SlowGuess/NeurIPS_2023_OCR huggingface dataset:
Yang Deng
School of Software Engineering
dengy73@mail2.sysu.edu.cn
Weibin  $\mathbf{W}\mathbf{u}^{*}$
wuwb36@mail.sysu.edu.cn
Jianping Zhang
jpzhang@cse.cuhk.edu.hk
Zibin Zheng
zhzibin@mail.sysu.edu.cn
Deep neural networks (DNNs) are vulnerable to adversarial attacks, which lead to incorrect predictions. In black-box settings, transfer attacks can be conveniently used to generate adversarial examples. However, such examples tend to overfit the specific architecture and feature representations of the source model, resulting in poor attack performance against other target models. To overcome this drawback, we propose a novel model modification-based transfer attack: Blurred-Dilated method (BD) in this paper. In summary, BD works by reducing downsampling while introducing BlurPool and dilated convolutions in the source model. Then BD employs the modified source model to generate adversarial samples. We think that BD can more comprehensively preserve the feature information than the original source model. It thus enables more thorough destruction of the image features, which can improve the transferability of the generated adversarial samples. Extensive experiments on the ImageNet dataset show that adversarial examples generated by BD achieve significantly higher transferability than the state-of-the-art baselines. Besides, BD can be conveniently combined with existing black-box attack techniques to further improve their performance.
In recent years, deep learning has achieved great success in the field of computer vision. Despite the shining achievement, deep neural networks (DNNs) are vulnerable to adversarial attacks [1, 2]. It is easy to deceive deep neural networks into making incorrect predictions by adding small adversarial perturbations to natural images, which are almost imperceptible to the human visual system [3]. This has brought significant security implications with the wide application of deep neural networks [4, 5]. Therefore, to enhance the robustness of deep neural networks, more and more researchers have begun to focus on adversarial attacks and defenses.
Adversarial attacks can be mainly divided into two types: white-box attacks and black-box attacks. In white-box attacks [2, 4, 6], attackers have access to all the information about the target model, such as the model architecture and parameters, so adversarial samples can be directly produced through gradients with a high success rate. However, white-box attacks are often difficult to implement in reality because attackers cannot obtain all the information of the target model. Black-box attacks can overcome this problem. Prevalent black-box attacks can be generally categorized as query-based and transfer-based. This paper mainly focuses on transfer-based black-box attacks, where attackers
utilize a substitute model to craft adversarial samples and apply these samples to attack black-box victim models [7, 8, 9].
However, existing transfer-based black-box attacks can overfit to the source model [10, 11]. As a result, the discrepancies between the substitute model and target models, which stem from their differences in architectures, parameters, and other aspects, may lead to poor attack performance of the generated adversarial examples against the victim models.
Therefore, numerous endeavors have been made to enhance the transferability of transfer-based attacks. The recent prominent techniques can be classified into three categories: gradient optimization, input augmentation, and model modification. Among them, the research direction that particularly interests us is model modification-based attacks. For example, the Intermediate-Level Attack (ILA) [12] and ILA++ [13] generate transferable adversarial examples by attacking intermediate feature maps. Skip Gradient Method (SGM) [14] utilizes skip connections to improve the transferability of adversarial samples. Linear Backpropagation (LinBP) [15] skips some non-linear activation layers during backpropagation. Although these attack techniques narrow the gap between the substitute model and the victim model, the transferability of the generated adversarial examples is still unsatisfactory. Additionally, they mostly focus on modifying the backpropagation of the source model while neglecting its forward propagation.
In this paper, we explore whether modifying the architecture of the source model can enhance the transferability of adversarial attacks. We propose a novel model modification-based transfer attack: Blurred-Dilated method (BD). In short, BD works by reducing downsampling operations while introducing BlurPool [16] and dilated convolutions [17] in the source model. Then BD employs the modified source model to generate adversarial samples. Extensive experiments on the ImageNet dataset confirm that BD can achieve significantly higher transferability than the state-of-the-art baselines.
- We propose a novel model modification-based transfer attack: Blurred-Dilated method (BD). BD reduces downsampling operations and adds BlurPool and dilated convolutions in the original source model. It then employs the modified source model to generate adversarial samples.
