Enhancing the Transferability of Adversarial Examples via a Few Queries and Fuzzy Domain Eliminating
Authors: Xiangyuan Yang
Jie Lin
hanlin Zhang
Xinyu Yang
Peng Zhao
Venue: Submitted to ICLR 2023 (2023)
Keywords: adversarial examples
transferability
deep neural network

Abstract: Due to the vulnerability of deep neural networks, the black-box attack has drawn great attention from the community. Though transferable priors decrease the query number of the black-box query attacks in recent efforts, the average number of queries is still larger than 100, which is easily affected by the number of queries limit policy. In this work, we propose a novel method called query prior-based method to enhance the attack transferability of the family of fast gradient sign methods by using a few queries. Specifically, for the untargeted attack, we find that the successful attacked adversarial examples prefer to be classified as the wrong categories with higher probability by the victim model. Therefore, the weighted augmented cross-entropy loss is proposed to reduce the gradient angle between the surrogate model and the victim model for enhancing the transferability of the adversarial examples. In addition, the fuzzy domain eliminating technique is proposed to avoid the generated adversarial examples getting stuck in the local optimum. Specifically, we define the fuzzy domain of the input example $x$ in the $\epsilon$-ball of $x$. Then, temperature scaling and fuzzy scaling are utilized to eliminate the fuzzy domain for enhancing the transferability of the generated adversarial examples. Theoretical analysis and extensive experiments demonstrate that our method could significantly improve the transferability of gradient-based adversarial attacks on CIFAR10/100 and ImageNet and outperform the black-box query attack with the same few queries.

Under review as a conference paper at ICLR 2023
ENHANCING THE TRANSFERABILITY OF ADVERSAR- IAL EXAMPLES VIA A FEW QUERIES AND FUZZY Do- MAIN ELIMINATING
Anonymous authors Paper under double-blee blind review
ABSTRACT
Due to the vulnerability of deep neural networks, the black-box attack has drawn great attention from the community. Though transferable priors decrease the query number of the black-box query attacks recent efforts, the average number queries is still larger than 100, which is casily affected by the query number limit policy. In this work, we propose a novel method called query prior- based method enhance the attack transferability of the family of fast gradient sign methods by using a few queries. Specifically, for the untargeted attack, we find that the successful attacked adversarial examples prefer be classified as the wrong cat- egories with higher probability by the victim model. Therefore, the weighted augmented cross-entropy loss is proposed the surrogate model and the victim model for enhancing the transferability of the adversarial examples. In addition, the fuzzy domain eliminating technique pro- posed to avoid the generated adversarial examples getting stuck in the local op- timum. Specifically, we define the fuzzy domain of the input example x the e-ball of x. Then, temperature scaling and fuzzy scaling are utilized to eliminate the fuzzy domain for enhancing the transferability the generated adversarial examples. Theoretical analysis and extensive experiments demonstrate that method could significantly improve the transferability of gradient- based adversar- ial attacks CIFAR10/100 and ImageNet and outperform the black-bo box query attack with the same few queries.
reduce the gradient angle between
INTRODUCTION
Deep Neural Network (DNN) has penetrated many aspects of life, e.g. autonomous cars, face recog- nition and malware detection. However, the imperceptible perturbations fool the DNN to make wrong decision, which is dangerous in the field of security and will cause significant economic losses. To evaluate and increase the robustness of DNN, the advanced adversarial attack methods need to be researched. In recent years, the white-box attacks make a great success and the black- box attacks make great progress. However, because of the weak transfcrability (with the low attack strength) and the large number of queries, the black-box attacks can still be further improved.
Recently, a number of transferable prior-based black-box query attacks have been proposed to reduce the number of queries. For example, Cheng et al. (2019) proposed prior-guided random gradient- free (P-RGF) method, which takes the advantage of a transfer-based prior and the query information simultaneously. Yang et al. (2020) also proposed simple baseline approach (SimBA++), which combines transferability-base
and query-based black-box attacks, and utilized the query feedback to update the surrogate model in a novel learning scheme. However, the average query number of the most query attacks is larger than 100 in the evaluations ImageNet. In this scenario, the performance of these query attacks may be significantly affected when the query number limit policy applied in the DNN application.
Besides, many black- box transfer attacks have been proposed to enhance the transferability of the adversarial examples, e.g. fast gradient sign method (FGSM) (Goodfellow et al.] 2015), iterative FGSM (I-FGSM) (Kurakin et al. 2017). momentum I-FGSM (MI-FGSM) (Dong et al. 2018). di- verse input I-FGSM (DI-FGSM) (ie et 2019), scale-invariant Nesterov I-FGSM (SI-NI-FGSM)

---

Under review as a conference paper at ICLR 2023
Lin et al. 2020) and variance-tuning MI-FGSM (VMI-FGSM) (Wang & He 2021). Zhang et al. 2022a) also proposed the relative cross-entropy loss (RCE) to enhance the transferability by maxi- mizing the logit's 's rank distance from the ground-truth class. However, these transfer attacks achieve weak transferability of adversarial examples under the constraint of low attack strength.
Therefore, to solve the above problems, we make the following contributions:
First, propose the query prior-baseds attacks to enhance the transferability of adversarial examples with few queries under the constraint of low attack strength. Specifically, we find that: (i) The better the transferability of the transfer black-box attack, the smaller the gra- dient angle between the surrogate model and the victim model. (ii) The successful attacked adversarial examples prefer to be classified as the wrong categories with higher probabil- ity by the victim model. Based on the aforementioned findings, the weighted augmented cross-entropy (WACE) loss proposed decrease the gradient angle between the surro- gate model and the victim model for enhancing the transferability of adversarial examples, which is proved in Appendices [A.4 and (A.5 The proposed query prior- prior-based method en- hances the transferability of the l'amily of FGSMs by integrating the WACE loss and a few queries (this contribution is described detail in Appendix C..
Second, when the query prior is not achieved, the fuzzy domain eliminating technique is used to enhance the transferability of adversarial examples. Specifically, we explore the effectiveness of the temperature scaling in eliminating the fuzzy domain and propose the fuzzy scaling to eliminate the fuzzy domain. By combining the temperature scaling and fuzzy scaling, fuzzy domain eliminating based cross-entropy (FECE) loss is proposed to enhance the transferability of the generated adversarial examples. In addition, the weighted augmented fuzzy domain eliminating based cross-entropy (WFCE) loss, which consists of the WACE and FECE loss, can further enhance the transferability of adversarial examples.
Third, theoretical analysis and extensive experiments demonstrate that: (i) On the premise of allowing query, the WACE loss better than cross-entropy (CE) and RCE losses. (ii) The temperature scaling and fuzzy scaling can effectively eliminate part of the fuzzy domain. (iii) Under the constraint of low attack strength, the query prior-based method and fuzzy domain eliminating technique can significantly improve the attack transferability of the family of fast gradient sign methods on CIFAR10/100 (Krizhevsky) 2009) and ImageNet (Russakovsky et al. 2015).
PRELIMINARIES
The family of FGSMs and the RCE loss are briefly introduced, which is helpful to understand our methods in Section and is regarded as the baselines in Section 4
2.1 FAMILY OF FAST GRADIENT SIGN METHODS
The methods mentioned in this section are referred as the black-box transfer attacks with the objec- tive of enhancing the transferability of adversarial examples.
Fast gradient sign method (FGSM) (Goodfellow et al. 2015) is the first transfer attack, which generates the adversarial examples add by maximizing the loss function L(x yoo 0) with step update:
ade x e sign (V L (xx, yo: 0))
where e the attack strength, yo is the ground truth, is the model parameters, sign(-) is the sign function and V (z, yo: 8) is the gradient of the loss function w.r.t.
Iterative FGSM (IFFGSM) (Kurakin et al. 2017) is the iterative version of FGSM by applying FGSM with small step size:
To = x, ode = Clips {agth + aa. sign (Va T. (oode yoo 0))
(2)
where Clips function restricts the generated adversarial examples to be within the e-ball of st.
2

---

Under review as a conference paper at ICLR 2023
Momentum I-FGSM (MI-FGSM) (Dong al., 2018) integrates the momentum into I-FGSM to escape from the poor local maxima and enhance the transferability of adversarial examples:
Va L (xgde Uo: 0)
gt+1 = p. St + V La (Igd0, yoo 0) |1
ade r++1
Clipf {xgdd sign (gt+1)}
where 9t is the accumulated gradient at iteration 6, and μ is the decay factor of gr-
Diverse inputs I-FGSM (DI-FGSM) (Xie et al. 2019) applies random transformations Tr(-) to the input images each iteration with probability p instead of only using the original images to generate adversarial examples.
Scale-invariant Nesterov I-FGSM (SI-NI-FGSM) (Lin al. 2020) integrates Nesterov Acceler- ated Gradient (NAG) into I-FGSM to leverage the looking ahead property of NAG, i.c. substitutes at Eq. with 4t 2:ddv + a μ 9t, and build a robust adversarial attack. Due to the scale-invariant property of DNN, the scale-invariant attack method is also proposed to optimize the adversarial perturbations over the scale copies of the input images.
Variance tuning MI-FGSM (VMI-FGSM) (Wang & He, 2021 further considered the gradient variance to stabilize the update direction and escape from the poor local maxima instead directly using the current gradient for the momentum accumulation:
VoL (xgdo, No: 0) + Ut
G++1 = 1 9t +
(4)
VaL (xgdu y0: + velli
1 N :=1 VoL (Itt ade yo: - VoL (zado Yo: 0) odo It+
(5)
Cliys, (a-d a sign (g++1)}
where ve+11 is the gradient variance as the t-th iteration, x zadv +rs Ti UI-(B-e)', (B-e)d) and U [a", ba] stands for the uniform distribution in d dimensions and / is a hyperparameter.
2.2 RELATIVE CROSS-ENTROPY (RCE) LOSS
To escape from the poor local maxima, RCE loss (Zhang al., 2022a) is new normalized CE loss that guides the logit to be updated in the direction of implicitly maximizing its rank distance from the ground-truth class:
Softmar(zi) = Ez:
(6)
Σ
etc
Le Mo: log Soflmar(zz).
C Σ c=l - LCE(#, Vc
LaCE(Z, Vo: = LCg( No: 0)
where is the logit of the ground truth label you C is the number of category, Ye is the category with index c. Note that, Proposition exxllains the effectiveness the RCE loss from the perspective of domain fuzzy eliminating in the targeted transfer attacks.
METHODOLOGG
In this section, the motivation is introduced first. Then, the weighted augmented cross-entropy (WACE) loss proposed and corresponding theoretical analysis described. By combining the WACE loss with few queries, our query prior-based method is mentioned. The fuzzy domain eliminating based cross-entropy (FECE) loss is proposed and its thcoretical analysis is described. Finally, By combining the advantages of the WACE and FECE losses, the WFCE loss is proposed.
3.1
MOTIVATION
First, though the transferable baser black-bor query attacks (Cheng et al. 2019 Yang et al. significantly reduce the query number, the average number of queries still larger than 100.
2020
3

---

Under review as a conference paper at ICLR 2023
Algorithm Query prior-based VMI-FGSM (QVMI-FGSM)
The surrogate model with parameters 0y: the victim model h with parameters 0,: the WACE loss Lw ACE; an example z with ground truth label yo: the magnitude of perturbation e; the number of iteration T and decay factor μi; the factor for the upper bound of neighborhood and the number of example N for variance tuning; the maximum number of queries Q and number of the wrong top-n categories ñ. Output: An adversarial example z.dv.
Input:
a = e/T
90 0g 0; 0
for -= 0
do
Query the logit output of the victim model:
h (xede) QSQ2T
1 (zgde), iSQ <T <TAEE [ - Q-1]
Zn
(9)
Zno if < TAtE
1 - ,
Calculate the gradient g++1 V. Lw ACE (2gdu, yo: Oz, Zi. n) Update g++1 by variance tuning-based momentum:
V LLWWACE (zzdo, yo: f, Zn, πi) + 1t
g++1 ge. gt +
V LWACE (x7de, yo: O Zn n2) + well
Update 11+1 by sampling N examples in the neighborhood of æ:
Σ
N V "LLwAGE (1 Voi f Zn, 7) - V Lw ACE (2qdu, Yoi f,, Zn n.)
1
1=
N
Update 2441 by applying the sign of gradient 2041 = Clips {agdu + sign (g++1)}
end for x ado aadv return add
The performance of these query attacks may be greatly affected by the query number limit policy of the DNN applications. On the contrary, we can use the results of a few queries as the priors to enhance the transferability of the black-box transferable attacks. Specifically, we find the preference of the attacked victim model (i.e., Proposition Then novel black-bor transfer attack is designed to achieve higher transferability through the combination of the preference and the results of a few queries. Note that the detailed motivation described in Appendix D
Second, common phenomenon occurs in the black-box transfer attacks: under the same attack strength, with the increase the attack strength, the attack success rate (ASR) of the white-box at- tacks fastly converges 100%, but the ASR of the black-box transfer attacks is slowly approaching 100%. This phenomenon shows that there a fuzzy domain between the surrogate model and the victim model for the black-box attacks. The fuzzy domain is locally optimal region where the generated adversarial examples make the surrogate model wrong but the victim model still correct. Therefore, the fuzzy domain eliminating technique can enhance the transferability of the black-box transfer attacks. In this paper, the temperature scaling and fuzzy scaling are used to eliminate the fuzzy domain.
3.2 WEIGHTED AUGMENTED CROSS-ENTROPY LOSS
In this section, we first introduce the characteristics and preference of the victim model, and then propose the WACE loss based the preference and give the theoretical analysis.
For the iterative gradient-based attacks, let f and h denote the surrogate model and the victim model, respectively. We use 8, and 0n to denote the parameters of the surrogate model and the victim model. respectively. In the following, Definitions and are mentioned to define the gradient angle between f and h. and the top-n wrong categories and the top-n wrong categories attack success rate
4

---

Under review as a conference paper at ICLR 2023
(ASR) respectively, which are used in the introduction and Proofs of Propositions [nd to analyze the preference of the victim model. Propositions I and are proved in Appendices A.I and A.2
Definition (Gradient angle between the surrogate model and the victim model) For the 1-th itera- lion udversarial example sede of the surrogate model J. the angle between V Laxtd v :Y6s 0y) and V Tiat Voo 0%) is the gradient angle between f and h at iteration t.
Proposition 1 When the step size or is small, the better the transferability of the transfer black-box attack, the smaller the gradient angle between the surrogate model and the victim model.
Definition 2 (Top-n wrong categories and top-n wrong categories attack success rate (ASR)) For the example (x, Mo). if the output of the victim model l is h(x), the top-n wrong categories are n. number of categories with the largest value in h(x)) except the ground truth yo: which is denoted as {y=, j 6 R.. The top-n wrong categories ASR denotes the accuracy of the adversarial example z classified as the wrong category in the top-n wrong categories.
Proposition 2 When the victim model h is attacked by the white-box gradient-based attacks, the successful attacked adversarial examples prefer to be classified as the wrong categories with higher probability (i.e. the top-n wrong categories {y-, li & (.)). Meanwhile, the higher the probability of the wrong category, the more likely the adversarial example is to be classified as this category.
Therefore, according to Propositions I and 2 (the details in Appendix A.3)) for the untargeted attack, the weighted augmented CE (WACE) loss is proposed to enhance the transferability of the adver- sarial examples. Besides maximizing the loss function Ler(= Yo: fy), the WACE loss also minimizes the loss function LeE(x"do Uy: where Vr. belongs the top-n wrong categories {yz,i < n):
1 Σn n
LWACE (z, Zn. n. LoE (C
Yoi 01)
w; LOB (2,)).00))
(10)
W; 2==11 e.hirs
(11)
where Z, h(x) = [ Fh,2. =,.c] is the query logit output of the victim model h to x; is the number of the top-n wrong categories. Note that Σ wi = and the higher the logit value of the wrong category, the larger the weight wt.
According to Proposition D the following Theorem I verified that the transferability of the transfer black-box attack based on the WACE loss is better than that based on the RCE and CE losses. Theorem iis proved in Appendices (..4diiee//A4aadAAA..
Theorem The angle between ALEWAAEEIR Yoi Noi Zn, 7) and V VoLCE(27 Yoi 0n.) less than the angle between V VELRGE (aqdu yoi 0f) and V V.LCE Moo 0r), and the angle between VoLCE yo: fy) and V LCE (zqdu yoi 0)).
Propositions and 2 and Theorem [ are the theoretical analysis of the WACE loss, which explained the high transferability of the WACE loss-based attacks.
3.3 QUERY -RSSE ATTACKS
The family of fast gradient sign methods in Section 2.1 uses the CE loss. However, on the premise of allowing a few queries, the CE loss is replaced by the WACE loss in the family of fast gradient sign methods. Therefore, VMI-FGSM (Wang & He. 202T) is transformed into query prior-based VMI-FGSM, namely QVMI- which described in Algorithm in detail. Specifically, two changes are made, compared with VMI-FGSM algorithm. First, the CE loss is replaced by our WACE loss. Second, according to Eq. g the maximum number of queries Q is greater than or equal to the number of attack iteration T. QVMI-FGSM queries the logit output of the victim model at each iteration, otherwise, QVMI-FGSM starts from O and performs equidistant query with [ as the interval.
Similarly. FGSM (Goodfellow et al. 2015), I-FGSM (Kurakin et al. 2017). MI- DDogg al. 2018). DI-FGSM (Xie et al., 2019) and SI-NI-FGSM (Lin et al. 2020) are transformed into Q- FGSM, QI-FGSM, QMI-FGSM, QDI-FGSM and QSI-NI-FGSM by combining the query priors
5

---

Under review as a conference paper at ICLR 2023
3.4 FUZZY DOMAIN ELIMINATING BASED CROSS-ENTRONT LOSS
In this section, we first define the fuzzy domain in the untargeted attacks and targeted attacks, re- spectively. Then, the temperature scaling and fuzzy scaling are introduced. Finally, the FECE loss is proposed based on these two scaling techniques and gives the theoretical analysis.
In Definitions and 4 p is a probability threshold identify whether the adversarial example à is locally optimal, and are respectively the wrong category with the highest probability and the target category, and Pa and p- are their corresponding probability in the probability vector of the adversarial example å predicted by the surrogate model f. respectively. The ground truth of x is yo-
Definition 3 (The Fuzzy Domain in the untargeted attacks) In the spherical neighborhood B (xx, c) with the input as the center and as the radius, the subdomain containing the local optimal region < p}. On the contrary, the subdomain of the surrogate model I is A.s,- 14,-(0 (p) = {ā| E B (x,e) A pa
without the local optimal region f (p) B (z. cz A..- (p) = { & E B (x, c) A Pe e p}. For the victim model h, in the domain B (a. e). the subdomain with correct classification is BA, {ā]ā B (I, e) org max h (i) = you. and the subdomain with wrong classification is {álâ E B (x. <) A arg max h (Ø) & Yo Therefore, in the domain B (I, the fuzzy domain in the untargeted attacks (i.e., M... (2...)) where NT represents the non- targeted altacks) is the region that makes the surrogate model fall into the local optimum and the victim model classification correct:
BA = B ( - BB,+
(Z.AA.) Pas, (D)
(12)
Definition 4 (The Fuzzy Domain in the targeted attacks) In the spherical neighborhood B (xr, c) with the input the center and as the radius, the subdomain containing the local optimal region of the surrogate model f is As,.- (p) = { E BB (zx Apr < <). On the contrary, the subdomain without the local optimal region A f (p) B (2,+) A (p) = { B (ax,) Apr 2 p}. For the victim model h, in the domain B (z, e). the subdomain classified as the target category is }. and the subdomain classified as other categories
Bb,+ { E B (z, E) arg max h is BR,- = B (xx,c) B = {ālé E B (z, e) A arg max h (f) F Ur}. Therefore, in the domain B (I,,)) c), the fuzzy domain in the targeted attacks (i.e., MTa (3.5.) where Ta represents the targeted attacks) is the region that makes the surrogate model fall into the local optimum and is classified as other categories by the victim model:
(2, -.a.. (p) BB.
(13)
The recent researches (Dong et al. 2018 Xie et al. 2019 Lin al. 2020 Wang He 2021 are
trying to avoid stucking into the local optimum of the generated adversarial examples and make progress on the transferability. Therefore, the local optimal region in J closely related to B in the untargeted attacks and Br,- in the targeted attacks.
Assumption Because the local optimal region in As,- is closely related to Br,+ in the untar- geted attacks and B,,- in the targeted attacks, eliminating the domain A can achieve the task of eliminating the fuzzy domain MNT
(x.f.h) or MiTa
(x.f.h)
Based on Assumption [ the temperature scaling and fuzzy scaling are used to eliminate A The temperature scaling was firstly proposed by HHitonn et al. (2015) on knowledge distillation. The fuzzy scaling uses penalty parameter K. to apply to the logit of the correct category in the untargeted attacks (KC > 1) or the logit of the target category in the targeted attacks (0 < IC < 1). By combining the temperature scaling and fuzzy scaling, the fuzzy domain climinating based cross- entropy (FECE) loss is proposed for the untargeted attacks:
kiooT
Ni Lanee e i=
FESoftmaz (K)
(14)
K. knento sa/ 1 1
LFECE (a, yo: 0 T.K. = --l--llg- log FFSSoftaa (2o: KK)
(15)
where T is the temperature parameter in the temperature scaling (T 1), FESoftmax is fuzzy domain eliminating based Softmax. For the targeted attacks, the ground truth category y. replaces
yr in Equations [4] and 15

