SlowGuess/NeurIPS_2023_OCR huggingface dataset:
Table 5: The attack success rates of adversarial samples generated by different source models, with MI-FGSM as the optimization algorithm. The best results are in bold.
Source Model	ε	RN50	IncV3	IncV4	IncRes	SE154	VGG19	DN201	PNASNet	Average
RN50	16/255	100%	67.0%	57.1%	54.5%	69.2%	82.8%	88.3%	63.7%	72.8%
8/255	100%	44.9%	37.1%	30.3%	47.6%	63.3%	73.3%	39.3%	54.5%
4/255	100%	22.9%	19.0%	10.6%	25.5%	43.8%	47.4%	17.9%	35.9%
BD RN50	16/255	99.9%	93.6%	93.8%	91.7%	95.1%	97.2%	99.1%	96.4%	95.9%
8/255	99.8%	80.1%	79.7%	74.6%	83.7%	91.2%	95.0%	81.0%	85.6%
4/255	99.5%	49.8%	47.7%	41.8%	58.1%	71.7%	75.9%	52.9%	62.2%
VGG16	16/255	79.6%	67.0%	69.7%	55.6%	69.5%	99.5%	70.0%	71.4%	72.8%
8/255	58.9%	41.0%	43.2%	28.0%	44.9%	98.1%	46.0%	44.0%	50.5%
4/255	35.5%	21.6%	21.7%	11.4%	23.9%	92.0%	27.2%	22.2%	31.9%
BD VGG16	16/255	92.0%	82.0%	84.1%	73.5%	86.3%	99.8%	87.3%	86.3%	86.4%
8/255	78.6%	58.8%	63.5%	46.0%	64.7%	99.0%	65.5%	66.4%	67.8%
4/255	51.3%	31.6%	34.9%	18.9%	34.7%	95.7%	39.0%	33.1%	42.4%
DN121	16/255	90.3%	71.7%	63.8%	60.2%	73.3%	85.0%	95.3%	69.7%	76.2%
8/255	77.0%	45.3%	42.9%	33.5%	49.7%	64.0%	84.2%	42.9%	54.9%
4/255	52.6%	26.3%	21.6%	12.1%	25.7%	43.4%	62.3%	20.2%	33.0%
BD DN121	16/255	96.4%	84.5%	82.0%	76.4%	87.5%	94.3%	97.3%	87.7%	88.3%
8/255	86.7%	63.4%	59.0%	50.1%	66.6%	80.6%	89.5%	65.1%	70.1%
4/255	64.3%	36.3%	35.3%	21.6%	37.2%	59.5%	68.8%	35.6%	44.8%
MobV2	16/255	76.6%	58.3%	49.9%	44.0%	59.2%	84.4%	68.4%	49.1%	61.2%
8/255	54.4%	36.1%	30.4%	20.8%	38.0%	63.7%	47.6%	26.2%	39.7%
4/255	33.8%	21.5%	17.1%	7.7%	18.3%	43.6%	27.1%	14.1%	22.9%
BD MobV2	16/255	89.8%	82.7%	76.8%	69.5%	79.4%	95.0%	87.9%	76.9%	82.3%
8/255	70.7%	60.1%	55.8%	44.6%	53.7%	81.7%	67.1%	51.5%	60.7%
4/255	42.4%	32.6%	30.0%	18.2%	27.6%	59.5%	39.5%	24.6%	34.3%
Datasets. Consistent with the previous works [18, 21], we use the ImageNet-compatible dataset in the NIPS 2017 adversarial competition [32] as the test set to generate adversarial samples. This dataset contains 1000 images with a resolution of  $299 \times 299 \times 3$ . After modifying source models with our BD, we fine-tune the modified source models with the ImageNet training set [25] to recover their classification accuracy.
Source and target models. For source models, we choose one model from each of the ResNet [23], VGG [26], DenseNet [27], and MobileNet [28] families, i.e., ResNet-50 (RN50), VGG16, DenseNet-121 (DN121), and MobileNetV2 (MobV2). For comparisons with the state-of-the-art techniques, we follow their choice to use RN50 as the source model. For target models, we select popular models following previous works [13, 14, 15], including VGG19 [26], Inception-v3 (IncV3) [33], Inception-v4 (IncV4) [34], SENet154 (SE154) [35], ResNet-50 (RN50) [23], DenseNet-201 (DN201) [27], Inception-ResNet-v2 (IncRes) [34], and PNASNet [36]. We use open-source pretrained models that are collected from torchvision $^{1}$  and a GitHub repository $^{2}$ .
