Making Substitute Models More Bayesian Can Enhance Transferability of Adversarial Examples
Authors: Qizhang Li
Yiwen Guo
Wangmeng Zuo
Hao Chen
Venue: ICLR 2023 poster (2023)
Keywords: Adversarial Examples
Black-box Attacks
Adversarial Transferability

Abstract: The transferability of adversarial examples across deep neural networks (DNNs) is the crux of many black-box attacks. Many prior efforts have been devoted to improving the transferability via increasing the diversity in inputs of some substitute models. In this paper, by contrast, we opt for the diversity in substitute models and advocate to attack a Bayesian model for achieving desirable transferability. Deriving from the Bayesian formulation, we develop a principled strategy for possible finetuning, which can be combined with many off-the-shelf Gaussian posterior approximations over DNN parameters. Extensive experiments have been conducted to verify the effectiveness of our method, on common benchmark datasets, and the results demonstrate that our method outperforms recent state-of-the-arts by large margins (roughly 19% absolute increase in average attack success rate on ImageNet), and, by combining with these recent methods, further performance gain can be obtained. Our code: https://github.com/qizhangli/MoreBayesian-attack. 

Published as a conference paper at ICLR 2023
MAKING SUBSTITUTE MODELS MORE BAYESIAN CAN ENHANCE TRANSFERABILITY OF ADVERSARIAL Ex- AMPLES
Qizhang Li:.2, Yiwen Guo Wangmeng Zuo', Hao Chen'
Harbin Institute of Technology. TTencent Security Big Data Lab, "Independent Researcher, 'UC Davis Ligi zhang95, guoyiwent @ gma.l.....ommmoooo com wmzuc@hit..o edtt..dducco cn chen@ucdavis.edi
ABSTRACT
The transferability of adversarial examples across deep neural networks (DNNs) is the crux of many black-box attacks. Many prior efforts have been devoted to im- proving the transferability via increasing the diversity in inputs of some substitute models. In this paper. by contrast, we opt for the diversity in substitute models and advocate to attack Bayesian model for achieving desirable transferability. Deriv- ing from the Bayesian formulation, finetuning, which can be combined with many off-the-shelf Gaussian posterior ap- proximations over DNN parameters. Extensive experiments have been conducted to verify the effectiveness of our method, on common benchmark datasets, and the results demonstrate that our method outperforms recent stale-of-the-arts by large margins (roughly 19% absolute increase in average attack success rate on Ima- geNet), and, by combining with these recent methods, further performance gain can be obtained. Our code: http://hwwbboooo//ll//////////// attack
develop a principled strategy for possible
INTRODUCTION
The adversarial vulnerability of deep neural networks (DNNs) has attracted great attention (Szegedy) ct al. 2014, Goodfellow et al.) 2015) Papernot et al.) 2016 Carlini Wagner] 2017, Madry et al.) 2018 Athalye et al.) (0118). It has been demonstrated that the prediction of state-of-the-an DNNs can be arbitrarily altered by adding perturbations, even imperceptible to human eyes, to their inputs.
Threat models concerning adversarial examples can be divided into white-box and black-box ones according to the amount of information (of victim models) being exposed to the attacker. In black- box attacks, where the attacker can hardly get access to the architecture and parameters of the victim model, the transferability of adversarial examples is often relied on, given the fact that adversarial examples crafted
substitute model can sometimes fool other models well. However, such methods also suffer from considerable failure rate when the perturbation budget is small. Thus, much recent effort has been devoted to improving the black-box transferability of adversarial examples, and variety of transfer-based attacks have been proposed.
Assuming that the substitute model was pre-trained and given, most of the recent research focused only on improving the backpropagation process when issuing attacks, yet little attention has been paid to possible training or finetuning of the substitute model. In this paper, we shall focus more on the training process, and for which we advocate to perform in a Bayesian manner, in order to issue attacks. By introducing probability measures to weights and biases of
more powerful transfer- the substitute model, all these parameters are represented under assumptions of some distributions to be learned. In this way, an ensemble of infinitely many DNNs (that are jointly trained in our view) can be obtained from single run of training. Adversarial examples are then crafted by maximizing average prediction loss over such a distribution of models, which is a referred to as posterior learned in the Bayesian manner. Experiments
attacking variety of CIFAR-10 10 (Krizhevsky & Hinton, 2009) and ImageNet (Russakovsky et al. 2015) victim models have been performed, and we show that the proposed method outperforms of th--tee considerably. Moreover, method can be conjugated with existing methods easily and reliably for further improving the attack performance.
Work was done under the supervision of Yiwen Guo who is the corresponding author.

---

Published as a conference paper at ICLR 2023
2 BACKGROUND AND RELATED WORK
2.1 ADVERSARIAL ATTACKS
White-box attacks. Given full knowledge of the architecture and parameters of a victim model, white-box attacks are typically performed via utilizzig some loss gradient with respect to the model inputs. For instance, given a normal sample (x,y) v) and a model fw R + IR. that is trained to classify x into y E R it is popular choice craft the adversarial example bounded small region of x, by maximizing the prediction loss, i.e., maxij Lx + Ax, y, w), where is the perturbation budget. FGSM proposed to calculate e sgn V (x, w)) for Ax in the p 00 setting (Goodfellow et al. 2015), and the iterative variants of FGSM, e-g., I-FGSM (Kurakin et al. 2017) and PGD (Madry et 20188) can be more powerful.
Ax within an lp
Black-box attacks. Black-box attacks are more challenging compared to the white-box attacks. Many existing methods largely rely on the transferability of adversarial examples, i.e., adversar- ial examples crafted on one classification model can generally succeed in attacking some other victim models as well. It is normally assumed to be able to query the victim model to annotate training samples, or be possible to collect pre-trained source model that is trained accomplish the same task as the victim models. Aiming at enhancing the adversarial transferability, methods have been proposed to modify the backpropagation computation, see for example the skip gradient method (SGM) (Wu et al., 2020), the linear backpropagation (LinBP) method (Guo et al., 2222)), the intermediate-levv attack (ILA) (Huang et al. 2019). and ILA++ (Li et al. |020a] Guo et al. 2022). It is also widely adopted to increase the diversity in inputs (Xie [0119 Dong et al. 20 Lin ett al., 2019; Wang et al. 2021). In this paper, we consider the diversity from another perspective, the substitute model(s), and we introduce a Bayesian approximation for achieving this.
Ensemble-basee attacks. Our method can be equivalent to utilizing an ensemble of infinitely many substitute models with different parameters for performing attacks. There exists prior work that also took advantage of multiple substitute models. For instance, [Liu et al.] (2017) proposed to generate adversarial examples on an ensemble of multiple models that differ in their architectures. [i et al. (2020b) proposed ghost network for gaining transferability, using dropout and skip connection ero- sion to obtain multiple models. Following the spirit of stochastic variance reduced gradient (Johnson & /Zhang 2013), Xiong et al. (2022) proposed stochastic variance reduced ensemble (SVRE) to re- duce the variance of gradients of different substitute models. From a geometric perspective, Gubri et al. (2022b) suggested finetuning with a constant and high learning rate for collecting multiple models along the training trajectory, on which the ensemble attack was performed. Another method collected substitute models by using cSGLD (Gubri et al. (2022a), which is more related to our work, but being different in the sense of posterior approximation and sampling strategy. We will provide detailed comparison in Section 4.2
2.2 BAYESIAN DNNS
If a DNN is viewed as a probabilistic model, then the training of its parameters w can be regarded as maximum likelihood estimation maximum posterior estimation (with regularization). Bayesian deep learning opts for estimating a posterior of the parameter given data at the same time. Prediction of any new input instance is given by taking expectation over such a posterior. Since DNNs normally involves huge number of parameters, making the optimization of Bayesian model more challenging than in shallow models, series of studies have been conducted and many scalabble approximations have been developed. Effective methods utilize variational inference (Graves) 2011] Blundell et al.,
2015 Kingma al.] 2015: Khan al.) 2018: Zhang et al.) 2018, Wu al. 2018 Osawa et al.
2019 Dusenberry et al. (020) dropout inference (Gal & Ghahramani 2016; Kendall & Gal 2017
Gal et al.) 2017). Laplace approximation (Kirkpatrick et al. 2017 Ritter et al. 2018 Li] 2000).
et al. 2019 2021 Wilson & Izmailov 2020). Taking SWAG (Maddox et al., (219)) as an example, which is an SGD-based approximation,
or SGD-based approximation (Mandt et al. [217]]
it approximates the posterior using a Gaussian distribution with the stochastic weight averaging (SWA) solution as its first raw moment and the composition of a low rank matrix and a diagonal matrix its second central moment. Our method is developed in Bayesian spirit and shall discuss SWAG thoroughly in this paper. Due to the space limit of this paper. we omit detailed introduction of these methods and encourage readers check references if needed.
2

