign method (vr-IGSM) and variance-reduced FGSM (vr-FGSM).
• Evaluate attacks in white-box, black-box, and ensemble settings on CIFAR-10 and ImageNet.

Experimental results

Research questions

• RQ1 How do source model architecture, capacity, and accuracy affect the transferability of adversarial examples to unseen target models?
• RQ2 How does local non-smoothness of the loss surface influence transferability, and can smoothing improve it?
• RQ3 Can a variance-reduced (smoothed) gradient attack improve cross-model transferability, including ensemble and momentum-based methods?

Key findings

• Transferability is asymmetric between source and target models and is higher between models with similar architectures.
• Multi-step attacks are generally more transferable, though behavior varies by architecture.
• Higher accuracy and smaller model depth (not just larger capacity) tend to yield stronger transferability, with deeper models sometimes producing less transferable adversaries.
• Smoothing the loss landscape via local gradient averaging (G_sigma) increases transferability compared with raw gradients (g_A).
• Variance-reduced attacks (vr-IGSM, vr-FGSM) significantly improve transferability across single-model and ensemble-based settings, including substantial gains on ImageNet.
• Variance-reduced attacks remain effective when combined with momentum-based methods and ensemble approaches.