Compared baselines. To validate the superiority of our proposed method, we compare it with the state-of-the-art model modification-based transfer attacks, including LinBP [15], ILA [12], and ILA++ [13].
Parameter settings. Whenever the size of the images does not match the model's input size, we resize the images to the input size of the model. We mainly focus on untargeted attacks under the  $l_{\infty}$  constraint. We set the maximum perturbation  $\epsilon$  to three different values: 16/255, 8/255, and 4/255.
$^{1}$ https://github.com/pytorch/vision/tree/main/torchvision/models
$^{2}$ https://github.com/Cadene/pretrained-models.pytorch
Table 6: The attack success rates of different transfer attacks, with MI-FGSM as the optimization algorithm and ResNet-50 as the source model. "Average" presents the average attack success rates against black-box models, i.e., all target models except ResNet-50. The best results are in bold.
Method	ε	RN50	IncV3	IncV4	IncRes	SE154	VGG19	DN201	PNASNet	Average
ILA	16/255	99.9%	73.8%	69.3%	68.1%	80.8%	91.0%	92.0%	73.6%	78.4%
8/255	100%	47.8%	43.0%	38.2%	53.7%	74.5%	72.7%	42.5%	53.2%
4/255	100%	24.5%	21.7%	13.7%	29.5%	49.6%	49.8%	20.4%	29.9%
ILA++	16/255	100%	76.3%	75.5%	71.1%	82.8%	94.3%	94.1%	79.7%	82.0%
8/255	100%	51.6%	51.5%	44.1%	61.2%	79.4%	82.1%	54.9%	60.7%
4/255	100%	28.1%	26.2%	18.4%	36.0%	57.5%	59.0%	25.7%	35.8%
LinBP	16/255	100%	81.4%	78.7%	73.3%	85.7%	94.8%	96.9%	78.9%	84.2%
8/255	100%	54.4%	52.1%	43.8%	60.8%	81.3%	81.2%	49.3%	60.4%
4/255	99.9%	30.0%	25.1%	16.1%	33.0%	59.4%	54.9%	21.5%	34.3%
BD (Ours)	16/255	99.9%	93.6%	93.8%	91.7%	95.1%	97.2%	99.1%	96.4%	95.3%
8/255	99.8%	80.1%	79.7%	74.6%	83.7%	91.2%	95.0%	81.0%	83.6%
4/255	99.5%	49.8%	47.7%	41.8%	58.1%	71.7%	75.9%	52.9%	56.8%
Table 7: The attack success rates of different combined methods, with MI-FGSM as the optimization algorithm and ResNet-50 as the source model. "Average" presents the average attack success rates against black-box models, i.e., all target models except ResNet-50. The maximum perturbation  $\epsilon = 16/255$ . The best results are in bold.
Method	RN50	IncV3	IncV4	IncRes	SE154	VGG19	DN201	PNASNet	Average
ILA	99.9%	73.8%	69.3%	68.1%	80.8%	91.0%	92.0%	73.6%	78.4%
BD+ILA	99.9%	95.0%	94.2%	94.2%	96.6%	99.1%	99.1%	95.6%	96.3%
LinBP	100%	81.4%	78.7%	73.3%	85.7%	94.8%	96.9%	78.9%	84.2%
BD+LinBP	100%	96.6%	95.9%	95.2%	97.7%	99.4%	99.4%	96.7%	97.3%
ILA+LinBP	100%	85.2%	84.9%	80.5%	89.0%	97.7%	97.7%	85.8%	88.7%
BD+ILA+LinBP	100%	97.6%	97.2%	96.0%	97.9%	99.4%	99.5%	97.5%	97.9%
The step size  $\alpha$  is set to 2/255 when  $\epsilon = 16 / 255$ , and 1/255 when  $\epsilon = 8 / 255$  or 4/255. For MI-FGSM, we set the decay factor  $\mu = 1.0$ . The iteration number  $T = 10$ . ILA/ILA++ runs 10 iterations after 10 iterations' baseline attacks. For competitors, we adopt their official implementations. The parameter settings for the combined attacks are the same. All experiments were performed with an NVIDIA V100 GPU.