- We conducted extensive experiments on the ImageNet dataset to validate the effectiveness of BD. Experimental results confirm that BD can consistently outperform the state-of-the-art benchmarks by a large margin.
- We show that the proposed BD can be conveniently combined with other transfer attacks to further improve their performance.
To enhance the transferability of adversarial attacks, recent techniques can be categorized into three types: gradient optimization, input augmentation, and model modification.
Gradient optimization. The Fast Gradient Sign Method (FGSM) family is the mainstream method in this category. FGSM [2] perturbs a clean example to generate an adversarial example by adding a small perturbation along the direction of the gradient sign, using only one iteration. The Iterative Fast Gradient Sign Method (I-FGSM) [4] and the Projected Gradient Descent method (PGD) [6] are iterative versions of FGSM for constructing adversarial examples. In comparison to FGSM, which only takes a single step along the direction of the gradient sign, these iterative methods deliver better attack performance. Momentum Iterative Method (MI-FGSM) [18] integrates momentum into the gradient at each iteration, allowing previous gradients to guide current updates.
Input augmentation. We briefly introduce some popular transfer attacks in this category. Diverse Input Method (DIM) [19] applies various transformations to input images in each iteration (e.g., random resizing and padding). Scale-Invariant Method (SIM) [20] optimizes perturbations utilizing the input images' scaled copies. In addition, the Translation-Invariant Method (TIM) [21] applies a preset kernel to the gradients with respect to the input images.
Model modification. Due to overfitting to the source model that is used to generate adversarial samples, the current transfer-based attacks usually exhibit limited transferability. Some researchers attempt to enhance the substitute model to improve the attack success rates. Since the decision
boundaries of different DNNs are different, employing an ensemble of source models is the most direct way to achieve this goal [7]. The Ghost Network [22] applies random dropout and skip connection erosion to simulate a large number of source models. However, creating and employing an ensemble of source models is still challenging and computationally expensive. Therefore, more works tend to focus on only one substitute model. Intermediate-Level Attack (ILA) [12] and ILA++ [13] craft transferable adversarial examples by attacking intermediate feature maps. Skip Gradient Method (SGM) [14] discovered that the gradient flow through skip connections can improve the transferability of adversarial samples. Therefore, SGM introduces a decay factor to reduce the gradient of residual modules. Linear Backpropagation (LinBP) [15] skips some non-linear activation layers during backpropagation.
Different from previous model modification-based transfer attacks that mainly focus on backpropagation, our proposed BD considers both backpropagation and forward propagation. Extensive experiments on the ImageNet dataset verify that our proposed method can effectively narrow the gap between the substitute model and the victim models, and thus significantly improve the transferability of the generated adversarial samples. Compared with state-of-the-art model modification-based transfer attacks, our method can also achieve significantly better attack success rates.
In this section, we provide a detailed introduction of our proposed technique. We first introduce our motivation in Section 3.1. Then in Section 3.2, we elucidate BlurPool [16] and dilated convolutions [17], which are the key components in our proposed method. After that, we explain the general strategy of our proposed BD in Section 3.3. Finally, we present the implementation details of BD with popular architectures as examples in Section 3.4.
3.1 Motivation
Based on our preliminary experiments, we observed that: (1) The adversarial samples generated by ResNet [23] usually have better transferability than those generated by other models. We think the reason may be that the skip connections of ResNet connect the lower-layer feature maps to the higher-layer feature maps, which helps to transfer more low-level features and reduce the information loss caused by downsampling. Due to the large resolutions of the raw input images, models need to conduct downsampling multiple times, resulting in a large amount of information loss. Besides, due to the structural differences between models, the discarded features are different. Therefore, preserving more low-level features, as ResNet does, can improve adversarial transferability. (2) On CIFAR-10/100 [24], the adversarial transferability between models is usually better than that on ImageNet [25, 15]. Since the resolutions of the images on CIFAR-10/100 are smaller, there are fewer downsampling in the CIFAR-10/100 models. Therefore, different CIFAR-10/100 models all maintain more common low-level features, making the generated adversarial sample easy to transfer.