---

Published as a conference paper at ICLR 2023
The robustness of Bayesian DNNS has also been studied over the last few years. In addition to the probabilistic robustness/safety measures such models (Cardelli et al. 2019 Wicker et al. 2020), attacks have been adapted (Liu et al. 2018b; Yuan et al., (2220) to testing the robustness in Bayesian settings. Theoretical studies have also been made (Gal & Smith 2018). Although Bayesian models suggested to be robust (Carbone al. 2020 Li al. 2019), adversarial training has also been proposed for them, as in Liu et al. (2018b) 8b 's work. Yet. to the best of our knowledge, these studies did not pay attention to adversarial transferability.
TRANSFER-BANE -BASED ATTACK AND BAYESIAN SUBSTITUTE MODELS
An intuition for improving the transferability of adversarial examples suggests improving the diver- sity during backpropagation. Prior work has tried increasing input diversity (Xie et al.. 2019 Dong al.) [219 Lin et al., 2019 Wang et al., (02T) and has indeed achieved remarkable improvements. In this paper we consider model diversity. A straightforward idea seems to train set of models with diverse architecture or from different initialization. all models (including the victim models) that are trained to accomplish the same classification task follow a common distribution, then training multiple substitute models seems to perform multiple point estimates with maximum likelihood es- timation. The power of performing attacks on the ensemble of these models may increase along with the number of substitute models. However, the time complexity of such a straightforward method is high, and it scales with the number of substitute models that could be trained. Here we opt for an Bayesian approach to address this issue and the method resembles performing transfer-based attack on an ensemble of infinitely many DNNs.
3.1 GENERATE ADVERSARIAL EXAMPLES ON A BAYESIAN MODEL
Bayesian learning aims to discover a distribution of likely models instead of a single one. Given a posterior distribution over parameters pl (W[[D) x p(D) w) p(()), where D is the dataset, we can predict the label of new input x by Bayesian model averaging, i.e.
pllx x, D) = p(u x. w)p(w
(1)
where p(y x. w) is the likelihood, sometimes also referred to as the predictive distribution (Izmailov eet al. 202T Lakssamaaaaaaannn
et al. (017) for given which is obtained from the DNN output with the assistance the softmax function. To perform attack on such a Bayesian model, a straight-
forward idea is to solve the following optimization problem (Liu al. 2018b Carbone al. 2020
arg min ply|x x + Ax, D) = arg min ply|x + Ax. w ())(((((D))) (Dwd.. A
(2)
Se
Obviously, it is intractable to perform exact inference on DNNs using Eq. (2) since there are a very large number of parameters. A series of methods aim to address this, and, as in prior work, we adopt the Monte Carlo sampling method to approximate the integral, i.e., p(y|x, D) where set of M models each of which parameterized by are sampled from the posterior p( (W|[)) One can then solve Eq. by performing attacks on the ensemble of these models,
E, w:).
M Σ plu A 1=1
M
arg min [e M
= arg max
L(x Ax,J, w.), W. pWWD) (3) Σ 1=1
Ax M
where L(.,', w:) is a function evaluating prediction loss of DNN model parameterized by w,. With iterative optimization methods, e.g., I-FGSM and PGD, different sets of models can be sampled at different iterations, as if there exist infinitely many substitute models.
3.2 THE BAYESIAN FORMULATION AND POSSIBLE FINETUNING
In this subsection, we discuss the way of obtaining the Bayesian posterior. Following prior work, consider threat model in which finetuning a source model is sometimes possible on benchmark datasets collected for the same task as that the victim models, though it is feasible to approximate the posterior without taking special care of the training process (Gal & Ghahramani 2016).
3

---

Published as a conference paper at ICLR 2023
Average Success Rate (%)
Average Success Rate (%)
60
35
50
30
40
25
30
20
Isatropic, w/o finetuning
Isatropic, w/o finetuning
15
Isttropic, w/ linetuning
10
Isotropic, w/ finetuning
0
0.003 0.006 0.009 0.012 0.015
0.003 0.006 0.009 0.012 0.015
(a) FGSM
(b) I-FGSM
Figure 1: How the (a) FGSM transferabilityy and (b) I-FGSM transferability change with different choices for the isotropic Gaussian posterior on CIFAR-IO. The dots the plots represent the transferability of adversarial examples crafted by single sample in the posterior. We performed foo. attacks under c = 4/255. Best viewed color.
To get started, simply assume that the posterior an isotropic Gaussian N(w, I where w is the parameter to be trained and a is positive constant for controlling the diversity of distribution. The rationality of such assumption of isotropic posterior comes from the fact that the distribution of victim models is unknown and nearly infeasible to estimate in practice, and higher probability of the victim parameters in the posterior may imply stronger transferability. We thus encourage explo- ration towards all directions (departed from w) of equal importance in the first place. Discussions with more practical assumption of the posterior will be given in the next section.
Optimization of the Bayesian model can be formulated as
N
max W
Bw-NWw oww.:w.. w).
(4)
N
We can further reformulate Eq.
into
M L(x;, Us, w Aw,), s.t. Aw, O(),00
min
(5)
MN
by adopting Monte Carlo sampling. The computational complexity of the objective in Eq. seems still high, thus we focus on the worst-case parameters from the posterior, whose loss in fact bounds the objective from below. The optimization problem then becomes:
N
min max
L(xi, Mi, w Aw), s.t. Aw NN0, 11 and p Aw)
(6)
N
t=1
where e controls confidence region of the Gaussian posterior. With Taylor's theorem, we further approximate Eq. ( with
1
min max AW N
T(x;, Ui, w) V Wi. w Aw, s. Aw ~ N(0 o²) 2²I) and p( p(Aw) 2
(7)
As Aw is sampled from zero mean isotropic Gaussian distribution, the inner maximization prob- lem has an analytic solution, which is Aw" ΣNV λε L yr, v) yis w)]l- de is computed with the probability density of the zero-men meoomman isotropic Gaussian distribution. Thereafter, the outer gradient for solving Eq. (7 + involves second-order partial derivatives in the Hessian matrix H which can be approximately calculated using the finite difference method. More specifically, the gradient estimated using N EN T.x,, Ve, w) (1/7) T.(x, Di, +w>A"") V Us. w)), where 7 a small positive constant.
Eis L Vi, w) HAw". which
N
quick experiment on CIFAR-I0 (Krizhevsky Hinton 2009) using ResNet-18 (He et al. 2016) was performed to evaluate the effectiveness of such finetuning. Introduction to victim models and detailed experimental settings are deferred to Section 4.1 Figure [ we compare attack transfer- ability using the conventional deterministic formulation and the Bayesian formulation, by applying FGSM and I-FGSM for single-step and multi-step attacks, respectively. We evaluated with different choices of the posterior covariance by varying the value of a. Notice that, has been mentioned,
4