---

Under review as a conference paper at ICLR 2023
Based Assumption Propositions and prove that the temperature scaling (T > 1 and K. 1) can eliminate a part of the fuzzy domain in the untargeted attacks and targeted attacks, respectively. climinate part of the fuzzy domain in the untargeted attacks (7 1 and K > 1) and targeted attacks (T = and 0 < K 1) respectively.
Propositions [5] and [6 prove that the fuzzy scaling
Note that Propositions 3 and proved in Appendix [A.
Proposition 3 In the untargeted attacks, when p 0.5, the temperature scaling (T 1 and K. 1) can eliminate part of the fuzzy domain M (2.f.h)
Proposition 4 In the targeted attacks, when 0.5, the temperature scaling (T > 1 and K. 1) can eliminate part of the fuzzy domain (z.f.)
Proposition 5 In the untargeted attacks, the fuezy scaling (T and K. 1) can eliminate part of the fuzzy domain M. (N.
Proposition 6 In the targeted attacks, the fuzzy scaling (T and 0 < K. < 1) can eliminate part of the fuzzy domain MTaa
3.5 WEIGHTED AUGMENTED FUZZY DOMAIN ELIMINATING BASED CROSS-ENTROPE LOSS
To combine the advantages of the WACE and FECE losses, the weighted augmented fuzzy domain eliminating based cross-entropy (WFCE) loss is proposed:
LWFCE (z, Yo: f,, ZE. R. T,K)
-n i=l wi LFEOE (2, yos f, T,K)
LEEGE (Z, Noi T,K)
(16)
4 EXPERIMENTS
To validate the effectiveness of the proposed query prior-based attacks and the fuzzy domain elimi- nating technique, we conduct extensive experiments on CIFARIO/100 (Krizhevsky) 2009) and Im- ageNet (Russakovsky al. 2015). The detailed experimental setup is described in Appendix B.] and all experimental results show in Appendix B this section, we compare our method with com- petitive baselines under various experimental settings. Experimental results demonstrate that method can significantly improve the transferability of the baselines. Finally, we provide further investigation on hyper-parameters ñ and Q used for the query prior-based attacks, and and K. used for the FECE loss based transfer attacks. The detailed experimental analysis is shown in Ap- pendix B All experiments are run on single machine with four GeForce RTX 2080tis and the deep learning framework is Pytorch.
4.1 COMPARISON WITH OR WITHOUT THE QUERY PRIORS ON THE UNTARGETED ATTACKS
and when the attack strength e 8/255, in comparison with different loss functions (the CE and RCE losses), the query prsor- attacks with the WACE loss can not only significantly improve the transfer attack success rate of the black-box setting but also improve the attack success rate of the white-box setting on different surrogate models and datasets.
Attacking naturally trained model. As shown in Tables I
Attacking an adversarially trained model. As shown in Tables 3 and 9 in comparison with differ- loss functions (the CE and RCE losses), the query prior- based attacks with the WACE loss can enhance the transferability of the gradient iterative-basee attacks when attacking the adversarially trained model and the attack strength 8/255 on different surrogate models.
Attacking the other models. VMI-FGSM is selected as the baseline to compare the transferabilitty to the other models where a surrogate model and query model are used to generate adversarial examples to attack many other models. As shown in Tables 13 [4
15 T6 17 and [8] when the
attack strength e = 8/255, in comparison with different loss functions (the CE and RCE losses), the query brser-based VMI-FGSM with the WACE loss can enhance the transferability of the generated adversarial examples on different surrogate models, query models and datasets (except for the case of the RCE loss in Table 16).
7

---

Under review as a conference paper at ICLR 2023
4.2 COMPARISON WITH OR WITHOUT THE FUZZY DOMAIN ELIMINATING TECHNIQUE ON THE UNTARGETED ATTACKS
Attacking a naturally trained model. As shown in Tables and in comparison with different loss functions (the CE and RCE losses), our FECE loss can significantly enhance the transferability of the gradient iterative-based attacks when attacking the naturally trained model and the attack strength = 8/2 8/255 on different datasets (IFARTO/110) Table 3 shows that our FECE loss can enhance the transferability of the latest gradient iterative-based attacks.
Attacking an adversarially trained model. As shown Table 3 in comparison with different loss functions (the CE and RCE losses), our FECE Ioss can enhance the transferability of VMI- FGSM and keep (or slightly decrease) the transferability of the other attacks when attacking the adversarially trained model on ImageNet.
Combination of the query priors and fuzzy domain eliminating technique in the untargeted when attacking the naturally trained model, in comparison with our WACE and FECE losses, our WFCE loss can further improve the transferability of the gradient iterative-based attacks on different datasets.
attacks. As shown in Tables I 2 and 3
4.3 COMPARISON WITH CURRENT BLACK- -AX QUERY ATTACKS ON THE UNTARGETED ATTACKS
8 and when the attack strength 8/255 and the allowed query number Q = 10, the attack success rate of our QVMI-FGSM is much larger than that of Square and PRGF when attacking the naturally trained model and adversarially trained model on different surrogate models and datasets (except for ImageNet with VGG16 as the surrogate model to attack the adversarially trained models when compared with Square).
As shown in Tables 2
4.4 ABLATION STUDY ON THE UNTARGETED ATTACKS
Different numbers of the top-n wrong categories ñ and the query number Q. Figures 5 and o resppectvvlly evaluate the effect of different ñ and Q the attack success rates of five naturally trained victim models and two adversarially trained victim models when these victim models are attacked by QI-FGSM (e = 8/ 3/55 with VGGI6 for CIFAR10/100 and ImageNet. As shown in Figure 5 when ň is greater than a certain threshold, the attack success rate will not be improved. As shown in Figure 6 the more the query, the greater the attack success rate.
Different sizes of the penalty parameter X. and the temperature T. Figures 9 and respectivvy evaluate the effect of different K and T on the attack success rates of ResNet50 to VGG16 using various transfer attacks for CIFAR CIFAR10/100 1//100 and ImageNet. As shown in Figure 9 with the increase of K, the attack success rates of the gradient iterative-based attacks are significantly increased on CIFAR10 except for SI-NI-FGSM. Complementarily, as shown in Figure [0] with the increase of T, the attack success rate of the SI-NI-FGSM increased on CIFAR 10, the attack success rates of all gradient iterative-based attacks significantly increased on CIFAR and the attack suc- cess rates of the latest gradient iterative-based attacks (MI-FGSM, SI-NI-FGSM and VMI-FGSM) increased by reasonable T on ImageNet. Figure [T further explores the optimal parameter combinations of IC and T on different datasets, which are summarized in Table
4.5 COMPARISON WITH OR WITHOUT THE FUZZY DOMAIN ELIMINATING TECHNIQUE ON THE TARGETED ATTACKS
slightly decreasing IC from can slightly increase the targeted attack success rates of several gradient iterative- based attacks CIFARI0/100. As shown in Figure 13 with the increase of the T. the targeted attack success rates of almost all the FECE (K = 1) based attacks increased and close to that of the RCE based attckk (Propositions 4 and 7 explain the result).
As shown in Figure 12
8

---

Under review as a conference paper at ICLR 2023
5
RELATED WORK
5.1 ADVERSARIAL. ATTACKS
Black-box Transfer Attacks are divided into five categories, i.e. feature destruction-based attacks, gradient generation-based attacks, data augmentation-baase attacks, model ensemble-based attacks, model specific- attacks, respectively. The feature destruction- based attacks (Wu et al. 2020b
Inkawhich et al. 2019; 2020; Huang et al.) 2019 Zhang et al., 2022b] Zhou al. [018 Ganeshan
et al.j 2019; Wang et al. 202 enhance the transferability of adversarial examples by destroying
the features the intermediate layers or critical neurons. The gradient generation- based attacks (Li
et al. 2020a] Guo et al.] 2020; Xie et al. [0099] Gao et al. [2020] [in et al.] 2020) Dong et al.) 2018]
Han et al. 2022 Wang & He| He][202]] 2021) enhance the transferability of adversarial examples by changing the way of gradient generation. The data augmentation-bast
attacks (Wang et al.) 202 Li et al.,
2020b Zou et al. 2020 Huang et al. (202I) ) increase the input diversity to enhance the transferability of adversrrial examples. The model ensemble-base based attacks (Liu et al.] [2017] Li et al.
2020c Xiong
et al. 2021 use the common attention of various models to enhance the transferability of adversarial
examples. The model specific-based attacks (Wu et al. (2200)) use the high transferability of some structures to enhance the transferability of adversarial examples, c.g. skip connection.
Black-box Query Attacks are divided into two categories, i.e., pure query attacks and transferable prior-based query attacks. The pure query attacks (Chen et al. 2017 Andriushchenko et al. 2020 Zhang et al. 2020) estimate the gradient or update the attack optimization model by querying the output of the victim model. Recently, Zhang et al. (2020) utilized the feedback knowledge not only to craft adversarial examples but also to alter the searching directions to achieve efficient attacks.
The transferable prior-based query attacks (Cheng et al. 2019)) Yang et al. [020] Tashiro et al.) 2020) use the prior knowledge of the surrogate model to decrease the query number. Recently, [Tashiro decently.[Tashiro (020) proposed Output Diversified Sampling to maximize diversity in the target model's outputs among the generated samples.
al.)
5.2 ADVERSARIAL DEFENSES
Adversarial training Madry et al. 2018 Zhang et al., 2019; Wong et al. 2020 Pang et al. 2021
is the most effective method defend against adversarial examples. Recently, Zhang et al. (019) designed a new defense method to trade off the adversarial robustness against accuracy. Wong eet al. (2020) discovered that adversarial training can use a much weaker and cheaper adversary, an approach that was previously believed to be ineffective, rendering the method no more costly than standard training in practice. |Pan et al. (20TT) investigated the effects of mostly overlooked training tricks and hyperparameters for the adversarially trained models.
CONCLUSION
Though transferable priors decrease the query number of the black-box query attacks, the average number of queries is still larger than 100, which is easily affected by the number of queries limit policy. On the contrary, we can utilize the priors of a few queries to enhance the transferabiliity of the transfer attacks. In this work, we propose the query prior-based method to enhance the transferability of the family of FGSMs. Specifically, we find that: (i) The better the transferability of the transfer attack, the smaller the gradient angle between the surrogate model and the victim model. (ii) The successful attacked adversarial examples prefer to be classified as the wrong categories with higher probability by the victim model. Based on the above findings, the weighted augmented cross- entropy (WACE) loss is proposed to decrease the gradient angle between the surrogate model and the victim model for enhancing the transferability of adversarial examples. In addition, because the existence of the fuzzy domain makes it difficult to transfer the adversarial examples generated by the surrogate model to the victim model, the fuzzy domain eliminating technique, which consists of the fuzzy scaling and the temperature scaling, is proposed to enhance the transferability of the generated adversarial examples. Theoretical analysis and extensive experiments demonstrate the effectiveness of the query prior-based attacks and fuzzy domain eliminating technique.

---

Under review as a conference paper at ICLR 2023
ETHICS STATEMENT
We do not anticipate any negative ethical implications of the proposed method. The datasets (CI- PAR1O/100 and ImageNet) used in this paper are publicly available and frequently used in the do- main of computer vision. The proposed method is beneficial to the development of Al security.
REPRODUCIBILITY STATEMENT
Appendix B.I introduces the details experimental setup, including datasets, models, baselines and hyper-parameters. Most baselines are implemented in a popular pytorch repository Kim (2020)
Python implementation of this paper and all baselines are available the supplementary materials.
REFERENCES
Maksym Andriushchenko. Francesco Croce, Nicolas Flammarion, and Matthias Hein. Square at- tack: A query-efficieet black-box adversarial attack via random search. In Computer Vision ECCV 2020 16th European Conference, Glasgow, UK, August 23-28, 2020, Proceedings, Part XXIII, volume 12368 of Lecture Notes in Computer Science, pp. 484-501. Springer, 2020.
Pin- Yu Chen, Huan Zhang, Yash Sharma, Jinfeng Yi, and Cho-Jui Hsieh. ZOO: zeroth order op- timization based black-box attacks to deep neural networks without training substitute models. In Proceedings of the 10th ACM Workshop Artificial Intelligence and Security, AlSec@ CCS 2017, Dallas, TX, USA, November 3, 2017, pp. 15-26. ACM, 2017.
Shuyu Cheng, Yinpeng Dong, Tianyu Pang, Hang Su, and Jun Zhu. Improving black-box adversarial attacks with a transfer-based prior. In Advances in Neural Information Processing Systems 32: Annual Conference on Neural Information Processing Systems 2019, NeurIPS 2019, December 8-14, 2019, Vancouver, BC, Canada, pp. 10932-10944 2019.
Ambra Demontis, Marco Melis, Maura Pintor, Matthew Jagielski, Battista Biggio, Alina Oprea, Cristina Nita-Rotaru, and Fabio Roli. Why do adversarial attacks transfer? explaining transfer- ability of evasion and poisoning attacks. USENIX Security Symposium, pp. 321-338. USENIX Association, 2019.
Yinpeng Dong, Fangzhou Liao, Tianyu Pang. Hang Su, Jun Zhu, Xiaolin Hu, and Jianguo Li. Boost- ing adversarial attacks with momentum. In 2018 IEEE Conference on Computer Vision and Pattern Recognition, CVPR 2018, Salt Lake City, UT, USA, June 18-22, 2018, pp. 9185-9193. Computer Vision Foundation IEEE Computer Society, 2018
Aditya Ganeshan, Vivek B. S., and Venkatesh Babu Radhakrishnan. FDA: feature disruptive at- tack. In 2019 IEENCVE International Conference on Computer Vision, ICCV 2019, Seoul, Korea (South), October 27 November 2, 2019, pp. 8068-8078 IEEE, 2019.
Lianli Gao, Qilong Zhang, Jingkuan Song, Xianglong Liu, and Heng Tao Shen. Patch-wise attack for fooling deep neural network. In Computer Vision ECCV 2020 16th European Conference, Glasgow, UK, August 23-28, 2020, Proceedings, Part XXVIII, volume 12373 of Lecture Notes in Springer, 2020.
Computer Science, pp.
Ian J. Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. In 3rd International Conference on Learning Representations, ICLR 2015, San Diego, CA, USA, May 7-9, 2015, Conference Track Proceedings, 2015.
Yiwen Guo, Qizhang Li, and Hao Chen. Backpropagating linearly improves transferability of adver- sarial examples. In Advances in Neural Information Processing Systems 33: Annual Conference on Neural Information Processing Systems 2020, NeurIPS 2020, December 6-12, 2020, virtual, 2020.
Xu Han, Anmin Liu, Yifeng Xiong, Yanbo Fan, and Kun He. Sampling- fast gradient rescaling method for highly transferable adversarial attacks. CoRR, abs/2204.02887,. 2022.
10

---

Under review as a conference paper at ICLR 2023
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recog- nition. In 2016 IEEE Conference on Computer Vision and Pattern Recognition, CVPR 2016, Las Vegas, NV, USA, June 27-30, 2016, pp. 770-778. IEEE Computer Society, 2016.
Geoffrey E. Hinton, Oriol Vinyals, and Jeffrey Dean. Distilling the knowledge in neural network. CoRR, abs/1503.0253 2015.
Gao Huang, Zhuang Liu, Laurens van der Maaten, and Kilian Q Weinberger. Densely connected convolutional networks. In 2017 IEEE Conference on Computer Vision and Puttern Recognition, CVPR 2017, Honolulu, HI, USA, July 21-26, 2017, pp. 2261-2269, IEEE Computer Society,
2017.
Howard Huang. torchvision.models. httpps//pproocd..oo/////al///sss html 2017.
Qian Huang, Isay Katsman, Zeqi Gu, Horace He, Serge J. Belongie, and Ser-Nam Lim. Enhancing adversarial example transferability with an intermediate level attack. In 2019 IEEE/CVF Interna- tional Conference on Computer Vision, ICCV 2019, Seoul, Korea (South), October 27 November 2, 2019, pp. 4732-4741. IEEE, 2019.
Tianjin Huang, Vlado Menkovski, Yulong Pei, Yuhao Wang, and Mykola Pechenizkiy, Direction- aggregated attack for transferable adversarial examples. CoRR, abs/2104.09172 2021.
Nathan Inkawhich, Wei Wen, Hai (Helen) Li, and Yiran Chen. Feature space perturbations yield more transferable adversarial examples. In IEEE Conference on Computer Vision and Pattern Recognition, CVPR 2019, Long Beach, CA, USA, June 16-20, 2019, pp. 7066-7074, Computer Vision Foundation IEEE, 2019.
Nathan Inkawhich, Kevin J. Liang, Binghui Wang, Matthew Inkawhich, Lawrence Carin, and Yiran Chen. Perturbing across the feature hierarchy to improve standard and strict blackbox attack transferabilityy In Advances in Neural Information Processing Systems 33: Annual Conference Neural Information Processing Systems 2020, NeurlPS 2020, December 6-12, 2020, virtual, 2020.
Hoki Kim. Torchattacks: A pytorch repository for adversarial attacks. arXiv:2010.01950, 2020.
arXiv preprint
Alex Krizhevsky. Learning multiple layers of features from tiny images. 2009.
Alexey Kurakin, lan J. Goodfellow, and Samy Bengio. Adversarial examples in the physical world. In Sth International Conference on Learning Representations, ICLR 2017, Toulon, France, April 26-26, 2017, Workshop Track Proceedings. OpenReview.net, 2017.
Qizhang Li, Yiwen Guo, and Hao Chen. Yet another intermeciate-level attack. In Computer Vision ECCV 2020 16th European Conference, Glasgow, UK, August 23-28, 2020, Proceedings, Part XVI, volume 12361 of Lecture Notes in Computer Science, pp. 241-257, Springer, 2020a.
Yingwei Li, Song Bai, Cihang Xie, Zhenyu Liao, Xiaohui Shen, and Alan L. Yuille. Regional homogeneity: Towards learning transferable universal adversarial perturbations against defenses. In Computer Vision ECCV 2020 16th European Conference, Glasgow, UK, August 23-28, 2020, Proceedings, Part XI, volume 12356 Lecture Notes in Computer Science, pp. 795-813. Springer, 2020b.
Yingwei Li, Song Bai, Yuyin Zhou, Cihang Xie, Zhishuai Zhang, and Alan L. Yuille. Learning transferable adversarial examples via ghost networks. In The Thirty-Fourth AAAI Conference on Artificial Intelligence, AAAI 2020, The Thirty-Second Innovative Applications of Artificial Intelligence Conference, IAAI 2020, The Tenth AAAI Symposium on Educational Advances in Artificial Intelligence, EAAI 2020, New York, NY, USA, February 7-12, 2020, pp. 11458-11465. AAAI Press, 2020c.
Jiadong Lin, Chuanbiao Song, Kun He, Liwei Wang, and John E. Hoperoft. Nesterov accelerated gradient and scale invariance for adversarial attacks. In 8th International Conference on Learning Representations, ICLR 2020, Addis Ababa, Ethiopia, April 26-30, 2020. OpenReview.net, 2020.
11

