ILA-DA: Improving Transferability of Intermediate Level Attack with Data Augmentation
Authors: Chiu Wai Yan
Tsz-Him Cheung
Dit-Yan Yeung
Venue: ICLR 2023 poster (2023)
Keywords: adversarial examples
adversarial transferability
data augmentation

Abstract: Adversarial attack aims to generate deceptive inputs to fool a machine learning model. In deep learning, an adversarial input created for a specific neural network can also trick other neural networks. This intriguing property is known as black-box transferability of adversarial examples. To improve black-box transferability, a previously proposed method called Intermediate Level Attack (ILA) fine-tunes an adversarial example by maximizing its perturbation on an intermediate layer of the source model. Meanwhile, it has been shown that simple image transformations can also enhance attack transferability. Based on these two observations, we propose ILA-DA, which employs three novel augmentation techniques to enhance ILA. Specifically, we propose (1) an automated way to apply effective image transformations, (2) an efficient reverse adversarial update technique, and (3) an attack interpolation method to create more transferable adversarial examples. Shown by extensive experiments, ILA-DA greatly outperforms ILA and other state-of-the-art attacks by a large margin. On ImageNet, we attain an average attack success rate of 84.5%, which is 19.5% better than ILA and 4.7% better than the previous state-of-the-art across nine undefended models. For defended models, ILA-DA also leads existing attacks and provides further gains when incorporated into more advanced attack methods.

Published as a conference paper at ICLR 2023
ILA-DA: IMPROVING TRANSFERABILITY OF INTER- MEDIATE LEVEL ATTACK WITH DATA AUGMENTATION
Chiu Wai YAN, Tsz-Him CHEUNG & Yan YEUNG
Department of Computer Science and Engineering
The Hong Kong University of Science and Technology
Clear Water Bay, Kowloon, Hong Kong
(cwyan, thcheungae econnec ust hk, dyyeungêcse .us. .kk
ABSTRACT
Adversarial attack aims to generate deceptive inputs to fool machine learning model. In deep learning, an adversarial input created for specific neural net- work can also trick other neural networks. This intriguing property is known as black-box transferability of adversarial examples. To improve black-box trans- ferability, a previously proposed method called Intermediate Level Attack (ILA) fine-tuner adversarial example by maximizing its perturbation diate layer of the source model. Meanwhile, it has been shown that simple image transformations also enhance attack transferability. Based these two ob- servations, we propose ILA-DA, which employs three novel augmentation tech- niques enhance ILA. Specifically,
interme-
propose (I) an automated way apply effective image transformations, (2) an efficient reverse adversarial update tech- nique, and (3) an attack interpolation method to create more transferable adver- sarial examples. Shown by extensive experiments, ILA-DA greatly outperforms ILA and other state-of-the-ard attacks by large margin. On ImageNet, we at- tain an average attack success rate of 84.5%, which is 19.5% better than ILA and 4.7% better than the previous state-of-the-as across nine undefended models. For defended models, ILA-DA also leads existing attacks and provides further gains when incorporated into more advanced attack methods. The code is available at https:///iitub..
DLA-DA
INTRODUCTION
Recent studies (Szegedy et al., 2013 Goodfellow et al. 2015) showed that deep neural network (DNN) models are vulnerable to adversarial attacks, where perturbations are added to the clean data to fool the models in making erroneous classification. Such adversarial perturbations are usually crafted to be almost imperceptible by humans, yet causing apparent fluctuations in the model output. The effectiveness of adversarial attacks on deep learning models raises concerns in multiple fields, applications.
especially for
Besides being effective the victim model, adversarial attacks are found be capable of transfer- ring across models (Papernot et al. 2016). One explanation for this phenomenon is the overlapping decision boundaries shared by different models (Liu al. 2017 Dong et al. 2018). Such behavior not only aggravates concerns on the reliability and robustness of deep learning models, but also en- ables various black-box attacks which leverage the transferring behavior, such as directly generating attacks from a source (or surrogate) model (Zhou et al.) 2018) or acting as gradient prior to reduce the number of model queries (Guo et al. 2019).
Intermediate Level Attack (ILA) is a method proposed by Huang et al. (2019) to fine-tune an exist- ing adversarial attack as reference, thereby raising its attack transferability across different models. Formulated to maximize the intermediate feature map discrepancy represented in the models, ILA achieves remarkable black-box transferability, outperforming various attacks that are directly gen- erated (Zhou et al.] 2018 Xie et al.) 2019a). On the other hand, many of the ransfer-based attacks empirically show that simple image transformations, including padding (Xie et al.] (019a), image translation (Dong et al. 2019), and scaling (Lin et al. 2020), effective in strengthening the trans-