Given the above observations, we think that employing a source model that can preserve more low-level features of an image can help to improve adversarial transferability. Such a source model can guide adversarial samples to more thoroughly and precisely destroy the low-level features of a clean image. As a result, the generated adversarial samples are more transferable, since different models all use low-level features to extract high-level semantics and then make predictions. Although downsampling is widely used in various neural networks [26, 23, 27, 28], downsampling will discard feature information [29], which will reduce the details of an image (i.e., the low-level features) during forward propagation and thus hinder the transferability of the generated adversarial examples. Therefore, we propose our Blurred-Dilated method (BD) to modify the source model to preserve more low-level features of an image. As a result, the modified source model can generate more transferable adversarial samples.
3.2 BlurPool and Dilated Convolution
To preserve more low-level features of an image, we need to reduce downsampling in the original source models. To this end, we need to add BlurPool and dilated convolutions to the original source models.
BlurPool. In convolutional neural networks (CNNs), pooling layers or ordinary convolutions with strides greater than 2 would conduct downsampling on the input feature map to reduce the size of the input feature maps and increase the model's receptive field. However, since some features are discarded in the downsampling process, information may be lost. Traditional pooling aggregates all pixels within the window to a single value. In contrast, BlurPool aims to minimize information loss caused by pooling operations via replacing the traditional pooling kernel with a Gaussian kernel. This method enables more detailed weighted averaging over features within the pooling window, while improving shift-invariance. Specifically, when using a Gaussian kernel (we adopt  $4 \times 4$  to follow the previous work [16]), BlurPool applies a Gaussian-weighted function to the neighborhood area around each feature for convolution calculation, and obtains a weighted average result. To further reduce the result's feature map spatial size, common downsampling strategies (such as using a large stride) are typically applied. Compared to the traditional pooling operations of simply selecting the maximum/average value within the window, BlurPool operations that use Gaussian-weighted averages can better preserve the relative positions and spatial relationships between features, thus alleviating the problem of information loss caused by pooling operations. BlurPool can be combined not only with pooling but also with strided-convolutions.
Dilated convolution. Traditional convolution operations only consider the point-wise product between the convolution kernel and the input. When using a dilated convolution, each specified position in the convolution kernel expands outward by a fixed number that is determined by the dilation rate. It enables the convolution kernel to process feature maps with a larger range of information while maintaining the same kernel size. In this way, by increasing the dilation rate, a larger receptive field can be obtained, and a wider range of image features can be captured. Dilated convolution captures more contextual information and improves the ability of models to handle high-resolution images. In traditional CNNs, as the resolution of the input image increases, the number of layers usually needs to increase accordingly. However, this leads to a larger model size and higher computational costs. By using dilated convolutions, a larger receptive field can be achieved without increasing the model size. Therefore, it can better process high-resolution images.
3.3 General Strategy
If we remove all downsampling operations, the dimension of image features will maintain vast, making the forward and backward computations too expensive to complete. Therefore, we adopt an "early stop" strategy for downsampling operations, which only retains downsampling in the early layers of the source model. In our experiments, we usually retain half of the downsampling operations in the original source model. This prevents losing too much low-level feature information and allows CNNs to consider the low-level feature information when generating adversarial samples. To further reduce the loss of feature information caused by downsampling, we modify the downsampling operations in the early layers of the source model with BlurPool as follows:
MaxPool  $\rightarrow$  MaxBlurPool: For max-pooling with a stride of  $s$ , it is changed into two parts: max-pooling with a stride of 1 and BlurPool with a stride of  $s$ .
Conv  $\rightarrow$  ConvBlurPool: For convolutions with a stride of  $s$  followed by the ReLU activation function, it is changed into two steps: convolutions with a stride of 1 followed by the ReLU activation function and then BlurPool with a stride of  $s$ .
AveragePool  $\rightarrow$  BlurPool: For average pooling with a stride of  $s$ , it is changed to BlurPool with a stride of  $s$ .