4.2 The Effectiveness of BD
Table 5 reports the attack performance of our method against different models. As we can see, when the source model is modified with our BD, the transferability of the generated adversarial samples is greatly improved across all source models. Specifically, our method improves the average attack success rates across all target models by  $10.5\% -31.1\%$ . Notably, when the maximum perturbation is 16, the lowest adversarial transferability from ResNet-50 to target models is  $54.5\%$ . Our proposed BD increases it to  $91.7\%$ , which is an increase of  $37.2\%$ . The experimental results confirm the effectiveness of our proposed BD in generating highly transferable adversarial samples with different source models.
4.3 Comparisons with the Baselines
Table 6 reports the attack success rate of our BD and all the competitors against the target models, with MI-FGSM as the optimization algorithm and ResNet-50 as the source model. It can be seen that our proposed BD significantly outperforms the state-of-the-art model modification-based transfer attacks across all target models at different levels of perturbation budgets. Specifically, in the black-box scenarios, we achieve an average attack success rate of  $95.3\%$ ,  $83.6\%$ , and  $56.8\%$ , under  $\epsilon = 16/255$ ,  $8/255$ , and  $4/255$ , respectively. In contrast, the state-of-the-art baselines have the highest average
Table 8: The attack success rates of different BD variants, with MI-FGSM as the optimization algorithm and ResNet-50 as the source model. "Average" presents the average attack success rates against black-box models, i.e., all target models except ResNet-50. The maximum perturbation  $\epsilon = 16/255$ . The best results are in bold.
BD Variants	RN50	IncV3	IncV4	IncRes	SE154	VGG19	DN201	PNASNet	Average
BD w/ BlurPool only	99.6%	80.6%	78.3%	76.0%	87.8%	93.9%	94.3%	87.1%	85.4%
BD w/ dilated conv only	99.8%	66.4%	58.6%	56.4%	72.9%	83.8%	84.7%	66.3%	69.9%
BD	100%	87.9%	86.8%	84.2%	93.5%	95.3%	98.0%	91.5%	91.0%
Table 9: The attack success rates on the CIFAR-10 and CIFAR-100 datasets, with MI-FGSM as the optimization algorithm. The best results are in bold.
Dataset	Source Model	ε	WRN	ResNeXt	VGG19	DN-BC	Average
CIFAR-10	RN20	16/255	95.1%	96.0%	96.1%	93.5%	95.2%
8/255	79.1%	83.3%	78.4%	76.5%	79.3%
4/255	48.7%	54.0%	43.3%	46.3%	48.1%
BD RN20	16/255	97.3%	97.8%	97.6%	96.0%	97.2%
8/255	84.7%	88.0%	82.4%	82.1%	84.3%
4/255	54.7%	60.8%	47.0%	51.8%	53.6%
CIFAR-100	RN56	16/255	95.4%	94.4%	94.3%	93.3%	94.4%
8/255	82.3%	80.5%	82.2%	78.8%	81.0%
4/255	60.4%	58.5%	61.8%	57.3%	59.5%
BD RN56	16/255	97.2%	96.8%	96.1%	96.0%	96.5%
8/255	87.1%	85.6%	85.0%	85.2%	85.7%
4/255	66.0%	64.5%	64.9%	64.1%	64.9%
attack success rates of only  $84.2\%$ ,  $60.7\%$ , and  $35.8\%$  under the same settings, respectively. In the white-box setting, since BD ResNet-50 is different from the original ResNet-50, and we use BD ResNet-50 to generate adversarial samples, the attack success rates are slightly lower than  $100\%$ . However, we note that the performance drop is negligible.