---

Published as a conference paper at ICLR 2023
Clean Image
I-FGSM
IFGGMM ILA-DA
Figure Visualization of the generated images among: clean image, I-FGSM, and I-FGSM ILA-DA (Ours), with the perturbation budget e = 16/255 (0.063).
ferability of an adversarial attack. Similar ideas can be applied to the ILA framework, which takes three input images as references, including clean image, reference adversarial image, and the up- dated image from the previous iteration. This motivates us to advance the current transfer-basee ILA attack by promoting reference diversity using three carefully-desigue augmentation techniques.
In this paper, we revisit ILA and propose ILA-DA, which employs three novel augmentation tech- niques to advance ILA attack transferability across different model architectures. First. we develop an automated way to apply effective image transformations for more diverse augmented references. Unlike recent research on Automated Data Augmentation (AutoDA) (Cubuk et al., 2019: Li et al.) 2020c) which constructs useful augmented data for model training, our approach applies learnable augmentations to create more powerful adversarial examples. Second, we propose an efficient aug- mentation method, called the reverse ad adversarial update, create augmented references by uti- lizing adversarial noises. Nevertheless, ILA-DA forms new augmented references by interpolating images in the direction that leads larger intermediate feature discrepancies. Through fine-tuning simple baseline attacks, such as the Iterative Fast Gradient Sign Method (I-FGSM), we show that ILA--D outperforms state-of-the-art transfer-based attacks both defended and undefended mod- els by large margins. Visualizations of some adversarial examples created by ILAADA are illustrated in Figure I and Appendix O
Our main contributions can be summarized as follows:
We propose ILA-DA, which applies three novel augmentation techniques, including auto- mated data augmentation, reverse adversarial update and attack interpolation, consider- ably strengthen the current ILA attack.
We demonstrate that ILA-DA outperforms various ILA attacks and other state-of-the-art approaches. On ImageNet, we attain an average attack success rate of 84.5%, which 19.5% better than ILA and 4.7% better than the previous state-of-the-art across nine unde- fended models.
We show that ILA-DA with simple I-FGSM attack references can exceed state-of-the-ar attacks on six defended models. We also find that incorporating ILA-DA into existing attacks can further increase their attack transferability.
2 RELATED WORKS
White-box and black-box attacks are two common threat models used in adversarial attack research. The white-box setting assumes that the attacker access to the victim model's internal state, cluding its gradient, parameters, training dataset, etc. The black-box setting, the other hand, only allows model queries without accessing any subsequent model information. While more variations such the grey-box and no-box settings exist, they generally not considered in this work.
Typical white-box attacks exploit the gradient of the model to generate adversarial examples. The Fast Gradient Sign Method (FGSM) (Goodfellow al. 2015) generates attacks by adding the signed gradient of the loss with respect to the image back to the image, obtaining a higher loss and possibly incorrect prediction. The Iterative Fast Gradient Sign Method (I-FGSM, also known as BIM) (Ku-
2