---

Published as a conference paper at ICLR 2023
50
80
Rate
40
Average Success Rate
70
60
30
40
Average
20
30
10
SWAG, w/ fineturing
SWAG, w/ finetuning
0
4
scale
scale
(a) FGSM
(b) I-FGSM
Figure 2: How the (a) FGSM transferability,, and (b) I-FGSM transferability change with different scales for the covariance of SWAG posterior on CIFAR-10. The dots in the plots represent the transferability of adversarial examples crafted by a single model in the posterior. We perform loo attacks under 4/255. Best viewed in color.
the posterior can also be given even without any finetuning, and we achieve this via directly applying the pre-trained parameters to w in ((w,o²1) Attacking such "Bayesian" model can be equiv- alent to attacking the deterministic model when a + O. With a being strictly greater than 0, one perform attack in way described in Section 33.1] Apparently, more significant adversarial transferability can be achieved by introducing the Bayesian formulation (along with a > 0), while the substitute model itself is suggested be
robust with such a Bayesian formulation (Li al., 2019 Carbone et al. 2020). In Figure ! see the blue curves that are obtained without any finetuning, the best performance achieved with o 0.012, showing +5.71% and + +14.301 4..30% absolute gain in attack success rate caused by attacks with FGSM and I-FGSM, respectively.
further be observed that obvious improvement (over +21% absolute increase in the I-FGSM success rate) can be achieved by introducing the additional finetuning, though attacking the pre- trained parameters in a Bayesian manner already outperforms the baseline considerably. Detailed performance on each victim model is reported in Table 1 Conclusions on ImageNet is consistent with that on CIFAR-10, see Appendix A
The (possible) finetuning improves the performance of unsatisfactory models that could be sampled. For instance, with a = 0.009, the worst performance 100 model samples from the posterior shows an test-set prediction accuracy of 90.59% while the model at population mean shows accuracy of 91.68%. After finetuning, both results increase, to 91.91% % and 92.65%, respectively, which means finetuning improves the test-set performance of Bayesian samples and this could be beneficial to adversarial transferability.
Table 1: Comparing transferability of FGSM and I-FGSM adversarial examples generated on deterministic substitute model and the Bayesian substitute model (with without additional fine- tuning) under the fo constraint with 4/255 on CIFAR-10. The architecture of the substitute models ResNet-18 18, and "average" was calculated over all six victim models except for ResNet- 18. We performed 10 runs of the experiment and report the average performance in the table.
fine-
ResNet-18 18
VGG-19
WRN
ResNeXt
DenseNet
PyramidNet
GDAS
Average
X
84.76%
33.95%
36.10%
36.89%
34.30%
13.21%
28.60%
30.51%
Isotropic
X
85. 14%
40.41
43.33%
43.97%
41.17%
14.92%
33.51
36.22%
FGSM
85.92%
54.06%
55.50%
57.40%
53.13%
19.23%
42.69%
47.00%
59.01%
69.644
61.35%
57.67%
21.22%
45.57%
50.74%
x
100.00%
37.51% 1%
57.01%
57.95%
52.84%
12.70%
40.32%
43.06%
100.00%
$2.30%
73.46%
75.38%
69.55%
19.61
53.85%
$7.36%
Isotropic
1-FGSM
100.00%
78.80%
91.63%
92.98%
90.22%
41.50%
78.76%
78.98%
+SWAG
100.00%
85.10%
94.66%
94.95%
92.75%
48.93%
83.89%
83.38%
3.3
FORMULATION WITH IMPROVED APPROXIMATION
In Section we have demonstrated the power of adopting Bayesian substitute models for gener- ating transferable adversarial examples, with relatively strong assumption of the posterior with presumed isotropic covariance matrix though. Taking one step further, we try to learn the covariance matrix from data in this subsection.
5

---

Published as a conference paper at ICLR 2023
Table 2: Success rates of transfer-based attacks on ImageNet using Res.eet-50 as substitute architec- ture and I-FGSM as the back-end attack, under the lo constraint with e 8/255 in the untargeted setting. "Average" was calculated over all ten victim models except for ResNet-50. We performed 10 runs and report the average performance for each result in the table.
Method
ResNet-50
VGG-19
ResNet-152
Inception v3
DenseNet
MobileNet
I-FGSM
100.00% %
39.22%
29.18%
15.60%
35.58%
37.90%
TIM (2019)
100.00% %
44.98%
35. 14%
22.21%
46.19%
42.67%
SIM (2020)
100,00 %
53.30%
46 80%
27.04%
54.16%
52.54%
LinBP (2020)
100.00% %
72.00%
58 62%
29.98%
63.70%
64.08%
Admix (2021)
100.00 %
57.95%
45.82%
23.59%
52.00%
55.36%
TAIG (2022)
100.00 %
54.32%
45.32%
28.52%
53.34%
55.18%
ILA+ (2022)
99,965
74.94%
69 64%
41.56%
71.28%
11.84%
LGV (2022)
100.00 %
89.02%
80.38%
45.76%
88.20%
87.18%
Ours
100.00 %
97.79% %
97.13%
73.12%
98.02% %
97.49 %
Method
SENet
ResNeXt
WRN
PNASNet
MNASNet
Average
I-FGSM
17.66%
26.18%
27.18%
12,80%
35,58%
27.69%
TIM (2019)
22.47%
32.11%
33.26%
21.09%
39.85%
34.00%
(2020)
27.04%
41.28%
21.74%
50.36%
41.69%
LinBP (2020)
41.02%
51.02%
54.16%
29.725
62.18%
52.65%
Admix (2021)
30.28%
41.94%
42.78%
21.91%
$2.32%
42.40%
TAIG (2022)
24.82%
38. 38.36%
42.16%
17.20%
54.90%
41.4%% %
(2022)
53.12%
65.92%
65.64%%
44.56%
70.40%
62.89%
LGV (2022)
54.82%
71.221%
75.14%
46.50%
84.58%
72.28%
Ours
85,41 %6
94.16%
95.39%
77.60%
97.15% %
91.33%
There exist dozens of methods for achieving the goal, here we choose SWAG (Maddox et al., 2019) which is a simple and scalable one. It introduces an improved approximation to the posterior over parameters. Gaussian approximation still considered, and more specifically, the SWA solution (Iz- mailov et al., 2018) is adopted as its mean and the covariance is decomposed into low rank matrix and a diagonal matrix, i.e., w ~ ~NN(ww (wSwA. ESWAG), where ΣSWAG = [ddag + Ejow-rank).
In SWAG, both the mean and the covariance are calculated using temporary models during training, and thus the posterior estimated from the training dynamics. Recall that the posterior concerned in the previous section is constructed using only a single model sampling, thus it can be readily com- bined with SWAG for improving the diversity and flexibility. Specifically, since WsWA is unknown before training terminates, On this point, the dispersion of w in the final Bayesian model comes from two independent Gaus- sian distribution and the covariance matrices added together, i.e., ~ A(wwwww ESWAG (T), where B = o2.
optimize models using the same learning objective in Section 3.2
Figure illustrates the attack performance when SWAG is further incorporated for approximating the posterior. It can be seen that our method works favourably well, and further improvements can be achieved comparing to the results in Figure ! Detailed success rates on each victim model are given in Table Conclusions on ImageNet are the same (see Appendix AA). Such empirical improvements indicate that the assumption of a more general Gaussian posterior may still align with the distribution of victim parameters in practice, and SWAG help estimate the posterior appropriately. Thus, without further clarification, we will incorporate SWAG into our method in the following experiments con- sidering the superior performance. Note that since SWAG requires continuous model checkpointing which is normally unavailable without finetuning, we only report the performance of our method with finetuning in the tables. If the collected source model was trained with frequent checkpointing and all these checkpoints are available, this method can be applied without finetuning.
EXPERIMENTS
We evaluate the effectiveness of our method by comparing it to recent state-of-the-an in this section.
4.1
EXPERIMENTAL SETTINGS
We tested untargeted foo attacks in the black-box setting, just like prior work (Dong & Yang 2019
Lin et al. 2019 Wang et al. 2021; : Guo et al. 2020; 2022). A bunch of methods were considered for comparison CIFAR- 10 (Krizhevsky & Hinton 2009). and ImageNet (Russakovsky et al. 2015),
using I-FGSM as the back-end method. On CIFAR-IO, 10, we set the perturbation budget to e 4/255
and used R8 (He al. 2016) source model. While ImageNet, the perturbation bud-