---

Under review as a conference paper at ICLR 2023
Yanpei Liu, Xinyun Chen, Chang Liu, and Dawn Song. Delving into transferable adversarial exam- ples and black-box attacks. In 5th International Conference on Learning Representations, ICLR 2017, Toulon, France, April 24-26, 2017, Conference Track Proceedings. OpenReview.net, 2017.
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. To- wards deep learning models resistant to adversarial attacks. In 6th International Conference on Learning Representations, ICLR 2018, Vancouver, BC, Canada, April 30 May 3, 2018, Confer- ence Track Proceedings. OpenReview.net, 2018.
Tianyu Pang, Xiao Yang. Yinpeng Dong, Hang Su, and Jun Zhu. Bag of tricks for adversarial training. In 9th International Conference on Learning Representations, ICLR 2021, Virtual Event, Austria, May 3-7, 2021. OpenReview.net, 2021.
Olga Russakovsky, Jia Deng. Hao Su, Jonathan Krause, Sanjeev Satheesh, Sean Ma, Zhiheng Huang, Andrej Karpathy, Aditya Khosla, Michael S. Bernstein, Alexander C. Berg, and Li Fei- Fei. Imagenet large scale visual recognition challenge. Int. J. Comput. Vis., 11(3)2211-252, 2015.
Mark Sandler, Andrew G. Howard, Menglong Zhu, Andrey Zhmoginov, and Liang-Chieh Chieh Chen. Mobilenetv2: Inverted residuals and linear bottlenecks. In 2018 IEEE Conference on Computer Vision and Puttern Recognition, CVPR 2018, Salt Lake City, UT, USA, June 18-22, 2018, pp- 4510-4520. Computer Vision Foundation TEEE Computer Society, 2018
Karen Simonyan and Andrew Zisserman. Very deep convolutional networks for large-scale im- age recognition. In 3rd International Conference on Learning Representations, ICLR 2015, San Diego CA, USA, May 7-9, 2015, Conference Track Proceedings, 2015.
Christian Szegedy, Vincent Vanhoucke, Sergey loffe, Jonathon Shlens, and Zhigniew Wojna. Re- thinking the inception architecture for computer vision. In 2016 IEEE Conference on Computer Vision and Pattern Recognition, CVPR 2016, Las Vegas, NV, USA, June 27-30, 2016, pp. 2818- 2826. IEEE Computer Society, 2016.
Yusuke Tashiro, Yang Song, and Stefano Ermon. Diversity can be transferred: Output diversification for white- and black-box attacks. In Advances Neural Information Processing Systems 33: Annual Conference Neural Information Processing Systems 2020, NeurIPS 2020, December 6-12, 2020, virtual, 2020.
Florian Tramèr, Alexey Kurakin, Nicolas Papernot, Ian J. Goodfellow, Dan Boneh, and Patrick D. McDaniel. Ensemble adversarial training: Attacks and defenses. In 6th International Confer- ence on Learning Representations, ICLR 2018, Vancouver, BC, Canada, April 30 May 3, 2018, Conference Track Proceedings. OpenReview.net, 2018.
Xiaosen Wang and Kun He. Enhancing the transferability of adversarial attacks through variance tuning. In IEEE Conference on Computer Vision and Pattern Recognition, CVPR 2021, virtual, June 19-25, 2021, pp. 1924-1933. Computer Vision Foundation IEEE, 2021.
Xiaosen Wang, Xuanran He, Jingdong Wang, and Kun He. Admix: Enhancing the transferability of adversarial attacks. In 202/ IEEE/CVF International Conference on Computer Vision, ICCV 2021, Montreal, QC, Canada, October 10-17, 2021, pp. 16138-16147, IEEE, 2021a.
Zhibo Wang, Hengchang Guo, Zhifei Zhang, Wenxin Liu, Zhan Qin, and Kui Ren. Feature importance-aware transferable adversarial attacks. In 2021 IEEE/CVF International Conference on Computer Vision, ICCV 2021, Montreal, QC, Canada, October 10-17, 2021, pp. 7619-7628. IEEE, 2021b.
Ross Wightman. Pytorch image models. vytorch-imagg--e model 2019.
httpss//ggithbb..cmm//mwgggggg.
Eric Wong, Leslie Rice, and J. Zico Kolter. Fast better than free: Revisiting adversarial training. In 8th International Conference on Learning Representations, ICLR 2020, Addis Ababa, Ethiopia, April 26-30, 2020. OpenReview.net, 2020.
12

---

Under review as a conference paper at ICLR 2023
Dongxian Wu, Yisen Wang. Shu-Tao Xia, James Bailey, and Xingjun Ma. Skip connections mat- ter: On the transferability of adversarial examples generated with resnets. In 8th International Conference on Learning Representations, ICLR 2020, Addis Ababa, Ethiopia, April 26-30, 2020. OpenReview.net, 2020a.
Weibin Wu, Yuxin Su, Xixian Chen, Shenglin Zhao, Irwin King. Michael R. Lyu, and Yu-Wing Tai. Boosting the transferability of adversarial samples via attention. In 2020 IEEE/CVE Conference Computer Vision and Pattern Recognition, CVPR 2020, Seattle, WA, USA, June 13-19, 2020, pp. 1158-1167. Computer Vision Foundation IEEE, 2020b.
Cihang Xie, Zhishuai Zhang, Yuyin Zhou, Song Bai. Jianyu Wang, Zhou Ren, and Alan L. Yuille. Improving transferability of adversarial examples with input diversity. In IEEE Conference on Computer Vision and Pattern Recognition, CVPR 2019, Long Beach, CA, USA, June 16-20, 2019, pp. 2730-2739. Computer Vision Foundation IEEE, 2019.
Saining Xie, Ross B. Girshick, Piotr Dollár, Zhuowen Tu, and Kaiming He. Aggregated residual transformations for deep neural networks. In 2017 IEEE Conference on Computer Vision and Pattern Recognition, CVPR 2017, Honolulu, HI, USA, July 21-26, 2017, pp. 5987-5995. IEEE Computer Society, 2017.
Yifeng Xiong, Jiadong Lin, Min Zhang, John E. Hoperoft, and Kun He. Stochastic variance reduced ensemble adversarial attack for boosting the adversarial transferability. CoRR, abs/2111.107552 2021.
Jiancheng Yang. Yangzhou Jiang, Xiaoyang Huang, Bingbing Ni, and Chenglong Zhao Learning black-box attackers with transferable priors and query feedback. In Advances in Neural Informa- fion Processing Systems 33: Annual Conference on Neural Information Processing Systems 2020, NeurlPS 2020. December 6-12, 2020, virtual, 2020.
Sergey Zagoruyko and Nikos Komodakis. Wide residual networks. In Proceedings of the British Machine Vision Conference 2016, BMVC 2016, York, UK, September 19-22, 2016. BMVA Press, 2016.
Chaoning Zhang, Philipp Benz, Adil Karjauv, Jae-Won Cho, Kang Zhang, and In So Kweon. Inves- tigating top-k white-box and transferable black-box attack. CoRR, abs/2204.00089, 2022a.
Hongyang Zhang, Yaodong Yu, Jiantao Jiao, Eric P. Xing, Laurent El Ghaoui, and Michael I. Jordan. Theoretically principled trade-off between robustness and accuracy. In Proceedings of the 36th International Conference Machine Learning, (CML.2019 9-15 June 2019, Long Beach, Cali- fornia, USA, volume 97 of Proceedings of Machine Learning Research, pp. 7472-7482. PMLR, 2019.
Jianping Zhang, Weibin Wu, Jen-tse Huang, Yizhan Huang, Wenxuan Wang, Yuxin Su, and Michael R. Lyu. Improving adversarial transfcrability via neuron utrrbution-basee attacks. CoRR, abs/2204.00008. 2022b.
Yonggang Zhang, Ya Li, Tongliang Liu, and Xinmei Tian. Dual-path distillation: A unified frame- work to improve black-box attacks. In Proceedings of the 37th International Conference on Machine Learning, ICML 2020, 13-18 July 2020, Virtual Event, volume 119 of Proceedings of Machine Learning Research, pp. 11163-111 11122. PMLR, 2020.
Wen Zhou, Xin Hou, Yongjun Chen, Mengyun Tang, Xiangqi Huang, Xiang Gan, and Yong Yang. Transferable adversarial perturbations. In Computer Vision ECCV 2018 15th European Confer- ence, Munich, Germany, September 8-, 2018, Proceedings, Part XIV, volume 11218 of Lecture Notes in Computer Science, pp. 471 1871.446..60 Springer, 2018
Junhua Zou, Zhisong Pan, Junyang Qiu, Xin Liu, Ting Rui, and Wei Li. Improving the transfer- diversity-ensemble and region fitting. In Computer Vision ECCV 2020 16th European Conference, Glasgow, UK. August 23-28, 2020, Proceedings, Part XXII, volume 12367 of Lecture Notes in Computer Science, pp. 563-
ability of adversarial examples with
579. Springer, 2020.
13

---

Under review as a conference paper at ICLR 2023
A
PROOFS
We provide the proofs in this section.
vo01s to Redlerto in ARLE
121 V0035 Restee50 AA300
Vo0 to Resketho insjete
0649
A110
A150
k01
0335
5083
6.30
022
1.54
C12
Figure 1: The cosine value of the gradient angle between the surrogate model and the victim model each iteration when the surrogate model is attacked by different methods for CIFAR10/100 and ImageNet. For example, in subfigure (1), VGG16 as the surrogate model and ResNet50 as the victim model are attacked by different transfer attacks for CIFARIO. Note that the attack strength e = 8/255.
Top-r WTOO
Figure 2: The top-n wrong categories attack success rate (ASR) (%) at each iteration t when the model attacked by I-FGSM (white-box setting) for CIFARI0/100 and ImageNet. For example, in subfigure (1), VGG16 is attacked by I-FGSM for CIFAR10. The successful attacked adversarial examples prefer to be classified as the top-n wrong categories. With the increase the iteration, the top-n wrong categories ASR gradually increases and approaches 100%. Note that the attack strength e = 8/255.
A. PROOF OF PROPOSITION
Proposition When the step size is small, the better the transferability of the transfer black-box attack, the smaller the gradient angle between the surrogate model and the victim model.
Note that we explore the relationship between the cos (0 is the gradient angle between the surro- gate model and the victim model) and the transferability on the same surrogate model and victim model pair using different transfer attack methods, but Liu et al. (2017) and Demontis et al. (2019) explore the relationship between the cos and the transferability on the different surrogate and vic- tim model pairs using the transfer attack method.
14

---

Under review as a conference paper at ICLR 2023
903
(4) Oe en CHANTER
ReotuetS on maageter
Figure 3: The average top-n wrong categories attack success rate (ASR) (%) at each iteration t when the model is attacked by I-FGSM (white-box setting) for CIFARION 10/100 and ImageNet. For example, in subfigure (1), VGG16 attacked by I-FGSM for CIFARIO. The smaller n. the higher the average top-n wrong categories ASR. Therefore, the higher the probability of the wrong category, the more likely the adversarial example is to be classified as this category. Note that the attack strength 8/255.
Proof (Empirical Proof) To verify the correctness of Proposition 7 we compare the relationship between the attack success rates of the family of fast gradient sign methods and the cosine values (i.e., the average cosine values of the gradient angles between the surrogate model and the victim model at all iterations) of the family of fast gradient sign methods when the attack strength, number of iteration and step size are TT, = 8/255, 10, 0.8 /2555. If the sort of the attack success rates is the same as the sort of the cosine values, Proposition iis correct with high confidence. Empirically, P Proposition iis verified on different surrogate models and datasets as follows.
When VGG16 is the surrogate model and ResNet50 is the victim model for CIFARIO, Table shoos that the sort of the attack success rates is VMI-FGSM (76.6%%) >> MI-FGSM (70.75%) >> SI-NI- FGSM (08) > DI-FGSM (62.80%) > I-FGSM (61.45%) > FGSM (41.9%%), and the Figure I (1) shows that the sort of the cosine values is also basically VMI-FGSM >> MI-FGSM >> SI-NI-FGSM > DI-FGSM > I-FGSM > FGSM.
When VGGI6 is the surrogate model and ResNet50 is the victim model for CIFARIOO, Table shows that the sort of the attack success rates is VMI-FGSM (77.70%) > MI-FGSM (69.30%) FGSM (63.15%) > DI-FGSM (59.30% > I-FGSM (50.70%), and the Figure (2) shows that the sort of the cosine values is also basically VMI-FGSM > MI-FGSM > SI-NI-FGSM Ra FGSM DI-FGSM > I-FGSM
SI-NI-FGSM (64.35%)
When VGGI6 is the surrogate model and ResNer50 is the victim model for ImageNet, Table 9 shows that the sort of the attack success rates is VMI-FGSM (62.4%) > SI-NI-FGSM (56.6%) > MI-FGSM (46.5%) > DI-FGSM (38.1 1%)= > FGSM (32.8%) >> I-FGSM (27.8%), and the Figure (3) shows that the sort of the cosine values is basically VMI-FGSM > FGSM > SI-NI-FGSM MI-FGSM+ > DI-FGSM > 1-FGSM.
When ResNet50 is the surrogate model and VGGI6 the victim model for CIFARIO, Table 7 shows that the sort of the attack success rates is VMI-FGSM (80.40%) >> MI-FGSM (77.25%) >> SI-NI- FGSM (73.00 (3.000)) >> DI-FGSM (67.65% >> I-FGSM (59.85% > FGSM (44.20%), and the Figure (4) shows that the sort of the cosine values is also basically VMIIFGSM > MI-FGSM > SI-NI-FGSM DI- DI-FGSM > I-FGSM > FGSM.
When ResNer50 is the surrogate model and VGG16 is the victim model for CIFAR100, Table shows that the sort of the attack success rates is VMI-FGSM (84.40%) >> MI-FGSM (77.35%) > DI-FGSM (68.40%)
SI-NI-FGSM (72.90%)
FGSM (64.80) (64.80) I-FGSM (61.45%), and the Figure (5) shows that the sort of the cosine values is also basically VMI-FGSM > MI-FGSM > SGSI > DI-FGSM > 1-FGSM > FGSM.
15

---

Under review as a conference paper at ICLR 2023
When ResNet50 is the surrogate model and VGG16 is the victim model for ImageNet, Table 3 shows that the sort of the attack success rates is VMI-FGSM (69.1%) >> SI-NI-FGSM (68.7%) > MI-FGSM (55.4%) >> DI-FGSM (52.6%) > FGSM (42.6%) I-FGSM (32.1%), and the Figure (6) shows that the sort of the cosine values is also basically VMI-FGSM > FGSM > SI-NI-FGSM > MI-FGSM DI-FGSM I-FGSM.
In conclusion, by discussing the above six cases for CIFARIO/100 and ImageNet datasets, for the family of iterative fast gradient sign methods except for FGSM, Proposition 7 correct with high confidence. Therefore, decreasing the cosine value of the gradient angle between the surrogate model and the victim model can enhance the transferabillity of adversarial examples.
Proof (Theoretical Proof) Assuming that the perturbation gradients of the surrogate model f and the victim model h at the attuck iteration are v,L(st yoo Oz) and V L= Mos On), respec- lively, and 0 is the ungle of them. Then, the perturbation gradient of the surrogate model I (i.e.. V V.L(at -yo: ()) decomposed as the parallel component V VZI :yo and the vertical component V Lx yo: Br), which satisfied that
V (ugdv Yoi 05) V. (1t .yo; On)
(17)
V (xqd Moi 0,) LV a (pado yoo 0%)
(18)
L. (x addv Mo: 0,) V (x you 0,) + V Io (x No: Uy)
(19)
For the victim model h, assuming that the variation of the loss funtion of the victim model h caused by the peruubatton V is
A (V.) I. (xc + Vz, Moi 0n) T. (x:2 :yoi On.)
(20)
where (-(-) represents the variation of the loss function of the victim model h.
According to Lemma for the victim model h, three properties (i.e., Equations 21 22 and 23 are achieved.
For the first property, in the case of moving the same distance (satisfied Lemma 7 along the gradient direction, the variation of the loss L (zqdo, yo: 0%) along the direction of the parallel component Laadd ,yo:8,) is greater than that along the direction of the vertical component Li Yoi f,), i.e.
)
V (1qde Vo; 0z)
T (ageuv Moo 0j)
4 a
12 a V L (aado Mo: 0f)
(21)
V (pndo, Yo: (,: 1
For the second property, the variation of the loss L (xqdn yo: 0%) along the direction of the parallel component
V L( yyo: (yy is positively correlated with the moving distance a, i.e.,
V!L (zgee Moi Moi 07)
A! (aqdu Noi 0j)
4 (a (a- Ao)
(22)
L (xgdv Moi 02)
| (a yoi 0,)
where Au represents the variation of the moving distance a.
v!
For the third property, the degree of correlation between 1t a v. (2 s10181)
and is
greater than that between Ab, (ax Li (uil))
and a, ie.,
V 2 (aadu ,yo; Os)
1/ (a+ Aa)
+ + (a- Aa)
(aado Noi 01)
V I. (a Mos 0,) 11
v I (xgddr Yo: 0g)
V 1 (I yoi Qs)
a
V!l (pndu yoi 0,)
+ A a
| T (Igde Sande,yo0 No; Uz) 112
(23)
16

---

Under review as a conference paper at ICLR 2023
where Aa represents the variation of the moving distance a.
At the gradient attack iteration t++1, assuming that the generated adversarial example xddy in range B (2qde, a) (i.e., in the sphere with radius a centered on the adversarial example 2. Hence, for the surrogate model f. when the adversarial example rędu moves the allowed maximum distance a along the direction of the perturbation gradient V vzL(x4th Yoi fy), ) the moving distance along the direction of the parallel component V!! Laadu ,y0 0y) is
a = cos 0,
(24)
the moving distance along the direction of the vertical component V L(z Mai 0y) is
a = a 0
(25)
Then, we discuss the angle & in three cases, i.e, z < 0 respectively.
and
< 0 < n
First, when I <<
0
< 2 or 0 < cos 1 < 22 ~ 0.707, if the angle i is reduced by As.
A = a [cos (1 Aa) - cos 0| = a (Ao sin
(26)
A, 1 = a [sin (1) Ao) ) - sin 0| = a (- - cos 1)
(27)
= a A
(28)
Therefore, according to Equations 27
22
23 and 28
if the angle 1 is reduced by Av.
V Lagddr Moi 0y)
V L (zgdrr yoi 0f)
4b +|2a11)-
)+ AB((aa 1)
!! Laagdr
Mxqdu Yoi 0 0
No: 8/)
v Laggee Myoi 0y)
V Lugduv yoi 0y)
42((a") + +1
+ -140-))
V Lagddu Moi 0g)
| L Moi 0f)112
v Il Uoi 0,)
V Laqduu Yo; fy) | Mazdo Yo: 05)
42(a
) Aa
(29)
V! yo: 0y)1|2
According Assumption 2 in small local area (i.e., is small enough, which is satisfied :MoiOn) On) along the direction of the perturbation gra- Velle," ac00y)
Lemma 7. the variation of the loss L(agdv Mooi
dient of the surrogate model f (i.e., AL(a- "[V wo:0;)],, }) is positively correlated with the sum of the variation the loss Maggur Moi 0n) along the directions of the parallel and vertical com- ponents (i.e., Al(all
ViMazdo mo:8s)
(att
V Magde (yo:9s) ())-))))))
)). Therefore, according
[! (0:0;))
to Equation 29 when the angle 2 is reduced by Ao, the loss L(zado yo: (%) is increased. According to the statistical results of Figure 7 the average cosine of the angle 1 between the latest transfer attack generated perturbation gradients of the surrogate model and the victim model is far less than 0. 0.707 (such as the maximum average cosine value less than 0.2 2.25 on CIFARIO, O. 18 on CIFAR100 and 0.05 on ImageNet). Therefore, with the latest transfer attack method as the baseline, increasing the cosine of the angle 0 can effectively improve the transferable attack success rate.
Second, when 0 < 0 < 1 0.707 & cos < 1, if the angle i is reduced by Ag. Equation 29 may not be satisfied. Therefore, increasing the cosine of the angle 9 may not effectively improve the transferable attack success rate.
Third, when _ < < n. if the angle is reduced by Ao. Equation 29 does not hold. Therefore, increasing the cosine of the angle & can not improve the transferable attack success rate. According to the statistical results of Figure [ the average cosine of the angle i is greater than 0 on the latest attack methods, so I < 2 & usually does not happen.
Overall, with the latest transfer attack method as the baseline, increasing the cosine of the angle can effectively improve the transferable attack success rate.
17

