Transferable Adversarial Attack based on Integrated Gradients
Authors: Yi Huang
Adams Wai-Kin Kong
Venue: ICLR 2022 Poster (2022)

Abstract: The vulnerability of deep neural networks to adversarial examples has drawn tremendous attention from the community. Three approaches, optimizing standard objective functions, exploiting attention maps, and smoothing decision surfaces, are commonly used to craft adversarial examples. By tightly integrating the three approaches, we propose a new and simple algorithm named Transferable Attack based on Integrated Gradients (TAIG) in this paper, which can find highly transferable adversarial examples for black-box attacks. Unlike previous methods using multiple computational terms or combining with other methods, TAIG integrates the three approaches into one single term. Two versions of TAIG that compute their integrated gradients on a straight-line path and a random piecewise linear path are studied. Both versions offer strong transferability and can seamlessly work together with the previous methods. Experimental results demonstrate that TAIG outperforms the state-of-the-art methods.

Published as a conference paper at ICLR 2022
TRANSFERABLE ADVERSARIAL ATTACK BASED ON INTEGRATED GRADIENTS
Yi Huang, Adams Wai-Kin Kong
School of Computer Science and Engineering Nanyang Technological University 50 Nanyang Avenue, Singapore 639798 {yi huangy, adamskong) edu. sg
ABSTRACT
The vulnerability of deep neural networks to adversarial examples has drawn tremendous attention from the community. Three approaches, optimizing stan- dard objective functions, exploiting attention maps, and smoothing decision sur- faces, are commonly used to craft adversarial examples. By tightly integrating the three approaches, we propose a new and simple algorithm named Transferable Attack based on Integrated Gradients (TAIG) in this paper, which can find highly transferable adversarial examples for black-box attacks. Unlike previous meth- ods using multiple computational terms or combining with other methods, TAIG integrates the three approaches into one single term. Two versions of TAIG that compute their integrated gradients on a straight-line path and a random piecewise linear path are studied. Both versions offer strong transferability and can seam- lessly work together with the previous methods. Experimental results demonstrate that TAIG outperforms the maae-offthe-an methods]
INTRODUCTION
Adversarial example, which can mislead deep networks is one of the major obstacles for applying deep learning on security-sensitive applications (Szegedy al. (014). Researchers found that some adversarial examples co-exist in models with different architectures and parameters (Papernot et al., 2016b] 2017). By exploiting this property, an adversary can derive adversarial examples through surrogate model and attack other models (Liu et al., (017). Seeking these co-existing adversarial examples would benefit many aspects, including evaluating network robustness, developing defense schemes, and understanding deep learning (Goodfellow et al. 2015)..
Adversarial examples are commonly studied under two threat models, white-box and black-box attacks (Kurakin et al.) 2018). In the white-box setting, adversaries have full knowledge of victim models, including model structures, weights of the parameters, and loss functions used to train the models. Accordingly, they directly obtain the gradients of the victim models and seek adversarial examples (Goodfellow et al. 2015 Madry et al.) |018|Carlini Carlini & Wagner, 2017). White- box attacks important for evaluating and developing robust models (Goodfellow et al. 2015). In the black-box setting, adversaries have no knowledge of victim models. Two types of approaches, query-based approach and transfer-based approach, are commonly studied for black-box attacks. The query-based approach estimates the gradients of victim models through the outputs of query images (Guo al. 2019 Mlyas et al.] 2018 2019 Tu al. 2019). Due to the huge number of queries, it can be easily defended. The transfer- based approach, using surrogate models to estimate the gradients, more practical way black-bor attacks. Some researchers have joined these two approaches together to reduce the number of queries (Cheng et al. 2019 Guo et al. 2019 Huang & Zhang 2020). This paper focuses on the mansfer-based approach because of its practicality and its use in the combined methods.
Thhe code will available http://gittaaccom//iiannnnottttt

---

Published as a conference paper at ICLR 2022
There are three approaches, standard objective optimization, attention modification, and smoothing to craft adversarial examples. In general, combining methods based on different approaches together yields stronger black-box attacks. Along this line, we propose new and simple algorithm named Transferable Attack based on Integrated Gradients (TAIG) to generate highly transferable adversar- ial examples in this paper. The fundamental difference from the previous methods is that TAIG uses one single term to carry out all the three approaches simultaneouslyy Two versions of TAIG, TAIG-S and TAIG-R are studied. TAIG-S uses the original integrated gradients (Sundararajan et al. 2017) computed on straight-line path, while TAIG-R calculates the integrated gradients on random piecewise linear path. TAIG can also be applied with other methods together to further increase its transferability..
The rest of the paper is organized as follows. Section summarizes the related works. Section 3 describes TAIG and discusses it from the three perspectives. Section 4 reports the experimental results and comparisons. Section gives some conclusive remarks.
RELATED WORKS
Optimization approach mainly uses the gradients of a surrogate model to optimize standard objective function, such as maximizing a training loss or minimizing the score or logit output of a benign image. Examples are Projected Gradient Descent (PGD) (aadry et al. 2018), Fast Gradient Sign Method (FGSM) (Goodfellow et al., 2015), Basic Iterative Method (BIM) (Kurakin et al. 2016), Momentum Iterative FGSM (MIFGSM) (Dong et al. a 2018)) and Carlini- -aghnr'ss (C&W) [Carlini & Wagner (017) attacks. They are commonly referred to as gradient-based attacks. These methods were originally designed for white-box attacks, but are commonly used as a back-end
component in other methods for black-box attacks.
Attention modification approach assumes that different deep networks classify the same image based similar features. Therefore, adversarial examples generated by modifying the features in benign images are expected to be more transferable. Examples are Jacobian based Saliency Map At- tack (JSMA) (Papernot et al.] 2016a), Attack Attention (AoA) (Chen et al. 2020) and Attention- guided Transfer Attack (ATA) (Wu et al.] 20206), which use attention maps to identify potential common features for attacks. JSMA uses the Jacobian matrix to compute its attention map. but its objective function is unclear. AoA utilizes SGLRP (Iwana et al.) 2019) to compute the attention map. while ATA uses the gradients of an objective function with respect to neuron outputs derive an attention map. Both AoA and ATA seek adversarial example that maximizes the difference be- tween its attention map and the attention map of the corresponding benign sample. In addition the attention terms, AoA and ATA also include the typical attack losses, e.g., logit output in their objec- tive functions, and use a hyperparameter to balance the two terms. Adversarial Perturbations (TAP) (Zhou et al., 2018)) Activation attack (AA) (Inkawhich et al. 2019) and Intermediate Level Attack (ILA) (Huang et al., 2019), which all directly maximize the distance between feature maps of benign images and adversarial examples, also belong to this category. TAP and AA generate adversarial ex- amples by employing multi-layer and single-layer feature maps respectively. ILA fine-tunes existing adversarial examples by increasing the perturbation specific hidden layer for higher black-box transferability.
Smoothing approach aims at avoiding over-fitting the decision surface of surrogate model. The methods based on the smoothing approach can be divided into two branches. One branch uses smoothed gradients derived from multiple points of the decision surface. Examples are Diverse
Inputs Iterative method (DI) (Xie et al., 2019), Scale Invariance Attack (SI) (Lin et al. 2020).
canslation-invariaa Attack (TI) (Dong et al.] 2019). Smoothed Gradient Attack (SG) (Wu & Zhu 2020). Admix Attack (Admix) (Wang et al. (021) and Variance Tuning (VT) (Wang & 202
Most of these methods smooth the gradients by calculating the average gradients of augmented im- ages. The other branch modifies the gradient calculations in order to estimate the gradients of a smoother surface. Examples are Skip Gradient Method (SGM) (Wu et al. 2020a) and Linear back- propagation Attack (LinBP) (Guo et al. 2020). SGM is specifically designed for models with skip connections, such as ResNet. It forces backpropagating using skip connections more than the routes with non-line lonear functions. LinBP takes similar approach, which computes forward loss as normal and skips some non- activations in backpropagating. By diminishing non-line non-linear paths in a surrogate model, gradients computed from smoother surface.
2

---

Published as a conference paper at ICLR 2022
3 PRELIMINARIES AND TAIG
3.1 NOTATIONS AND INTEGRATED GRADIENTS
For the sake of clear presentation, set of notations is given first. Let F RN + R be classification network that maps input k-th output node in the logit layer, and f:: I 7 R be the network mapping to the output value of the k-th class, i.e., F(x) = (x) (x)) (x)))) where 7' is a transpose operator. To simplify the notations, the subscript k omitted i... f= when represents arbitrary class in or the class label is clear. æ and き represent benign image and an adversarial example respectively, and 2, and H; represent their i-th pixels. The class label of denoted as y. The bold symbols
vector whose k-th element represents the value of the
e.g., 2, are used to indicate images, matrices and vectors, and non-bold symbols e.g., Zs. are used to indicate scalars.
Integrated gradients (Sundararajan et al., 2017) is method attributing the prediction of a deep net- work to its input features. The attributes computed by it indicate the importance of each pixel to the network output and can be regarded as attention and saliency values. Integrated gradients is developed based on two axioms - Sensitivity and Implementation Invariance, and satisfies another two axioms Linearity and Completeness. To discuss the proposed TAIG, the completeness ax- iom needed. Thus, we briefly introduce integrated gradients and the completeness axiom below. Integrated gradients is line integral of the gradients from reference image an input image An integrated gradient the i-th pixel of the input æ defined as
['
0f(r (x r)) dm,
(f, (z+ 1e4-r4) rs)
dr;
9=0
where r; is the i-th pixel of r. In this work, black image is selected as the reference r.
The completeness axiom states that the difference between f(x) and f(r) is equal the sum of IG, x, r), i.e.,
To simplify the notations, both (z) and [G.(f. used to represent IG, (f, æ, r). and (G(x) and [G (ff.)) æ) are used to represent [TG x, r) ... IG (f, x, r))², when f and r are clear. The details of the other axioms and the properties of integrated gradients be found in (Sundararajan let al. (2017).
3.2
THE Two VERSIONS TAIG-S AND TAIG-R
We propose two versions of TAIG for untargeted attack. The first one based on the original integrated gradients performs the integration on a straight-line path. This version is named Transferable Attack based on Integrated Gradients Straight- line Path (TAIG-S) and its attack equation is defined
sign (IG x)),
where the integrated gradients are computed from the label of az, i.e., y, and > controls the step size.
Figure 1: An original image and the corresponding integrated gradients from ResNet50, Inception V3 and 1e from left right.