---

Published as a conference paper at ICLR 2023
Table 3: Success rates caused by transfer-based attacks on CIFAR-10 using ResNet-18 as substitute architecture and I-FGSM as the back-end attack, under the for constraint with e = 4/255 in the untargeted setting. "Average" was calculated over all six victim models except for ResNet-18. We performed 10 runs and report the average performance for each result in the table.
Method
R8
19
WRN
ResNeXt
DenseNet
PyramidNet
GDAS
Average
I-FGSM
100.00%
37.51%
57.01%
57.95%
52.84%
12.70%
40.32%
43.06%
TIM (2019)
100.00% %
39.65%
58.41%
59.74%
54.07%
13.33%
40.59%
44.30%
SIM (2020)
100.00% %
47.62%
64.62%
68.41%
62.43%
17.09%
44.46%
50.77%
LinBP (2020)
100.00 %
58.43%
78.49%
81.10%
76.50%
27.20%
60.91%
63.77%
Admix (2021)
100.00%
49.17%
69.94%
69.95%
64.65%
16.90%
49,50'
53.35%
TAIG (2022)
100.00%
47.20%
59.70%
63.18%
56.83%
15.29%
43.92%
47.69%
ILA++ (2022)
100.00%
59.46%
78.03%
78.49%
74.91%
25.60%
59.11%
62. 60%
LGV (2022)
100.00%
80.62%
92.52%
92.67%
90.44%
41.50%
77.28%
79.17%
Ours 100.00%
85.10%
94.66% %
94.95%
92.75%
48.93%
83.89 %
83.38
get was set to = 8/255 and used ResNet-50 (He et al..
2016 as the source model. For victim
models CIFAR-IO, we chose ResNet-18 (He et al.] 2016). VGG-19 with batch normaliza-
tion (Simonyan & Zisserman 2015), a PyramidNet (Han et al. al.] 2017), GDAS (Dong & Yang 2019).
WRN-28-10 (Zagoruyko & Komodakis 2016). a ResNe (Xie et al. 2017), and a DenseNet- following Guo et al. (2020; 2022)'s 's work. On ImageNet, ResNet-50 (He et al., (0T6)) VGG-19 (Simonyan & Zisserman, (2055) ResNet-152 (He et al., 2016), Inception
BC (Huang et al. 2017)
v3 (Szegedy et al., 2016). DenseNet-121 (Huang et al. (017). MobileNet v2 (Sandler et al., 2018),
SENet- 154 (Hu et al. 20.8). ResNeXt-101 (Xie et al. 20177. WRN-101 (Zagoruyko & Komodakis) 2 PNASNet (Liu et al. 2018a). and MNASNet (Tan et al. (019)) were adopted as victim mod- els Since these victim models may require different sizes of inputs, we strictly followed their official pre-processing pipeline to obtain inputs of specific sizes. For CIFAR- tests, we performed attacks on all test data. For ImageNet, we randomly sampled 5000 test images from a set of the vali- dation data that could be classified correctly by these victim models, and we learned perturbations to these images, following prior work (Huang Kong 2022 Guo et al. 2020 2022). For comparison, evaluated attack success rates of adversarial examples crafted utilizing different methods all victim models. Inputs to all models were re-scaled to [0.0, 1.0]. Temporary results after each attack iteration were all clipped to this range to guarantee the inputs to DNNs were close to valid images. When establishing a multi-step baseline using I-FGSM we run it for 20 iterations on CIFAR-10 10 data and 50 iterations on ImageNet data with step size of 1/255.
In possible finetuning, we set 7 = 0.1/|| Aw" 2|2 and a finetuning learning rate of 0.05 if SWAG was incorporated. We set a smaller finetuning learning rate of 0.001 if it was not. We use SGD opti- mizer with a momentum of 0.9 and a weight decay of 0.0005 and finetune models for 10 epochs on both CIFAR-10 and ImageNet. We set the batch size of 128 and 1024 on CIFAR-10 and ImageNet, respectively. On 100 finetune without and with SWAG, we set Ae. = 2 and Xę. = 0.2, respectively. On ImageNet, we always set λe,- = 1. When performing attacks, we set o = 0.009 and a = 0.002 for models finetuned without and with SWAG, respectively. SWAG rescale the co- variance matrix by a constant factor, for disassociate the learning rate from the covariance (Maddox et al. 2019). Here we use 1.5 as the rescaling factor on ImageNet. Since we found little differ- ence in success rate between using diagonal matrix and diagonal matrix plus low rank matrix as the covariance for SWAG posterior, we always use the diagonal matrix for simplicity. For compared competitors, we followed their official implementations and evaluated on the same test images on CIFAR-10 and ImageNet for generating adversarial examples fairly. Implementation details about these methods are deferred to Appendix [ All experiments are performed on an NVIDIA V100 GPU.
4.2 COMPARISON TO STATE-OF-THE-ART
We compare our method to recent state-of-the-an in Table and 3 attacking 10 victim models on ImageNet and 6 victim models on CIFAR- 10. Methods that increase input diversity, i.e. and TIM (Dong et al.) 2019) SIM (Lin et al. 2019), Admix (Wang et al. 2021). that modify back- propagation, i.e., LinBP (uoo et al. 2020) and ILA++ (Guo et al. 2022), and very recent methods including TAIG (Huang & Kong 2022) and LGV (Gubri al. 2022b) are compared. It can be observed in the tables that our method outperforms all these methods significantly. Specifically, our method achieves an average success rate of nearly 91.33% on ImageNet, which outperforms the sec-
7

---

Published as a conference paper at ICLR 2023
ond best by 19.05%. When attacking Inception v3 and PyramidNet, which are the most challenging victim models on ImageNet and CIFAR-10, 10, respectively, our method outperforms the second best by 27.36% and 7.43% while outperforms the I-FGSM baseline by 57 .5%% and 36.23%.
Comparison to (more) ensemble attacks. From certain perspectives, our method shows a similar spirit to that of ensemble attacks, thus here we compare more such attacks (Liu et al. 2017 Xiong eet al. 2022) empirically. Table provides results of all methods under the &oo constraint and c 8/255 Our method taking ResNet-50 as the substitute architecture achieves an average success rate of 91.33% on ImageNet, while the two prior methods taking ResNet-50, Inception v3, MobileNet, and MNASNet altogether as substitute architectures achieve 46.58% and 57.52%. One may also utilize more than one architecture for our method, as natural combination of our method and prior methods, see Table for results. We use ResNet-50 and MobileNet as substitute architectures when combining with the ensemble methods, though more architectures lead to more powerful attacks.
Table 4: Comparison to ensemble attacks on ImageNet under the lo constraint with e = 8/255. "Average" is obtained on all the 7 models. We performed 10 runs and report the average results.
Method
VGG-19
ResNet- 152
DenseNet
SENet
ResNeXi
WRN
PNASNet
Average
Ensemble (2017)
63.68%
48.14%
56.42%
35.96%
45.36%
44.06%
32.46%
46.58
SVRE (2022)
73.12%
60.00%
66.50%
46.44%
57.72%
55.80%
43.08%
57.52%
Ours
97.79%
97.13%
98.02%
85.41%
94.16%
95.39%
77.60%
92.21%
Ours Ensemble
98.52%
97.24%
98.83%
87.48%
94.26%
95.75%
79.72%
93.11%
Ours + SVRE
98.74%
97.69 %
99.04 %
88.27%
95.60% %
96.24%
80.25 %
93.69%
Comparison to Gubri et al. (2022a)'s 's method. Gubri al. (2022a) 's method suggested to collect
multiple substitute models along a single run of training using cSGLD (Zhang et al.) 2019). It is related to Bayesian learning the sense that eSGLD a Bayesian posterior sampling method. The difference between our method and Gubri et al.'s lie in three main aspect. First, our method is moti- vated by the belief that scaling the number of substitute models, to infinity if possible, improves the transferability of adversarial examples; thus, by establishing proper posterior with or without fine- tuning, our method is capable of producing different sets of substitute models at different iterations of L-FGSM, as if there exist infinitely many models (see Appendix for the benefit in scaling the number of models). By contrast, Gubri et al.'s 's method utilizes a fixed finite set of models collected during single run of finetuning. Second, as have been demonstrated in Section 3.2, our method is capable of achieving superior transferubility even without finetuning, while finetuning is requisite for Gubri et al.'s 's method. Third, the derivation in Section 3.2 leads to a principled finetuning ob- jective for our method, which is also strikingly different from that of Gubri et al.'s method. Table 5 compares the two methods empirically and shows the superiority of our method in experiments. We followed their experimental settings to evaluate the methods and copy their results in the paper. More specifically, the back-end I-FGSM was perform with e = 4/255 and a step size of e/ /10 for 50 opti- mization steps in total. Victim models include ResNeXt-50, DenseNet-122 121, EfficientNet-BO (Tan & Le 2019). , etc.
Table 5: Comparison to Gubri et al. (022a) 's on ImageNet under the foe constraint with 4/255. We performed 10 runs and report the average performance for all our results.
Method
ResNeXt-50 R5
DenseNet
MNASNet
EfficientNet
Gubri et al. Oars
2022a s
78.71%
65.11%
61.4%% 80.32
51.81% 82.15%
31.11%
97.14%
77.93%
61.15%
Attack robust models. It is also of interest to evaluate the transferability of adversarial examples to robust models, and we compare the performance of competitive methods in this setting in Table The victim models here include robust Inception v3 and robust EfficientNet-Bol collected from the public timm [Wightman] 2019) repository, together with robust ResNet-50 and a robust DeiT- S (Touvron et al. (2021a) provided by Bai et al. (202T). ). All these models were trained using some sorts of advanced adversarial training (Madry et al. 20188 Wong et al. 2020 Xie et al., 2020) on ImageNet. We still used the ResNet-50 source model which was trained just as normal and not robust to adversarial examples. Obviously, in Table b our method outperforms the others consistently in attacking these models. In addition to adversarial training, we also tested on robust models obtained via randomized smoothing (Cohen et al., 2019), which is one of the most popular methods for achieving certified robustness. In particular, our method achieves success rate of 29, 25% in
8