---

Published as a conference paper at ICLR 2023
rakin et al. (017a) performs FGSM iteratively while clipping the difference between the adversarial example and the original image within a perturbation budget. Projected Gradient Descent (PGD)
(Madry et al., all] 2018)) first initiates random start within the perturbation budget and runs I-FGSM to update the attack.
Under the black-box setting, the model information be estimated by repeated model queries with varying inputs (Chen et al. 2017 Brendel et al. 2018)_ Recently, there are multiple attempts reduce the number of model queries (Bhagoji al. 2018 Ilyas al. 2018 Li al. (020a). However, in order to provide an accurate estimation to the model information, the required number of model queries is still abnormally large, causing the attacks to be detected by real-world systems easily. This turns the spotlight back to transfer- based attacks, which create adversarial examples through blx transferability instead of repeated attempts.
2.1 TRANSFER-BASEI ATTACKS
Since strong gradient-based white-box attacks usually do not exhibit high transferability (Kurakin et al. 2017b), notable efforts have been devoted to improve transferability apart from increasing the attack strength. An observable direction of the previous works is to incorporate carefully-desipe data augmentation techniques into existing attacks.
MI-FGSM. Dong al. (2018) first introduced the Momentum Iterative Fast Gradient Sign Method (MI-FGSM) to incorporate momentum to stabilize the update direction in iterative attacks, resulting in more transferable attacks.
DIM. The Diverse Input Method (DI--FGSM, or DIM) (Xie et al. 2019a) applies random resizing and zero-padding with a certain probability to the image in each iteration of I-FGSM.
TIM. Dong et al. (019) pointed out the discretion of attention map between the defended and undefended models and proposed the monnslation-Invariann Method (TIM) by attacking an ensemble of translated images. To reduce the computational overhead, it was shown that kernel convolution can be applied to the gradient achieve similar effects.
SIM and NI-FGSM. Lin et al. (2020) introduced the scale- invaeinnariant property of DNN and proposed the Scale- Invarian Method (SIM) to attack an ensemble of images with a scaling factor of 0.5 on the pixel values. In the same paper, the Nesterov Iterative Fast Gradient Sign Method (NI-FGSM) was introduced, aiming to escape from poor local maxima with the Nesterov accelerated gradient.
Variance Tuning, Wang & He (202T) proposed variance tuning. For each iteration, the gradient is adjusted with an expectation gradient sampled from the image's neighborhood. Combining vari- ance tuning with the composition of previous methods, denoted as the Composite Transformation Method (CTM), they formed the attack VMI-CT-FGSM and VNI-CT-FGSM, resulting one the strongest transfer-based black-box attacks defended models. Following the convention, will name this series of work the CTM family. table matching the names and the alias of the CTM family is shown in Appendix 0
Admix. Wang et al. 2021)) recognized the effectiveness of input transformation in attack transfer- ability and proposed Admix. Inspired by Mixup (Zhang al. 2018), Admix computes the gradient on a set of mixed images with different categories, which can be viewed as a special case of SIM, but with higher empirical contribution transferability.
SGM and LinBP. Unlike the CTM family, another type of works successfully raise the attack trans- ferability by exploiting CNN model architectures. [Wu et al. (2020) found that attack transferability can be enhanced by scaling up the gradient in the skip connection and referred to the technique as Skip Gradient Method (SGM). Guo al. (2020) revised the linear property of DNN models and proposed LinBP to propagate backward without considering the non-linear layers.
2.2 INTERMEDIATE LEVEL ATTACK FOR FINE-TUNING ADVERSARIAL EXAMPLES
The aforementioned works generate adversarial examples by maximizing the loss at the logits out- put. Nevertheless, some works leverage the intermediate feature of the CNN models. Activation Attack (Inkawhich et al. 2019) proposes to perturb the image such that its activation is closer to that of the target class. Feature Distribution Attack (FDA) (Inkawhich et al. 2020 perturbs the layer-
3