---

Published as a conference paper at ICLR 2022
The second version is named Transferable Attack based on Integrated Gradients on Random Piece- wise Linear Path (TAIG-R). Let P be random piecewise linear path and Te. ... Zg be its + turning points, including the starting point æp and the endpoint gg. The line segment from æ. to Le+1 is defined as a + 1) x (xe+1 2e), where I v S 1. When computing integrated gradients of the line segment, 2e is used reference and the corresponding integrated gradients can be computed by equation The integrated gradients of the entire path are defined,
E-1
RIG,( 2o) - Σ 1e
(4)
==0
The integrated gradients computed from the random piecewise linear path is called random path integrated gradients (RIG). Note that RIG still fulfills the completeness axiom:
ΣΣ IG.(f. 2et1,
E (f(a.41) f(x.)) f(xx) f(xa).
(5)
It should be highlighted that the integrated gradients computed from other paths also fulfill the completeness axiom (Sundararajan al. 2017). In this paper, the turning points, De the random path are generated by
a. = 2o + ( x0) + v,
F.
where e E (0, 1, ... E) and v is a random vector following a uniform distribution with support from (-T,7). The attack equation of TAIG-R is
I = - a x sign (f. x));
which the same as TAIG-S, except that [G x) with PGD and BIM, TAIG can be applied iteratively. The sign function used in TAIG because the distance between and æ is measured by 1x norm in this study.
TAIG-S is replaced by RIG x). As
3.3 VIEWING TAIG FROM THE THREE PERSPECTIVES
In the TAIG attack equations i.e., equation and equation the integration of optimization, atten- tion, and smoothing approaches is not obvious. This subsection explains TAIG from the perspective of optimization first, and followed by the perspectives of attention and smoothing. TAIG-S used in the following discussion, as the discussion of TAIG-R is similar.
Using the completeness axiom, the minimization of f can be written as
min f(x) = min (G)()))++((
(8)
1
Since f(r) is independent of æ. can be ignored. Taking gradient on both sides of equation g have the sum of (x) equal to fx(x),, which is the same as the gradients used in PGD and FGSM for white-box attack. For ReLU networks, it can proven that
Vf(x) Σ (())
(9)
where the j-th element (II))())) is
aIG,(a) d2,
ifi=j, j,
ØIG
(10)
Oæy
otherwise.
The proof is given in Appendix A.1. Computing the derivative of (Z, respect to æ, and using the definition of derivative,
(G.
IG,(#: hdv) [G,
lim h-
(11)
dr,
h
4

---

Published as a conference paper at ICLR 2022
where all the elements of Ar are zero, except for the i-th element being one. Using the backward difference, it can be approximated as
(I) [G)()) [G, (a= hdx)
(12)
dr;
h
where h > 0. According the completeness axiom, if an adversarial example Stars whose (Rtr))) 0, vi, then f( - f(r) O, where r is a black image in this study. In other words, the network outputs of the adversarial example and the black image are the same, which implies that the adversarial example has a high probability to be misclassified. In equation [2 (r) (z har))// represents the slope between (a)()) and IG; har). (a) and (G h&z) can be regarded as the integrated gradient of the i-th element of the current and the target udversarial example. To minimize equation 3 we seek an adversarial example, whose integrated gradients are zero. Thus, the target integrated gradient i.c., IG,( hAx) is set to zero such that it would not contribute to the network output. Setting IG;( hAr) to zero,
(I),(x)
IG,(z)
(13)
Or:
h
obtained. Given that h in equation is positive and TAIG-S uses the sign of IG, we can draw the following conclusions: 1) sign (z)) can be used to approximate sigm ff) of ReLU networks; 2)
the quality of this approximation depends on equation 12 meaning that (iz) and sign(( ())) are not necessarily very close. To maintain the sign of V for the minimization, we choose back- ward difference instead of forward difference in equation 12 If forward difference is used in equation 12 the term x sign x)) in equation would become ta x (ign(IG(fyr x)) and TAIG-S would maximize f. More detailed explanation can be found in Appendix A.2.
Fig. shows the distribution of normalized |sign (I)(f,))
where || - ||2 is 4 norm. On average, 68% elements of sign(IG(J..)) x)) and sign(Vf) are the same, indicating that Sign x)) weakly approximates sign(Ve f The previous discussion also applicable to RIG, because
Jagnt Eatt <i) signtttill |rggrerry xg) -igo
also fulfills the completeness axiom. Fig. 2 also shows the distribution of
normalized [|sign(RI (RIG ff)z))) sign( (V)ll. On average, 58% elements of zign(RIG(s (f. )) and (ign(V)) are the same. Because sign(IG(J, æ)) can weakly approximate Sign(V TAIG-S can be used to perform white-box attack. As for how it can enhance the transfcrability in black-box attacks, we believe more insights can be gained by viewing TAIG from the perspectives of attention and smoothing.
100
0.45
0.43
050
Figure
The relative frequency distributions of normalized
|ssgn x)) - sign [|
and ||ign æ)) sign( (V)Il-
Viewing from the perspective of attention, integrated gra- dients identify key features, which deep networks use in the prediction and allot higher integrated gradient values to them. If networks are trained perform on the same classification task, they likely use similar key features. In equation 12 the target integrated gradient in the backward difference is set to zero. By modifying the input image through its integrated gradients, the key features are amended, and the transferability can be enhanced. To justify these arguments, Fig. [ shows the integrated gradients of an original image from different networks and Fig. shows the integrated gradients before and after TAIG-S and TAIG-R attacks. These figures indicate that 1) different models have similar integrated gradients for the same images and 2) TAIG-S and TAIG-R significantly modify the integrated gradients.
The normalization is done by dividing times the total number of pixels.
ResNet50 is utilized to compute IG(J, RIG(S, a)) and V..
To avoid overfitting the surface of surrogate model, smoothing based on augmentation is commonly used. Equation] [ shows that TAIG-S employs intensity augmentation if the reference r is a black
Pt should he highlighted that better approximation is not our goal. When (f.. is close to (ign(f)) f), only implies that it stronger for white-box attack.
5

---

Published as a conference paper at ICLR 2022
image. Since r; 0, 2; 2 0 and TAIG-S only uses the sign function, the term [1;;-;)] in equation can be ignored. Therefore, sign(IG([f: æ)) in equation only depends on -== af(m))
dw, drj, whose
discrete version is g. Σ== 0f(xxØ/8) This discrete version reveals that TAIG-S uses the sum the 0z;
gradients from intensity augmented images to perform the attack. Similarly, it can observed from equation [ equation and equation 6 that TAIG-R applies both noise and intensity augmentation to perform the attack.
Figure 3: The first row is the original image and the IG before and after attack. The second row is the original image and the RIG before and after attack. The images from left to right are the original images, the original IG (RIG) of the image, the IG (RIG) after TAIG-S attack, and the IG (RIG) after TAIG-R attack. The results are obtained from ResNet50.
EXPERIMENTAL RESULTS
In this section, we compare the performance the proposed TAIG-S and TAIG-R with the state-of- the-art methods, including LinBP (Guo et al. 2020). SI (Lin al. 2020), AOA (Chen et al. (0200 and VT [Wang& & He. 2021). As LinBP had shown its superiority over methods, including SGM
Wu et al. 2020a), TAP (Zhou et al. 2018) and ILA (Huang al. 2019), they are not included in the comparisons. The comparisons are done on both undefended and advanced defense models. To verify that IG and RIG could be good replacement of standard gradient for transferable attacks, they are also evaluated on the combinations with different methods. In the last experiment, we use different surrogate models to demonstrate that TAIG is applicable to different models and has similar performances.
4.1 EXPERIMENTAL SETTING
ResNet50 (He al. 2016 selected as surrogate model to generate adversarial examples to com- pare with the state-of the methods. Inception (Szegedy et al. (016). DenseNet121 (Huang ctt al., 2017). MobileNetV2 (Sandler et al.] 2018). SENet154 (Hu et al.J 2018) and PNASNet-S- Large (Liu et al. 2018) are selected to evaluate the transferability of the adversaria examples. For the sake of convenience, the names of the networks are shortened as ResNet, Inception, DenseNet, MobileNet, SENet, and PNASNet in the rest of the paper. The networks selected for the black-box attacks were invented after or almost at the same period of ResNet, and the architecture of PNASNet conducted on ImageNet (Russakovsky al.
was found by neural searching. The experiments 2015) validation set. 5000 images are randomly selected from images that can be correctly classified by all the networks. As with the previous works (Guo al. 2020 Lin et al.) 2020). 4o is used to measure the difference between benign image and the corresponding adversarial example. By fol- lowing LinBP, the maximum allowable perturbations are set as 0.03, 0.05, 0.1. We also report the experimental results of 4/255, 8/255, 16/ 16/255 in Table in the appendix. The preprocessing procedure the input varies with models. We follow the requirement to preprocess the adversarial examples before feeding them into the networks. For example, for SENet the adversarial examples are preprocessed by three steps: (1) resized to 256 x 256 pixels, (2) center cropped to 224 x 224 pixels and (3) normalized using mean [0.485, 0.456, 0.406] and std [0.229, 0. 0,224, 0.225). At- tack success rate is used as an evaluation metric to compare all the methods. Thirty sampling points used estimate TAIG-S. For TAIG-R, the number of turning point E is set to 30 and is set