---

Under review as a conference paper at ICLR 2023
Lemma 1 When a is small enough, the loss L(ag -oo: -Vo:Bn) 0n.) : the perturbation gradient V.L( Yo: By.) in the region B(x ,a) (i.e., in the sphere with radius centered on the adversarial example z²ddo.
increases fastest along the direction of
Proof When is small enough, in the region B(ugdv .i), the rate of variation of the loss Laqqu, MYo 0n) along the direction of the perturbation gradient VzI(aado ,yo: 0n) is almost equal to the Lipschitz constant of the loss function L(zt"" yo: 0n. in this region.
Assumption 2 In small local area (i.e.. a is small enough. which is satisfied Lemma D. the variation of the loss L(z yo: 0k) along the direction of the perturbation gradient of the surrogate model J (i.e, AL(ax V.L(afd N
(=.L(xt"r,0000)) is positively correlated with the sum of the variation of
the loss L(z Yoo -ooBBh) along the directions of the parallel and vertical components (i.e., Aa(l.. alll.
Ll! 26.01) + (a [Vad"" 0.:0,)
Laa Nai8,)
))
VLLMag" wni0s))
Lemma I and Assumption are used in the Theoretical Proof of Proposition I Note that, As- sumption is reasonable. When a is small enough, in the region B(z .). the rate of varia- tion of the loss Lxzgdt yoo 0,) along the direction of the parallel component (ird yo: 0y) (which is parallel to V VaL(x yo: (,)) is almost equal to the Lipschitz constant of the loss func- tion L(xgdo Yo: 0s) in this region. Meanwhile, in the region Bazzdv (a), the rate of variation of the loss [(zīde Yo: 0%) along the direction of the vertical component V i L(zadu yo: 8y) (which is per- pendicular to V Lazdd (bo (x)) is almost O. Therefore, 1/,(a-
x
V. L(agd m.:0g) ) is positively [ ,0.000)))))
correlated with (al) Vi (.ile) + (a [[ L(rgdr wo:Dr))2 V!ilard s
V. ((x2"")a000))) m000e)
However, increases, the Lipschitz constant of the loss function L(zddo Moo -boi 0%) in the gion B(a7de,,, a) also increases and is greater than the rate of variation of the loss Lxzfdr yos 0r) along the direction of the parallel component V!.L( (17dd))6::8)) B(zzdo a), the rate of variation of the loss L(xgdr Moi (n.) along the direction of the vertical component V [a::de "eredd;;;" By) becomes uncertain. Therefore, the positive correlation between (a VaL(afdr No:8,) and (a!l Lirft""....0 [ ww:"")
Meanwhile, in the region
(a L= w.:lf) will L B..00r
L. .0:00))
weaken, which is why the transferable attack success rate of the gradient iterative- based attacks (I-FGSM. MI-FGSM, DI-FGSM, SI-NI-FGSM and VMI-FGSM) is higher than that of FGSM (be- cause the attack step length of the gradient iterative- attacks is less than that of FGSM).
Corollary When 0 & cos 9- < 0.707, increasing cos 0 is a necessury and insufficient condition to improve the transferubility of the generated udversarial examples. To effectively improve the transferabiliiy,, a small step size a is also needed.
Proof (Theoretical Proof) For 0 & cos 1 0.700,, if a is small and satisfied Lemma 7 so Propo- sition [ is correct. As a increases, the Lipschitz constant of the loss function Lizede yos 0%) in the region Blaqde ,a) also increases and is greater than the rate of variation of the loss L [xzdd yyo ,yo On) along the direction of the parallel component L.I yyo 0o; Meanwhile, in the region Bixgdo (x), the rate of variation of the loss Laxade Yo: 0x) along the direction of the vertical component V L[aadu .yo: -yo;0;) Oz) becomes uncertain. Therefore, the positive correlation be- L. meilf))
V.L(a,dy -w.0f) and (a( V!lL(addy (yo:0)) )+ Aiattt L ViLlard (o.8s))
tween A2(a TVLleet 20:81)11
will weaken. When a is large a certain extent, 4a V.L(andr ,y::0)) VV.llz"" :oi9 and Aillll
Vaaad (1:0)) )+ (aatt....
Magad go:0r)
1 w):0)))l are no longer positively correlated. Then Equa-
Lagga mn:0 l2
tion 29 does not hold, so Proposition is incorrect. Therefore, small step size a is a key parameter to effectively improve the transferability.
Proof (Empirical Proof) As shown in Figure (3),, when VGGI6 is the surrogate model and ResNer50 is the victim model for ImageNet. the sort of the cosine values is basically FGSM >> SI-NI- FGSM > MI-FGSM > DI-FGSM >> I-FGSM, but the sort of the attack success rate is SI-NI-FGSM (56.6%) > MI-FGSM (46.5%) > DI-FGSM (38. 1%)= > FGSM (32.8%) > I-FGSM (27.8%).
18

---

When VGGI6 for CIFARIO is attacked by I-FGSM, Figure (1) shows that ASR > ASR ASR==3 ASR > ASR"=1 69% > 10-1 each iteration. With the increase of the Under review as a conference paper at ICLR 2023
As shown in Figure[[(6) when ResNet50 is the surrogate model and VGG16 is the victim model for ImageNet, the sort of the cosine values is basically FGSM > SI-NI-FGSM > MI-FGSM >> DI-FGSM I-FGSM, but the sort of the attack success rate is SI-NI-FGSM (68.7%) > MI-FGSM (55.4%) > DI-FGSM (52.6%) >> FGSM (42.6% > I-FGSM (32. 1%).
Therefore, to effectively improve the transferability, small step size is also needed. Note that, in Figure 7 the attack strength c is the same, the step size a of FGSM is greater than SI-NI-FGSM, MI-FGSM and DI-FGSM.
A.2 PROOF OF PROPOSITION 2
Proposition 2 When the victim model h is attacked by the white-box gradient-based attacks, the successful attacked adversarial examples prefer to be classified as the wrong categories with higher probability (i.e. the top-n wrong categories {y-, li & f.).. Meanwhile, the higher the probability of the wrong category, the more likely the adversarial example is to be classified as this category.
Proof (Empirical Proof) To verify the correctness of Proposition 2 we explore the top-n wrong categories attack success rate (ASR) on I-FGSM at each iteration where the attack strength, number of iterations and step of size are e, e,T,e a 8/255, 10, 0.8/255. Assuming that AS denotes the top-n wrong categories ASR, and ASR denotes the average top-n wrong categories, namely ASR ==n ASR First, if the top-n wrong categories ASR is significantly higher than the average level (i.e. C-1 where C is the number of categories of the classification task), namely ASR ASRann > 1
C-1" the previous sentence of Proposition 2 correct with high confidence. Second, when n1 < n2, the average top-n1 wrong categories ASR is higher than the average top-n2 wrong categories ASR, namely AST > ASR A= the last sentence of Proposition 2 is correct with high confidence. Empirically, Proposition D verified on different surrogate models and datasets as follows.
iteration I, ASR gradually increases and approaches 100%. Figure (1) shows that ASR =1
ASR A
> ASR > ASR > ASR =b
at each iteration.
When ResNet50 for CIFARIO is attacked by I-FGSM, Figure (2(2) shows that ASRI= ASR AS > ASR > ASR==1 2 76% >> To at each iteration. With the increase of the
iteration I, ASR gradually increases and approaches 100%. Figure (4) shows that ASR m=
> ASR 2=2 > ASR n=3 > ASR R-4 > *SRR" at each iteration.
a=b
When VGG16 CIFARI00 is attacked by I-FGSM, Figure (3) (33) shows that ASR > ASR ASR > AS > ASR 2 54% > 100-I each iteration. With the increase of the
iteration I, ASR gradually increases and approaches 100%. Figure (2) shows that ASR 7=
ASR ASR"-1 1= ASR n=20 ASR" at each iteration.
==50
When ResNet50 for CIFARI00 is attacked by I-FGSM, Figure (44) shows that ASR"=50 > ASR > ASRB=10 ASR > ASR > 52% > Too-I at each iteration. With the increase of the iteration t, ASRa=n gradually increases and approaches 100%. Figure 3 (5) shows that ASR > ASR ASR" > *S > ASR *SRR=50 at each iteration.
When VGGI6 for ImageNet is attacked by I-FGSM, Figure (5) shows that ASR > ASR > ASR=55 > ASR*=1 2 33% > 1000-1 at each iteration. With the increase of the ASR 10
iteration I, ASR gradually increases and approaches 100%. Figure (3) shows that ASR =1
ASR > ASR n= > ASR" n=20 > ASR at each iteration.
When ResNet50 for ImageNet is allacked by I-FGSM, Figure (66) shows that ASR > ASRa=20 20
> ASRa=10 > R > ASR > 43% > 1000-1 at each iteration. With the
increase of the iteration t, ASR gradually increases and approaches 100%. Figure 3 (6) shows 7=20
that ASR ASR R=3
ASR 10 > ASR ASR at each iteration.
19

---

Under review as a conference paper at ICLR 2023
In conclusion, by discussing the above six cases CIFARI0/100 and ImageNet datasets, the Propo- sition is correct with high confidence. Therefore, after knowing the output of the victim model, directly classifying the adversarial examples into the category in the top-n wrong categories can remove the gradient perturbation of the other wrong categories.
Proof (Theoretical Proof) To explore whether the successful adversarial examples prefer to be classified as the wrong categories with higher probability or not, the derivation formula of LCE w.r.t the input is
OLCE dz
OLCE
azo
C
OLCE dz:
8zo
dr
Oz.
dr
(=((00))
1
e
Ozo
1
e
Oz:
+
(30)
In 2
e
dx
In2
2j=1 e
Dx
im ((gl))
According to Equation 30 the coefficient of Bäs
50 )) less than and the coefficient of 0z: (i... 1n2 ES e² is greater than The greater the logit output 2, of the wrong Oz
(i.e.,
1n2
E ao
category ys, the larger the coefficient of 8e (i.e., 1n2 ΣS Eg Therefore, in the process of the
gradient ascent of the loss function LCE, the greater the logit output 2; of the wrong category y is, the faster grows. Due to the fact that the greater the logit output 24 of the wrong category the larger the probability ps. the successful adversarial examples prefer to be classified as the wrong categories with higher probability.
A.3 THE DETAIL DESIGN PROCESS OF THE WACE LOSS
According to Proposition | decreasing the gradient angle between the surrogate model f and the victim model h, i.e., the angle between V V_Lox(I Mooi ,y)i0)) and V.LcE(17 3oo 02), can en- hance the transferability of adversarial examples.
According to the previous sentence of Proposition 2 because the successful attacked adversarial ex- amples prefer to be classified as the wrong categorics with higher probability, to avoid the gradient perturbation of the other wrong categories, besides maximizing the loss function T-c (a:dv Yo; Oy), we also minimize the distance between the model output and the top-n wrong categories with higher probability, namely maximizing (a Yo: By) - -i= 1, LCE(a :r. where each cat- egory in fyr,1e li ) is equally important.
According to the last sentence of Proposition] 2 the higher the probability of the wrong category, the more likely the adversarial example is be classified as this category. Therefore, add weight to the distance calculation of the top-n wrong categories according to the logit each cat- egory in the top-n wrong categories, namely maximizing Le .Noi Σ <thu
Lo Yr, 0f).
Therefore, the WACE loss is:
n @thir LWACE (x. Noi 0j, Zn, m) LoE (x. 1 "n
ahr, Loe (2,Vr.09) (31)
i=1 E
A.4 PROOF OF THBOREM 1
Theorem 1 The angle between V, Lw AcE(aadu ,yo: ,y:o0y, Zn, R) and V L.CCElode .oo 0p) ) is less than the angle between LaLAE (aqdv yo; 0y) and Va Mos 0n), and the angle between V V (2qdu yoo fy) and V.Ice( (andv yo: x²).
20

---

Under review as a conference paper at ICLR 2023
Proof According to Proposition
2
aLCE
aLCE
(-
dzn,o Oxqdo
aLCE dznd
V VaLCE (xtde yoi 0n.
axqdv
Ozh.o
Ozhi
drg
k= ((()b)
c
(-
dzh,o
e
Ōzh,
1n2
1
E i=
eahi
angdu
+
==== e
==(((0)
((1-
can
azh.o
e
Uzh.ri
(32)
2
Ei=1 e
dxgdo
-j==1 e
dxqdv
Eq. and in the main paper are the CE loss, the RCE loss and the WACE loss, respectively, The gradient of each loss w.r.t. xgdo the surrogate model f is as follows, respectively.
V VLLOr (atde :boi0g)
θLoE
OLCE
(-ange))
Ozo Orqae
ÅLCE
Oz.
anqdv
Ozo
Oz,
Orqdr
((ffo)
(11-
e0 Σ i=
(-
Ozo Oxgeu
e
dzi
+
(33)
2
Ouqdo
2==l e
im ((5tt)
ÔCRCE
ĐLRCE.
(-
Ozo Oxqado
òLRCE
8z: Ōx
VELRCE (1qdv, 0)000))
Σ
axqde
Ozo
Oz
i' ((i)
Ozo dxqdo
Ozi Dxqdu
(34)
1n2
C
ÖLWACE Oxqdu
OLWACE Ozo
Ozo dxedo
ÖLWACE
Oz:
V VeLWACE (oqdo, (ooiii
Ōz,
Oxqdo
(=1((<f)
1
((-2))
Oz7.
+
(35)
1n2
Assuming that ad is successful attacked adversarial example and agdu is correctly classified by the surrogate model f and the victim model h with almost 100% probability. When the iteration & is equal to 0, (1 -5- et and (1
Ei ethis are approximately O, and ESie55 and ehh.s Ei=r ehd
are approximately 0. Eq. 32 and 33 are transformed as follows, respectively.
chi Ozh.7.
LIB (agdv, Noi On)
(36)
In
chiry
Oxqdo
1=1
j=1
V.LCE (Iędu, yo: 0,) = 0
(37)
Therefore, according to Proposition 2 in comparison with the gradient of the CE and RCE losses, 35
and show that the gradient of the WACE loss remove the gradient of the unrelated wrong categories (i.e., the wrong categories with minimun probability).
Eq. 34
36
comparison with the CE loss, Eq. 32 33 and 35 show that the gradient of the WACE loss removes the gradient of the unrelated wrong categories and enhances the weight (or coefficient) of the gradient of the ground truth. In comparison with the RCE loss, Eq. 32 34 3 show that the gradient of the WACE loss removes the gradient of the unrelated wrong categories.
With the increase of the iteration t, according to Proposition
Therefore, Theorem 7 is correct.
21

---

Under review as a conference paper at ICLR 2023
0.150
0120
0130
00:00
01175
Ve 1OAM
A1500
A180
023
05%
Figure 4: The cosine value of the gradient angle between the surrogate model and the victim model each iteration when the surrogate model is attacked by different methods for CIFARI0/100 00 and ImageNet. For example, in subfigure (I), VGGI6 as the surrogate model and ResNer50 as the victim model are attacked by different transfer attacks for CIFARIO. The query prior-based attacks significantly improve the cosine value of the gradient angle between the surrogate model and the victim model, i.c. decrease the gradient angle between the surrogate model and the victim model. Note that the attack strength = 8/255.
A.5 THE REDUCTION OF THE GRADIENT ANGLE WITH THE WACE LOSS
To verify that the WACE loss can reduce the gradient angle between the surrogate model and the victim model, we compare the cosine value of the gradient angle between the family of iterative FGSM and their query prior-based version. As shown Figure for CIFARI0/100 and ImageNet, at each iteration, the cosine value of the gradient angle between the surrogate model and the victim model on the family of iterative FGSM are smaller than that on their query prior- based version. Therefore, the WACE loss can reduce the gradient angle between the surrogate model and the victim model.
A.6 PROOF OF PROPOSITIONS
4 AND 6
Proposition In the untargeted attucks, when p 0.5, the temperature scaling (T > 1 and K. 1) can eliminate part of the fuzzy domain M (z.1.k)
Proof When T >> and K = 1, Eq. 14 is transformed as:
ea:/T
F E T21
(38)
Ec_ E
Assuming that (i) the adversarial example & is generated without the temperature scaling and the logit output of the surrogate model f Z₁- fā) [zf,1, 2............ ,Zf.c]; (ii) the adversarial example '! is generated with the temperature scaling and the logit output of the surrogate model f is , =2y,0 2/.2
Z' = f If à E NT (2.fA)
(ili) the same attack eventually makes that Vc, 2'T.o!TT 2f.0-
FTeT
2
Pa
e <
(39)
Σe
where è is the wrong category with the highest probability. To make '' not belong to (2 according to Assumption 7 L' does not belong to As.- (p). Therefore, the probability threshold should satisfied:
FLeT 0C E
the
<P
1
<
(40)
E
E6
22

---

Under review as a conference paper at ICLR 2023
When the condition that Yc CAe c, 2 t. is satisfied,
0.5 <
(41)
Lcsi 2/00
Hence,
p> 0.5
Ve < CA 8 1
0.5
Σ e <
(42)
Ees =/
Therefore, the temperature scaling can eliminate the fuzzy domain with 0.5
Ecs e (1/ -1,))
Proposition 4
In the targeted attacks, when p > 0.5, the temperature scaling (T and K. 1) eliminate part of the fuzzy domain (2.f..)
Proof The Proof of Proposition 4 is the same as that of Proposition 3 Note that the category ye is changed to yr.
Proposition 5 In the untargeted attacks, the fuzzy scaling (T = 1 and K. > 1) can eliminate part of the fuzzy domain Mi(... (x.f,h)
Proof When T = 1 and K. > 1, Eq.
14 1 transformed as:
N.
FESoftmar 1,K)
ek For 2e Inepto
6s0
(43)
i #
efiizo
Assuming that (i) the adversarial example à: is generated without the fuzzy scaling and the logit ousput of the surrogate model f is Z; f (.) = "ff.,,f,22"*. ,2,,cl; (ii the adversarial example Y' generated with the fuzzy scaling and the logit output of the surrogate model f is
Z' f = ,/,2 ; (iii) the same attack eventually makes that Ve & CCc Zf. 2
f/y 25,0 = K 2/ i MINT
(2.JNy
6=1.e
P8
D ettic
Ki
Ee=inefo 2/,
<p
(44)
To make Yl not belong to MT to f.. (p). Therefore, when 2fa0
(. according to Assumption K.
we need to make t' does not belong
=/1 0,
(45)
E 1,0 + Ecainefo t
Ee=1
ho
When 21,0 K K- 2 <0, à and स' are almost successfully attacked, i.e., ă, M
Therefore, the fuzzy scaling can eliminate the fuzzy domain with
p when
10 tener the
2/1.0 >.
Proposition 6 In the targeted attacks, the fuzzy scaling (T and 0 < K. < 1) can eliminate part of the fuzzy domain MTa
[.. Proof When T and K < Eq. is transformed as:
F..Softmaz (2x; 1,K)
Locky etc
(46)
Lemthe ate of
Ki + 500
23

---

Under review as a conference paper at ICLR 2023
Table 1: The untargeted attack success rates (%) six naturally trained models for CIFARIO using
various transfer attacks and two query attacks with the attack strength e 8/255. The adversarial examples are generated by ResNet50. denotes the attack success rates under white-box attacks. Average means to calculate the average value except
Note that Q = 1 in Q-FGSM.
Model
Attack
Loss
V16
V19
R50
WRN-164
DI21
M-v2
Average
Squarei =
12.15
18.85
17.53
PRGFIQ I0)
4.25
4.15
26,95
8.10
7.75
6,00
6.17
CE
44,20
46.20
65.50 65.50)
56.15
53.15
55.10
50.96
FGSM
RCE
37.95
38.95
54.70*
49.25
45.65
49.70
44.3
FECE/Our))
50.40
52.50
75.80*
63.00
59.10
59.95
$6.99
WACE(Ours)
Q QGGSMM(Our))
WFCF((Ours)
48.30
46.75
71 30
59.80
55.65
57.65
53.63
59.85
62.55
99.85*
93.95
88.70
84.35
77.88
I-FOSM
RCE
58.05
60.10
99.05*
90.60
86.15
82.25
75.43
FECE(OurS)
66.75
69.35
100
95.70
91.75
87.35
82, 18
WACE(Ours)
68.50
99,90*
QI-FGSMMOUr))
WFCE(Ours)
71.20
70.60
99.954
96.85
93.60
90.50
84.55
77.25
MI-FGSM
RCE
70.95
72,90
97.35*
88,50
84.90
82:55
79.96
FECE/OurS)
83,30
84.70
100"
96.30
92.40
90.05
89.35 39.35
(MI-FGSM((Ou))
WAC E(Our))
84,40
82.90
99.70*
97.00
93.55
91.85
89.94
RosNet50
WFCE(Ours)
85.00
82.55
99.70'
97.15
93.85
92,00
90.11
67.65
79.44
DLFG
RCE
63.75
6.3.65
94_50*
83.05
80.45
76.90
73.56
FFCF(Our))
75.05
93.30
91.15
(DI-FGSM(Ours)
WAC E(Ours)
75.05
73.20
99.25
94,20
91.50
88.75
84.5c 54
WFCE(Ours)
77.20
75,20
99.15*
93.95
91.10
89,00
85.29
CE
73.00
75,80
98.10*
92.35
89.95
86,45
83.51
SINIFGGM
RCE
82.45
84,20
99.55
96.75
94.85
92.35
90.12
FECE(Our))
90.76
(SSNI-)GS((Our))
WFCF((Orr)
WAC ((urs)
87.65
87.55
87.85
87.40
99.85*
98.40
98.60
96.25
96.25
95.35
93.08
CE
80.40
82,20
99.20*
94,60
90.80
88,95
87.39
VMI-FGSM
RCE
77.75
78.05
97.50*
92.15
89.00
87.60
84.91
FECE/Ours)
83.95
85.50
100*
96.35
92.70
90.00
89.7
WACrs(Our))
88.60
86.10
99.65*
97.95
95.40
94.50
92.51
QVMI-FGSM((UUS)
WFCE(OOrr)
87.75
91.82
Assuming that (i) the adversarial example à generated without the fuzzy scaling and the logit output of the surrogate model J is Z; (i) [= ,2,,,,,""""",,..." ,23.c); (ūi the adversarial example 3' generated with the fuzzy scaling and the logit output of the surrogate model f is
Z' = f ,, ; (iii) the same attack eventually makes that Vc & CCA zf. f/ 2s. K0 2 If E MTa (2.1
Kizly + Le=inoft 21.0
<.p
(47)
To make Y' not belong to MTa (n. according to Assumption A f. (p). Therefore, when 2f,7 K. z'y,r > because
7 we need to make t' does not belong
(21,-- -0=2(/7) < (2' K- )
+ De=LNeHT cn -k
<p<
Kizty,.
et'
Kosly + Ec S.c.
p
Ec
(48)
When 2 = KC 24 and 5' are almost failed attacked,
Kitlyy
Therefore, the fuzzy scaling can eliminate the fuzzy domain with Ki +50 2/rr 0.
p when
24