---

Published as a conference paper at ICLR 2023
wise and class-win wise feature distribution, which is determined by set of auxiliary binary classifiers. Different from the others in which the attack is directly generated, ILA (Huang et al. 2019) uses a projection loss to fine-tune existing reference attack.
Consider an input image x, an existing adversarial attack x', a model F, and function Fi that outputs the feature maps layer 1 of the model. The original ILA projection loss proposed by Huang et al. (2019) minimizes the dot product:
L(x, xxx,,',x')= - Ay/
(1)
where Ay and Ay" are two vectors defined follows:
Ay' = Fi(x') - (x(
(2)
Ay"' Fx"x" Fi())
(3)
This is equivalent to maximizing Ay" Ay/- The idea behind the formulation is to increase the norm without sacrificing the perturbation direction that causes misclassification. Due to the constraint of the perturbation budget, there is hardly room for fine-tuning in the image space. Instead, projection maximization is carried out in the feature space, specifically at layer of the model.
Based on the same framework, Li al (2020)) proposed another formulation of ILA: maxx" (Fi(x") - Fi(x)) w', where w Is a pre-computed parameter vector that directly maps the intermediate-level discrepancies layers. One notable trick of the design is that the computation of w involves every feature map discrepancy (x,) - (x) in each iteration f during the generation of x', We refer this attack as ILA++ in the rest of this paper.
predict the adversarial loss, skipping the remaining model
3
OUR METHOD
Based on what we have observed from the previous work, adversarial attacks tend to exhibit higher transferability when more references involved. The increase of references be achieved by data augmentation and reusing the temporal information over multiple iterations. From Equation (T) all three ILA input references x' and x" are images, suggesting the possibility of applying image augmentation like that for representation learning to improve model generalization.
One natural way augment the images is apply image transformation to the input before retriev- ing the intermediate feature maps. Consequently, the function Fi can be substituted by
(x) (x(())
where T can be any image transformation function.
Different from conventional data augmentation that generalizes model representation, our task is to improve attack transferability, which can interpreted as generalizing an adversarial example to succeed in attacking more models. To achieve the goal, we propose three augmentation techniques: automated data augmentation, reverse adversarial update, and attack interpolation. The algorithmic details for applying these augmentation techniques in ILA-DA are depicted in Algorithm [] The clip function is to ensure that the first argument is within the range defined by the second and third arguments.
3.1 AUGMENTATION LEARNING
Data augmentation is an effective technique to improve model generalization. However, it is non- trivial to select the most effective augmentation method for specific task and dataset. As Auto- mated Data Augmentation approach, AutoAugment (Cubuk et al. 2019) uses reinforcement learning search for the optimal augmentation policy for dataset. With similar motivation, we propose an automated way to learn effective image transformations that lead to more vigorous ILA attack.
We model the augmentation selection process T, as sampling from a distribution Pz(z) with the leamable parameter vector a in Equation (5):
(x(x)= = Σ (xpx(x), z ~ Pa(z)
(5)
4

---

Published as a conference paper at ICLR 2023
Algorithm ILA-DA
Require: x,x', Fr. perturbation budget step size number of iterations n, set of transformations
1p:) augmentation parameter a
Initialize a
x"
x
for i <- 1 1to m do
Nrev f 2x
reverse adversarial update
~ (Z)
Ay Fi(T((x)) (xee))
x" + x" )x - (x,r))
Ay t
( Ari))
x" < clip(x", x 6, +)
x" + clip(x",00 .0 .0
+ ||"د 112
x' 4- Ax" +1 A)x'
attack interpolation
a a ( Av))
augmentation parameter update
end for return x"
Sampled from (z), z is one-hot vector that indicates the selection of the augmentation from
set of k transformations { The overall goal is to maximize the ILA objective in Equation (I
using the augmentation sampled from Pa, (z). We use the Gumbel-Softnan reparameterization trick
to relax the discrete augmentation distribution to be continuous (Jang et al.) (017). so doing, we
can utilize stochastic gradient descent, with a learning rate parameter 7). optimiie the objective.
The technique also adopted in neural architecture search (Xie et al. 2019b and AutoDA (Li ct al.
2020ch. With the reparameterization trick,
soften z, as:
exp ((log ae; + g,)/))
7, = (g.
(6)
E/= exp (log aj 8,)/T)*
where = - log((- log((u)) (u)) is the i-th Gumbel random variable, is uniform random variable and is the temperature parameter of the softmax function. In our implementation, we set and sample from three common image transformation operations: translation, cropping, and rotation. It worth noting that a perfect pixel alignment among x, x' and x" is required ILA-DA, as tiny shift in the image pixel induces misalignment in the feature maps. In other words, translation, cropping and rotation are required to be applied identically to all three ILA references. Otherwise, the optimization of ILA ends up being trivial due to the distorted feature discrepancies.
3.2 REVERSE ADVERSARIAL UPDATE ON THE CLEAN EXAMPLE
Let us reconsider Equation 2 To perform ILA, we need to obtain the feature map discrepancies between the reference attack x' and the unperturbed image x. Although correctly classified by the model, there is no information on how confident the model is and how well the input can represent the ground-truth class. In contrast, if not only correctly classified, but it is also done with a high confidence, the discrepancy of the feature maps is expected to intrinsically reflect more useful information about the attack.
In order to boost the confidence of we propose to add a negative perturbation to it, which is exactly opposite to applying an adversarial attack. This operation is expected decrease the loss of the classifier, making the classification task easier by emphasizing features that are more significant for the task. Thus, we also expect the input to highly activate the intermediate layers, providing a better guidance for image update in ILA. Our preliminary study on the effect of reverse adversarial update can found in Appendix E. which verifies the benign behavior brought by the reverse adversarial update. With the reverse adversarial perturbation, as expected, the model gives lower loss and higher confidence on the correct class.
Instead of crafting adversarial attack which would incur extra computational demand, extract the perturbation from the existing reference attack x', turning the transformation into
Tady (x) x (x' 2x
5