---

Published as a conference paper at ICLR 2023
Table 6: Success rates of attacking vision transformers and adversarially trained models on Ima- geNet using ResNet-50 as the substitute architecture under the foo constraint with 8/255. We performed 10 runs and report the average results in the table.
Vision transformers
Robust models
Method
ViT-B
DeiT-B
Swin-B
BETT
Inception v3
EfficientNet
ResNet-50
DeñT-S
I-FGSM
4.70%
5.92%
5.18%
3.64%
11.94%
9.48%
9.26%
10.68%
ILA++ (2022)
9.48%
21.34%
14.88%
11.76%
15.54%
30.90%
10.08%
11.08%
LGV (2022)
11.18%
20.025%
12.14%
11.66%
18.00%
39.06%
10.56%
11.50%
Ours
21.66%
43.53%
21.84%
29.78%
25.89%
67.05% %
11.02%
12.02%
attacking smoothed ResNet-50 ImageNet, following the same settings as in 'abbe 6 I-FGSM, LL+++ and LGV achieve 9.74%, 16.06%, and, 17.64%, respectively.
while
Attack vision transformers. The community has witnessed surge of transformers in computer vi- sion and machine learning applications. Here we also test the transferability of adversarial examples (generated convolutional substitute architectures) tested with a ViT-B DDsovviskiiy et al. 2020). DeiT-B B (Touvron et al. 2021b). Swin-B (Liu et al., 202T, and BEiT et al., 2021). These models were all collected from timm (Wightman 2019). Results in Table 6 show that, though it is indeed more challenging to transfer to vision transformers, our method can also gain considerable improvements.
some vision transformers. Specifically,
4.3 COMBINATION WITH OTHER METHODS
We would also like to mention that it is also possible combine our method with some methods in Table to further enhance the transferability, since method focuses model diversity and does not consider improvement
input diversity and backpropagation. In Table 7 we report the attack success rate of our method, in combination with Admix, LinBP, and ILA++. It can be seen that the transferability to all victim models are further enhanced. The best performance is obtained when combined with ILA++ leading average success rate achieve of 94.65% (which is roughly 32% higher than the original performance of ILA++) and a worst success rate of only 84.44% (when attacking PNASNet).
Table 7: Combining our method with some recent vate-of-the-arts in Table 2 performed with = 8/255 on ImageNet. We performed 10 runs and report the average results.
The experiment was
Admix
LinBP
ILA+
Ours
Ours
Ours
ResNet
100.00% %
100.00%
100.00%
100.00
99. 99.96%
100.00%
VGG-19
57.95%
97.84%
72.00%
98.28%
74.94%
98.60 %
ResNNct-152
45.82%
97.55%
58.62%
96.49 %
69.64%
97.61 %
Inception v3
23.59%
77.15% %
29.98%
80.65 %
41 41.56%
87.65 %
DenseNet
52.00%
98.61 %
63.70%
98.55 %
71.28%
98.95%
MobileNet
55.36%
98.13%
64.08%
97.75%
71.84%
98.65
SENet
30.28%
87.49%
41.02%
87.35%
53.12%
89.43%
ResNeXi
41.94%
94.98%
$1.02%
92.50 %
65.92%
95.48 %
WRN
42.78%
95.90%
54.16%
94.92% %
65.64%
96.72% %
PNASNet
21.91%
78.68
29.72%
76.94%
44.56%
84.44%
MNASNet
52.32%
98.41
62.18%
97.21 %
70.40%
98.95
Average
42.40%
92.47%
$2.65%
92.06%
62.89%
94.65% %
5 CONCLUSION
In this paper, we have considered diversity in substitute models for performing transfer-based at- tacks. Specifically, we have developed a Bayesian formulation for performing attacks and advocated possible finetuning for improving the Bayesian model. By simply assuming the posterior to be an isotropic Gaussian distribution or, one step further, more general Gaussian distribution, our attack can be equivalently regarded as generating adversarial examples on a set of infinitely many substitute models while the time complexity of possible finetuning is just as normal. Extensive experiments have been conducted to demonstrate the effectiveness of our method on ImageNet and CIFAR-IO. 10. It has been shown our method outperforms recent state-of-the -hr-tsr-rrtsst by large margins in attacking more than 10 convolutional DNNs and 4 vision transformers. The transferability robust models has also been evaluated. Moreover, we have also shown that the proposed method can further be combined with prior methods to achieve more powerful adversarial transferability.

---

Published as a conference paper at ICLR 2023
REFERENCES
Anish Athalye, Nicholas Carlini, and David Wagner. Obfuscated gradients give false sense of security: Circumventing defenses to adversarial examples. In ICML, 2018.
Yutong Bai, Jieru Mei, Alan Yuille, and Cihang Xie. Are transformers more robust than cnns? In Thirty-Fifth Conference Neural Information Processing Systems, 2021.
Hangbo Bao, Li Dong, Songhao Piao, and Furu Wei. Beit: Bert pre-training of image transformers.
In International Conference on Learning Representations, 2021.
Charles Blundell, Julien Cornebise, Koray Kavukcuoglu, and Daan Wierstra. Weight uncertainty in neural network. In International conference on machine learning, pp. 1613-1622. PMLR, 2015.
Ginevra Carbone, Matthew Wicker, Luca Laurenti, Andrea Patane, Luca Bortolussi, and Guido Sanguinetti. Robustness of bayesian neural networks pradient-based attacks. Advances in Neural Information Processing Systems, 53:15602-15613, 2020.
Luca Cardelli, Marta Kwiatkowska, Luca Laurenti, Nicola Paoletti, Andrea Patane, and Matthew Wicker. Statistical guarantees for the robustness of bayesian neural networks. arXiv preprint 1rXiv:/903.0198) 2019.
Nicholas Carlini and David Wagner. Towards evaluating the robustness of neural networks. In IEEE Symposium on Security and Privacy (SP), 2017.
Jeremy Cohen, Elan Rosenfeld, and Zico Kolter. Certified adversarial robustness via randomized smoothing. International Conference on Machine Learning, pp. 1310-1320. PMLR, 2019.
Xuanyi Dong and Yi Yang. Searching for a robust neural architecture four gpu hours. CVPR, 2019.
Yinpeng Dong, Tianyu Pang, Hang Su, and Jun Zhu. Evading defenses to transferable adversar- ial examples by translation-invariint attacks. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 4312-4321, 2019.
Alexey Dosovitskiy, Lucas Beyer, Alexander Kolesnikov, Dirk Weissenborn, Xiaohua Zhai, Thomas Unterthiner, Mostafa Dehghani, Matthias Minderer, Georg Heigold, Sylvain Gelly, et al. An image is worth 16x16 words: Transformers for image recognition at scale. arXiv preprint arXiv:2010.11929, 2020.
Michael Dusenberry, Ghassen Jerfel, Yeming Wen, Yian Ma, Jasper Snoek, Katherine Heller, Balaji Lakshminarayanan, and Dustin Tran. Efficient and scalable bayesian neural nets with rank-1 factors. In International conference on machine learning. pp. 2782-2792. PMLR, 2020.
Yarin Gal and Zoubin Ghahramani. Dropout as a bayesian approximation: Representing model uncertainty in deep learning. In international conference machine learning, pp. 1050-1059. PMLR, 2016.
Yarin Gal and Lewis Smith. Sufficient conditions for idealised models to have no adversarial examples: theoretical and empirical study with bayesian neural networks. arXiv preprint 1rXiv:1806.00667, 2018.
Yarin Gal, Jiri Hron, and Alex Kendall. Concrete dropout. Advances in neural information process- ing systems, 30, 2017.
Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. In ICLR, 2015.
Alex Graves. Practical variational inference for neural networks. Advances neural information processing systems, 24, 2011.
Martin Gubri, Maxime Cordy, Mike Papadakis, Yves Le Traon, and Koushik Sen. Efficient and transferable adversarial examples from bayesian neural networks. In Uncertainty Artificial Intelligence, pp. 738-748. PMLR, 2022a.
10