---

Published as a conference paper at ICLR 2022
equal E. Because the line segment is short, each segment is estimated by sampling point in TAIG-R. An ablation study about the number of sampling points is provided in the supplemental material Section A.6. All the experiments performed on two NVIDIA GeForce RTX 3090 with the main code implemented using PyTorch.
Table 1: Attack success (%) of different methods in the untargeted setting. The symbol * in- dicates the surrogate model used generate the adversarial examples. The attack success rate of the surrogate model is not included in the calculation of average attack success rate. The images of AOA-SI are provided by DemageNet with VGG19 the surrogate model.
Method
ResNet
Inception
PNASNet
SENet
DenseNet
MobileNet
Average
0.03
100.00
22,80
7.30
11.32
36.98
36.98
23.08
AOA
0.05
100.00
14.64
22.30
$5.00
47.74
35.22
0.1
100.00
64.62
37.40
52.24
80.56
76.30
62.22
0.03
100.00
21.46
12.68
15.14
42.58
43.16
27.00
0.05
100.00
36.80
25.12
37.76
62.52
61.92
44.82
0.1
100.00
58.40
48.20
56.68
91.90
79.74
66.98
0.03
100.00
31.16
28.20
44.36
66.04
65.50
47.05
LinBP
0.05
100.00
62.08
58.88
77.08
89.84
88.78
75.33
0.1
100.00
92.58
93.66
97.72
99.22
98.94
96.42
0.03
100.00
24.98
14.06
20.32
48.66
50.56
31.72
TAIG-S
0.05
100.00
43.56
30.68
42.74
71.92
71.76
52.13
0.1
100.00
69.68
60.06
74.78
91.54
89.70
77.15
0.03
100.00
46.06
33.82
40.14
72.52
71.58
52.82
TAIG-R
0.05
100.00
74,22
66.30
73.46
93.62
91.56
79.83
0.1
100.00
95.18
94.50
96.02
99.60
99.20
96.90
VGG19*
Method
ResNet
Inception
PNASNet
SRNet
DenseNet
MohileNet
Average
AOA-SI
0.1
90.40 98.40
85.72 95.95
79.22
68.50
92.98 95.82
92.36 98.40
83.76
TAIG-R
0.1
95.56
95.84
97.43
4.2 COMPARISON WITH STATE-OF-THE-ARTS
Usually, one method has several versions by using different back-end attacks such as FGSM, IFGSM, and MIFGSM. In the comparison, FGSM and IFGSM are selected as the back-end meth- ods for one-step and multi-step attacks, respectively. In one-step attacks, the step size for all the methods is set to E. In multi-step attacks, for LinBP, we keep the default setting where the number of iterations is 300 and the step size is 1/255 for all different
The linear backpropagation layer starts at the first residual block in the third convolution layer, which provides the best performance (Guo et al. 2020). TAIG-S and TAIG-R are run 20, 50, and 100 iterations with the same step size as LinBP for = 0.03, 0.05, 1. respectively. For SI, the number of scale copies is set to 5, which is the same as the default setting. The default numbers of iterations of SI and AOA are 10 and 0.1 respectively. We found that more iterations would improve
10-20 for the performance of SI and AOA. Therefore, the numbers of iterations of SI and AOA for different are kept the same TAIG-S and TAIG-R. The authors of AOA method provide public dataset named DAmageNet, which consists of adversarial examples generated by combining SI and AOA with ImageNet validation set as the source images. VGG19 was taken as the surrogate model and is set to 1. For comparison, TAIG-R is used to generate another set of adversarial examples with 0.1 and VGG19 the surrogate model. 5000 adversarial images generated by TAIG-R and 5000 images sampled from DAmageNet with the same source images are used in the evaluation. Ta- TeeTisss the experimental results of untargeted multi-step attacks. It demonstrates that the proposed TAIG-S outperforms AOA and SI significantly but it is weaker than LinBP. The proposed TAIG-R outperforms all the state-of-the-art methods in all models, except for SENet. In terms of average attack success rate, TAIG-R achieves an average attack success rate of 52.82% under = 0.03. Comparison results of the one-step attacks are given in Table [ in the appendix, which also shows the superiority of TAIG-R. We also provide the results of LinBP and SI under the same number of gradient calculations as TAIG-S and TAIG-R in Table 8 in the appendix. VT (Wang & He, (02T) and Admix (Wang al. 2021), which use NIFGSM (Lin al. 2020) and MIFGSM (Dong al.
16/ 255 and
7

---

Published as a conference paper at ICLR 2022
2018) as the back-end methods are also compared and the experimental results given in Table I1 in the appendix.
LinBP and SI are also examined the target attack setting. AOA is excluded because it was not designed for target attacks. The experimental results show that TAIG-R can get an average attack success rate of 26% under 0.1, which is the best among all the examined methods. The second best is LinBP with an average attack success rate of 10.1%. Due to limited space, the full experimental results are given in Table 7 iin the appendix.
4.3 EVALUATION ON ADVANCED DEFENSE MODELS
In addition to the undefended models, we further examine TAIG-S and TAIG-R on six advanced defense methods. By following SI, we include the top-3 defense methods in the NIPS competition and three recently proposed defense methods in our evaluation. These methods are high level rep- resentation guided denoiser (HGD, rank-1) 1) (Liao et al. 2018), random resizing and padding (R&P, rank-2) (Xie et al. 2018), the rank-3 submission (MMD) feature distillation (FD) (Liu et al. 2019), purifying perturbations via image compression model (ComDefend) (Jia et al. 2019) and random smoothing (RS) (Cohen al. 2019)). is set 16/255, which is the same the setting in the SI study (Lin et al. 2020). and ResNet is taken as the surrogate model in this evaluation. The results are listed in Table The average attack success rates of TAIG-R is 70. 80%, 25.61 % higher than the second best - LinBP. It shows that TAIG-R outperforms all the state-of ofaee-of-th-arrr the methods in attacking the advanced defense models. We also evaluate the performance of TAIG-S and TAIG-R on two advanced defense models based on adversarial image detection in Section A.5.
4.4 COMBINATION WITH OTHER METHODS
TAIG-S and TAIG-R can be used as back-end attacks, as IFGSM and M-IFGSM, by other methods achieve higher transferability. Specifically, (G) and (IG(x) in TAIG-S and TAIG-R can re- place the standard gradients in the previous methods to produce stronger attacks. In this experiment, investigated. LinBP and ILA use the same
LinBP, DI, and ILA with different back-end attacks set of back-end attacks, including IFGSM. TAIG-S, and TAIG-R. For LinBP, the back-end attacks are used seek adversarial examples, while for ILA, the back-end attacks are used to generate di- rectional guides. For DI, (=) and RIG((x) are used to replace the gradients in M-IFGSM and produce two new attacks. The two new attacks are named DI+MTAIG-S and DI+MTAIG-R The numbers of iterations of all the back-end attacks are 20, 50, and 100 for 0.03, 0.05, 0.1 respec- tively. As ILA and their back-end attacks are performed in a sequence, the number of iterations for ILA is fixed to 100, which is more effective than the default setting. And the intermediate output layer is set to be the third residual block in the second convolution layer in ResNet50 as suggested by (Guo al., (020). Table lists the results. They indicate that TAIG-S and TAIG-R effectively enhance the transferability of other methods. As with other experiments, TAIG-R performs the best. The results of 4/255, 8/555, 16/25 16/255, are given in Table 13 in the appendix.
Table 2: Attack success rate(%) of different methods against the advanced defense schemes. The adversarial examples are generated from ResNet.
HGD
R&P
MMD
FD
Comdefend
RS
Average
AOA
6.06
5.63
6.67
19.09
40.54
6.46
14.08
26.07
13.03
16.79
41.37
66.79
7.59
28.61
LinBP
49.40
16.70
21.74
84.56
88.91
9.94
45.21
TAIG-S
32.07
16.04
20.93
49.89
81.40
8.69
34.84
TAIG-R
75.29
56.00
63.18
94.71
97.58
38.14
70.82
4.5 EVALUATION ON OTHER SURROGATE MODELS
To demonstrate that TAIG is also applicable to other surrogate models, we select SENet, VGG19, Inception, and DenseNet as the surrogate models and test TAIG on the same group of black-box
8

---

Published as a conference paper at ICLR 2022
Table 3: Attack success rate(%) using different surrogate models. The attack success rate of the surrogate model is not included in the calculation of average success rate.
Suroggtte model
ResNet
Inception
PNASNet
SENet
DenseNet
MobileNet
Average
SENet 90.92
83.18
84.78
99.66
91.80
89.70
88.08
VGG19
93.96
84.70
86,20
86.88
93.64
96,24
90.27
Inception
76.36
100.00
59.30
59.66
78.04
80.08
90.69
DenseNet 99.32
90.26
89.76
89.64
99.98
97.54
93.30
Table 4: Attack success rate(%) of different combinations. The symbol * indicates the surrogate
model used to generate adversarial examples. The attack success rate the surrogate model is not included in the calculation of average success rate.
Method
ResNet
Inception
PNASNet
SENet
DenseNet
MobileNet
Average
0.03
99.98
30.72
30.62
42.70
61.42
45.04
ILA+
0.05
100.00
52.00
51.82
68.76
80.46
82.12
67.03
IFGSM
0.1
100.00
84.12
85.10
93.96
96.56
97.04
91.36
0.03
100.00
40.60
33.20
51.60
70.84
72.28
53.70
IL
0.05
100.00
66.40
60.88
80.08
90.96
90.58
77.78
TAIG-S
0.1
100.00
93.62
93,20
97.96
99.32
98.77
96.57
0,03
100.00
49.24
41.50
57.56
78.68
78.04
61.00
ILA+
0.05
100.00
74.76
71.64
85.18
94.90
93.42
83,98
TAIG-R
0.1
100.00
96.54
96.48
98.58
99.72
99.44
98.15
0.03
99.98
28.36
25.00
36.56
61.96
61.84
42.74
LinBP+
0.05
100.00
57.34
55.44
71.50
87.06
86.52
71.57
IFGSM
0.1
100.00
88.82
90.62
95.76
98.86
98.44
94.50
LinBP+
0.03
99.98
48.26
34,94
47.98
79.42
77.62
57.64
0.05
100.00
81.24
73.88
84.48
87.08
95.54
84.44
TAIG-S
0.1
100,00
98.90
98.56
99.32
99.90
99.72
99.28
0.03
99.98
60.14
47.70
59.26
85.52
84.70
67.46
LinBP+
0.05
100.00
88.80
85.80
91.18
97.58
92.38
TAIG-R
0.1
100.00
99.34
99.24
99.62
99.92
99.86
99.60
0.03
99.98
19.34
16.12
20.02
42.70
40.71
27.78
DI+M
0.05
100,00
31.54
28.50
35.94
58.94
57.42
42.47
IFGSM
0.1
100,00
57.64
57.22
67.36
83.66
84.94
70.16
0.03
100.00
39.50
25.94
33.14
64.16
64.02
45.35
DI+M
0.05
100.00
59.30
47,04
59.08
83.88
82,60
66.38
TAIG-S
0.1
100.00
86.16
81.10
86.82
97.22
96.16
89.49
0.03
100,00
58.46
46.68
51.72
81.46
78.62
63.39
DI+M
0.05
100.00
82,80
75.94
80.46
96.20
93.96
85.87
TAIG-R
0.1
100.00
97.86
97.32
97.84
99.76
99.54
98.46
models. Because TAIG-S and TAIG-R are almost the same, except for the paths of computing integrated gradients and TAIG-R outperforms TAIG-S in the previous experiments, we select TAIG- as an example. this experiment, we set & to 16/255, and the results are reported in Table indicates that TAIG-R performs similarly on different surrogate models.
5 CONCLUSION
In this paper, we propose new attack algorithm named Transferable Attack based on Integrated Gradients. It tightly integrates three common approaches in crafting adversarial examples to gener- ate highly transferable adversarial examples. Two versions of the algorithm, one based on straight- line integral, TAIG-S, and the other based random piecewise linear path integral, TAIG-R, are studied. Extensive experiments, including attacks on undefended and defended models, untargeted and targeted attacks and combinations with the previous methods, conducted. The experimental results demonstrate the effectiveness of the proposed algorithm. In particular, TAIG-R outperforms all the state-of-fe ofrth--rtttt methods in all the settings.