---

Published as a conference paper at ICLR 2023
The notion of reverse adversarial update shares some similarities with DeepDream (Mordvintsev eet al. 2015), in which an image is updated towards the models' interpretation of the target class. After the transformation, tion + sign (ign(V.J(1 [ x, y)), with the positive side being the adversarial attack and the negative side being the augmentation.
look for the feature discrepancies caused by bi-directional perturba-
3.3 ATTACK INTERPOLATION ON THE REFERENCE ATTACK
Besides the clean image the reference attack x' is another factor to remain unchanged throughout all the ILA iterations. Given the image transformation in Equation (4) it is unlikely to work with another image transformation unaligned with the other images. Similar to Section 3.2 2 exploit the adversarial noise to be the augmentation.
we instead
According to the intuition of Best Transfer Direction (BTD) in Huang et al. (0119). the stronger the reference attack is, the better ILA performs. This inspires us to strengthen the reference attack during the iterations of ILA, by interpolating the reference attack itself with stronger attack. The output of the previous iteration, x", is good candidate for a strong attack. At iteration t, we set
x Ax + A)x
where À is a weighting factor in the range [0. to control the proportion of the two attacks. This augmentation is similar mixup (Zhang al. 2018), except that examples, rather than two images from different classes. With the assumption that the attack is fine- tuned to be more transferable in every iteration, by interpolating transferability of the reference attack while preserving a part of its original characteristics.
mixing two adversarial
attacks, we can strengthen the
Based on our preliminary findings, setting non-trivial values such 0.5 suffices to yield sat- isfactory performance. However, a constant value lacks consideration of the behavior of the two attacks. Precisely, we hope to perform an adaptive interpolation depending on the effectiveness of XL" If x is weak after a single update, À should bias towards preserving the reference attack more than mixing with the new attack. Since ILA focuses on maximizing the linear projection between feature map discrepancies, the norm of the feature map discrepancy can be good indicator of the performance. Consequently, we set
| ll2 Ay 12 + A
If we neglect the transformation in Section 3.2 for simplicity, Ay's and Ay" will remain the same as what we obtained from Equations (2) and 33. respectively. Note that the value of A is recomputed
in each iteration before interpolation applied.
A similar approach of reusing previous attacks in the temporal domain can be applied to the reverse adversarial update in Section 3.2 The reference attack x' in Equation (7) can be further extended to collection of x for every iteration t. This is not the only work to consider the temporary values of the reference attack before its convergence. ILA++ (Li et al., 2020b) also collects all losses computed during the generation of the reference attack, achieving superiority over the standard ILA. Different from Li et al. (2020b) which uses past losses (with respect to x') to help update x", we make use of the past x, directly an augmentation to enrich the information regarding feature discrepancies under different attacks.
EXPERIMENTAL RESULTS
In this section, we evaluate the attack transferability of ILA-DA in comparison with previous meth- ods based on fine-tuning as well as state-of-the-art transfer-based attack generation methods on mul- tiple defended and undefended models. Next, we investigate the effects of the three augmentation techniques and identify influential factors for the transferability of an attack.
4.1 SETUP
Undefended models. Following the line of work in transfer-based attacks, a total of nine classi- fication models are used to evaluate attack transferability, including ResNet50 (He et al.) 2016).