---

Under review as a conference paper at ICLR 2023
Table 2: The untargeted attack success rates (%) on six naturally trained models for CIFAR 100 using various transfer attacks and two query attacks with the attack strength = 8/255. The adversarial examples are generated by ResNet50. denotes the attack success rates under white-box attacks. Average means to calculate the average value except
Note that Q = 1 in Q-FGSM.
Model
Attack
Loss
V16
R50
RN30
WRN-16-4
D121
M-v2
Average
Squarel
34.05
51.35
39.99
PRGFQ 10)
8,70
43.65
12.45
12.15
12.50
8.10
10.78
CE
64.80
83.40
68.75
72.15
71.60
66.00
68.78
FGSM
RCE
63.85
81.75*
67.55
70.55
69.95
66.35
67.65
Q-FUSM(OUs))
WACH(Ours)
65.30
83.75
69.65
72.80
72.60
67.65
69.6
CB
S1.10
LFGSM
RCE
69.45
98.50
84.10
85.80
84.35
68.00
78. 34
FECE/Ours)
69.45
83,80
83.85
67.75
78.37
(GSSO(((Our))
WACEOOurs)
71.25
99,40
88.55
90.30
87.65
70.50
81.65
(FCE((Our)
72.40
99.40"
89.15
90.90
88.50
72.10
82.61
CE
77.35
97.80"
85.55
85.70
74.05
81.87
MI-FGSM
RCE
79.10
96.99'
86.50
88.
87.10
78.20
83.88
FECE(OUTS)
97.15*
$7.30
(MI-FGSM(OOrs)
WACH(OUrS)
80.90
98.80"
89.45
91.40
90.05
79.35
86, 2.1
WFCE/Ours)
81.25
98.55*
89.90
91.65
90.05
79.90
86.55
ResNet50
CE
68.40
97.55*
B3.40
83.05
81.25
63.83
76.39
DI-FGSM
RCE
72.55
96.05*
83,50
85
83. 10
71.70
79. 22
PECE/Ours)
96.40*
83.65
FGSM((O))))))
WFCF(Ourl)
WACEFOuus)
74.70
98.25
68.25
89.65
88,30
75.15
83. 13
CE
72.90
97.00"
82,60
84,85
82.65
70.75
78,
SINI-FGSM
RCE
84.85
99.55*
91.70
92.75
92.00
84.05
89.07
FECE(OurS)
84.70
99.50*
91.75
92.95
92.55
83.15
89.02
WACE(Ours)
86.10
99.65*
93,70
93.75
93,90
82,20
89. 93
OSINI-FOM((Ous)
WFCL(Ours)
99,70%
93.85
CE 84.40
58,
68.75
903.35
89.25
B0.70
$6.69
VMI-PGSM
97.90*
90.55
82,70
87.78
FBCE(Ours)
85.30
98.00"
90.10
91.40
90.40
82.75
87.99
QVMI- FGMM(OGSS((Un))
WACHOOury
87.05
98.95
92.70
94.33
93,20
84.60
90.38
WFCB(Ourr)
87.20
98,90
92,60
94.45
93.30
85.05
90.52
VD616
12
V11
64.
12
0-
389 250 600
Figure 5: The untargeted attack success rates (%) on the victim models with adversarial exam- ples generated by QI-FGSM 8/255) for CIFAR10/100 and ImageNet (the surrogate model is VGG16) when varying the number the top-n wrong categories ñ.
B DETAILED EXPERIMENTAL ANALYSIS
In this section, we first introduce the experimental setup, then we compare our method with com- petitive baselines under various experimental settings.
B. EXPERIMENTAL SETUP
Datasets. Different methods are compared on CIFARIO/100 (Krizhevsky 2009) and ImageNet (Russakovsky et al. 2015). We randomly pick 2,000 clean images from the CIFAR10/100 test dataset and 1,000 clean images from the ILSVRC 2012 validation set (Russakovsky et al. 2015). where the selected images are correctly classified by both surrogate model and victim model.
Models. We consider nine naturally trained networks, including VGG16 (V16) (Simonyan & Zisserman 2015), VGG19 (V19) (Simonyan & Zisserman 2015), ResNet50 (R50) (He et al.
25

---

Under review as a conference paper at ICLR 2023
Table 3: The untargeted attack success rates (%) of six naturally trained models and two adversari- ally trained models on ImageNet using various transfer attacks and two query attacks with the attack strength 8/255. The adversarial examples are generated on ResNet50. denotes the attack success rates under white-box attacks. Avg. means to calculate the average value of the naturally trained models except *. Note that Q in Q-FGSM.
Model
Attack
Loss
V16
V19
R5D
R152
1-v3
M-v2
Arg.
a-1-v3
ne-IR-v2
Square( 0)
37.5
35.3
18.1
12.9
18.2
35.8
26.3
13.8
13.4
Square(
38.8
36,5
20.2
14.6
19.1
37.4
27.8
16.3
Square( Q 10)
44.4
41.4
25.6
18.3
24.1
43.7
32.9
21.7
17.6
PRGF(Q 10)
6.9
5.3
80.2"
3.2
7.1
5.7
3.2
1.7
CE
90.4
42.3
39.4
FGSM
RCE
37.7
36.2
80.5*
30.6
24.6
35.2
32.9
19.0
10.2
FECE/Ours)
43.50
41.4
90.0*
42.4
30.7
41.1
39.8
20.0
11.0
Q-FGSM
WACE(Ours)
44.2
42.5
90,74
42.6
31.2
42.8
40.7
20.1
10.8
(Ours)
WFCE(Qurs)
43.60
42.3
90.8*
41.9
31.1
43.5
40.5
19.5
11.4
CE
32.1
T00*
45.0
17.0
33.2
31.4
I-FGSM
RCE
28.9
28.0
100*
35.2
16.2
29.7
27.6
8.4
5.7
QL-GGSM
(Ours)
WACE(Ours)
39.9
36.6
100
53.0
22.6
44.4
39.3
10.9
7.3
CE
55.4
53.0
100
70.7
37.8
58.6
55.1
17.1
11,9
MI-FGSM
RCE
57.1
56.6
100*
63.6
35.9
56.2
53.9
16.1
11.6
FECE/OurS)
58.70
57.3
100*
65.9
37.4
56.3
55.1
16.6
11.8
N
QMI-FGSM
WACE(OurS)
62.5
60.5
100
74.8
43.1
61.2
19.9
(Ours)
WFCE(Ours)
63,30
58.9
100
74.9
41.9
66.1
61.0
19.8
13.8
DI FGSM
CE
62.7
51.5
RCF
46.1
46.9
100*
53.0
36.1
48.4
46.1
12.2
9.5
QDI-FGSM
WACH(Our))
61.0
56.9
100
68.9
41.5
64.5
58.6
16.9
12.7
(Ours)
CE
68.7
68.2
100
81.8
31.4
72.3
68.3
24.2
16.7
SINIFGGM
RCE
70.5
100*
81.0
52.5
FECE(Our))
72.30
71.1
100
84.0
52.5
74.2
70.8
23.7
16.4
QSIN-FGSM
WACH(Ours)
73.6
(Ours)
WFCF(Ours)
75.10
71.3
100
87.4
$7.0
79.3
74.0
26.0
21.1
CE
69.1
68.5
99.9*
83.9
53.1
72.1
69.3
21.4
16.9
VML-FGSM
RCF
69.9
70.9
100*
79.5
52.1
71.8
68.8
22.1
18.7
FECE/OurS)
75.90
74.1
100*
83.2
55.3
74,9
72.7
22.8
19.1
QVMI-FGSM
WACE(QUrs)
100
88.2
76.9
(Ours)
WFCE(OUrs)
78.90
75.0
100
88.8
60.4
81.5
76.9
27.2
22.7
VO026 Imaggdiict
153
X53
D121
D122
28
Figure 6: The untargeted attack success rates (%) on the victim models with adversarial exam- ples generated by QI-FGSM (e = 8/255) for CIFARI0/100 and ImageNet (the surrogate model is VGG16) when varying the number of queries Q
2016). 52 (R152) (ee et al. 2016), ResNext50 (RN50) (Xie et al. 2017). WideResNet- 16-4 WWRN-16-4) (Zagoryyko & Komodakis 2016). Inception-v3 (I-v3) (Szegedy al.) 2016), DenseNet121 21 (D121) (Huang et al. (017) and MobileNet-v2 (M-v2) (Sandler et al. 2018 and two adversarially trained models, namely adversarial Inception-v3 (a-I-v3) and adversarial ensemble Inception- Reshettv22 (ac-IR-v2) (Tramèr et al. 2018)) We choose VGG16 and ResNet50 source models for CIFAR 10/100 and ImageNet, respectively. The CIFAR10/100 models are trained from scratch and the ImageNet models are the pretrained models in (Wightman 2019 Huang 2017).
Baselines. Several most recently proposed methods aiming at generating transferable adversarial
examples taken baselines, i.e. FGSM (Goodfellow et al. 2015), I-FGSM (Kurakin et al.
2017 MI-FGSM (Dong et al. 2018), DI-FGSM (Xie et al, al, 2019). SI-NI-FGSM (Lin et al. 2020)
and VMI-FGSM (Wang He 2021) which implemented in pytorch repository (Kim 2020
26

---

Under review as a conference paper at ICLR 2023
Table 4: The untargeted attack success rates (%) six naturally trained models for CIFARIO using various transfer attacks and two-query attacks with the attack strength e 66/255. The adversarial examples are generated by ResNet50. denotes the attack success rates under white-box attacks.
Average means to calculate the average value except Note that Q = 1 in Q-FGSM.
Model
Attack
Loss
V16
V19
R50
WRN- 16-4
DI21
M-v2
Average
Squarii =
42.10
45.00
51.97
PRGFIQ I0)
9.25
10.40
43.45
19.25
16.55
15.40
14.17
CE
66.00
69.55
80.259
75.85
73.95
77.95
72.78
FGSM
RCE
60.90
64.35
74,90
71.35
68.30
76.00
68. 18.18
FECE(Ous))
73.45
75.50
84,65
80.35
76.65
80.85
77.36
Q QGGSMM(Our))
WACE(Ours)
71.25
77.35
79.30
74.59
WFCF:(Ours)
70.75
71.35
83.00
76.00
73.90
79.75
74.47
84.55
86,70
100"
99.05
97.55
94.50
92.47
I-FOSM
RCE
84.50
85.60
100*
99.15
96.70
95.50
92.29
FECE(OurS)
88,70
90.10
100*
99.60
98. 20
96 40
94. 60
WACE(Ours)
89.30
QI-FGSMMOUr))
WFCE(Ours)
92.00
92.00
100
99,80
98.55
97.55
95.98
99.95*
59.50
MI-FGSM
RCE
94.30
95.35
99.85*
98,90
97.90
96.25
96.54
FECE/OurS)
97.45
98.10
100
100
99.70
98.10
98.67
(MI-FGSM((On))
WAC E(Our))
97.35
97.45
100
99.80
99.20
98.25
98.41
RosNet50
WFCE(Ours)
97.80
97.45
100
99.75
99.
99.10
98.68
DLFG
RCE
91.35
91.65
99.45*
98.155
97.05
96.40
94.92
FFCF(Our))
95.20
99.75
QDI-FGSM(Ours)
E(Our)
95.95
95.00
100*
99.80
99.20
98.45
97. 68
WFCE(Ours)
95,80
95.85
100
99.80
99.20
98.75
97.88
CE
96.50
97.10
99395*
99.35
98.75
97.85
97.95
SINIFGGM
RCE
98.25
98.75
100*
99.95
99.70
99.35
99.2
FECE(Our))
(SSM)U))
WFCF(OOrs)
WAC ((urs)
98,70
98.95
98.70
100
99.95
100
99.90
99.90
98.80
99.22
99.30
CE
96.80
97.10
99.95
99.25
98.85
97.40
97.88
VMI-FGSM
RCE
97.65
97.70
99.80*
99.30
99.20
98.90
V8.55
FECB/Ours)
97.45
97.85
100*
99.70
99.25
97.70
98.39
WACrs(Orr)
98.55
98.60
100
99.75
99.70
99. 30
99.18
FUMI-FUSMM(OUS)
WFCE(Ourr)
98.40
99.65
99.55
99.06
W18354 Hio
W15--1-4
A1c1
P-0
200
Figure 7: The untargeted attack success rates (%) on the victim models with adversarial exam- ples generated by QI-FGSM (e = 8/255) for CIFARIO/ and ImageNet (the surrogate model is ResNet50) when varying the number of the top-n wrong categories ñ.
In addition, the RCE loss (Zhang et al. 2022a), which integrated into the above transfer attacks instead of cross-entropy loss (CE), and two black-box query attacks, i.e. P-RGF (Cheng et al. 2019) and Square (Andriushchenko et al. 2020), are taken as baselines to further validate the effectiveness of our method.
paramterssss On CIFARI0/100 and ImageNet, we set the maximum perturbation, number of iteration and step size T, 8 8/255, 10, 0.8 /25 or 16 16/255, 10, 1.6 We set the decay factor = 1.0 for MI-FGSM, SI-NI-FGSM and VMI-FGSM. The transformation probability is set to 0.5 for DI-FGSM. The number of scale copies is 5 for SI-NI-FGSM. The number of sampled examples in the neighborhood and the upper bound of neighborhood are 20 and 1.5, respectively. TTe number of query, which is the same that of our query prior-based attacks, is set to Q 10
27

---

Under review as a conference paper at ICLR 2023
Table 5: The untargeted attack success rates (%) on six naturally trained models for CIFAR 100 using various transfer attacks and two query attacks with the attack strength e 16/255. The adversarial examples are generated by ResNet50. denotes the attack success rates under white-box attacks. Average means to calculate the average value except Note that Q = 1 in Q-FGSM.
Model
Attack
Loss
V16
R50
RN30
WRN-16-4
D121
M-v2
Average
Qq11
74.90
71,80
76.
PRGH(QE1))
18.05
60.95
26.65
26.40
25.00
17.15
22,65
CE
84.75
91.15"
86.03
88.25
85.80
86.00
86.29
FGSM
RCE
83.55
90.90"
85,80
87.65
85.25
86.55
85,
Q-FUSM((UsS)
WACH(Ours)
84.30
91,90
87.00
89.30
86.00
87.40
86.8
CE
99.90
90.35
75.50
LFGSM
RCE
86.80
99.90
94.30
95.85
94,50
85.95
91.48
FECE/Ours)
87.75
99.85
93.95
94,
84.90
91.25
(GSSO(((Our))
WACE(OurS)
88.20
99,90"
96.05
96.95
95.60
85.70
92.5
(FCE((Our)
89.15
99,90
95.95
97.90
96.35
87.35
93.34
CE
99.70"
93.95
94.75
93.21
MI-FGSM
RCE
94.80
99.45"
96.00
97.10
96,00
93.20
95.42
FECE/OUTS)
(MI-FGSM(OOrs)
WACH(OurS)
94.70
99.80"
97.05
98.55
97.00
91.90
95, 8-4
WFCE/Ours)
94.80
99,85*
97.10
98.30
97.15
92.55
95.98
ResNet50
CE
87.65
19,67
93.75
V5.00
93.90
B3.43
50.75
DI-FGSM
RCE
91.70
99,30"
94.50
96.10
94.60
89.10
93.2
PECE/Ours)
99.45*
(DLMOO((())))
WFCF(Our))
WACEFOur))
92.85
93.25
99.80"
97.00
96.75
97.80
97.05
91.10
90.95
95.13
CE
91.95
99,70*
93.70
96.40
95.50
91,40
95,79
SINI-FGSM
RCE
97.50
100*
98.35
98.80
98.95
97.35
98.19
FECE(OuTS)
97.45
99,95
98.05
98.90
99,00
96.35
97.95
WACE(Ours)
96.90
100*
98.65
98.65
98.85
95.25
97. 66
OSINI-FOM((Ous)
WFCL(Ours)
98.75
97.
CE 95.85
19,75
96.20
98.15
97.20
94,.15
96.31
VMI-PGSM
70*
97.90
98.
95.50
97.35
FBCE(Ours)
97.25
99.85*
97.30
98.50
98. 15
95.70
97. 3.
QVMI- FGMM(()S)(OUn))
WACH/Oury
97.40
99.85*
98.05
99.25
98.60
96.30
97.92
WFCB(Ours)
97.65
99,99"
97.90
99.35
98.45
96.05
97.88
VIA
%0
10-
Figure 8: The untargeted attack success rates (%) on the victim models with adversarial exam- plcs generated by QI-FGSM (e = 8/255) for CIFAR10/100 and ImageNet (the surrogate model is ResNet50) when varying the number of queries Q
for Square and P-RGF. For the proposed method, we set Ā=1 and Q = 10 for CIFAR1O, ū=5 and Q 10 for CIFAR100 and ImageNet. Table (00ecluuesccluees the best parameter combination of K. and T for the FECE loss on different transfer attacks and datasets with the ResNet50 as the surrogate model.
B.2 COMPARISON WITH OR WITHOUT THE QUERY PRIORS ON THE UNTARGETED ATTACKS
B.2.1 ATTACKING A NATURALLY TRAINED MODEL.
To validate that the query priors enhance the transferability of the transfer attacks, per- form six transfer attacks with or without the query priors to attack six naturally trained models for CIFAR10/100 and ImageNet. As shown in Tables
and 9 when the attack strength
28