We then abandon the downsampling operations in the later layers of the source model. As a result of removing downsampling operations, the feature map size will increase, which reduces the receptive fields of subsequent layers and decreases the amount of context information each neuron has for making predictions [30]. Since contextual information is crucial for resolving ambiguities in local clues [31], this decrease in the receptive field is an undesired trade-off. Therefore, we use dilated convolutions to increase the receptive fields of higher layers, which compensates for the reduction in receptive fields caused by the removal of downsampling operations. This allows the modified source model to have the same or an even larger receptive field compared to the original model. In this way, the modified model can have a global understanding of the image, which enables it to generate adversarial perturbations that are more transferable.
Table 1: The structural details of Blurred-Dilated ResNet-50 (BD RN50).
Layer Name	Output Size	Configuration
conv1	112×112	7×7 conv, 64, s=1 BlurPool, s=2
pooling	56×56	2×2 maxpool, s=1 BlurPool, s=2
conv2 (×3)	56×56	1×1 conv, 64 3×3 conv, 64 1×1 conv, 256
conv3 (×4)	28×28	1×1 conv, 128 3×3 conv, 128 (BlurPool when s=2) 1×1 conv, 512
conv4 (×6)	28×28	1×1 conv, 256 3×3 conv, 256, dr=2 1×1 conv, 1024
conv5 (×3)	28×28	1×1 conv, 512 3×3 conv, 512, dr=2 1×1 conv, 2048
classification	1×1	global average pool
1000-d	FC-1000 softmax
Table 2: The structural details of Blurred-Dilated DenseNet-121 (BD DN121).
Layer Name	Output Size	Configuration
conv	112×112	7×7 conv, s=1 BlurPool, s=2
pooling	56×56	3×3 maxpool, s=1 BlurPool, s=2
dense layer1 (×6)	56×56	1×1 conv 3×3 conv
transition layer1	56×56	1×1 conv
28×28	BlurPool, s=2
dense layer2 (×12)	28×28	1×1 conv 3×3 conv
transition layer2	28×28	1×1 conv
dense layer3 (×24)	28×28	1×1 conv 3×3 conv, dr=2
transition layer3	28×28	1×1 conv
dense layer4 (×16)	28×28	1×1 conv 3×3 conv, dr=2
classification	1×1	global average pool
1000-d	FC-1000 softmax
Finally, we fine-tune the modified BD model on its original training set to alleviate the accuracy drop caused by model modification. We employ the resultant BD models to generate adversarial samples to conduct transfer attacks.
3.4 BD Implementation Details
Our proposed BD can be conveniently applied to popular CNNs. Different source models may have slight differences in performing model modification. Therefore, we present the implementation details of BD with four popular architectures as examples in this section. In Tables 1-4,  $s$  means the stride,  $dr$  means the dilation rate, and BlurPool adopts a Gaussian kernel size of 4 and a stride of 2.
Blurred-Dilated ResNet-50. We apply our proposed BD to ResNet-50 [23] to obtain the Blurred-Dilated ResNet-50 (BD RN50). Table 1 shows the structural details of BD RN50. Specifically, we modify the first three downsampling operations with BlurPool. That is, for the first downsampling operation, we change the stride of the  $7 \times 7$  convolution from 2 to 1, and then add a BlurPool layer. For the second downsampling operation, we change the stride of MaxPool from 2 to 1, and then add a BlurPool layer. For the third downsampling operation, we change the stride of conv3_1 from 2 to 1, and then add a BlurPool layer. At the same time, we remove downsampling operations in the subsequent layers to maintain the feature map size at  $28 \times 28$ . As shown in Table 1, dilated convolutions with a dilation rate of 2 are introduced in conv4 and conv5, respectively, except for conv4_1 and conv5_1.
Blurred-Dilated DenseNet-121. We apply our proposed BD to DenseNet-121 [27] to obtain the Blurred-Dilated DenseNet-121 (BD DN121). Table 2 shows the structural details of BD DN121. Specifically, we modify the first three downsampling operations with BlurPool. That is, we change the stride of the  $7 \times 7$  convolution from 2 to 1, and then add a BlurPool layer. We change the stride of the  $3 \times 3$  MaxPool from 2 to 1, and then add a BlurPool layer. We replace the first  $2 \times 2$  average pool with a BlurPool layer. Furthermore, we remove the average pool in the last two transition layers. Similar to ResNet-50, dilated convolutions with a dilation rate of 2 are added to the final two groups of dense blocks as shown in Table 2, except for dense layer3_1 and dense layer4_1.