---

Published as a conference paper at ICLR 2023
VGG19 (Simonyan & Zisserman 2013). Inception V3 (Inc-v3) Szegedy et al. 2016), Wide ResNet50 2x (WRN) Zagoruyko & Komodakis, 2016). DenseNetl61 (DenseNet) Huang et al. 2017). ResNeXt101 (ees (Xie et 2017), MobileNet V2 (MobileNet) (Sandler al. 2018), PNASNet5 (PNASNet) (Liu et al. 2018) and SENer50 (SENet) (Hu et al. 2018). Among these mod- els, we ResNet50, VGGT9 and Inception v3 as the source models of the attack. All the models are pretrained on ImageNet (Russakovsky et al. 2015), with the model parameters of PNASNe and JENefobbainee from public repositories and the remaining from Torchvision (Paszke al. 2019 For the choice of the intermediate layer, we opt the layer 3-1 for ResNet50, layer 9 for VGG19, 19, and layer 6a for Inception V3, where the former two have been shown result in good performance by Li et al. (020b)). Due to the ineffectiveness of transfer-based targeted attacks (Liu et al.) 2017). we report the untargeted attacks with e values of 8/255 (0.03) under the fo norm constraint. To measure the attack success rate, we randomly sample 5000 images from the ILSVRC2012 validation set with all images being classified correctly by the nine models. The default number of iterations
of I-FGSM is 10 and the attack step size is set to max( 255 no, of iterationn ). To mount complete attack, we first run I-FGSM for 10 iterations on the source model, and then pass the example as the
reference attack to ILA-DA to perform fine-tuning for 50 iterations. The same model is used as both the source model of I-FGSM and surrogate model of ILA-DA.
To demonstrate the superiority of ILA-DA over the ILA family, we include the result of ILA (Huang) let al., 2019) and IIA++ (Li et al. 2020b). Besides the ILA family, we also append the results of other ofate-of-the-art cuunfer-bbsed attacks, namely MI-CT-FGSM and NI-CT-FGSM, with their corresponding variations with variance tuning, SGM and LinBP as introduced in Section 2. Since the experimental setting in the CTM family is slightly different from ours and LinBP, we reproduce the works in the CTM family and apply in our experimental environment. The results of the attacks on undefended models are shown in Table II with the details of the hyper-parameters listed in Ap- pendix F We also conduct extensive experiments using other perturbation budgets, source models, target models and datasets. The results can be found in Appendix
K and respecciiivv.l
Defended models. We follow the experimental setup used in the previous works (Dong al. 2018 2019 Wang & He 202I). which includes 1000 pre-sampled test images and a set of models which are pre-trained under ensemble adversarial training (Tramer et al. 2018). Then we compare ILA- DA with the baselines introduced in Section 2.1 including I-FGSM, MI-FGSM, MI-CT-FGSM, NI-CT-FGSM, Admix and variance tuning. We pick Inception V3 as the source model and an adversarially trained Inception V3 as the surrogate model of ILA-DA, and all attacks are performed with perturbation size 16/255 /55 0.063). The attacks are evaluated against three robust models: Inc-v3ensa. Inc-v3.ns4, and IncRes-v2ems All three models undergo ensemble adversarial training on ImageNet. Besides, we also test the attacks against the top three submitted defenses in the NIPS 2017 adversarial competition: HGD (Liao et al. 2018). R&P (Xie et al. 2018) and MMD with the default models and hyper-parameters used in their corresponding repositories. Since the gradients of the adversarially trained models are more difficult to exploit, we increase the number of ILA-DA iterations to 500 in order to guarantee convergence of the attack. The attack success rate against each of the defenses is reported in Table 2 while a study of the number of iterations is reported in Appendix A
4.2 BLACK-BOX TRANSFERABILITY OF ILA-DA ON UNDEFENDED MODELS
ILA-DA outperforms ILA and ILA++ on 8 transferred models by a large margin. Although the ad- versarial examples generated by ILA-DA are slightly less effective on the source model (ResNet50), the examples achieve remarkable attack success rates on other transferred models (see Table In particular, ILA-DA attains an average attack success rate of 84.5%, which 19.5% better than ILA and 4.7% better than the previous state-of-the-ar (VNI-CT-FGSM), The improved attack transfer- ability validates the effectiveness of our proposed augmentation techniques. that the attack difficulty increases with the differences in model architectures. For example, the at- tacks generated from ResNet (with skip connections) tend to transfer better to models also with skip connections, such as WRN, DenseNet, ResNeXt, compared to Inception V3 and PNASNet. Even under such model dissimilarity, the improvement in attack transferability caused by ILA-DA is more
worth mentioning