---

Published as a conference paper at ICLR 2022
ACKNOWLEDGMENT
This work is partially supported by the Ministry of Education, Singapore through Academic Re- search Fund Tier 1, RG73/21.
ETHICS STATEMENT
Hereby, we assure that the experimental results reported accurately and honestly. The experimen- tal settings including data splits, hyperparameters, and GPU resources used are clearly introduced in Section 4 and the source code will be shared after this paper is published. The ImageNet dataset and source code from AOA and LinBP attack are used in this paper and they are cited in Section 4.
REFERENCES
Nicholas Carlini and David Wagner. Towards evaluating the robustness of neural networks. In IEEE Symposium on Security and Privacy, 2017.
Sizhe Chen, Zhengbao He, Chengjin Sun, Jie Yang, and Xiaolin Huang. Universal adversarial attack on attention and the resulting dataset damagenet. IEEE Transactions on Pattern Analysis and Machine Intelligence, 2020.
Shuyu Cheng, Yinpeng Dong, Tianyu Pang, Hang Su, and Jun Zhu. Improving black-box adversarial attacks with transfer-basee prior. In Advances in Neural Information Processing Systems, 2019.
Jeremy Cohen, Elan Rosenfeld, and Zico Kolter. Certified adversarial robustness via randomized smoothing. International Conference on Machine Learning. 2019.
Yinpeng Dong, Fangzhou Liao, Tianyu Pang. Hang Su, Jun Zhu, Xiaolin Hu, and Jianguo Li. Boost- ing adversarial attacks with momentum. In Proceedings of the IEEE Conference on Computer Vision and Puttern Recognition, 2018
Yinpeng Dong, Tianyu Pang, Hang Su, and Jun Zhu. Evading defenses to transferable adversarial examples by translation-invan ence on Computer Vision and Pattern Recognition, 2019.
attacks. In Proceedings of the IEEE Computer Society Confer-
Ian Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. In International Conference on Learning Representations, 2015.
Yiwen Guo, Ziang Yan, and Changshui Zhang. Subspace attack: Exploiting promising subspaces for query-efficient black-box attacks. In Advances in Neural Information Processing Systems, 2019.
Yiwen Guo, Qizhang Li, and Hao Chen. Backpropagating linearly improves transferability of ad- versarial examples. In Advances in Neural Information Processing Systems, 2020.
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recog- nition. In Proceedings of the IEEE conference on computer vision and pattern recognition, 2016.
Jie Hu, Li Shen, and Gang Sun. Squeeze-and-excitee Conference on Computer Vision and Pattern Recognition, 2018.
networks. In Proceedings of the IEEE
Shengyuan Hu, Tao Yu, Chuan Guo, Wei-Lun Chao, and Kilian Q WWiinerger. A new defense against adversarial images: Turning weakness into a strength. Advances in Neural Informa- fion Processing Systems, 2019.
Gao Huang. Zhuang Liu, Laurens Van Der Maaten, and Kilian Q Weinberger. Densely connected convolutional networks. Proceedings of the IEEE conference on computer vision and pattern recognition, 2017.
Qian Huang, Isay Katsman, Horace He. Zeqi Gu, Serge Belongie, and Ser-Nam Lim. Enhancing adversarial example transferability with an intermediate level attack. Proceedings of the IEEE International Conference Computer Vision 2019.
10

---

Published as a conference paper at ICLR 2022
Zhichao Huang and Tong Zhang. Black-box adversarial attack with transferable model-basee em- bedding. In International Conference on Learning Representations, 2020.
Andrew Ilyas, Logan Engstrom, Anish Athalye, and Jessy Lin. Black-box adversarial attacks with limited queries and information. In International Conference on Machine Learning. 2018.
Andrew Ilyas, Logan Engstrom, and Aleksander Madry. Prior convictions: Black-box adversarial attacks with bandits and priors. In International Conference on Learning Representations, 2019.
Nathan Inkawhich, Wei Wen, Hai Helen Li, and Yiran Chen. Feature space perturbations yield more transferable adversarial examples. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, 2019.
Brian Kenji Iwana, Ryohei Kuroki, and Seiichi Uchida. Explaining convolutional neural networks using softmax gradient layer-wise relevance propagation, 2019.
Xiaojun Jia, Xingxing Wei, Xiaochun Cao, and Hassan Foroosh. Comdefend: An efficient image compression model to defend adversarial examples. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, 2019.
Alexey Kurakin, Ian Goodfellow, and Samy Bengio. Adversarial examples in the physical world. CoRR, 2016.
Alexey Kurakin, Ian Goodfellow, Samy Bengio, Yinpeng Dong, Fangzhou Liao, Ming Liang, Tianyu Pang. Jun Zhu, Xiaolin Hu, Cihang Xie, et al. Adversarial attacks and defences competition. In The NIPS'17 17 Competition: Building Intelligent Systems. 2018.
Fangzhou Liao, Ming Liang, Yinpeng Dong, Tianyu Pang, Xiaolin Hu, and Jun Zhu, Defense against adversarial attacks using high-level representation guided denoiser. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, 2018.
Jiadong Lin, Chuanbiao Song, Kun He, Liwei Wang. and John E. Hoperoft. Nesterov accelerated gradient and scale invariance for adversarial attacks. In International Conference on Learning Representations, 2020.
Chenxi Liu, Barret Zoph, Maxim Neumann, Jonathon Shlens, Wei Hua, Li-Jia Li, Li Fei-Fei, Alan Yuille, Jonathan Huang, and Kevin Murphy. Progressive neural architecture search. Proceed- ings of the European Conference on Computer Vision, 2018
Yanpei Liu, Xinyun Chen, Chang Liu, and Dawn Song. Delving into transferable adversarial exam- ples and black-box attacks. In Proceedings of International Conference on Learning Representa- tions, 2017.
Zihao Liu, Qi Liu, Tao Liu, Nuo Xu, Xue Lin, Yanzhi Wang, and Wujie Wen. Feature distilla- tion: Dnn-oriented jpeg compression against adversarial examples. In Proceedings of the IEEE Conference Computer Vision and Pattern Recognition, 2019.
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. In International Conference Learning Representations, 2018
Nicolas Papernot, P. McDaniel, S. Jha, Matt Fredrikson, Z. Y. Celik, and A. Swami. The limitations of deep learning adversarial settings. IEEE European Symposium on Security and Privacy, 2016a.
Nicolas Papernot, Patrick McDaniel, and Ian Goodfellow. Transferability in machine learning: from phenomena to black-box attacks using adversarial samples. arXiv preprint arXiv:1605.07277, 2016b.
Nicolas Papernot, Patrick McDaniel, Ian Goodfellow. Somesh Jha, Z Berkay Celik, and Ananthram Swami. Practical black-box attacks against machine learning. In Proceedings of the 2017 ACM Asia conference computer and communications security, 2017.

---

Published as a conference paper at ICLR 2022
Olga Russakovsky, Jia Deng, Hao Su, Jonathan Krause, Sanjeev Satheesh, Sean Ma, Zhiheng Huang, Andrej Karpathy, Aditya Khosla, Michael Bernstein, et al. Imagenet large scale visual recognition challenge. International journal of computer vision. 2015.
Mark Sandler, Andrew Howard, Menglong Zhu, Andrey Zhmoginov, and Liang- Chich Chen. Mo- bilenetv2: Inverted residuals and linear bottlenecks. In Proceedings of the IEEE Conference Computer Vision and Pattern Recognition, 2018.
H.R. Sheikh and A.C. Bovik. Image information and visual quality. IEEE Transactions on Image Processing, 15(2):430-444 2006. doi: 10.1 11110/11.2000.5599333
Mukund Sundararajan, Ankur Taly, and Qiqi Yan. Axiomatic attribution for deep networks. In International Conference on Machine Learning, 2017.
Christian Szegedy, Wojeiech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfel- low, and Rob Fergus. Intriguing properties of neural networks. In International Conference on Learning Representations, 2014.
Christian Szegedy, Vincent Vanhoucke, Sergey loffe, Jon Shlens, and Zhigniew Wojna. Rethink- ing the inception architecture for computer vision. In Proceedings of the IEEE conference on computer vision and pattern recognition, 2016.
Chun-Chen Tu, Pai-Shun Ting, P. Chen, Sijia Liu, Huan Zhang, Jinfeng Yi. Cho-Jui Hsich, and Shin- Ming Cheng. Autozoom: Autoencoder- based zeroth order optimization method for attacking black-box neural networks. In AAAI Conference on Artificial Intelligence, 2019.
Xiaosen Wang and Kun He. Enhancing the transfcrability of adversarial attacks through variance tuning. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, 2021.
Xiaosen Wang, Xuanran He, Jingdong Wang, and Kun He. Admix: Enhancing the transferability of adversarial attacks. In Proceedings of the IEEE International Conference Computer Vision, 2021.
Z. Wang, E.P. Simoncelli, and A.C. Bovik. Multiscale structural similarity for image quality as- sessment. In The Thrity-Seventh Asilomar Conference on Signals, Systems Computers, 2003, volume 2, pp. 1398-1402 Vol.2, 2003. doi: 10. 11009/ACSSC.2003.122222
Zhou Wang and A.C. Bovik. universal image quality index. IEEE Signal Processing Letters, (3)881-84, 2002.
doi: 001100997.9998223
Zhou Wang, A.C. Bovik, H.R. Sheikh, and E.P. Simoncelli. Image quality assessment: from error visibility to structural similarity. IEEE Transactions Image Processing, 13(4):600-612, 2004. doi: 10.1109/TPP.003..8 819861.
Zifan Wang, Haofan Wang, Shakul Ramkumar, Piotr Mardziel, Matt Fredrikson, and Anupam Datta. Smoothed geometry for robust attribution. Advances in Neural Information Processing Systems, 2020.
Dongxian Wu, Yisen Wang, Shu-Tao Xia, James Bailey, and Xingjun Ma. Skip connections matter: On the transferability of adversarial examples generated with resnets. In International Conference on Learning Representations, 2020a.
Lei Wu and Zhanxing Zhu. Towards understanding and improving the transferability of adversarial examples in deep neural networks. In Asian Conference on Machine Learning, 2020.
Weibin Wu, Yuxin Su, Xixian Chen, Shenglin Zhao, Irwin King, Michael R. Lyu, and Yu- Yu-Wing Tai. Boosting the transferability of adversarial samples via attention. In Proceedings of the IEEE Conference Computer Vision and Pattern Recognition, 2020b.
Cihang Xie, Jianyu Wang, Zhishuai Zhang, Zhou Ren, and Alan Yuille. Mitigating adversarial effects through randomization. In International Conference Learning Representations, 2018.
12