---

Published as a conference paper at ICLR 2023
Martin Gubri, Maxime Cordy, Mike Papadakis, Yves Le Traon, and Koushik Sen. Lgv: Boosting ad- versarial example transferability from large geometric vicinity, arXiv preprint arXi::220..13129, 2022b.
Yiwen Guo, Qizhang Li, and Hao Chen. Backpropagating linearly improves transferability of ad- versarial examples. In NeurlPS, 2020.
Yiwen Guo, Qizhang Li, Wangmeng Zuo, and Hao Chen, An intermediate- attack framework on the basis of linear regression. IEEE Transactions on Pattern Analysis and Machine Intelligence, 2022.
Dongyoon Han, Jiwhan Kim, and Junmo Kim. Deep pyramidal residual networks. In CVPR, pp. 5927-5935, 2017.
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recog- nition. In CVPR, 2016.
Jie Hu, Li Shen, and Gang Sun. Squeeze-and-eecitation networks. In CVPR, 2018.
Gao Huang, Zhuang Liu, Laurens Van Der Maaten, and Kilian Q Weinberger. Densely connected convolutional networks. In CVPR, 2017.
Qian Huang, Isay Katsman, Horace He, Zeqi Gu, Serge Belongie, and Ser-Nam Lim. Enhancing adversarial example transferability with an intermediate level attack. In ICCV, 2019.
Yi Huang and Adams Wai-Kin Kong. Transferable adversarial attack based on integrated gradicnts. arXiv preprint 2xXi:2225.133522 2022.
Pavel Izmailov, Dmitrii Podoprikhin, Timur Garipov, Dmitry Vetrov, and Andrew Gordon Wil- son. Averaging weights leads to wider optima and better generalization. arXiv preprint arXiv:1803.05407, 2018
Pavel Izmailov, Sharad Vikram, Matthew D) Hoffman, and Andrew Gordon Gordon Wilson. What are bayesian neural network posteriors really like? International conference on machine learn- ing. pp. 4629-4640, PMLR, 2021.
Ric Johnson and Tong Zhang. Accelerating stochastic gradient descent using predictive variance reduction. Advances in neural information processing systems, 26, 2013.
Alex Kendall and Yarin Gal. What uncertainties do need in bayesian deep learning for computer vision? Advances in neural information processing systems, 30, 2017.
Mohammad Khan, Didrik Nielsen, Voot Tangkaratt, Wu Lin, Yarin Gal, and Akash Srivastava. Fast and scalable bayesian deep learning by weight-perturbatinn in adam. In International Conference Machine Learning, pp. 2611 1-2620. PMLR, 2018.
Durk P Kingma, Tim Salimans, and Max Welling. Variational dropout and the local reparameteri- zation trick. Advances in neural information processing systems, 28, 2015.
James Kirkpatrick, Razvan Pascanu, Neil Rabinowitz, Joel Veness, Guillaume Desjardins, Andrei A Rusu, Kieran Milan, John Quan, Tiago Ramalho, Agnieszka Grabssk-BBrrwinkka et al. Overcom- ing catastrophic forgetting neural networks. Proceedings of the national academy of sciences, 114(13):3521-3222 2017.
Alex Krizhevsky and Geoffrey Hinton. Learning multiple layers of nical report, Citeseer, 2009.
features from tiny images. Tech-
Alexey Kurakin, Ian Goodfellow, and Samy Bengio. Adversarial machine learning scale. In ICLR, 2017.
Balaji Lakshminarayanan, Alexander Pritzel, and Charles Blundell. Simple and scalable predictive uncertainty estimation using deep ensembles. Advances neural information processing systems, 30, 2017.
11

---

Published as a conference paper at ICLR 2023
David X Li. On default correlation: A copula function approach. The Journal of Fixed Income, (4):43-54, 2000.
Qizhang Li, Yiwen Guo, and Hao Chen. Yet another intermediate-leve attack. In ECCV, 2020a.
Yingwei Li, Song Bai, Yuyin Zhou, Cihang Xie, Zhishuai Zhang, and Alan Yuille. Learning trans- ferable adversarial examples via ghost networks. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 34, pp. 11458-118 11465, 2020b.
Yingzhen Li, John Bradshaw, and Yash Sharma. Are generative classifiers more robust adversarial attacks? In International Conference on Machine Learning, pp. 3804-3814, PMLR, 2019.
Jiadong Lin, Chuanbiao Song, Kun He, Liwei Wang, and John E Hopcroft. Nesterov accelerated gradient and scale invariance for adversarial attacks. arXiv preprint arXiv:1908.000 06281, 2019.
Chenxi Liu, Barret Zoph, Maxim Neumann, Jonathon Shlens, Wei Hua, Li-Jia Li, Li Fei-Fei, Alan Yuille, Jonathan Huang, and Kevin Murphy. Progressive neural architecture search. In ECCV, 2018a.
Xuanqing Liu,, Yao Li, Chongruo Wu, and Cho-Jui Hsieh. Ady-bnn: Improved adversarial defense through robust bayesian neural network. arXiv preprint arXiv:1810.01279, 2018b.
Yanpei Liu, Xinyun Chen, Chang Liu, and Dawn Song. Delving into transferable adversarial exam- ples and black-box attacks. In ICLR, 2017.
Ze Liu, Yutong Lin, Yue Cao, Han Hu, Yixuan Wei, Zheng Zhang, Stephen Lin, and Baining Guo. Swin transformer: Hicrarchical vision transformer using shifted windows. In Proceedings of the IEEE/CVF International Conference Computer Vision, pp. 10012-10022, 2021.
Wesley Maddox, Shuai Tang, Pablo Moreno, Andrew Gordon Wilson, and Andreas Damianou. Fast adaptation with linearized neural networks. In International Conference on Artificial Intelligence and Statistics, pp. 2737-2745. PMLR, 2021.
Wesley Maddox, Pavel Izmailov, Timur Garipov, Dmitry Vetrov, and Andrew Gordon Wilson A simple bascline for bayesian uncertainty in deep learning. Advances in Neural Information Processing Systems, 32, 2019.
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant adversarial attacks. In ICLR, 2018.
Stephan Mandt, Matthew Hoffman, and David Blei. Stochastic gradient descent as approximate bayesian inference. arXiv preprini arXiv: 704.04289. 2017.
Kazuki Osawa, Siddharth Swaroop, Mohammad Emtiyaz E Khan, Anirudh Jain, Runa Eschenhagen, Richard E Turner, and Rio Yokota. Practical deep learning with bayesian principles. Advances in neural information processing systems, 32, 2019.
Nicolas Papernot, Patrick McDaniel, and Ian Goodfellow. Transferability in machine learning: from phenomena to black-box attacks using adversarial samples. arXiv preprint arXiv: urXiv:1605.07277, 2016.
Hippolyt Ritter, Aleksandar Botev, and David Barber. A scalable laplace approximation for neural networks. In 6th International Conference on Learning Representations, ICLR 1018-Conference Track Proceedings, volume 6. International Conference on Representation Learning, 2018.
Olga Russakovsky, Jia Deng, Hao Su, Jonathan Krause, Sanjeev Satheesh, Sean Ma, Zhiheng Huang, Andrej Karpathy, Aditya Khosla, Michael Bernstein, Alexander C. Berg, and Li Fei-Fei. Imagenet large scale visual recognition challenge. IJCV, 2015.
Mark Sandler, Andrew Howard, Menglong Zhu, Andrey Zhmoginov, and Liang-Chies Chen. Mo- bilenetv2: Inverted residuals and linear bottlenecks. In CVPR, 2018
Karen Simonyan and Andrew Zisserman. Very deep convolutional networks for large-scale image recognition. In ICLR, 2015.
12