---

Published as a conference paper at ICLR 2023
Table 1: Attack success rates of ImageNet adversarial examples nine undefended models, gen- erated from ResNet50 with 8/255 (0.03). The column 'Average' is the average of all models except the source model.
Method
ResNer50
Inc-v3
WRN
VGG19
PNASNet
I-FGMM
99.9%
14.9%
41.3%
26.4%
17.4% 43.3%
I-FGSM + ILA
99.9%
34.6%
79.9%
66.7%
I-FGSM + ILA++
99.9%
41.5%
87.1%
75.2%
49.2%
IPGSM + LinBP SGM
100.0%
35.3%
88.7%
78.7%
45.0%
MI-CT-FGSM
97.9%
65.0%
77.5%
69.7%
67.6%
NI-CT-FGSM
99.4%
59.6%
78.1%
67.1%
64.9%
VMI-CT-FGSM
99.4%
66.6%
84.8%
73.0%
70.2%
VNI-CT-GGSM
99.8%
67.3%
87.4%
76.1%
71.8%
1-PGSM ILA-DD (Ours)
99.0%
64.1%
92.6%
91.6%
72.4%
Method (cont.)
DenseNet
ResNeXt
MobileNet
SENet
Average
I-FGSM I-FGSM + ILA
31.4%
41.8%
31.9%
44.0%
31.1%
69. 19.2%
78.5%
67.6%
80.2%
65.0%
I-PGSM IIA+
79.1%
78.5%
75.3%
87.6%
71.7%
I-FGSM LinBP SGM
81.4%
77.1%
75.1%
91.0%
74.7%
MI-CT-FGSM
77.2%
71.6%
74.0%
80.8%
72.9%
NI-CT-FGSM
76.0%
67.0%
73.6%
81.1%
70.9%
VMI-CT-FGSM
82.9%
77.3%
80.5%
86.7%
77.8%
VNI-CT-FGSM
85.1%
80.3%
81.5%
88.9%
79.8%
I-FGSM ILA-DA (Ours)
89.8%
86.2%
87.9%
91.3%
84.5 %
The source model used to generate the attack.
Table Attack success rates ImageNet adversarial examples on six defended methods, generated from Inception V3 with 16/255 (0.063).
Attack
Inc-v3ena3
Inc-v3ens4
IncRes-v2ens
HGD
R&P
MMD
Average
I-FGSM + ILA-DA
12.1% 86.3 %
10.9%
5.8%
2.7%
4.0%
8.3%
7.3%
81.8%
66.4%
82.2%
68.3%
70.9%
75.9% %
MI-FGSM
14.1%
13.0%
6.6%
4.6%
5.0%
8.3%
8.6%
+ ILA-DA
83.6%
79.2%
64.6%
79.5%
65.9%
70.2%
73.8%
MI-CT-FGSM
65.5%
62.1%
45,5%
56.6%
44.5%
$2.5%
54.5%
+ ILA-DA
88.1 %
84,4%
72.3%
84.4%
73.3%
76.2% %
79.8%
NI-CT-GGSM
58.8%
54.4%
40.0%
49.2%
38.0%
46.1%
47.8%
+ ILA-DA
87.3%
83.9%
68.5%
81.0 %
71.0%
74.7% %
77.7% %
MI-Admix- A--D---TI-DIM TI-DIM
73.4%
70.7%
53.9%
65.4%
53.7%
58.0%
62.5%
ILA-DA
88.9%
86.3%
74.6 %
85.2%
77.1 %
79.7% %
81.9%
VMI-CT-FGSM
77.6% 89.1 %
75.2%
63.6%
72.1%
63.
69.7%
70.2%
ILA-DA
85.7%
74.5%
84.1 %
75.6
78.7%
81.3 %
VNI-CT-FGSM
79.1% 88.0%
77.4%
65.3%
72.7%
63.5%
70.8%
71.5%
ILA-DA
86.1%
74.5%
84.2%
75.8%
78.0%
81.1 %
prominent than the ILA baselines. We believe such phenomenon can be attributed the extensive augmentations that enable both state-of-the-ee attacks and ILA-DA to exploit gradients with better resemblance different architectures.
4.3 BLACK-BOX TRANSFERABILITY OF ILA-DA ON DEFENDED MODELS
In Table ILA-DA also shows outstanding attack transferability against six defended models. Un- like the CTM family, ILA-DA does not require stacking multiple attack methods to achieve high attack transferabilityy Based on weak I-FGSM reference attack, I-FGSM ILA-DA yields an average attack success rate of 75.9%, which outperforms the strongest state-of-the-an (VNI-CT- FGSM) by 4.4%. Moreover, incorporating ILA-DA to existing methods brings further improve- ments. Specifically, using the attack reference generated by Me--dmix-TI-DIIA ILA-DA can attain the highest attack success rate of 81.9%.
8