---

Under review as a conference paper at ICLR 2023
Table 6: The untargeted attack success rates (%) six naturally trained models and adversari- ally trained models for ImageNet using various transfer attacks and two query attacks with the attack strength 16/255. The adversarial examples generated by ResNet50. denotes the attack
success rates under white-box attacks. Avg. means to calculate the average value of the naturally trained models except Note that Q in Q-FGSM.
Model
Attack
Less
V16
V19
R50
R152
1x3
M.v2
Arg.
a-1x3
Qquare(Q=0)
77.8
73.2
42.2
30.7
40.4
72.2
56.1
35.1
30.4
Qquaro(Q=1)
74.6
41.9
73.0
57.6
37.3
32.2
SquaneQQ=1))
83.8
80.6
55.8
43.4
51.9
79.5
65.8
47.3
40.1
PRGF(Q=10)
12.1
11.0
88.9
6.7
13.6
10.9
5.9
3.6
61.4
FGSM
RCE
62.8
61.3
80.6*
44.4
38.1
60.7
53.5
31.8
18.6
FECE(Ours)
66.7
87.0*
42.0
61.6
57.3
33.2
19.1
Q.FGSM
WACE(Ours)
66.9
63.8
86.8*
51.8
42.3
63.3
57.6
33.7
21.3
(Ours)
OFCF(Ours)
66.2
63.6
86.9*
51.4
42.8
63.5
57.5
33.2
20.3
I-FGSM
CE
49.3
46.8
T009
29.2
53.6
49.1
15.1
T0.0
RCE
52.4
49.0
100
60.9
30.2
52.4
49.0
15.9
9.6
QI-FUSM
(Ours)
OACE(Ours)
61.8
57.1
100
75.6
36.4
64.6
59.1
17.4
11.2
R
77.1
75.7
100*
84.8
56.2
75.5
73.9
27.8
18.7
MI-FGSM
RCE
82.8
81.3
100*
84.0
$7.9
80.1
77.2
28.5
19.2
FECFFOurs)
84.3
81.4
100*
85.5
57.6
80.6
77.9
28.8
18.6
QMI-FGSM
78.9
100
61.0
82.5
78.5
28.6
23.5
(Ours)
OFCE(Ours)
83.5
80.6
100
88.8
63.2
83.8
80.0
30.2
22.4
75.7
DI-FGSM
RCE
75.8
72.3
100*
81.3
54.6
74.8
71.8
18.7
13.8
QDI-FGSM
OAC
81.0
78.5
100
89.8
62.7
83.3
79.1
24.2
17.0
(Ours)
CE
91.8
91.2
T00
96.6
79.3
9T.9
90.2
41.2
30.0
SINI-FGSM
RCE
94.3
100
79.5
94.4
37.0
26.7
FECE(OurS)
93.9
94.5
100
97.5
80.2
94..3
92.08
40.1
28.8
FSSN
OAC
78.0
31.4
(Ours)
WFCF(Ours)
90.7
89.8
100*
96.4
77.9
93.3
89.6
39.8
32.1
CE
89.3
53.3
100
95.7
74.2
38.6
87.2
38.1
32.6
VMI-FGSM
RCF
91.7
91.2
100*
96.5
80.1
91.2
90.1
44.
38.9
FECE(Ours)
92.3
92.5
100*
97.5
81.0
92.2
91.1
44.6
37.2
QVMI-FOSM
WACE/Ours)
82.3
93.7
91.4
(Ours)
WFCE(Ours)
92.1
91.8
100
97.6
82.2
93.7
91.5
47.2
41.8
Table 7: The untargeted attack success rates (%) on six naturally trained models for CIFAR10 using various transfer attacks and two query attacks with the attack strength 8/2 8/255. The adversarial examples generated by VGGI6. * denotes the attack success rates under white-box attacks. Average means to calculate the average value except *, Note that Q = 1 in Q-FGSM
Model
WRN-I6-1
Average
Square (Q) 10)
12.65
13.00
14.15
18.75
19.40
27.15
17.52
PRGE (Q = 10)
23.75*
4.30
4.20
5.00
3.20
4.90
4.72
CE
62.40*
46.90
45.19
FGSM
RCE
56.65*
41.30
38.45
42.95
39.00
44.25
41.19
Q-FGSM (Owrs)
72.85
51.60
LFGSM
CE
97.80*
68.95
61.45
72.65
68.30
70.90
68.45
RCE
96.80*
10
60.80
72.20
68.
70.65
67.99 97.97
QI-PGSM (Ours)
WACE
98.80
74.35
68.65
80.90
76.50
80.35
76.15
CE
93.35*
75.75
70.75
76.05
74.00
74.10
74.13
MI-FOSM
VGG16
QML-FGSM (Ours)
WACE
96.65
80.80
77.65
84,20
$0.95
$4.70
$1.66
DI-FGSM
CE
91.30*
71.50
69,20
RCE
89.60*
67.20
61.25
68.90
64,90
68.10
66.07
QDI-FGSM (Ours)
WACE
95.85*
74.25
71.15
$1.40
76.45
$0.80
76.81
CE
94.00
72.10
68. 10
77.90
72.85
75.55
73.3
SI-NI-FGSM
RCE
98.60
85.60
80,30
87.45
85.45
86.35
85.03
(Ours)
VMI-FGSM
CE
$4.90"
80.00
76.60
81.60
78.40
79.95
79.31
RCE
91.70*
77.30
75.50
79.10
76.65
78.75
77.46
QVMI-FOSM (Ours)
WACE
97.10*
84.40
83.35
88.40
85.70
89.10
86.19
= 8/255, the query prior-based attacks with the WACE loss can not only significantly improve the transfer attack success rate of the black-box setting but also improve the attack success rate of the white-box setting on different surrogate models and datasets. comparison with the CE loss, the average increase of the ASR is 2.98 to 4.43% on Q-FGSM and 4. 12 to 15.48% on the other five
29

---

Under review as a conference paper at ICLR 2023
Table 8: The untargeted attack success rates (%) on six naturally trained models for CIFAR 11FARR10OAE using various transfer attacks and two query attacks with the attack strength = 8/255. The adversarial examples are generated by VGGl6. denotes the attack success rates under white-box attacks. Average means to calculate the average value except
Note that Q = 1 in Q-FGSM.
Model
Attack
Loss
V16
R50
RN50
WRN-1644
D121
M-x2
Average
Square (Q
36.75
41.40
38.74
PRGF 10)
46.20*
6.90
8.10
8.00
6.95
6,95
7,38
CE
85.75*
63.15
64.30
68.65
66.25
06.45
65.76
FGSM
RCE
83.55*
61.05
63.25
67.20
65.25
64.40
64.23
Q-FGSM (Ours)
WACE
85.30*
63.20
65.65
68.75
67.00
67.65
66.45
CE
99.60*
54.10
I-FGSM
RCE
99.50*
47.25
56.30
60.00
54.10
52.90
54,11 11
QI-PGSM (Ours)
WACE
99.75*
60.70
69.45
72.05
66.70
61.50
66.08
MI-FGSM
CE
99.30
69.30
72.75
76.35
71.10
69.33
71.77
RCE
99.10*
68.20
72.50
76.05
72.55
70.25
71.91
VGG16
QMI-FOSM (Ours)
WACE
99.30*
82.50
76.45
78.59
CE
98.60*
39,30
64.05
66.35
60.25
$8.50
61.69
FGSM
97.30*
67.70
62.23
QDI-FGSM (Ours)
WACE
99.00
67.05
73.45
75.60
69.45
69.40
70.99
SI-NI-FOSM
CE
96.75*
64.35
70.10
73,90
70.65
69.44
RCE
99.60*
71.65
76.15
80.05
76.10
75.25
75.84
QSI-NI-FGSM (Ours)
WACE
99.90
77.15
81.40
83.70
80.55
77.75
80.11
Cb
99.55*
79.42
VMI-FGSM
RCE
99.05
79.20
80.20
83,90
80.30
79.65
80.65
QVMI-FGSM (Ours)
WACE
84.40
84.47
Table 9: The untargeted attack success rates (%) on six naturally trained models and two adver- sarially trained models for ImageNet using various transfer attacks and two query attacks with the attack strength 8/255. The adversarial examples are generated by VGG16. denotes the attack success rates under white-box box attacks. Avg. means to calculate the average value of the naturally trained models except Note that Q 1 in Q-FGSM.
Modal
Attack
Loss
VI6
V19
R50
RI52
[-v3
M-v2
Avg.
8-1-v3
ac-IR-v2
Square (Q = 0)
40.2
34.5
16.5
12.4
17.9
34.1
25.9
12.3
11.2
Square (Q=
41.2
35.7
17.8
13.5
19.2
35.1
27.1
14.5
12.4
Square (Q 10)
47.7
41.6
23.2
16.2
23.6
41.3
32.3
20.3
16.8
PRGF (Q =
88
21.1
4.3
2.5
FGSM
CE
95.6*
72.8
32.8
24.6
26.0
42.0
39.6
18.0
T0.T
RCE
95.0"
67.0
27.6
18.2
21.1
38.3
34.4
17.0
7.9
Q-FGSM (Ours)
WACE
96.4"
72.7
33,9
24.4
26.4
43.9
40.3
18.1
10.4
CE
99.4"
87.9
27.88
18.4
15.0
37.3
37.3
7.8
3.9
LFGSM
18.4
7.0
QI-FGSM (Ours)
WACE
100
90.6
33.99
22.6
21.2
46.6
43.0
8.5
5.9
MI-FGSM
CE
99.4
95.8
46.5
33.5
58.3
53.4
13.8
RCE
100*
94.5
38.3
27.3
28.3
55.4
48.8
14.0
7.2
VGG16
QMI-FGSM (Ouns)
WACE
100
96.5
52.4
39.5
36.7
68.0
58.0
16.1
9.2
94.1
38.1
8.8
DI-FUSM
RCB
99.9*
90.9
27.6
17.7
20.2
44.8
40,2
9.0
4.5
QDLFGSM (Ours)
WACE
100*
94.9
45.6
33.5
10.7
SI-NI-FGSM
CE
100
98.0
56.6
41.8
43.8
70.3
62.1
17.7
11.5
RCB
100
97.7
54.3
41.1
40.5
70.4
60.8
16.9
10.3
QSI-NI-FGSM (Ours)
WACE
100
97.5
64.5
51.6
47.3
75.4
67.3
21.1
13,9
CE
99.4
98.0
62.4
48.5
43.6
72.8
65.1
17.3
11.3
VMI-FGSM
96.1
55.4
68.4
16.7
QVMI FGSM (Ours)
WACE
100
98.1
69.2
54.6
50.5
78.2
70.1
19.8
14.5
query prior- brsed- transfer attacks for CIFAR1O, 0.69 to 0.82% on Q-FGSM and 3.69 to 11.18% on the other five query prior- prior-based transfer attacks for CIFAR100, 0.7 to 1.3% on Q-FGSM and 4.6 to 7.9% the other five query prior-based transfer attacks for ImageNet. In comparison with the RCE loss, the average increase of the ASR is 8.43 to 9. 9.64% on CIFAR10 and 2.96 10.98% on the other five query prior-based transfer attacks for CIFAR1O, 1.95 to 2.22% on Q-FGSM and 0.86 11.97% on the other five query prior-based based transfer attacks for CIFAR100, 5.9 to 7.8% on Q-FGSM and 4.2 to 13.6% the other five query prior-based transfer attacks for ImageNet.
In addition, as shown in Tables comparison with the CE and RCE losses, the query prior- based attacks with the WACE loss still effectively enhance the transferability of the gradient iterative- braat attacks on different surrogate models and datasets.
6
and 12
when the attack strength c = 16/255, in
30

---

Under review as a conference paper at ICLR 2023
Table 10: The untargeted attack success rates (%) six naturally trained models for CIFARIO using various transfer attacks and two query attacks with the attack strength e = 16/255. The adversarial examples are generated by VGGl6. denotes the attack success rates under white-box attacks.
Average means to calculate the average value except Note that Q = 1 in Q-FGSM.
Model
Attack
Loss
V16
V19
R50
WRN-164
D121
M-v2
Average
Square (Q 10)
42.55
57.75
58.10
PRGF (Q) 10)
39.30"
12.80
10.55
13.60
11.70
12.60
12.25
CE
70.50*
64.65
65.
67.60
61.75
76.25
67.19
FGSM
RCE
66.35*
62.05
63.00
64.75
59,40
74,20
64.68
Q-FOSM (Ours)
WACE
77,70
67.50
69.75
71.45
67.25
79.35
71.06
CE
99.75*
89.25
84.98
1-FGSM
RCE
99.45-
87.15
80.75
89.40
85,25
86,70
85.85
QI-FGSM (Ours)
WACE
99,90
91.60
85,95
94.30
90.75
90.75
90.67
MI-FGSM
CE
98.90"
34.00
50.00
V3.45
91.15
90..5
91.87
RCE
38.50*
93.15
90.00
93.15
91.40
91.45
91.88 83
VGG16
QMI-FGSM (Ours)
WACE
99.35*
95.55
96.65
FGSM
CE
98.10
91.90
85.95
91.85
88,70
89.95
89.67
RCE
97.35*
87.70
88.45
QDI-FGSM (Ours)
WACE
99.00
94.25
91.50
96.00
94.35
95.60
94.34
CE
59,90
96.25
94.25
96.70
94,20
94.05
95.09
SI-N--FOSM
RCE
99.70*
97.70
96.20
98.05
96.40
97.50
97.17
QSI-NI-FGSM (Ours)
WACE
99.95*
99.30
97.70
98.80
98.40
98.10
98.46
VMI-FGSM
CE
99.85*
97.35
96.80
RCE
99.50
97.30
96.25
97.40
96.85
97.25
97.01
QVMI-FGSM (Qurs)
WACE
99.80
98.70
97.80
98.35
98.62
Table 11: The untargeted attack success rates (%) on six naturally trained models for CIFARI00
using various transfer attacks and two query attacks with the attack strength c = 16/255. The adversarial examples generated by VGG16. denotes the attack success rates under boite-box
attacks. Average means to calculate the average value except *. Note that Q = 1 in Q-FGSM.
Model
Attack
Loss
V16
R50
RN50
WRN-I6-4
D121
M-v2
Average
Square IQ PRGF (Q = 10)
76.10
72.20
74.25
78.70
71.10
83.85
76.03
63.65*
15.45
18.35
17.60
14.30
14.85
16.11
CE
91.50*
84.80
85.90
87.25
$4.80
$5.9
FGSM
RCE
90.95*
83.95
85.40
86.50
84.00
86.35
85.24
Q.FGSM (Ours)
WACE
91.60*
85.70
86.55
88.10
85.15
87.50
86.6
CE
100*
68.25
74.30
78,40
71.35
09.00
72.42
I-FGSM
RCE
100*
66.75
73.50
78.60
72.20
74,25
73.06
QI-FGSM (Ours)
WACE
100
81.30
81.65
MI-FGSM
CE
100
87.95
88.50
91.10
87.35
86. 15
88.21
RCB
100
88.85
15
92.85
89.50
VGG16
QMI FGSM (Ours)
WACE
100
92.65
92.20
95.35
92.00
90.85
92.61
CE
99.759
77.35
81.25
86.25
80.10
79.30
80.93
DI-FGSM
RCE
99.70*
78:40
82,75
86.30
81.10
83.00
82.31
QDI-FGSM (Ours)
WACE
99.95*
85.80
88.60
92.10
87.30
87.30
88.22
CG
99.85*
92.45
90.15
SI NI FGSM
RCF
100
91.10
92.55
93.30
92.10
93.40
92, 49
QSI-NI-FGSM (Ours)
WACE
100
93.10
92.85
95.95
93.30
92.75
93.59
VMI-FGSM
CF
100
93.25
92.30
95.10
92.75
91.65
93.01
RCE
100
93.95
93.80
95.75
93.75
93.65
94,
QVMI-FOSM (Ours)
WACE
99.95*
95.75
94.45
95.32
In conclusion, through the comparison with or without the query priors, the low attack strength, i.e. c= 8/255, the query prior-based attacks can significantly enhance the transferability of adversarial examples attack the naturally trained models. At the high attack strength, i.e. 16/255, most query prior-based attacks can enhance the transferability of adversarial examples, but the average ASR of QSI-NI-FGSM has a slight decrease on ImageNet with VGG16 as the surrogate model.
B.2.2 ATTACKING ADVERSARIALLY TRAINED MODEL
Tables 3 and 9 perform six transfer attacks with or without the query priors to attack two adversari- ally trained models for ImageNet on different surrogate models when the attack strength 8/255. The results show that the query prior-based attacks with the WACE loss can enhance the trans- ferability of the gradient btesa attacks when attacking the adversarially trained model. In comparison with the CE loss, the increase of the ASR 0.1 to 0.3% on Q-FGSM and 0.7 to 6.3% on the other five transfer attacks for ImageNet (except for slight decrease on Q-FGSM with ResNet50
31

---

Under review as a conference paper at ICLR 2023
The untargeted attack success rates (%) six naturally trained models and two adver- sarially trained models for ImageNet using various transfer attacks and two query attacks with the attack strength 16/255, The adversarial examples are generated by VGGI6. denotes the attack success rates under white-box attacks. Avg. means to calculate the average value of the naturally trained models except * Note that Q in Q-FGSM.
Table 12:
Model
Attack
Loss
V16
V19
R50
R152
1-v3
M-v2
Avg.
a-I-v3
ae- ne-IR-v2 v2
Square (Q 0)
79.0
72.6
39.6
27.6
38.4
70.9
54.7
32.2
27.6
Square (Q = 1)
79.4
73.3
41.1
29.8
39.7
71.7
55.8
34.8
29.1
Square (Q 10)
84.0
80.2
51.5
40.1
50.7
79.4
64.3
46.4
38.2
PRGF (Q2 = 10)
94.3*
38.9
10.3
5.7
13.1
17.0
5.8
2.1
CE
82.9
47.4
36.4
35.8
61.6
32.0
16.8
FGSM
RCB
95.4*
81.5
43.4
32.1
34.1
61.5
50.5
31.5
14.7
Q-FGSM (Ours)
WACE
95.8*
82.4
47.9
35.9
34.8
62.8
$2.8
32.7
15.9
L.FGSM
CE
99.4"
97.2
46.2
31.7
28.1
58.8
52.4
13.9
7..5
RCE
100*
96.3
35.9
25.4
22.2
52.2
46.4
14.0
QI-PGSM (Ours)
WACE
100
97.6
53.4
39.2
32.4
66.4
$7.8
15.4
CE
99.4"
98.7
69.0
54.2
$1.1
79.8
70.6
24.3
14.6
MI-FGSM
81.1
24.2
VGG16
QMI FGSM (Ours)
WACE
100
99.1
73.0
60.7
$4.9
81.7
73.9
25.5
16.1
DI-FGIM
CE
99.6*
98.6
60.2
44.8
44.6
73.8
64.4
15.6
9.2
RCB
100
97.9
50.2
38.1
37.5
68.3
58.4
14.4
8.3
QDI-FGSM (Ours)
WACE
100
98.7
67.1
53.3
50.1
80.9
70.0
17.6
12.3
CE
100
99.7
86.0
73.1
70.8
91.7
84.3
32.3
20.9
SI-NI-FGSM
RCB
100
99.6
85.1
71.0
67.6
91.1
82.9
28.4
18.5
USI-N--FGMM (Ours)
99.5
84.7
72.3
90,2
33.5
VMI-FGSM
CE
99.8
99.4
81.4
72.2
65.8
88.3
81.8
32.5
22.2
RCB
100
99.4
84.9
70.9
67.2
89.5
82.4
32.7
22.9
DVMI-FGSM (Ours)
WACE
100
99.7
87.2
78.4
70.3
90.6
85.2
37.3
28.0
Table 13: The untargeted attack success rates (%) on five naturally trained models for CIFARIO using VMI-FGSM as the baseline with the attack strength e = 8/255. The adversarial examples are generated by VGG16 and ResNet50, which are the surrogate model and the query model, respec- tively. Note that ResNet50 both the query model and the victim model.
Surrogate
Model
Model
Query
Attack
Loss
V19
R50
WRN-1644
D121
M.v2
Average
VMI FGSM
CE
80.00
76.60
81.60
78.40
79.95
79.31
VGGI6
ResNet50
RCE
77.30
75.50
79.10
76.65
78.75
77.46
QVMI-FGSM(Our))
WACE
84.50
83.35
85.40
83,90
84.45
84.32
as the surrogate model). In comparison with the RCE loss, the increase of the ASR is 0.6 to 2.5% on Q-FGSM and 1.6 to 5.2% on the other five transfer attacks for ImageNet.
In addition, as shown in Tables 6 and 12 when the attack strength = 16/255, in comparison with the CE and RCE losses, the query prior-based attacks with the WACE loss can still effectively enhance the transferability of the gradient iterative-based attacks to attack the adversarially trained models on different surrogate models (except for QSI-NI-FGSM with ResNet50 as the surrogate model attack adversarial Inception-v3).
In conclusion, through the comparison with or without the query priors, at the low attack strength, ie. 8/255, the query prior-based attacks except for Q-FGSM enhance the transferability of adversarial examples to attack the adversarially trained models. At the high attack strength, i.e. 16/255, the query prior-based attacks except for Q-FGSM can enhance the transferability of adversarial examples to attack the adversarially trained models, but QSI-NI-FGSM reduces the attack success rate.
B.2.3 ATTACKING THE OTHER MODELS
In all baseline methods, because VMI-FGSM has the highest overall performance, VMI-FGSM is selected as the baseline to further compare the transferability to the other models. Then, a surrogate model and a query model are used to generate adversarial examples to attack many other models where the query model is target victim model queried by query-prior based attack method. Here, VGG16 and ResNet50 (ResNet50 and VGG16) are used as the surrogate model and the query model respectively on CIFAR 10/100 and ImageNet.
32