---

Published as a conference paper at ICLR 2022
Cihang Xie, Zhishuai Zhang, Yuyin Zhou, Song Bai, Jianyu Wang, Zhou Ren, and Alan Yuille. Improving transferability of adversarial examples with imput diversity. In Proceedings of the IEEE Conference Computer Vision and Pattern Recognition, 2019.
Weilin Xu, David Evans, and Yanjun Qi. Feature squeezing: Detecting adversarial examples in deep neural networks. In 25th Annual Network and Distributed System Security Symposium, NDSS 2018, San Diego, California, USA, February 18-21. 2018, 2018.
Wen Zhou, Xin Hou, Yongjun Chen, Mengyun Tang, Xiangqi Huang, Xiang Gan, and Yong Yang. Transferable adversarial perturbations. In Proceedings of the European Conference on Computer Vision, 2018.
13

---

Published as a conference paper at ICLR 2022
A APPENDIX
A.1 THE PROOF OF EQUATION 10
For ReLU networks it can be proven that the j-th element of (IG,, is:
(G)
if J,
(I))
d2y
Oxy
0
otherwise.
Considering @GG.(a)
(x; - (r;) x fy=0
0f(r x (x r)) duj }. Using the product rule,
dw;
have
0(x; ri) Of(r + x (xc r))
a 0f(r + + n (x r)) dn
dn + (xs - -ri)
dr,
dx:
n= dry
Ōr;
1==
0(2--r11
0, i # otherwise, On,
0(x-rr) dmy
Thus, the first term becomes
0f(r + 17 (x r)) dn
ifi
O(x; - rz) dx, n=
0f(r + 11 x (x - r))
Ox:
dn
dx:
otherwise.
0 81(r x (x r))
fn=0 On; dx, network. Thus,
dn in the second term is zero because of the ReLU functions in the
0s(r + 17 x (x r))
1=
dn
if =
@1G.(x)
Oz.
(14)
Or,
0
otherwise.
Since
(G..(w) 8z;
af(r + x (x r))
dn, equation
14 can be written
8x;
@IG.(a)
if J,
(I)
82,
(15)
Ory
0
otherwise.
A.2 WIYY USE BACKWARD DIFFERENCE
Some may question why backward difference is used in equation 12] instead of forward difference i.e. (I hAx) (=))//,, forward difference used and target integrated gradient, i.e. (G,( + hAx) in forward difference is set to zero,
OIG;(x) IG.(x:)
(16)
ax,
h
where h > 0. The attack equation would become
T x + (ig)
(17)
Considering the discrete vector form of IG,
i x (x)r)), m
IG(F = (x
vf(r
(18)
1=0
"The term ReLU network is to refer to the networks with second-ord order derivatives being zero (Wag et al. 2020) due to their computational unit, ReT.U (w" v). where is network parameter and is the input from previous layer.
14

---

Published as a conference paper at ICLR 2022
where is the Hadamard product also known element-win product, it is noted that when i/m, which is the discrete version of in equation 1 is close to one, v x (æ (x-r)) can approximate (a: r)), whose i/m is close to
f(()). If only use ff(r
compute equation 17 m
equation 17 is an approximation of gradient ascent. On the contrary. we only use V i r)), whose m is close to one to compute the integrated gradients in the proposed attack equation in fact an approximation of gradient decent. Since we would like to minimize f, backward difference is applied to equation 12 and TAIG-S in equation 3 performs an approximation gradient decent.
iee, equation S equation
A.3 COMPARISON WITH STATE-OF-THE-ARTS
A.3.1 MORE RESULT ON THE MAIN COMPARISONS
In this section, we provide more experimental results about the comparisons on LinBP, SI and AOA omitted in the main paper. The experimental results of TAIG-S and TAIG-R for untargeted attack under ε = 4/255, 8/255, 16/2 6/2255 running with 20, 50 and 100 iterations are given in Table The re- sults of different methods using FGSM the back-end method for one-step attacks summarized in Table 5 Table 7 lists the experimental results of different methods on the target attack setting. These results highlight the effectiveness of the proposed methods, in particular, TAIG-R.
The comparison experiments between LinBP, SI, TAIG-S, and TAIG-R are also conducted under different E with the same number of gradient calculations, and the results are listed in Table 8 For AOA, the calculation of SGLPR is too slow, and we find that the average attack success rate of AOA only changes from 32.07 (100 iterations) to 32.19 (300 iterations) under & = 16/255. As the result of AOA is not good as LinBP and SI, we do not run it for more iterations. Table [ shows that more number of gradient calculations will slightly improve the performance of and LinBP, but they are still not good as TAIG-R.
Table 5: Attack success rate(%) of different methods using FGSM for one-step attack in the untar- geted setting. The symbol indicates the surrogate model for generating the adversarial examples.
Method
ResNet
Inception
PNASNet
SENet
DenseNet
MobilenNet
Average
0.03
90.62
25.78
9.60
11.10
28.92
28.10
20.70
AOA
0.05
88.72
38.44
16.20
20.70
39.90
40.20
31.09
0.1
88.94
62.40
33.00
44.00
60.34
72.10
54.37
0.03
61.26
20.00
10.18
10.54
20.10
32.86
18.74
SI
0.05
77.68
37.26
23.28
24.78
49.48
54.80
37.92
0.1
91.90
66.
53.50
56.82
78.66
83.96
67.81
0.03
74.46
16.06
8.02
12.08
29.82
34.12
20.02
LinBP
0.05
75.58
25.46
25.62
22.56
42.66
50.42
33.34
0.1
84,84
45.12
33.00
45.50
64.46
81.44
53.90
0.03
84,00
25,32
14,96
17.48
38.80
39.30
27.17
TAIG-S
0.05
87.16
38,56
27.24
31.16
53.70
56.30
41.39
0.1
91.52
61.32
51.30
57.02
76.46
83.28
65.88
0.03
92.92
34.32
24.14
24.10
49.12
48.48
36.03
TAIG-R
0.05
96.48
53.64
44.02
46.36
68.06
66.86
55.79
0.1
98.94
79.16
75.98
76.48
89.22
90.24
82.22
A.3.2 COMPARISON WITH LINBP ON VGG19
Section 4.2 shows that LinBP performs the second-best among all the methods. Therefore, we com- pare TAIG-R with LinBP using VGG19 as surrogate model under 16/255. LinBP is sensitive to the choice the position from where the network is modified. To find the best position to start the model modification, we test all the possible position in VGG19 separately and generate adver- sarial examples from these 16 different positions with 100 iterations. Then we use the six black-box models to compare their performance. Table 9 gives the experimental results. We select SENet and ResNet as two examples and show how the attack success rate LinBP varies with the choice of the position in VGG-19 in Fig. Based Table D select the modified positions with the
15

---

Published as a conference paper at ICLR 2022
Table 6: Attack success rate(%) of different methods in the untargeted setting. The symbol indi- cates the surrogate model for generating the adversarial examples.
Method
ResNet'
Inception
PNASNet
SENet
DenseNet
MobileNet
Average
4/255
99.80
10.64
1,50
2.64
11.18
12.34
7.66
AOA
8/255
99.86
20.50
4.44
6.98
22.36
24.16
15.69
16/255
99.78
40.70
11.50
18.92
40.78
48.44
32.07
4/255
99 64
8.84
3.88
5.42
19.10
20.50
11.55
SI
8/255
100.00
20.82
11.76
15,90
41.12
42.74
26.47
16/255
100.00
44.82
32.06
42.06
71.72
69.82
52.10
4/255
99.98
8.78
6.60
12.20
25.04
27.32
15.99
LinBP
8/255
100.00
29.98
27.26
43.40
64.88
64.68
46.04
16/255
100.00
74.30
73.98
88.50
94.78
94.00
85.11
4/255
99.98
10.10
4.54
6.60
21.62
25.02
13.58
TAIG-S
8/255
100.00
26.14
15.02
22.64
49.80
52.74
33.27
16/255
100.00
55.34
43.04
57.86
82.08
80.66
63.80
4/255
99 96
17.04
8.66
11.60
35.38
37.28
21.99
TAIG-R
8/255
100.00
45.44
34.00
41.62
73.72
73.86
53.73
16/255
100.00
84.30
78.82
84.72
97.00
95.90
88.15
Table 7: Attack success rate(%) of different methods using IFGSM in the targeted setting. The symbol indicates the surrogate model for generating the adversarial examples.
Method
ResNet"
Inception
PNASNet
SENet
DenseNet
MobilenNet
Average
0.03
99.36
0.00
0.00
0.00
0.04
0.08
0.02
SI
0.05
99.98
0.14
0.12
0.14
0.70
0.28
0.28
0.10
100.00
0.48
0.00
0.98
2.60
1.02
1.02
0.03
99.00
0.08
0.34
0.78
1.56
0.76
0.70
LinBP
0,05
99.58
0.94
2,00
3.58
6.90
3.56
3.40
0.10
99.48
5.58
8,22
9.18
18.58
8.96
10.10
0.03
98.06
0.02
0.04
0.12
0.76
0.34
0.26
TAIG-S
0.05
98.28
0.42
0.66
0,98
3,46
1.76
1.46
0.10
98.36
1.86
3.52
4.74
11.30
4.34
5.15
0.03
98.06
0.62
1.18
1.16
4.52
2.58
2.01
TAIG-R
0.05
98.32
4.66
7.26
7,08
18.54
9.60
9.43
0.10
98.04
17.00
31.12
20.48
40.98
20.56
26.03
best performance and use them to generate adversarial examples with 3000 gradient calculations.
The results listed in Table 10
A.3.3 COMPARISON WITH VT AND ADMIX
In this section, we compare TAIG-R with Admix (Wang et al. 2021) and VT (Wang & He 202 which use other back-end methods. Admix uses MIFGSM as the basic iteration method (MI-Admix) and VT has two different versions NI-VT and MI-VT, which use MIFGSM and NIFGSM as their back-end methods respectively. VT and Admix both use Inception as the surrogate model their study and they also provided 1000 images used in their evaluation. experiment. Thus, we run TAIG-R on Inception V3 on the same 1000 images they used under the with 3000 gradient calculations. Table lists the attack
was set to 16/255 in their
same value of All the methods success rate of these methods on different models and shows that TAIG-R outperforms MI-Admix, MI-VT, and NI-VT in all the models. NI-VT is slightly better than MI-VT. As NI-VT performs the best, we further run NI-VT on the 5000 images used in our evaluation with ResNet50 as a surrogate model under different e and the results are listed in Table 12
A.4 COMBINATIONS WITH OTHER METHODS
In Section 4.3, LinBP, DI, and ILA with different back-end attacks are investigated under E = 0.03, 0.05, 0.1. In this section, we provide the experimental results of the same setting under
16