---

Published as a conference paper at ICLR 2023
Christian Szegedy, Wojciech Zaremba, llya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. Intriguing properties of neural networks. In ICLR, 2014.
Christian Szegedy. Vincent Vanhoucke, Sergey loffe, Jon Shlens, and Zbigniew Wojna. Rethinking the inception architecture for computer vision. In CVPR, 2016.
Mingxing Tan and Quoe Le. Efficientnet: Rethinking model scaling for convolutional neural net- works. In International conference on machine learning, pp. 6105-6114, 14. PMLR, 2019.
Mingxing Tan, Bo Chen, Ruoming Pang, Vijay Vasudevan, Mark Sandler, Andrew Howard, and Quoc V Le. Mnasnet: Platform-awar aware neural architecture search for mobile. In CVPR, 2019.
Hugo Touvron, Matthieu Cord, Matthijs Douze, Francisco Massa, Alexandre Sablayrolles, and Hervé Jégou. Trriniin data-efficient image transformers & distillation through attention. In International Conference on Machine Learning, pp. 10347-10357. PMIR, 2021a.
Hugo Touvron, Matthieu Cord, Matthijs Douze, Francisco Massa, Alexandre Sablayrolles, and Herve Jegou. Training data-efficient image transformers & distillation through attention. In International Conference Machine Learning, volume 139, pp. 10347-10357, July 2021b.
Xiaosen Wang, Xuanran He, Jingdong Wang, and Kun He. Admix: Enhancing the transfcrability of adversarial attacks. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pp. 16158-16167, 2021.
Matthew Wicker, Luca Laurenti, Andrea Patane, and Marta Kwiatkowska. Probabilistic safety for bayesian neural networks. In Conference on Uncertainty in Artificial Intelligence, pp. 1198-1207. PMLR, 2020.
Ross Wightman. Pytorch image models.
https://githb..comm/ http://tthabbccommwwghttaaaaa
2019.
Andrew G Wilson and Pavel Izmailov. Bayesian deep learning and probabilistic perspective of
generalization. Advances in neural information processing systems, 33:4697-470s 2020.
Eric Wong, Leslie Rice, and J Zico Kolter. Fast is better than free: Revisiting adversarial training.
arXiv preprint MXXXi:2001.03994 2020.
Anqi Wu, Sebastian Nowozin, Edward Meeds, Richard E Turner, Jose Miguel Hernandez-Lobato, and Alexander L Gaunt. Deterministic variational inference for robust bayesian neural networks. arXiv preprint arXiv:1810.03990 2018
Dongxian WU, Yisen Wang, Shu-Tao Xia, James Bailey, and Xingjun Ma. Rethinking the security of skip connections in resnet-like neural networks. In ICLR, 2020.
Cihang Xie, Zhishuai Zhang, Yuyin Zhou, Song Bai, Jianyu Wang, Zhou Ren, and Alan L Yuille. Improving transferability of adversarial examples with input diversity. In CVPR, 2019.
Cihang Xie, Mingxing Tan, Boqing Gong, Jiang Wang, Alan L Yuille, and Quoc V Le. Adversarial examples improve image recognition. Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. $19-828, 2020.
Saining Xie, Ross Girshick, Piotr Dollár, Zhuowen Tu, and Kaiming He. Aggregated residual trans- formations for deep neural networks. In CVPR, 2017.
Yifeng Xiong, Jiadong Lin, Min Zhang, John Hoperoft, and Kun He. Stochastic variance reduced ensemble adversarial attack for boosting the adversarial transferability. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 14983-14992, 2022.
Matthew Yuan, Matthew Wicker, and Luca Laurenti. Gradient-free adversarial attacks for bayesian neural networks. arXiv preprint arXiv:2012. /2640, 2020.
Sergey Zagoruyko and Nikos Komodakis. Wide residual networks. In BMVC, 2016.
13

---

Published as a conference paper at ICLR 2023
Guodong Zhang, Shengyang Sun, David Duvenaud, and Roger Grosse. Noisy natural gradient as variational inference. In International Conference on Machine Learning, pp. 5852-5861. PMLR, 2018.
Ruqi Zhang, Chunyuan Li, Jianyi Zhang, Changyou Chen, and Andrew Gordon Wilson Cyclical stochastic gradient meme for bayesian deep learning. In International Conference on Learning Representations, 2019. 2019
14

---

Published as a conference paper at ICLR 2023
A PERFORMANCE OF POSSIBLE FINETUNING ON IMAGENET
Table 8: Comparing transferability of FGSM and I-FGSM adversarial examples generated de- terministic substitute model and the Bayesian substitute model (with or without additional finetun- ing) under the &o constraint with 8/255 ImageNet. The architecture of the substitute models ResNet-50, and "Average" was calculated over all ten victim models except for ResNet-50. We performed 10 runs of the experiment and report the average performance in the table.
fine- tune
ResNet-50
VGG-19
ResNet-152
Inception
DenseNet
MobileNet
87.68%
34.40%
27.06%
21.46%
34.38%
36.88%
FGSM
X
87.02%
49.94%
40.14%
33.82%
49.86%
51.16%
Isotropic
100.00%
66.70%
55.62%
31.04%
63.50%
64.84%
+SWAG
/
96.96%
77.08%
64.34%
54.58%
77.10%
78.52%
X
100.00%
39.22%
29.18%
15.60%
35.58%
37.90%
I-FGSM
98.40%
70.28%
58.80%
47.04%
70.76%
70.74%
Isotropic
100.00%
93.48%
90.16%
51.02%
90.00%
89.98%
+SWAG
100.00%
97.74%
97.12%
73.24%
98.06%
97.50%
fine- tune
SENet
ResNeXt
WRN
PNASNet
MNASNet
Average
x
17.84%
24.46%
24.78%
15.50%
34.40%
27.12%
FGSM
Isotropic
X
28.04%
37.26%
37.98%
24.92%
48.48%
40.16%
V
38.26%
49.26%
52.44%
27.04%
61.94%
51.06%
+SWAG
V
43.00%
55.64%
59.34%
39.36%
75.48%
62.44%
X
17.66%
26.18%
27.18%
12.80%
35.58%
27.69%
I-FGSM
X
41.36%
52.06%
55.06%
36.18%
67.50%
56.900 56.98%
Isotropic
/
75.88%
86.48%
86.92%
62.86%
87.56%
81.43%
+SWAG
/
85.44%
94.14%
95.36%
77.58%
97.12%
91.33%
B SENSITIVITY OF XE.n
When finetuning is possible, we have λe,r as hyper-parameter. An empirical study was performed show how the performance of our method varies along with the value such a hyper-parameter We tested with Aeo E {0, 0.01, 0.05, 0.1, 0.2, 0.5, 1, 1.5, 2} on ImageNet and show the average attack success rates of attacking ten victim models in Figure
can be seen by increasing the value of Ae.r. the adversarial transferability is improved, while it drastically drop when it is too large. Tuning of such hyper-parameet can be done coarsely in a logarithmic scale on a validation set different datasets.
C BENEFIT OF SCALING THE NUMBER SUBSTITUTE MODELS
Our method is developed based on the belief that utilizing more substitute models should improve the transferability of adversarial examples, and the Bayesian formulation is considered since infinitely many models can be sampled from it in principle. In this section, we evaluate the transferability of adversarial examples crafted on different numbers of substitute models, which are sampled before issuing attacks. Figure B illustrates the results, and it can be observed that using more substitute models can indeed improve the transferability of adversarial examples. Average success rates caleu- lated on the same victim models as in Table 2 are reported.
15