Blurred-Dilated VGG16. We apply our proposed BD to VGG16 [26] to obtain the Blurred-Dilated VGG16 (BD VGG16). Table 3 shows the structural details of BD VGG16. Specifically, the first three
Table 3: The structural details of Blurred-Dilated VGG16 (BD VGG16).
Layer Name	Output Size	Configuration
conv0(x2)	224×224	3×3 conv, 64
pooling1	112×112	2×2 maxpool, s=1 BlurPool, s=2
conv1(x2)	112×112	3×3 conv, 128
pooling2	56×56	2×2 maxpool, s=1 BlurPool, s=2
conv2(x3)	56×56	3×3 conv, 256
pooling3	28×28	2×2 maxpool, s=1 BlurPool, s=2
conv3(x3)	28×28	3×3 conv, 512, dr=2
conv4(x3)	28×28	3×3 conv, 512, dr=2
classification	7×7	global average pool
1000-d	FC-4096
FC-4096
FC-1000
softmax
Table 4: The structural details of Blurred-Dilated MobileNetV2 (BD MobV2).  $t$  means the expansion factor.  $c$  means the channel number.
Layer Name	Output Size	Configuration	t	c
conv1	112×112	3×3 conv, s=1 BlurPool, s=2	-	32
bottleneck1 (×1)	112×112	1×1 conv 3×3 dwise 1×1 conv	1	16
bottleneck2 (×2)	56×56	1×1 conv 3×3 dwise (BlurPool when s=2) 1×1 conv	6	24
bottleneck3 (×3)	28×28	1×1 conv 3×3 dwise (BlurPool when s=2) 1×1 conv	6	32
bottleneck4 (×4)	28×28	1×1 conv 3×3 dwise 1×1 conv	6	64
bottleneck5 (×3)	28×28	1×1 conv 3×3 dwise, dr=2 1×1 conv	6	96
bottleneck6 (×3)	28×28	1×1 conv 3×3 dwise, dr=2 1×1 conv	6	160
bottleneck7 (×1)	28×28	1×1 conv 3×3 dwise 1×1 conv	6	320
conv2	28×28	1×1 conv	-	1280
classification	1×1	global average pool	-	-
1000-d	FC-1000 softmax	-	-
MaxPool layers are replaced with MaxBlurPool. That is, the stride of the MaxPool layers is changed to 1, followed by a BlurPool layer with a Gaussian kernel size of 4 and a stride of 2. Downsampling layers in the later stages are also removed to retain the feature map's size at  $28 \times 28$ . Finally, as shown in Table 3, the last two groups of standard convolutions layers are replaced with dilated convolutions having a dilation rate of 2, except for conv3_1.
Blurred-Dilated MobileNetV2. We apply our proposed BD to MobileNetV2 [28] to obtain the Blurred-Dilated MobileNetV2 (BD MobV2). Table 4 shows the structural details of BD MobV2. Specifically, we stop downsampling when the feature map size reaches  $28 \times 28$ . To this end, in the bottlenecks of the original model that execute downsampling operations, we change the stride from 2 to 1. Moreover, for the first three convolutional downsampling operations, we change the stride of the convolution to 1 followed by a BlurPool layer. As shown in Table 4, dilated convolutions with a dilation rate of 2 are introduced in bottleneck5 and bottleneck6, except for bottleneck5_1 and bottleneck6_1.
Section 4.1 details our experimental settings. In our experiments, we first verify the effectiveness of our proposed method in Section 4.2. Then in Section 4.3, we compare our proposed method with the state-of-the-art baselines. After that, we combine our proposed BD with other transfer attacks to further validate the effectiveness of our proposed method in improving adversarial transferability in Section 4.4. Finally, we conduct ablation studies to further analyze our proposed method in Section 4.5.