---

Published as a conference paper at ICLR 2022
Table 8: Attack success ra) of different methods under the same number of gradient caleulations with TAIG-S and TAIG-R using IFGSM in the untargeted setting. The symbol indicates the surrogate model for generating the adversarial examples.
Number gradient calculations
Methods
ResNet"
Inception
Pnasnet
Senet
Densenet
Mobilenet
Average
4/255
600
99.90
8.12
3.58
4.90
17.34
19.42
10.67
8/255
1500
100,00
20.40
11.12
16.12
40.04
42.54
26.04
16/255
3000
100.00
48.48
35.68
48.96
73.92
72.84
55.98
0.03
600
100.00
22.28
12.06
17.80
42.28
44.38
27.76
0.05
1500
100.00
39.40
26.68
37.48
64.78
65.10
46.69
0.1
3000
100.00
68.68
61.26
72.56
88.66
87.56
75.74
4/255
600
99.98
8.70
6.30
11.70
24.72
26.62
15.61
8/255
1500
100.00
29.52
27.10
43,16
64.12
63.22
45.42
LinBP
16/255
3000
100.00
74.02
74.50
87.48
94.86
94.68
85.11
0,03
600
100.00
30.48
27.98
43,78
65.50
64.52
46.45
0.05
1500
100.00
61.80
59.40
77.80
89.28
88.78
75.41
0.1
3000
100.00
93.62
94.22
98.02
99.24
98.88
96,80
4/255
600
99.98
10.10
6.60
21.62
25.02
13.58
8/255
1500
100.00
26.14
15.02
22.64
49.80
52.74
33.27
16/255
3000
100.00
55.34
43.04
57.86
82.08
80.66
63.80
TAIG-S
0.03
600
100.00
24.98
14.06
20.32
48.66
50.56
31,72
0.05
1500
100.00
43.56
30.68
42.74
71.92
71.76
52.13
0.1
3000
100.00
69.68
60.06
74.78
91.54
89.70
77.15
4/255
99.96
17.04
11.60
35.38
37.28
8/255
1500
100.00
45.44
34.00
41.62
73.72
73.86
53.73
16/255
100.00
84.30
78.82
84.72
95.90
TAIG-R
100.00
46.06
33.82
40.14
71.58
0.05
1500
100.00
74.22
66.30
73.46
93.62
91.56
79,83
0.1
3000
100.00
95.18
94.50
96.02
99.20
70
60
50
20
10
Position
VGG19-
VGG1S--Reshet
An illustration of how the attack success rate of LinBP varies with the choice of the position in VGG19.
Figure 4:
4/255, 8/255, 16/255. The results are given in Table 13 It demonstrates that TAIG-R and TAIG-S improve the transferability of other methods. Besides, the same combinations are also ex- amined in the target setting and the experimental results are listed in Table 14 It demonsirates that TAIG-S and TAIG-R also improve the transferability of different methods in target attacks. How- the combinations of TAIG-S and TAIG-R with other methods do not consistently improve the performance of TAIG-S and TAIG-R, which is different from the observations untargeted attacks. Through the comparison of Table 7 and Table 14 it is noted that the transferability of TAIG- would
17

---

Published as a conference paper at ICLR 2022
Table 9: Attack success rate(%) of different modification position of LinBP in the untargeted set- ting. The surrogate model is VGGI9 and the attack success rate is computed from 100 gradient calculations.
LinBP Poistion
ResNet
Inception
PNASNet
SENet
DenseNet
MobileNet
Average
35.71
20.67
9.19
17.76
24.52
47.48
25.89
37.81
19.76
10.19
19.05
25.92
49.38
27.02
3
44.67
20.38
10.10
20.86
27.05
54.57
29.61
4
45.29
14.14
7.00
18.86
23.05
51.81
26.69
5
40.57
18.33
10.57
22.00
27.95
55.24
29.11
6
46.71
24.52
11.19
22.38
38.71
65.62
34.86
7
25.57
22.24
13.29
15.71
28.19
54.21
26.54
8
32.14
19.05
11.33
21.29
28.05
53.81
27.61
9
23.71
16.86
20.05
31.57
54.76
27.95
29.15
10
74,90
56.10
53.48
58.90
70.48
82.29
66.03
11
30.62
23.10
16.48
24.14
32.19
$1.43
29.66
12
66.71
45.57
63.76
75.24
59.08
51.71
35.24
32.00
46.10
51.57
65.52
47.02
14
74.43
49.10
58.57
67.10
71.38
81.10
66.95
15
62.19
37.81
43.33
53.76
59.00
74.52
55.10
16
69.52
43.57
53.00
59.52
66.10
77.52
61.54
Table 10: Attack success rate(%) of LinBP using the best two modified VGG19 as surrogate model. The attack success rate is computed from 3000 gradient calculations.
LinBP Poistion
ResNet
Inception
PNASNet
SENet
DenseNet
MobileNet
Average
10
83.16
67.70
64.76
67.68
80.74
88.12
75.36
14
79.32
51.58
59.80
73.42
74.32
85.70
70.69
TAIG-R
93.96
84.70
86.20
86.88
93.64
96.24
90.27
be harmed when combined with other methods in the target setting. And the performance of TAIG-S will decrease when combined with ILA in the target setting.
A.5 EVALUATION ON ADVANCED DEFENSE MODEL BASED ON DETECTION
In this section, we evaluate the performance of TAIG-S and TAIG-R on two advanced defense models based on adversarial image detection. These two methods are Feature squeezing (FS (Xu et al. (2018) and Turning a Weakness into a Strength (TWS Hu et al. (2019)) We use their default settings and examine their detection rate on the different methods. For each of methods, 5000 adversarial images generated under = 16/25 265 with 3000 gradient calculations are used in this evaluation. The detection rate and the attack success rate after detection (ASRD) are listed in Table
15 The ASRD is defined as the number of successful attacks over 5000. The detection rates of both detectors on AOA are low, but the ASRD of AOA is the lowest one. Table [5] shows that TAIG-R has the highest ASRD among all the methods.
Table 11: success rate(%) of VT and Admix using MIFGSM and NIFGSM in the untargeted set- ting with é = 16/255. The symbol * indicates the surrogate model for generating the adversarial examples.
Method
Inception"
PNASNet
SENet
DenseNet
MobilenNet
ResNet
Average
MI-Admix
99.10
51.80
55.10
67.80
69.60
67.70
62.40
MI-VT
98.80
60.40
60.40
68.50
70.90
69.60
65.96
NI-VT
98.90
61.40
62.10
68.60
71.80
70.70
66.92
TAIG-R
100.00
65.30
64.60
79.90
82.90
79.80
74.50
18