---

Published as a conference paper at ICLR 2023
Average Success Rate (%)
Average Success Rate (%)
90
91.0
88
90.5
90.0
84-
89.0
80
0.10.2
0.5
1.5
20 100
200
400
600
800
1000
Number substitute
ALo
Figure 3: How the transferability changes with the value of À under 8/255. Average suc- cess rates calculated on the same victim models as in Table 2 are reported.
Figure 4: How the adversarial transferabil- ity changes by scaling the number of substitute models under e = 8/255. Average success rates reported.
D DETAILED EXPERIMENTAL SETTINGS OF COMPARED METHODS
Here we report some detailed experimental settings of compared methods. For TIM (Dong et al., 2019), we adopted the maximal shift of 3 x 3 and 7 7 on CIFAR-10 and ImageNet, respectively. For SIM (Lin et al. 2019). the number of scale copics is 5. For Admix (Wang et al. 202I). we set the number of mix copies 3, and let the mix cocfficient be 0.2. For LinBP (uuo al. 2020), the last six building blocks in ResNet-50 and the last four building blocks in Resnet-18 were modified to be more linear during backpropagation. For TAIG (Huang & Kong 2022). set 30 the number of tuning points. For ILA++ (Li et al.) 2020a Guo et al. 2002). we chose the first block of the last meta-block of ResNet-18 and the first block of the third block of ResNet-50. Ridge regression was adopted for ILA+ since it is faster. Note that as the back-end I-FGSM was perform for 50 optimization steps in total for ImageNet experiments and 20 steps for CIFAR-10 experiments, the results of for instance ILA+ is slightly different from those in its original paper.
16


Reviews:
[{"review_id": "wu3VoQCnqU0", "reviewer": "Reviewer_o774", "summary": "", "questions": "", "limitations": "", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "The authors consider the problem of crafting adversarial attacks that are transferable across different deep neural networks architectures (DNNs). In order to solve this problem the authors propose to craft the attacks on Bayesian neural networks (BNNs) trained with Gaussian posterior approximations. On a set of experiments on Cifar-10 and ImageNet the authors show that their approach outperforms state-of-the-art methods.", "summary_of_the_review": "The paper presents an interesting empirical idea with encouraging experimental results. The quality of the paper is hindered by the clarity of the writing, some inaccuracies, and missing discussion and justification about the methods used to train and attack a BNN. ", "strength_and_weaknesses": "Strengths\n\n- The main idea of the paper, which is to use BNNs to obtain transferable adversarial attacks, is clear and intuitive\n\n- Experimental results are convincing and show that the proposed method outperforms competitive algorithms\n\nWeaknesses\n\n- A recent paper [Gubri et al (2022a)] also explored BNNs to obtain transferable attacks. While the methods in this paper seem to obtain better empirical results, the results of this paper feel incremental compared to [Gubri et al (2022a)]\n\n- Section 3 and 4 are often confusing and contain some inaccuracies. In particular:\n\n-- After Eqn 1, p(y | x,w) is the likelihood and not the predictive distribution.\n\n-- In Section 3, experiments are mixed with the explanation of the methods and this creates confusion. Furthermore, in this Section the authors present adversarial attacks for BNNs assuming that the posterior is an isotropic Gaussian. However, for basically all approximate posterior inference methods commonly employed for BNNs, the posterior will in general never be an isotropic Gaussian. In view of this, I would re-organise the Section presenting the method for a general Gaussian posterior.\n\n-- L is Eqn 3 is not defined (I guess it is the loss, but please say it explicitly)\n\n-- In Section 4 the description of the experimental setting takes almost one page. To improve readability I would move some of the details (especially those about the details of the methods the authors compare against) in the appendix. \n\n- Something that is not clear to me is why the authors need to develop a new method to attack BNNs, instead of using methods already available in the literature, see e.g. [1,2,3]. This should be at least discussed and motivated. Also, it is not clear how the authors are attacking BNNs trained with SWAG. Please, clarify\n\n- An important aspect that the authors should keep in mind (and discuss) is that BNNs are known to be more robust to adversarial attacks compared to standard neural networks [4] (depending on the approximate posterior method employed). As a consequence, the results of this paper seems to hint on the fact that while it may be harder to find adversarial attacks for BNNs, these may transfer more easily across different architectures.\n\n- Why in the experiments do you need to use a bigger $\\epsilon$ for ImageNet than for Cifar-10? This is counterintuitive for me  \n\n\n[1] Liu, Xuanqing, et al. \"Adv-BNN: Improved Adversarial Defense through Robust Bayesian Neural Network.\" International Conference on Learning Representations. 2018.\n\n[2] Yuan, Matthew, et al. \"Gradient-Free Adversarial Attacks for Bayesian Neural Networks.\" Third Symposium on Advances in Approximate Bayesian Inference. 2020.\n\n[3] Carbone, Ginevra, et al. \"Robustness of bayesian neural networks to gradient-based attacks.\" Advances in Neural Information Processing Systems 33 (2020): 15602-15613.\n\n\n", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}, {"review_id": "_6f-yczBhm", "reviewer": "Reviewer_8LEh", "summary": "", "questions": "", "limitations": "", "rating": 8, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "This paper proposes to optimize for diversity in substitute models and advocate attacking a Bayesian model for improving the transferability of adversarial examples.  The author also developed a Bayesian formulation for performing attacks and advocated possible finetuning for improving the Bayesian model.  Extensive experimental results have demonstrated that the proposed method can enhance the transferability of adversarial examples, yielding better attack success rates.", "summary_of_the_review": "The experimental results are impressive and the idea is interesting.", "strength_and_weaknesses": "Strengths:\n1.\tUtilizing Bayesian models to increase generative adversarial sample mobility is instructive, and the study of ensemble attacks is interesting. The attack method can be equivalently regarded as performing adversarial attack on a set of infinitely many substitute models.\n2.\tThe baselines are advanced, and extensive experiments demonstrate the effectiveness of the proposed method.\n\nWeaknesses:\n1.\tSome experimental settings are not very reasonable. For example, in Table 4, the authors adopt ResNet-50, Inception v3, MobileNet, and MNASNet altogether as substitute architectures of baselines while adopting ResNet-50 and MobileNet as substitute architectures when combining their method with the ensemble methods. Why not experiment with the same surrogate model? This comparison may be unfair when most of the black box models use the ResNet structure. Moreover, it will be more convincing if the author can add some experiments on advanced defense models, such as adversarial training models, Randomized Smoothing (RS)[1], and Neural Representation Purifier (NRP)[2].\n2.\tThere are some severe spelling mistakes in the article that the author should check carefully, such as “Aidmix” should be “Admix”.\n3.\tThe authors could try to add some analysis on why this method works.\n[1]Cohen J, Rosenfeld E, Kolter Z. Certified adversarial robustness via randomized smoothing[C]//International Conference on Machine Learning. PMLR, 2019: 1310-1320.Naseer M, Khan S, Hayat M, et al.\n[2] A self-supervised approach for adversarial robustness[C]//Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. 2020: 262-271.\n", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}, {"review_id": "KGOymjDhAZ", "reviewer": "Reviewer_uSCB", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "This paper proposes to attack a Bayesian model for improving the transferability of black-box adversarial attacks. Specifically, the authors employ gradient-based attack algorithms on their constructed Bayesian models and expect the generated adversarial attacks can better fool other unseen models. Extensive experiments show that the proposed method surpassed baseline methods in terms of attack success rate.", "summary_of_the_review": "Given the strength and weaknesses, I tend to rate the paper as marginally above the acceptance.", "strength_and_weaknesses": "Strength\n\n1. In general the paper is well-written.\n2.  The authors conduct extensive experiments to validate the transferability of the proposed method by concerning many different neural architectures and multiple baselines.\n3. The proposed way to employ Bayesian estimation for improving the transferability of attacks looks novel to me.\n\nWeaknesses\n\n1. When both the substitute model and the victim model are adversarially trained (Table 6), the improvement is quite marginal. Therefore, the proposed method may only be employed to improve the transferability of attacks on nonrobust models, which weakens the empirical significance.\n2.  In Eq. 6, ∆w is sampled from the gaussian prior. Then why do we need p(∆w) ≥ ε? Plus, if p(∆w) ≥ ε is important, then ε should be a very important hyper-parameter but there is no experiment showing the sensitivity,\n", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}]

Author rebuttal:

Decision: Accept: poster