---

Under review as a conference paper at ICLR 2023
Table 14: The untargeted attack success rates (%) five naturally trained models for CIFARIO using VMI-FGSM as the baseline with the attack strength = 8/255. The adversarial examples are generated by ResNet50 and VGGI6, which are the surrogate model and the query model, respec- tively. Note that VGG16 is both the query model and the victim model.
Surmggate
Model
Model
Query
Attack
Loss
V16
V19
WRN-16-4
D121
M-v2
Average
CT
80.40
82.20
94.60
90.80
88.95
87.39
ResNet50
VGGI6
VMI-FGSM
RCE
77.75
78.05
92.15
89.00
87.60
84.91
QVMI FGSM(OUrS)
WACE
88.60
87.10
96.30
93.75
92.60
91.67
Table 15: The untargeted attack success rates (%) on five naturally trained models for CIFARI00 using VMI-FGSM as the baseline with the attack strength = 8/255. The adversarial examples are generated by VGG16 and ResNet50, which are the surrogate model and the query model, respec- tively. Note that ResNet50 is both the query model and the victim model.
Sarrogate
Model
Model
Query
Allack
Loss
R50
RN50
WRN-16-4
D121
M-x2
Average
VMI-FUSM
CE
77.70
80.00
82.85
79.70
76.85
79.42
VGG16
ResNet50
RCE
79.20
80.20
83,90
80.30
79.65
80.65
QVM- PGSM(OUrS)
WACE
83.30
81.70
84.05
80.65
78.00
81.54
When VGG16 and ResNet50 are the surrogate model and the query model, respectively, as shown Tables 13 15 and the attack success rate of QVMI-FGSM is almost higher than that of VMI- FGSM (with the CE loss). Specifically, the average increase of the ASR is 5.01 % on CIFAR 10, 2. 1.12% on CIFARI00 100 and 1.78% on ImageNet. addition, the ASR of QVMI-FGSM is higher than that of VMI-FGSM with the RCE loss.
When ResNet50 and VGG16 are the surrogate model and the query model, respectively, as shown in Tables [4, 16 and 18. the attack success rate of QVMI- FGSM is also almost higher than that of VMI-FGSM (with the CE loss). Specifically, the average increase of the ASR is 4.28% on CIFAR 10, 0.64% on CIFAR 100 and 3.42% ImageNet. In addition, the ASR of QVMI-FGSM is also almost higher than that of VMI-FGSM with the RCE loss (except for CIFARIOO 100 with ResNet50 as the surrogate model and VGG16 as the query model).
Overall, the adversarial examples generated by QVMI-FGSM not only perform better on the query model but also perform better on the other models.
Why does the transferable atlack success rate of the adversarial examples generated by the surro- gate model and the query model improve the other models? Two points answer the question. First, there are similarities between models, which is also the reason why the adversarial examples have transferability. Second, attacking multiple models is similar attacking an ensemble model. Because attacking the surrogate model and the query model at the same time is similar to attacking the ensemble model consisting of them and et al. (2017) found that the adversarial examples gen- erated by the ensemble model have higher transferabilityy QVMI-FGSM has higher transferability than VMI-FGSM to the other models.
B.3 COMPARISON WITH OR WITHOUT THE FUZZY DOMAIN ELIMINATING TECHNIQUE ON THE UNTARGETED ATTACKS
B.3.1 ATTACKING NATURALLY TRAINED MODEL
To validate that the fuzzy domain eliminating technique can enhance the transferability of the trans- fer attacks, we perform six transfer attacks with or without the fuzzy domain eliminating technique to attack six naturally trained models for CIFARIO, 10, five gradient iterative- based attacks for CIFAR 100, FGSM and three latest gradient iterative-based attacks (MI-FGSM, SI-NI-FGSM and VMI-FGSM) for ImageNet. Note that, according to Table 30 when K and T = 1, the FECE loss becomes 8/255, our FECE loss can significantly enhance the transferability of the transfer attacks to attack the naturally trained models different datasets. In comparison with the CE loss, the average increase of the ASR is
the CE loss. As shown in Tables 2 and 3 when the attack strength
33

---

Under review as a conference paper at ICLR 2023
Table 16: The untargeted attack success rates (%) five naturally trained models for CIFAR100 using VMI-FGSM as the baseline with the attack strength = 8/255. The adversarial examples are generated by ResNet50 and VGGI6, which are the surrogate model and the query model, respec- tively. Note that VGG16 is both the query model and the victim model.
Sumogate
Model
Query
Model
Attack
Loss
V16
RN50
WRN-16-4
D121
M-v2
Average
CE
84.40
88.75
90.35
89.25
80,70
86.69
ResNe150
VGG16
VMI-FG5M
RCE
84.00
90.45
91.20
90.55
82.70
87.78
WACE
87.05
89.20
90.50
90.10
79.80
87.33
Table 17: The untargeted attack success rates (%) on five naturally trained models for ImageNet using VMI-FGSM as the baseline with the attack strength e = 8/255. The adversarial examples are generated by VGGI6 and ResNet50, which are the surrogate model and the query model, respec- tively. Note that ResNet50 both the query model and the victim model.
Surrogate
Query
Model
Model
Attack
Loss
V19
R50
R152
L.33
M.v2
Averuge
CE
98.0
62.4
48.5
43.6
72.8
65.06
VGG16
ResNet50
PMLFGGM
RCE
96.1
55.4
42.3
41.3
68.4
60.7
OVMI-)GSM(OUs)
WACE
97.6
69.2
50.8
44.1
72,5
66.84
6.03% on FGSM and 2.31 7.25% the other five gradient iterative-based attacks for CIFAR I0, 1.3 to 10.27% on the five gradient iterative-based attacks for CIFAR 100, 0.4% on FGSM and 2.3 to 3.4% on the latest gradient iterative-based attacks (SI-NI-FGSM and VMI-FGSM) for ImageNet. In comparison with the RCE loss, the average increase of the ASR is 12.69% on FGSM and 0.64 to 11.14% on the other five gradient iterative- attacks for CIFARIO, 10, 0.21 to 0.6% on several gra- dient iterative-based attacks (MI-FGSM. DI-FGSM and VMI-FGSM) for CIFAR 100 (the average ASR is kept I-FGSM and SI-NI-FGSM), 6.9% FGSM and 1.2 3.9% on the latest gradient iterative- attacks for ImageNet.
In addition, as shown in Tables 5 and when the attack strength 16/255, in comparison with the CE loss, our FECE loss based allacks can still effectively enhance the transferability of the gradient iterative-based based attacks on different datasets. In comparison with the RCE loss, our FECE loss based attacks can also still effectively enhance the transferability of the gradient iterative- based attacks on CIFAR and ImageNet, and keep the transferability of the gradient iterative-based attacks on CIFARION 100.
In conclusion, through the comparison with or without the fuzzy domain eliminating technique, at the low attack strength, i.e. 8/255, our FECE loss can effectively enhance the transferabilityy of adversarial examples to attack the naturally trained models on different datasets. At the high 16/255, our FECE loss can effectively enhance the transferability of ad-
attack strength, i.e. versarial examples to attack the naturally trained models on CIFAR1O and ImageNet, and keep the transferability of adversarial examples on CIFAR100.
B.3.2 ATTACKING AN ADVERSARIALLY TRAINED MODEL
Table 3 performs the three latest transfer attacks (MI- SI-NI-FGSM and VMI-FGSM) with or without the fuzzy domain eliminating technique to attack two adversarially trained models for ImageNet when the attack strength e = 8/255. In comparison with different loss functions (the CE and RCE losses), our FECE loss can enhance the transferability of VMI-FGSM and keep (or slightly decrease) the transferability of the other transfer attacks.
In addition, shown in Table 6 when the attack strength e 16/255, in comparison with the CE loss, our FECE loss can enhance the transferability of FGSM, MI-FGSM and VMI-FGSM. and keep the transferability of SI-NI-FGSM. In comparison with the RCE loss, FECE loss enhance the transferability of FGSM and SI-NI-GGSM, and keep (or slightly decrease) on MI-FGSM and VMI-FGSM.
In conclusion, through the comparison with or without the fuzzy domain eliminating technique, at the low attack strength, i.e. 8/255, our FECE loss can steadily improve the transferability of
34

---

Under review as a conference paper at ICLR 2023
Table 18: The untargeted attack success rates (%) five naturally trained models for ImageNet using VMI-FGSM as the baseline with the attack strength = 8/255. The adversarial examples are generated by ResNet50 and VGGI6, which are the surrogate model and the query model, respec- tively. Note that VGG16 is both the query model and the victim model.
Surrogate
Model
Query Model
Attack
Loss
V16
V19
R152
1-v3
M-v2
Average
CE
69.1
68.5
83.9
53.1
72.1
69.34
VMI-FGSM
ResNe150
VGGI6
69.9
70.9
79.5
52.1
71.8
QV FGSMIOOUS)))
WACE
78.6
72.5
85.2
52.5
75.0
72.76
Table 19:
The untargeted attack success rates (%) on adversarial Inception-v3 for ImageNet using various transfer attacks and a query attack with the attack strength é 8/255. The adversarial examples generated by adversarial ensemble Inception Inception-Resnct-22 Note that Q 1 in Q-FGSM and Q = 5 in the other attacks.
Attack
Square
Q-FGSM
QI-GGMM
OMI-FGSM
QUI-FGSM
OSI-N-FOSM
QVMI-FGSM
se IR-v2
16.9
23.2
13.4
22,9
17.7
24.5
28.7
VMI-FGSM. At the high attack strength, i.e. c= 16/255, the CE, RCE and FECE losses have their own advantages on different transfer attacks.
B.3.3 COMBINATION OF THE QUERY PRIORS AND FUZZY DOMAIN ELIMINATING TECHNIQUE
As shown in Tables 1 3 and 6 whether the attack strength 8/255 16/ 26/255, when at- tacking the naturally trained model, in comparison with our WACE and FECE losses, our WFCE loss can further improve the transferability of the gradient iterative- based attacks different datasets. In addition, when attacking the adversarially trained model and the attack strength = 16 255, in com- parison with our WACE and FECE losses, our WFCE loss can further improve the transferability of the latest VMIIFGSM on ImageNet.
B.4 COMPARISON WITH CURRENT BLACK-BOL QUERY ATTACKS ON THE UNTARGETED ATTACKS
and 12 whether the attack strength e = 8/255 or 16/255, when the allowed query number T0, the attack success rate of our QVMI-FGSM is much larger than that of Square and PRGF when attacking the naturally trained models on different surrogate models and datasets.
As shown Tables
10
As shown in Tables 3 6 allowed query number Q that of PRGF when attacking the adversarially trained models on different surrogate models for ImageNet.
and 12 whether the attack strength 8/255 or 16/ (6/255, when the 10, the attack success rate of our QVMI-FGSM is much larger than
As shown in Table when the attack strength e = 8/255 and the allowed query number Q = 10, the attack success rate of our QVMI-FGSM is larger than that of Square when attacking the adversarially trained models on ImageNet.
To highlight the advantages of the query prior- attacks for attacking the adversarially trained models when compared with Square, we set adversarial ensemble Inception- Resnet-v2 PreptiionRReseet-222 as the sur- rogate model rather than the naturally trained models (i.e. VGG16 or ResNet50) and adversarial Inception-v3 3 as the victim model, and reduce the query number from 10 to 5 (i.e. Q 5). As shown in Table [9] when the attack strength 8/255, by comparing the best query baser attacks with Square, the increase of the ASR is 1.88% As shown in Table 20 when the attack strength is 16/255, the increase of the ASR is 7.5%.
In conclusion, (i) through the comparison with Square, whether the attack strength is low high, the ASR the query prior- prsor-based attacks is far greater than that of Square for attacking six naturally trained models. When attacking two adversarially trained models, at the low attack strength, i.e.
35

---

Under review as a conference paper at ICLR 2023
The untargeted attack success rates (%) on adversarial Inception-v3 for ImageNet using various transfer attacks and a query attack with the attack strength e 16/255. The adversarial examples are generated by adversarial ensemble Inception Resnet-vv.. Note that Q in Q-FGSM and Q 5 in the other attacks.
Table 20:
2-I-V3
Square
O-FGSM
QL-FSSM
FMIM
QDI-FGSM
OSENN-FGSM
OVMI-FGSM
I--12-2
39.4
41.3
21.4
36.3
28.3
38.5
46,9
Table 21: The untargeted attack success rates (%) on five naturally trained models for CIFARIO using I-FGSM as the baseline with the attack strength 8/255. VGG16 is the surrogate model and the query number of QI-FGSM is I, i... Q
Model
V19
R50
WRN-16-4
D121
M--2
Average 68.45
I-FGSM
CE
68.95
61.45
72.65
68.30
70.90
VGGI6
RCE
68.10
60.80
72.20
68.10
70.65
67.97
OI-FOSMIQ=
WACE
74.60
68.70
81.50
76.55
80.70
76.41
e = 8/255, some query prior-based attacks are better than Square (Q = 10). At the high attack strength, i.c. e 16/255, Square (Q= 10) is better than the query prior-based attacks and Square (Q = 0) is better than the transfer attacks (i.c., the family of FGSMs). However, when we use the adversarially trained model as the surrogate model and reduce the query number, regardless of whether the attack strength is low or high, the ASR of the query prior-based attacks is greater than that Square for attacking the other adversarially trained models. (ii) P-RGF is inefficient at limits of few queries on six naturally trained models and two adversarially trained models for CIFAR10/10 and ImageNet. The ASR of the query prior-based based attacks is far greater than that of P-RGF.
B.5 ABLATION STUDY ON THE UNTARGETED ATTACKS
B.5.1 DIFFERENT NUMBERS OF THE TOP-N WRONG CATEGORIES
Figures 5 and respectively evaluate the effect of different ñ on the attack success rates of five nat- urally trained victim models and two adversarially trained victim models when these victim models are attacked by QI-FGSM (e- 8/255) with VGG16 and ResNet50 for CIFAR 10/100 and ImageNet. As shown in Figures 5 and 7 when vi greater than a certain threshold, the attack success rate will not be improved, e.g., Figure S shows that the threshold is 2 for CIFAR10, 10 for CIFAR100 and 5 for ImageNet approximately. y, and Figure 7 shows that the threshold is 2 for CIFARIO, for CI- FAR100 and 10 for ImageNet approximately. Because increasing ñi increases the calculation time of the gradient, ñ is not the bigger the better.
B.5.2 DIFFERENT QUERY NUMBERS
Figures 6 and respectively evaluate the effect of different Q on the attack success rates of five nat- urally trained victim models and two adversarially trained victim models when these victim models are attacked by QI-FGSM (e = 8/255) with VGG16 and ResNet50 for CIFAR10/100 and Ima- geNet. On the victim models, the more the query, the greater the attack success rate. As shown in Figure 6 when the query number increases from to 10, the attack success rate increases by 3.5% most for CIFAR10, 10, 10% at most for CIFAR 100 and 5% at most for ImageNet approximately, and the increased attack success rate is mainly increased in the first five queries. As shown in Figure B when the query number increases from CIFAR 10, 8% at most for CIFAR 100 and 5% at most for ImageNet approximately, and the increased attack success rate is mainly increased in the first five queries.
10, the attack success rate increases by 3% most for
B.5.3 COMPARISON WITH OR WITHOUT THE QUERY PRIORS WHEN Q =
When Q 0. the query basor- methods will be transformed into the usual methods, e.g., QI- FGSM + I-FGSM. To further explore the effectiveness of the query-prior based method, we set the query number as 1 and I-FGSM is selected as the baseline.
36

---

Under review as a conference paper at ICLR 2023
Table 22: The untargeted attack success rates (%) five naturally trained models for CIFARIO using I-FGSM as the baseline with the attack strength = 8/255. ResNet50 is the surrogate model and the query number of QI-FGSM is I, i... Q
Model
Artack
Lass
V16
V19
WRN-16-4
D121
M-v2
Average
CE
59.85
62.55
93.95
88.70
84.35
77.88
ResNet50
LFGSM
QI-FGSM(Q=I)
WACE
68.45
68.55
96.85
93.25
89.60
83.34
Table 23: The untargeted attack success rates (%) five naturally trained models for CIFAR1OM using I-FGSM as the baseline with the attack strength = 8/255. VGG16 the surrogate model and the query number of QI-FGSM is 1, i.e., Q 1.
Model
Atlack
Loss
R50
RN50
WRN-16-4
D121
M-V2
Average
CE
30.70
58.70
61.15
54.10
50.65
55.06
I-FGSM
VGG16
47.25
56.30
54.10
52.90
54.11
QI-FOSM(Q=1)
WACE
58.95
68.35
70.55
64.25
$8.95
64.21
25 and 26 even if the number of query Q is 1, the query prior- based method can still signfiicnnly improve the transferability of the baseline method on different surrogate models and different datasets with attack strength 255
As shown in Tables 21
22
23
B.5.4 FURTIER VERIFY THE EFTECTIVENESS OF THE QUERY PRIOR-BASED ATTACKS
To further verify the effectiveness of the query prior-based attacks, make a more fair compar- ison that OVMI-FGSM compared with the combination of VMIIFGSM and Square. As shown in Tables 27 28 and 29 when the attack strength
8/255 and the allowed query number Q 10, the results of our QVMI-FGSM have higher performance than the combination of VMI-FGSM and Square attack five naturally trained models on CIFAR 10/100 and ImageNet.
B.5.5 DIFFERENT SIZES OF THE TEMPER ATURE PARAMETER
Figure evaluates the effect of different IC the attack success rates of ResNer50 VGG16 using various transfer attacks for CIFAR 10/100 and ImageNet. As shown in Figure p with the increase of K, the attack success rates of the gradient iterative-based attacks are significantly increased on CIFAR10 except for SI-NI-FGSM. When the K. increases to 2, the performance of all gradient iterative-based attacks is almost optimal on CIFARIO.
B.5.6 DIFFERENT SIZES OF THE PENALTY PARAMETER
Figure 10 evaluates the effect of differrnt T the attack success rates of ResNet50 to VGG16 using various transfer attacks for CIFAR 10/100 and ImageNet. As shown in Figure TO with the increase T, the attack success of the SI-NI-FGSM is increased CIFAR10 10, the attack success rates of all gradient iterative-based attacks are significantly increased on CIFAR 100 and the attack success rates of the latest gradient iterative-based attacks (MI-FGSM, SI-NI-FGSM and VMI-FGSM) increased by a reasonable T on ImageNet.
In addition, Figure II further explores the optimal parameter combinations of and T on different datasets, which are summarized in Table 30
B.6 COMPARISON WITH OR WITHOUT THE FUZZY DOMAIN ELIMINATING TECHNIQUE ON THE TARGETED ATTACKS
As shown in Figure 12 slightly decreasing KC from can slightly increase the targeted attack success rates of several gradient iterative- based attacks on CIFAR10/100 As shown in Figure [3] with the increase of the T, the targeted attack success rates of almost all the FECE (K. I) based attacks are increased and close to that of the RCE based attacks, which are theoretically analyzed in Propositions and
37

---

Under review as a conference paper at ICLR 2023
Table 24: The untargeted attack success rates (%) five naturally trained models for CIFAR100 using I-FGSM as the baseline with the attack strength = 8/255. ResNet50 is the surrogate model and the query number of QI-FGSM is I, i... Q
Madel
Attack
Loss
V16
RN50
WRN-
D121
M-v2
Average
ResNet50
LFGSM
CE
61.45
81.40
82.05
84.35
81.10
58.05
72.81
QI-FGSM(Q=I)
WACE
68.70
86.05
88.45
86.75
67.15
79.42
Table 25: The untargeted attack success rates (%) on five naturally trained models for ImageNet using I-FGSM as the baseline with the attack strength 8/255, VGG16 the surrogate model and the query number of QI-FGSM is 1, i.e., Q
1.
Model
Attack
Loss
V19
R50
R152
1-43
M-v2
Average
18.4
I-FGSM
VGG16
RCE
82.2
18.4
12.2
10.4
30.4
30.4
QI OLFGSMM(==1)
WACE
87.4
31.1
21.7
20.2
42.4
40.6
Proposition 7 With the increase of the T. the targeted attack success rates of almost all the FECE (K. 1) based attacks are close that of the RCE based attacks.
Proof In the targeted attacks, the RCE and FECE losses respectively are Eq. 49 and 50
1 L LCE(I, 0o:0)
LRCE(I,
yr: (eie((,,r:)))
= -L. 0r: +
(49)
C
LFECE (x,, Vr: T, = log F.Soofmar (z+; T,
(50)
where K. K= 1 in the FECE loss. To explore the targeted attack success rates of almost all the FECE (K 1) based attacks are close that of the RCE based attacks with the increase of the the derivation formula of L.CE( yr, 0) and LFECE (x,, 0+;0,T, w.r.f. the input respectively are
Eq. 57 and 52
θLRCE
ÒLRCE
(0zz dx
ÔLRCE Ōz:
+
Σ
Oz
Ozr
Oz,
Oz
i=1(A
1
1
Ozi
(51)
In2
Or
C
Ox
i=1
OLFECE
θLFECE
(dzr
ÔLFECE
Oz,
dx
O2r
0x
Oz,
dr
i= (i
(11- ezrlT
1ār
eaIT
Ozi
(1- i-1 c2t/T
(52)
T 1n2
dr
2jj1 e//lT
Or
i=1(iT))
In Eq. 52 with the increase T,,, when T - +00, (1
2 C-1
and
e:/TT
Fe /
C
65/
T.
When C is large, C-1 C Rs 1. Then,
@LRCC 0x
(ØLFECE Ox
sign
sign
(53)
where sign(.) is the sign function. Therefore, with the increase of the T, the targeted attack success rates of almost all the FECE (K. based attacks close that the RCE based attacks.
Therefore, according to Proposition D the high performance of the RCE loss in the targeted transfer attacks be explained as the fuzzy domain eliminating technique.
38