4.4 Combining with Existing Methods
Since our BD preserves the core architecture of the source model, it can be combined with previous transfer attacks such as LinBP and ILA. The results are presented in Table 7, with MI-FGSM as the optimization algorithm and ResNet-50 as the source model. We can see that our BD can significantly further promote the transferability of adversarial samples when combined with other transfer attacks. Specifically, BD significantly improves the black-box attack success rates of ILA and LinBP by an average of  $17.9\%$  and  $13.1\%$ , respectively. When combining BD with ILA and LinBP in the black-box settings, the average attack success rate can reach  $97.9\%$ , and the lowest attack success rate can be increased to  $96.0\%$ , compared to only  $80.5\%$  achieved by combining ILA and LinBP.
4.5 Further Analysis
To verify the contribution of each component in BD, we conduct an ablation study by removing the BlurPool component and the dilated convolution component from BD, respectively. Table 8 reports the attack success rates, with MI-FGSM as the optimization algorithm and ResNet-50 as the source model. The maximum perturbation is set to 16/255. We can see that the removal of the BlurPool component and the removal of the dilated convolution component lead to a decrease in black-box attack performance by  $21.1\%$  and  $5.6\%$  on average, respectively. These results suggest that BlurPool and dilated convolutions both contribute to improving adversarial transferability, which validate the design of our method.
Besides, we perform experiments on datasets with lower resolution. Following previous efforts [15, 13], we choose the CIFAR-10 and CIFAR-100 datasets [24], which consist of 60000 images
from 10 and 100 classes, respectively. They are both officially divided into a training set of 50000 images and a test set of 10000 images. We use their test sets to generate adversarial samples and their training sets to fine-tune the modified BD model. We choose ResNet-20 (RN20) and ResNet-56 (RN56) [23] as the source models for the CIFAR-10 and CIFAR-100 datasets, respectively. For target models, we choose widely applied DNN models, including Wide Residual Network (the WRN-28-10 version) [37], ResNeXt-29 [38], VGG19 [26], and DenseNet-BC (DN-BC) [27]. We use open-source pretrained models that are collected from a GitHub repository<sup>3</sup>.
Table 9 presents the results. We can see that our method can still consistently improve the adversarial transferability of the source model by a large margin, which confirms that our method is also effective on datasets with lower resolution.
In this paper, we propose a novel model modification-based transfer attack: Blurred-Dilated method (BD). BD reduces downsampling operations and adds BlurPool and dilated convolutions in the original source model. It then employs the modified source model to generate adversarial samples. Extensive experiments on the ImageNet dataset validate that BD can be conveniently applied to different popular source models to generate highly transferable adversarial examples. Our proposed method can also obtain significantly better adversarial transferability than the state-of-the-art baselines. Besides, our method can be conveniently combined with other transfer attacks to further improve their performance.
Limitations and future work. Our proposed model modification method is mainly based on domain knowledge and empiricism. Therefore, although there is a general strategy, it still requires manual trial and error to attain the final model structures that can generate highly transferable adversarial samples. Moreover, the final model structure that we obtain is only the optimal one among the candidate structures that we consider in this work. We leave it to future work to automate the search for model structures that can manufacture highly transferable adversarial examples. Our work also mainly focuses on CNN models that have convolutional and pooling layers. We plan to extend our method to more non-CNN models, like Vision Transformers [39] in the future work.
Broader impacts. Our work not only offers a new way to effectively evaluate the robustness of deep learning models, but also provides further insights into the relationship between model structures and adversarial transferability. Additionally, our work calls the attention of both researchers and practitioners to this new security issue. We believe that our method can be utilized to generate more transferable adversarial samples for adversarial training, which can better improve the robustness of a model.
The authors are grateful to the anonymous reviewers for their valuable comments and suggestions, which helped to improve this paper. This work was supported by the National Natural Science Foundation of China (Grant No. 62206318).
[1] Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. Intriguing properties of neural networks. In International Conference on Learning Representations, 2014.
[2] Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. In International Conference on Learning Representations, 2015.
[3] Weibin Wu, Yuxin Su, Xixian Chen, Shenglin Zhao, Irwin King, Michael R Lyu, and Yu-Wing Tai. Towards global explanations of convolutional neural networks with concept attribution. In IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 8652-8661, 2020.
<sup>3</sup>https://github.com/bearpaw/pytorch-classification