---

Published as a conference paper at ICLR 2022
Table 12: Attack success rate(%) of NI-VT under the number of gradient calculations with TAIG-S and TAIG-R in the untargeted setting, The symbol indicates the surrogate model for generating the adversarial examples.
Number gradient calculations
Methods
ResNet"
Inception
Pnasnet
Senet
Densenet
Mobilenet
Average
4/255
600
94.40
14,06
6.16
5.88
16. 16.12
23.54
13.15
8/255
1500
95.20
31.82
18.28
18.50
37.58
42.00
29.64
16/255
3000
96.20
61.22
46.56
47.78
65.16
70.10
58.16
NI-TT
0.03
600
95.40
32.94
18.62
18.90
38.40
42.68
30.31
0.05
1500
95.80
52.70
36.16
34.86
56.94
61.14
48.36
0.1
3000
96.70
79.88
71.42
68.23
83,20
84.66
77.48
4/255
600
99.96
17.04
8,66
11.60
35,38
37.28
21.99
8/255
1500
100,00
45.44
34,00
41.62
73.72
73.86
53.73
16/255
3000
100.00
84.30
78.82
84.72
97.00
95.90
88.15
TAIG-R
0,03
600
100,00
46,06
33.82
40.14
72.52
71.58
52.82
0.05
1500
100,00
74.22
66.30
73,46
93.62
91.56
79,83
0.1
3000
100.00
95.18
94.50
96.02
99.60
99.20
96.90
Table 13: Attack success rate(%) of different combinations in the untargeted setting, The symbol indicates the surrogate model for generating adversarial examples.
Method
ResNet"
Inception
Pnasnet
Senet
Densenet
Mobilenet
Average
4/255
99.98
10.28
7.96
12.64 24
24.68
27.82
16.68
ILA+ IFGSM
8/255
100.00
27.16
26.08
38.94
55.84
58.42
41.29
16/255
99.96
61.74
61.80
78.72
86.66
88.24
75.43
4/255
99.94
11.96
6.78
13.32
27.84
32.26
18.43
ILA+ TAIG-S
8/255
100.00
36.00
28.62
47.98
68.98
69.52
50.22
16/255
100.00
75.98
72.76
88.62
95.06
95.18
85.52
4/255
99.96
14.66
9.06
15.68
33.74
36.54
21.94
ILA+
8/255
100.00
42.56
35.10
52.14
73.82
74.68
55.66
TAIG-R
16/255
100.00
83.10
80.62
90.98
97.18
96.90
89.76
4/255
99.96
10.08
6.82
11.76
27.50
29.42
17.12
LinBP+ IFGSM
8/255
100.00
30.48
27.82
41.66
64,90
65.14 14
46.00
16/255
100.00
72.38
72.50
85.28
94.12
93.88
83.63
4/255
99.66
14.30
7.32
12.32
33.88
36.96
20.96
Linbp+
8/255
50.66
37.14
51.12
80.40
79.62
59.79
TAIG-S
16/255
91.58
87.92
93.24
99.10
98.44
4/255
99.70
21.24
12,52
18.10
43.12
46.46
28.29
Linbp+
8/255
99.98
62.94
50.96
63.72
87.96
86.36
70.39
TAIG-R
16/255
99.98
95.52
94.20
96.78
99.58
99.08
97.03
4/255
99,94
8.56
5.80
7.08
19,80
20.98
12.44
DI+ MIRGSM
8/255
100.00
18.55
15.20
20.32
41.72
41.08
27.37
16/255
100.00
39.32
38.12
47.74
70.06
68.00
52.65
4/255
99.98
14.22
6.74
9.64
29.44
31.62
18.33
DI+ MTAIG-S
8/255
100.00
35.76
22.60
31.56
61.40
62.00
42.66
16/255
100.00
68.32
57.68
69.16
89, 24,44
88.24
74.57
4/255
99.96
21.32
12.26
15.30
40.62
43.38
26.58
DI+ MTAIG-R
8/255
100.00
55.48
42.88
48.92
80.12
78.54
61.19
16/255
100.00
89.50
85.72
89.16
98.00
97.26
91.93
A.6 ABLATION STUDY
In this section, we investigate the influence of the number of sampling points. In this experiment, is set to 8/255 and 1000 images are sampled from the 5000 images used the evaluation. (Sundarara- jan et al.) 2017) pointed out that the sampling points between 20 to 300 enough to approximate the integral. Following Sundararajan et al. suggestion, the number of sampling points for TAIG- S starts from 20 with increment of 10 in each of the tests. We find that with the increase of the
19

---

Published as a conference paper at ICLR 2022
Table 14: Attack success rate(%) of different combinations in the target setting. indicates the surrogate model for generating adversarial examples.
The symbol
Method
ResNet'
Inception
PNASNet
SENet
DenseNet
MobilenNet
Average
0.03
58.86
0.10
0.10
0.26
0.50
0.30
0.25
ILA+
0.05
28.90
0.30
0.46
0.50
1.20
0.70
0.63
IFGSM
0.10
9.14
0.98
1.24
0.92
1.76
0.58
1.10
0.03
63.34
0,32
0.72
2.34
1.10
1.07
ILA+
0.05
54.28
1,50
2.72
2.06
5.56
1.86
2.74
TAIG-S
0.10
25.16
3.70
6.00
2.36
6,92
1.68
4.13
0.03
69.40
0.60
1.08
1.10
3.38
1.56
ILA+
0.05
62.92
5.38
3.58
9.36
2.80
4.77
TAIG-R
0.10
34.44
6.76
11.20
2.68
7.79
0.03
98.68
0.04
0.10
0.28
1.02
0.58
0.40
LinBP+
0.05
99.60
0,60
1.42
2.36
5,90
3.14
2.68
IFGSM
0.10
99.60
4.84
7.96
9.54
17.52
9.18
9.81
0.03
67.40
0.50
0.72
0.74
3,90
1.78
1.53
Linbp+
0.05
68.66
3.82
4,60
5.40
13.56
6.20
6.72
TAIG-S
0.10
65.42
11,50
15.28
11.02
23.20
12.32
14.66
0.03
62.54
1.18
1,56
1,80
6.64
3.48
2.93
Linbp+
0.05
62.62
5,40
7,06
6.74
15.70
8.20
8.62
TAIG-R
0.10
51.98
10.34
13.58
9.30
19.90
10.76
12.78
0.03
99.84
0.02
0.02
0.02
0.08
0.16
0.06
DI+
0.05
100.00
0.02
0.10
0.20
0.28
0.18
0.16
MIFGSM
0.10
100.00
0.28
0.72
0.88
1.66
0.56
0.82
0.03
98.22
0.20
0.18
0.30
0.84
0.58
DI+ MTAIG-S
0.05
98.36
4.50
0.10
98.32
3.22
5.02
5.00
12.50
4.28
6.00
0.03
97.66
0,92
1.36
1.34
5,08
2.54
2.25
DI+ MTAIG-R
0.05
98.30
4.94
7.22
6.46
8.40
0.10
98.14
17.58
29.40
18.88
38.66
18.70
24.64
Table 15: methods.
The detection rate(%) and attack success rate after detection (ASRD %) of different
Detector
TWS
FS
Method
Detection rate
ASRD
Detection rate
ASRD
AOA
5.72
31.66
4,28
4.71
SI
14.8
41.72
10.02
20.20
NI-VT
16.04
54.26
7.02
51.82
LinBP
49.46
31.36
15.04
57.58
TAIG-S
21.24
46.24
11.98
29.86
TAIG-R
21.16
68.52
12.22
67.58
number of sampling points, the attack success rate of TAIG-S only slightly fluctuates. Thus, we stop it at 70 sampling points and the results are listed in Table For TAIG-R, we follow the same setting. The number of turning points also starts from 20 with an increment of in each of the tests. And each of the segments in the path is estimated by one sampling point. We find that the attack success rate is slightly improved when the number of turming points increases. But the improvement becomes slow when the number of turning points is larger than 50. The results listed Table [7] To study the influence the number of sampling points 5 in each line segment, fix the turning points E' to 20 and change S from I to 5. With the increase of sampling points, the success attack success rate has slight improvements. The results are listed in Table 18
A.7 PERCEPTUAL EVALUATION
In this section, provide the perceptual evaluation of different methods seven full reference objective quality metrics, namely: Root Mean Square Error (RMSE), Lg distance, Peak- Peak-Signal--to- Matie-Ratio (PSNR), Structural Similarity Index (SSIM) (Wang et al., 2004), Visual Information
20

---

Published as a conference paper at ICLR 2022
Table 16: Attack success rate(%) of TAIG-S under different S in the untargeted setting. The symbol indicates the surrogate model for generating adversarial examples.
S
ResNet"
Inception
PNASNet
SENet
DenseNet
MobileNet
Average
20
100.00
25.00
15.50
23.70
50.40
52.80
33.48
30
100.00
25.70
15.40
23.50
50.70
52.70
33.60
40
100.00
25.70
14.60
25.60
50.80
52.80
33,90
50
100.00
25.30
15.40
24.40
49.60
51.80
33.30
60
100.00
25.80
14.70
22.80
50.90
53.00
33,44
70
100.00
24.70
15.60
24.00
49.20
52.90
33.28
Table 17: Attack success rate(%) of TAIG-R under different E in the untargeted setting. The symbol indicates the surrogate model for generating adversarial examples.
E
ResNet
Inception
PNASNet
SENet
DenseNet
MobileNet
Average
20
100.00
44.50
34.70
42.10
71.20
72.60
53.02
30
100.00
45.50
36.20
44.60
73.10
73.70
54.62
40
100.00
46.60
36.10
43.90
74.20
75.00
55.16
50
100.00
47.50
36.40
45.70
75.70
75.30
56.12
60
100.00
48.30
36.80
44.80
75.30
75.90
56.22
70
100.00
47.80
37.30
44.50
75.60
75.00
56.04
80
100.00
47.50
37.40
46.10
76.10
75.50
56.52
90
100.00
48.30
37.50
45.70
76.70
76.10
56.86
100
100.00
47.40
37.50
45.90
77.20
76.30
56.86
150
100.00
47.70
37.90
46.00
76.30
76.40
56.86
200
100.00
47.40
37.90
46.00
77.40
75.70
56.88
Fidelity (VIFP) (Sheikh & Bovik 2006). Multi-Scale SSIM index (MS-SSIM) (Wang et al. 2003). Universal Quality Index (UQI) Wang & Bovik (002). 1000 images used in this evaluation. The results are listed in Table 19 It shows that these methods perform similarly and TAIG-S is slightly better than the others.
Table 18: Attack success rate(%) of TAIG-R under different S for E 20 in the untargeted setting. The symbol indicates the surrogate model for generating adversarial examples.
S
ResNet
Inception
PNASNet
SENet
DenseNet
MobileNet
Average
100.00
44.50
34.70
42.10
71.20
72.60
53.02
100.00
45.70
34.10
41.90
73.10
72.60
53.48
100.00
45.60
35.60
43.90
74.00
74.10
54.64
100.00
45.40
34.80
43.30
74.20
74.00
54.34
100.00
46.90
35.20
44.80
75.50
74.40
55.36
21

---

Published as a conference paper at ICLR 2022
Table 19: Perceptual evaluation of different methods on reference objective quality metrics, The upward pointing arrow indicates that higher is better and the downward pointing arrow indicates that lower is better.
Methods
Lod
SSIM
RMSEL
PSNR1
UQIt
VIFPT
MS-SSIMT
8/255
0.968
0.913
0.027
31.36
0.973
0.988
0.969
AOA
16/255
0.979
0.751
0.054
25.41
0.948
0.973
0.910
8/255
0.973
0.921
0.026
31.65
0.975
0.981
0.971
SI
16/255
0.977
0.779
0.050
25.98
0.952
0.968
0.918
8/255
0.958
0.937
0.024
32.49
0.975
0.993
0.969
NI-VT
16/255
0,966
0.824
0.045
27.02
0.955
0.987
0.911
8/255
0.978
0.919
0.026
31.55
0.975
0.967
0.972
LinBP
16/255
0.983
0.767
0.052
25.76
0.950
0.923
0.914
8/255
0.940
0.023
32.66
0.981
0.978
TAIG-S
16/255
0.937
0.846
0.041
27.67
0.965
0.995
0.942
8/255
0.952
0.931
0.025
31.96
0.976
0.987
0.968
TAIG-R
16/255
0.968
0.805
0.049
26.16
0.953
0.997
0.906
22