---

[ are represented in the Under review as a conference paper at ICLR 2023
Table 26: The untargeted attack success rates (%) five naturally trained models for ImageNet using I-FGSM as the baseline with the attack strength = 8/ 8/255. ResNet50 is the surrogate model and the query number of QI-FGSM is I, i... Q
Model
Attack
1 Loss
V16
V19
R152
L-3
M.x2
Average
I LEGSM
CE
32.1
29.7
45.0
17.0
33.2
31.4
ResNet50
28.9
35.2
QI-FGSM(Q=I)
WACE
38.1
33,3
49.1
20.8
41.0
36.5
Table 27: The untargeted attack success rates (%) on five naturally trained models for CIFARIO using the combination of VMI-FGSM and Square as the baseline with the attack strength 8/ 8/255. VGG16 the surrogate model and the query number of QVMI-FGSM and Square 10, i.e., 10.
Model
Altack
Loss
V19
R50
WRN-16-4
D121
M-v2
Average
VMI-FGSM Square
CE
80.05
77.40
81.65
79.15
80.35
79.72
VGG16
77.45
79.25
QVMI-FGS((Ous)
WACE
84.40
83.35
88.40
85.70
89.10
86.19
B.7
LIMITATION
The query prior-based attacks are effective for the untargeted attack. However, because Proposition 2 more conducive the exploration of the untargeted attack than the targeted attack, the proposed query prior-based attacks are designed as the untargeted attacks, which may not work in the targeted attack. In the future, the design of the query prior-based bas-d targeted attack is still problem that needs to be studied.
C THE DETAILED CONTRIBUTION INTRODUCTION OF THE QUERY PRIOR-BASHR ATTACKS
The detailed contributions of the query prior-based attacks as follows.
First, we propose Proposition and Corollary D which explore the relationship between the cos (0 is the gradient angle between the surrogate model and the victim model) and the transferability on the same surrogate model and victim model pair using different transfer attack methods. In addition, we propose Proposition 2 which finds the preference property of deep neural networks. and Corollary
The Theoretical and Empirical Proofs of Propositions
appendices A. and A.2
Second, by utilizing Propositions I 2 and Corollary [] we designed a simple WACE loss function.
proved Theorem and Figure proved that the WACE loss is better than CE and RCE losses reducing
the gradient angle between the surrogate model and vietim model. Based on the WACE loss, we designed the query prior- prser-based attacks, which solved two problems. First, compared with several latest transfer attack methods, the query prior-based attacks significantly improve the transferable attack success rate on the target victim model for CIFAR10/100 and ImageNet, and effectively improve the transferable attack success rate on the other models for CIFAR10/100 and ImageNet. Second, compared with two latest effective query attack methods, when the number of query is reduced to 10, the attack success rate of our QVMI-FGSM still remains high and is much higher than them.
Third, as far as we know, our query-prior based attack method is the first try to solve the problem of black-box attack that allows a few queries (i.e., less or equal to 10).
D THE DETAILED MOTIVATION OF THE DESIGNED QUERY PRIOR-BASED ATTACKS
To the best of our knowledge, divide the current black-box attacks into three scenarios.
39

---

Under review as a conference paper at ICLR 2023
Table 28: The untargeted attack success rates (%) five naturally trained models for CIFAR100 using the combination of VMIIFGSM and Square as the baseline with the attack strength 8/255. VGGI6 the surrogate model and the query number of QVMI-FGSM and Square is 10, i.c., 10.
Model
Attack
Loss
R50
RN50
WRN-T6-4
D121
M-v2
Average
CE
80.25
82.05
84,80
81.95
80.25
81,86
VMI-FGIMM Square
VGG16
82.08
QVMI FGSM(
WACE
83.30
85.50
87.75
84.40
81.40
84.47
Table 29: The untargeted attack success rates (%) on five naturally trained models for ImageNet using the combination of VMI-FGSM and Square as the baseline with the attack strength 8/255. ResNet50 is the surrogate model and the query number of QVMI-FGSM and Square is 10, i.e.,
Q 10.
Model
Attack
Loss
V16
R152
Lvv3
M.v2
Avernge
ResNee50
VML-FGSM & Square
CE
74.9
74.0
84.7
56.4
53.9
75.1
73.0
(VMI-
WACE
78.6
74,8
88.2
60.8
82.3
76.9
The first scenario is the query-free transfer-based attack, i.e., the allowed number of query Q 0. The adversarial examples are generated by the surrogate model without any knowledge of any target model. For example, the current transfer-based attacks are the query-free transfer-based attack, i.c., FGSM, I-FGSM, MI-FGSM, DI-FGSM, SI-NI-FGSM and VMI-FGSM.
The second scenario is the query-based attack without transfer prior, i.e., a sufficient number of query and without transfer prior. The adversarial examples are generated by gradient estimation or random search. For example, typical effective algorithm is Square.
The third scenario is the query-based attack with transfer prior, i.e., a sufficient number of query and with transfer prior. The adversarial examples are generated by the combination of the transfer prior and gradient estimation (or random search) where the transfer prior is used to improve the efficiency of gradient estimation and reduce the number of query. For example, a typical effective algorithm is PRGF.
In our paper, we explore novel scenario, i.e., the fourth scenario. The fourth scenario is the transfer-based attack with few queries, i.e., the allowed number of query Q S 10. The adversarial examples are generated by the surrogate model with a few query outputs of a target victim model (the number of query Q S 10).
The fourth scenario reasonable, and there is no black-box attack algorithm specifically belonging to the fourth scenario at present. Why is the fourth scenario reasonable? There two reasons to answer the question and the two reasons are also the problems that existed in the first, second and third scenarios.
First, in the second and third scenarios, although the number of queries in the current query-based attacks is decreasing, it still needs hundreds of queries. Even if the number of query Q S 10, the attack success rates of the query-based attacks with or without transfer prior are significantly reduced, and are far lower than the query-free transfer-based attack in the first scenario, which can be found in our experimental results.
Second, Proposition I and Corollary of our paper explore the reason why the attack success rate of the current query- transfer-base attack in the first scenario is increasing (i.e.. when the step size a is small, the better the transferability of the transfer-based attack, the smaller the gradient angle 19 between the surrogate model and the victim model). To reduce the angle & for improving the transferability, Proposition of our paper explores the preference of deep neural network imple- mented classification models after being attacked by the gradient-based attack algorithm (i.e., the successful attacked adversarial examples prefer to be classified as the wrong categories with higher design algorithm to reduce the angle / for enhancing the transferability of the generated adversarial examples with a few query outputs of a target victim model.
probability). By utilizing Propositions I 2 and Corollary [
40

---

Under review as a conference paper at ICLR 2023
Table 30: The optimal parameter of the FECE loss the combination of different methods and datasets with ResNet50 as the surrogate model.
CIFARIO
CIFARIOO
InageNet
K.
K.
FGSM
10
2.0
1.0
1.0
1.0
1.02
BIM
1.0
3.5
1.15
1.0
1.0
MIFGSM
1.0
3.0
1.05
3.5
1.15
DIFGSM
1.0
2.5
3.5
1.0
1.0
1.0
SINIFGSM
5.5
2.0
VMIFGSM
1.0
2.5
2.0
1.05
2.0
1.0
RecNie50 VS616 CIAA31
Sedier50 VGGLE CIRAA100
ReddertS InsgeReet
QH1
Bar
58 PCSM
5M CRTTCE
50-
3.0
32
1.50
3.00
3.53
1.30
1.05
The untargeted attack success rates (%) of ResNet50 VGG16 using various transfer attacks for CIFAR10/100 and ImageNet when varying the size of IC (K > 1) in the FECE loss. Note that T in the FECE loss is 1.
Figure 9:
Therefore, by utilizing Propositions and Corollary I we design simple WACE loss function. Theorem and Figure4prove prove that the WACE loss is better than the CE and RCE losses on reducing the gradient angle between the surrogate model and the victim model. Based the WACE loss, design the query prior-based attacks, which solves the above two problems and are verified by the extended experiments. Overall, in the fourth scenario (i.e., the allowed number of query Q < 10), our method has the highest attack success rate when compared with the current black-box attacks.
41

---

Under review as a conference paper at ICLR 2023
111 Not50 V90J9 CIARAO
22 Ressicttt VOSle CPAAADS
(3) NcRRt50 VODI5 mrggiict
21855M
Figure 10: The untargeted attack success rates (%) ResNet50 to VGG16 using various transfer attacks for CIFARI 10/000 and ImageNet when varying the size of TT (T in the FECE loss. Note that in the FECE loss is 1.
[1] ResNet50 VGG16 on
on ImageNet
BB
TCSM
85
BM MERSSM DIRGON SIMFGSR
EOOM
MESSM
DINGSM
SINFOSM
ASR
05
1.0
12
1.4
1.00
1.01
1.02
1.23
1.04
1.05
Figure 11: The untargeted attack success rates (%) of ResNet50 to VGG16 using various transfer attacks for CIFAR 10AA100110 and ImageNet when varying the size of IC (K > 1) in the FECE loss. Note that T in the FECE loss is the optimal value.
13) VSCLE
VCCL6
on Imagelee:
E504
EGCM
FC54
3.55
2.0
035
13
0.0
Figure 12: The targeted attack success rates (%) of ResNet50 to VGG16 using various transfer attacks for CIFAR 10/100 and ImageNet when varying the size of KC (0 < K. < 1) in the FECE loss. Note that T in the FECE loss is 1.
42

---

Under review as a conference paper at ICLR 2023
Figure 13: The targeted attack success rates (%) of ResNet50 to VGG16 using various transfer attacks for CIFAR10/100 and ImageNet when varying the size of (T >> 1) in the FECE loss. Note that AC in the FECE loss is I.
43


Reviews:
[{"review_id": "fw3fFDZetV", "reviewer": "Reviewer_19nG", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": 2, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "Existing blackbox adversarial attack methods still make lots of queries to create an adversarial example. This paper addresses the problem by proposing the query prior-based attacks and fuzzy domain eliminating technique to enhance adversarial example transferability. Theoretical analysis and extensive experiments demonstrate that this method could significantly improve the transferability of gradient-based adversarial attacks.\n", "summary_of_the_review": "The main contribution of the paper is spread out over 43 pages, and it is beyond the commitment of a reviewer. Meanwhile, the main part does not contain any experiment results (all results are in appendix), therefore it is incomplete. \n", "strength_and_weaknesses": "Strength:\n\n- This paper tries to improve the transferability of adversarial examples in both theoretical and empirical perspectives. \n\nWeaknesses:\n\n- In Eq (10), is multiplying w_i necessary?\n- The proof of Theorem 1 seems incorrect. (I could be wrong.) The theorem says the “angle” between WACE and CE is smaller than others. However, in the proof, the angle or the cosine of the angle is not computed.\n- Lemma 1 and Assumption 2 are very strong assumptions considering that neural networks are highly non-linear, and alpha may be relatively large.\n", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "2: Several of the paper’s claims are incorrect or not well-supported.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}, {"review_id": "Xc2jHnGYZC", "reviewer": "Reviewer_9Tuj", "summary": "", "questions": "", "limitations": "", "rating": 5, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "The authors exploit the properties of adversarial examples to design weighted augmented CE loss to improve transferability. Then, they add two parameters, i.e., fuzzy scaling and fuzzy domain to eliminate some fuzzy region in the searching. Thus, adversarial example with higher transferability is more likely to be found. The authors provided solid justifications for their designs. ", "summary_of_the_review": "The proposed designs are justified theoretically. \n\nPresentation and organization should be improved. \n\nComparsion with the state-of-the-art transfer-based attack methods is expected. ", "strength_and_weaknesses": "Strength:\n\nThe proposed methods outperformed the CE loss and RCE loss.\n\nThe proposed designs are justified theoretically. \n\n\nWeaknesses: \n\nAssumption 1 is not mathematically well defined.\n\nThe experimental results on CIFAR100 are not necessary to me. \n\nIn the experiments, authors show that proposed methods can improve the transferability of gradient-based approaches. However, many state-of-the-art methods are not purely gradient approach. Some exploit the skip link and some attacks the key features based on attribution maps. The authors are better to check last two years ICRL and NIPS. Comparing with these methods are expected. These methods are based on smoothing. Some of the techniques in the proposed methods are related to smoothing. Will it be over-smoothed by applying these state-of-the art transfer-based methods with the proposed method. In some previous cases, we have seen that combining two strong transfer attacks do not always improve the results. \n", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}, {"review_id": "URLGojcvxH", "reviewer": "Reviewer_XmMZ", "summary": "", "questions": "", "limitations": "", "rating": 5, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "This paper is mainly about enhancing the power of black-box attacks by delving into phenomena regarding the transferability of adversarial examples. The authors’ approach is twofold: inducing smaller gradient angles and removing fuzzy domains. The authors defined new loss terms (WACE and FECE), then combined them to design their strongest attack. Experimental results are briefly described in the paper. (All the details are in the Appendix.)", "summary_of_the_review": "I believe the paper achieved nontrivial contributions to the field. First, the concept of gradient angle seems a novel and valuable idea for understanding attack transferability. Second, the concept of fuzzy domain also makes sense, and it explains the performance gap between white-box attacks and black-box attacks.\nHowever, The paper writing is far from the standard and could be a reason for rejection. The authors put no details about the experiments in the main body, then referred to tables in the Appendix. Doing this even seems that the authors are exploiting the unlimited Appendix page limit. As a reviewer, I believe this is out of a standard paper writing practice, so I cannot score the recommendation above the acceptance threshold. (If a better reason is needed, I don’t see any detailed experimental result in the main body, and reviewers are not obliged to read Appendix to check it further.) The authors should choose the essential parts carefully and showcase them within the 10-page limit.\n", "strength_and_weaknesses": "[[Strengths]]\n1. The suggested idea of gradient angle provides valuable insights into attack transferability.\n2. The number of experiments is ample enough to support the power of the suggested method.\n\n[[Weaknesses]]\n1. The writing style is unnecessarily lengthy, making the paper harder to read. I suggest rewriting some statements to be more concise. Let me provide some examples. First, the authors defined the term gradient angle for simplicity, but Theorem 1 uses the phrase ‘the angle between A and B’ multiple times with complicated parameters. Defining a simpler notation for the gradient angle would shorten the statement. Also, Definitions 3 and 4 overlap a lot in their sentences and notations, meaning the authors can just describe what the readers should make replacements to get Definition 4 from Definition 3.\n2. The paper writing is quite disorganized. For example, some jargons or Greek symbols appear before they define them.\n3. The authors keep all the tables in the Appendix and briefly describe the results in the main body. If there are too many experimental results, put a few representative results worth highlighting in the main body, then refer to the Appendix for more results.\n4. It is better to separate Appendix A into two sections, one for formal proofs and the other for empirical verification of the statements. (Just demonstrating from experiments is not considered valid proof.)\n", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "4: All of the claims and statements are well-supported and correct.", "technical_novelty_and_significance": "4: The contributions are significant, and do not exist in prior works.", "empirical_novelty_and_significance": "Not applicable"}, "extra_text": {}}, {"review_id": "PbFnj2p4I3", "reviewer": "Reviewer_g4Mo", "summary": "", "questions": "", "limitations": "", "rating": 1, "confidence": 5, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "This work proposes two methods to enhance adversarial transferability. The first method is called the query prior-based method, which enhances adversarial transferability by using a few queries of the target model. The second method uses temperature scaling and fuzzy scaling to scale the network output before SoftMax operation, in order to eliminate the fuzzy domain defined in the paper.", "summary_of_the_review": "The theoretical novelty is limited, and experimental settings are problematic. Comparisons with the transfer-based attack are not fair, and comparisons with the query-based attack are not sufficient. Based on these, I tend to reject this paper.\n", "strength_and_weaknesses": "[ Strengths]\n+ The idea of this work is easy to follow.\n\n[ Weaknesses & Suggestions to Authors]\n\n- The contribution of the theoretical analysis seems limited. Proposition1 and proposition 2 are well-known heuristic understandings. For example, [cite 1] has analyzed the effect of gradient alignment between the source and target models. If the attacking directions of the source model and the target model are similar, adversarial transferability will be high. Thus, I think the theoretical contribution of this paper is limited.\n\n[cite 1] Ambra Demontis, Marco Melis, Maura Pintor, Matthew Jagielski, Battista Biggio, Alina Oprea, Cristina Nita-Rotaru, and Fabio Roli. Why do adversarial attacks transfer? explaining transferability of evasion and poisoning attacks. In 28th USENIX Security Symposium USENIX Security 19), pp. 321–338, 2019.\n\n- The theoretical analysis is not rigorous. \n(1). The formulation of the proposition/theorem is not rigorous and mathematical. Take Proposition 1 for an example, the concept of “the transferability of the transfer black-box attack” is not clearly defined by the mathematical formula in the paper.\n(2). The proof is not rigorous. I go through the proof and find that some key steps in the proof are ambiguous. Take Theorem 1 for an example, the theorem states that the angle between (a) the gradient of the WACE loss on the source model and (b) the gradient of the CE loss on the target model is smaller than (c) the gradient of the CE loss on the source model and (b) the gradient of the CE loss on the target model. Then, in the proof, after giving the solutions of (a)(b)(c). The proof does not continue to mathematically compare the angles between these gradients but ends with some intuitive explanations. In other words, the theorem is not mathematically proven. In this way, I suggest the authors not write the claims as theorems, but as conjectures. \n\n- The main objective of this paper is not clear. The title claims that this paper focuses on the transferability of adversarial examples, while the introduction indicates that the authors aim to improve the black-box attack. If the focus is adversarial transferability, the information of the target model is usually unknown in transfer-based attacks. If the focus is the black-box attack, then the comparison with other black-box methods is insufficient (see the following concerns about experiments).\n\n- Experiments are problematic. \n(1) Comparisons with the transfer-based attack are not fair. The proposed method accesses queries of the target model during attacking, while other transfer-based methods have no information about the target model. Using information of target models to guide the attack can obviously enhance the transferability. Thus, comparisons between the proposed method and other transfer-based methods are unfair. A fair comparison requires at least two attackers to access the same information. \n(2) Comparisons with the query-based attack are not sufficient. Only two query-based attacks are chosen as baseline methods for comparisons, which is not sufficient to demonstrate the effectiveness of the proposed method.\n(3) Baseline methods combining transfer-based and query-based attacks are required. \nSince the proposed method combines transfer-based and query-based attacks, there should be baseline methods also combining these two kinds of attacks, for fair comparisons. For example, a naïve baseline method can be designed as the linear interpolation of perturbations generated with transfer-based and perturbations generated with query-based attacks. Moreover, transferable prior-based query attacks [cite 2, 3] should be compared.\n(4) Experimental results cannot demonstrate the correctness of the theoretical analysis. In the analysis of fuzzy domain elimination, it is claimed (such as in Proposition 3, 4) that the fuzzy domain can be partly eliminated by setting the temperature scaling factor greater than 1. However, as Table 30 shows, the optimal temperature scaling factor in many settings is 1. In this way, I doubt that the experimental results may be better if the temperature scaling factor is allowed to be less than 1, which contradicts the proposed theoretical analysis.\n(5) Some results of the proposed methods are not reported in the table. For example, the results of WACE and WFCE in the Q-FGSM in Table 2 are not reported. Therefore, I doubt the effectiveness of the proposed methods in these cases.\n\n[cite 2] Shuyu Cheng, Yinpeng Dong, Tianyu Pang, Hang Su, and Jun Zhu. Improving black-box adversarial attacks with a transfer-based prior. In Advances in Neural Information Processing Systems 32: Annual Conference on Neural Information Processing Systems 2019, NeurIPS 2019, December 8-14, 2019, Vancouver, BC, Canada, pp. 10932–10942, 2019\n\n[cite 3] Jiancheng Yang, Yangzhou Jiang, Xiaoyang Huang, Bingbing Ni, and Chenglong Zhao. Learning black-box attackers with transferable priors and query feedback. In Advances in Neural Information Processing Systems 33: Annual Conference on Neural Information Processing Systems 2020, NeurIPS 2020, December 6-12, 2020, virtual, 2020.\n\n\n[ Minors]\n- This main paper is not self-contained. All experimental results are put in the appendix, which makes the main paper not self-contained. \n", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "2: Several of the paper’s claims are incorrect or not well-supported.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}]

Author rebuttal:

Decision: Reject