---

Published as a conference paper at ICLR 2022
A.8 VISUALIZATION OF IG AND RIG
In this section, we provide more IG and RIG of different images. Fig. 5 is original images used in the visualization. Fig. 6 and Fig. are the IG and RIG of Fig. 5 and Fig. 5 from different
networks. Fig. and Fig. are the IG and RIG of Fig. 5(c) and Fig. ((d) before and after attacks.
(a)
(b)
(d)
Figure 5: Original images.
(a) IG
(b) RIG
Figure 6: The IG and RIG of Fig. ((a) from ResNet, MobileNet, SENet and Inception, from left to right.
23

---

Published as a conference paper at ICLR 2022
(a) IG
(b) RIG
Figure 7: The IG and RIG of Fig. 5(b) from ResNet, MobileNet, SENet and Inception, from top to bottom.
24

---

Published as a conference paper at ICLR 2022
(a) Orignal image
bb) TAIG-S attack
TAIG-R attack
Figure& 8: The IG and RIG of (a) the original image in Fig. 5(c) (b) the image after TAIG-S attack
and (c) the image after TAIG-R attack. The left column is IG and the right column is RIG.
25

---

Published as a conference paper at ICLR 2022
(a) Orignal image
b)) TAIG-S attack
TAIG-R attack
Figure 9: The IG and RIG of (a) the original image in Fig. 5(d) (b) the image after TAIG-S attack
and (c) the image after TAIG-R attack. The left column is IG and the right column is RIG.
26


Reviews:
[{"review_id": "w5HJ_wKAv5", "reviewer": "Reviewer_xf97", "summary": "", "questions": "", "limitations": "", "rating": 5, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "Strengths:\n1. The experimental results are good.\n2. The idea of updating along the integrated gradients is new and has theoretical support.\n\nWeaknesses:\n1. The most important weakness is the confusing experimental settings. Firstly, this paper lacks the details of calculating integrated gradients, i.e., how to calculate Equation (1)? According to the experiments section, I guess the integrated gradients are computed by averaging the gradients of 30 sampling points. Thus, the TAIG-S is 30X slower than most methods with the same iterations, such as LinBP and AOA. Although SI also requires calculating multiple gradients, TAIG-S is still 6X slower than SI (with the number of scale copies of 5). Furthermore, TAIG-R requires more gradient calculations because it should calculate function IG(f,x) E (the number of turning points) times. However, the authors did not report the value of E in the experiment section. Thus, I think it is better to compare the performance with other methods under the same gradient calculations instead of iterations. \n2. In section 3.3, the authors claim that sign(IG(f,x)) approximates sign(\\nabla f). I think it is a very weak approximation since there are only 68% elements of sign(IG(f,x)) and sign(\\nabla f) are the same, while random guessing can achieve about 50% of the same elements as sign(\\nabla f). The approximation of RIG is much worse (only 58%). Is this because the limited number of sampling points? Will the similarity between sign(IG(f,x)) and sign(\\nabla f) be higher if more sampling points are used to calculate IG? Besides, TAIG-S approximates sign(\\nabla f) better than TAIG-R while TAIG-R is better than TAIG-S in all experimental results. How do you explain this phenomenon?\n3. Ablation studies are missing. It’s necessary to see the sensitivity of the number of sampling points (30 in this paper) and the number of random paths (E, which is not be reported in this paper).\n4. From Table 1, LinBP seems to be the strongest counterpart. Why not compare with LinBP when VGG19 (or the other surrogate model listed in Table 4) is taken as the surrogate model? Finally, as I said before, LinBP only calculates gradients once in each iteration, it is unfair to compare it with TAIG-R which calculates gradients 30E times in each iteration. I recommend the authors to compare with some advanced methods which require more gradient calculations [1,2, 3].\n5. Maybe a typo: What’s the name of your methods? In the abstract, the method is called Transferable Attack “based on” Integrated Gradients. In later, the name is changed to Transferable Attack “using” Integrated Gradients.\n\n[1] Wu W, Su Y, Lyu M R, et al. Improving the Transferability of Adversarial Samples With Adversarial Transformations[C]//Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. 2021: 9024-9033.\n[2] Wang X, He K. Enhancing the Transferability of Adversarial Attacks through Variance Tuning[C]//Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. 2021: 1924-1933.\n[3] Wang X, He X, Wang J, et al. Admix: Enhancing the transferability of adversarial attacks[C]// Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV). 2021: 16158-16167.\n", "summary_of_the_paper": "Two methods are proposed in this paper. They are Transferable Attack using Integrated Gradients on Straight-line Path (TAIG-S) and Transferable Attack using Integrated Gradients on Random Piecewise Linear Path (TAIG-R). Compared with typical gradient-based attack methods, the TAIG-S uses integrated gradients to update adversarial examples, and TAIG-R uses random path integrated gradients to update adversarial examples. Experiments on ImageNet can prove the effectiveness of these methods.", "summary_of_the_review": "This paper proposes a novel algorithm to generate adversarial examples, and the results are good. However, some analysis and experimental results are confusing. The most important weakness is the high computational cost. Please address issues listed in the detailed comments during the rebuttal and make the paper clearer.", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}, {"review_id": "LrXXRzZZ0yI", "reviewer": "Reviewer_N6RH", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "The authors propose a simple but effective technique for generating adversarial perturbations in a black-box setting. In addition to this, the core component of the proposed technique (the Integrated Gradients and the Random Path Integrated Gradients) can be used to improve the existing techniques. I found the paper to be clear. I would encourage the authors to additional experiments to justify the claims made in the paper. \n\nBelow are a few questions for the authors:\nHow does your method stack up against other classes of black-box adversarial attacks? For instance, I would encourage the authors to compare against gradient-free attacks.\nHow imperceptible are the examples generated by the proposed technique? For instance, even though most black-box adversarial have higher success rates, they generally forgo imperceptibility.\nHow good is the proposed technique in evading the recent class of adversarial example detection methods?\n\nI would also encourage the authors to include a detailed set of ablation studies, such as how many samples are needed to ensure that the surrogate models are sufficient. Does TAIG require less in comparison to others? Also, over how many samples are the Integrated Gradients computed, does that impact your results? In addition to the above, it will also be helpful to report run-times for each of the techniques.", "summary_of_the_paper": "In practice, adversarial examples are generated in three ways, i) solving a standard optimisation problem, ii) leveraging the salient regions of an image, or iii) smoothing the decision surfaces. The authors propose a simple technique named Transferable Attack based on Integrated Gradients (TAIG) that combines all these three approaches. Unlike the existing systems, which leverages other methods by adding additional terms to the objective function, TAIG integrates them into a single objective.", "summary_of_the_review": "In general, the paper explores an exciting direction, but I found the experiments a bit lacking. I would encourage the authors to address the questions listed above", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}, {"review_id": "5dJILT9Clr", "reviewer": "Reviewer_bFo6", "summary": "", "questions": "", "limitations": "", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "The proposed Transferable Attack based on Integrated Gradients (TAIG) generated the adversarial examples on the integrated gradients, which has shown good attack performance against some deep neural networks. The proposed attack method can be analyzed from three aspects: optimization based, attention based, and smoothing decision surface based. However, I have some concerns about this paper:\n1.\tIt seems the paper only combines the traditional attack (FGSM) on the integrated gradients. Will the other attacks achieve better performance on the integrated gradients? More novel contributions should be stated;\n2.\tWhy the paper selects a black image as the reference?\n3.\tThere are still some extant works that generated the adversarial examples based on the sensitive feature in the image. It is better to describe the difference and compare the performance;\n4.\tI am not convinced by the explanation that sign(IG(f,x)) approximates sign(f) such that 68% elements are the same according to Fig. 2. It is better to propose any other theoretical explanation;\n5.\tIn the experiment, the authors select thirty sampling points to estimate TAIG-S and TAIG-R. Please explain why it works?\n6.\tThere are some typos and grammar errors in the paper, it is better to revise them.\n", "summary_of_the_paper": "This paper studies adversarial attacks to deep neural network. To achieve good attack performance, this paper proposes the attack to the integrated gradients and the method (TAIG) is shown to be highly transferable to other black-box models.", "summary_of_the_review": "The paper proposes the integrated gradients and the method (TAIG)  to attack black-box models, which has shown good performance. But there are still some place to improve.", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "2: Several of the paper’s claims are incorrect or not well-supported.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "Not applicable"}, "extra_text": {}}, {"review_id": "0l6Kiptn2Wd", "reviewer": "Reviewer_cPsc", "summary": "", "questions": "", "limitations": "", "rating": 8, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "Strengths:\n- The application of the Integrated Gradients technique to produce adversarial examples is novel\n- The evaluation of the method is comprehensive, and demonstrates state of the art performance in almost all cases\n\nWeaknesses:\n- The technical novelty is not enormous, in the sense that it consists purely of a straightforward application of an existing technique, and the method section mainly consists of a justification of why the method makes sense in this domain", "summary_of_the_paper": "This paper applies the Integrated Gradients technique to the problem of creating adversarial examples in the black box setting. This produces results that are better than the state of the art methods for most of the networks tested, and it can be used in combination with those existing methods to produce even better results.", "summary_of_the_review": "The paper is overall quite good, with thorough experiments demonstrating good performance.", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "4: All of the claims and statements are well-supported and correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "4: The contributions are significant, and do not exist in prior works."}, "extra_text": {}}]

Author rebuttal:

Meta-review: This paper proposes integrating three existing approaches to give a simple algorithm called TAIG for generating transferable adversarial examples under blackbox attacks.

In the original reviews, some strengths and weaknesses of the papers were highlighted although some of them have not reached general agreement after the discussion period.

Regarding the merits, it is generally felt that the experimental results are good and the idea of updating along the integrated gradients is new (despite a simple idea) and has some theoretical justification.

Nevertheless, even after the discussion period, some concerns still remain, including the technical novelty of the proposed method and the high computational requirements of the proposed method, among others.

We appreciate the authors for responding to the reviews by clarifying some points and providing further experimental results. The paper would be more ready for publication if all the comments and suggestions are taken into consideration to improve the paper more thoroughly.
Decision: Accept (Poster)