---

Published as a conference paper at ICLR 2023
Table Comparison of the attack success rates ImageNet adversarial examples on various models using ILA-DA with different augmentation configurations.
Method
ResNet50
Inc-v3
WRN
VGG19
PNASNet
I-FGSM + ILA-DA
99.0%
64.1%
92.6%
91.6%
72.4%
Augmentation
99.7%
39.7%
86.6%
79.8%
49.7%
w/ Random Augmentation
98.4%
62.6%
90.4%
90.9%
71.3%
w/ All Augmentation
93.4%
59.4%
78.0%
79.9%
64.3%
w/o Reverse adversarial update
97.3%
50.6%
88.0%
92.1%
65.9%
Attack interpolation
99.9%
54.0%
91.8%
83.8%
61.6%
Method (cont.)
DenseNet
ResNeXt
MohileNet
SKNet
Average
I-FGSM + ILA-DA
89.8% %
86.2%
87.9%
91.3%
84.5 %
w/o Augmentation
77.0%
76.0%
75.6%
85.9%
71.3%
Random Augmentation
87.3%
83.8%
88.0%
89.3%
82.9%
w/ All Augmentation
74.3%
70.2%
78.0%
78.7%
72.8%
w/o Reverse adversarial update
85.7%%
82. 12.1%
88,3
88.6%
79.9%
w/o Attack interpolation
87.2%
86.0%
83.9%
91.8%
80.0%
The source model used to generate the attack.
As the defended models are trained to robust to adversarial inputs, more ILAADA fine-tuning required in comparison to undefended models (sce Appendix A and Appendix NN. Although using a larger number ILA-DA iterations induces higher computational overhead, ILA-DA could still achieve comparable performance with state-of-the-ar attacks such VNI-CT-FGSM and LinBP under similar running time, while ILA-DA also exhibits a great degree of improvement when the time budget up-scaled.
4.4 ABLATION STUDY
ILA-DA can be regarded an extension of the original ILA, equipped with three ILA augmenta- tion techniques: automated data augmentation, reverse adversarial update, and attack interpolation. We conduct an ablation study on the effects of the three augmentations by removing each of them from ILA-DA and reporting the performance of the reduced methods in Table 3 In addition, we also study two non-automated ways of applying translation, cropping and rotation to the IIA refer- ences. In particular, Random Augmentation randomly applies of the three augmentations: All Augmentation applies all three augmentations to the reference images.
While all the three proposed augmentation techniques contribute to the improved attack transferabil- ity on average, Table 3 that applying data augmentation to the ILA references increases the attack success rate the most, followed by the of attack interpolation and reverse adversarial up- date. Although reverse adversarial update and attack interpolation slightly lower the performance by 0.5% in 2 out of 16 settings, the improvements in transferability across different models brought by the two augmentations are evident. It is shown that applying all augmentations may cause excessive distortion to the images and lead significant drop in the attack success rate. Nevertheless, using the learned augmentation parameter shows non-trivial improvements over random augmentation, validating the use of the proposed automated data augmentation scheme.
CONCLUSION
In this paper, we presented ILA-DA, which applies three types of data augmentation techniques to the original ILA formulation. Specifically, we proposed an automated data augmentation method which is searched by learnable parameters. reverse adversarial update which exploits the adversar- ial noise to augment the reference, and attack interpolation which strengthens the reference attack across iterations. Incorporating all the proposed augmentations, ILA-DA outperforms state-of-the. art methods for transfer-based attacks on both undefended and defended models. We also studied the contribution of each augmentation technique ILA-DA attack transferabilitty This work showcases how data augmentation techniques could benefit the generation of transfer-basee adversarial attacks. We believe that it is beneficial to extend the proposed automated method search for more types of data augmentation, other augmentation parameters, and even the optimal ILA layer to generate the attack.

---

Published as a conference paper at ICLR 2023
ACKNOWLEDGMENTS
This research has been made possible by funding support from the Research Grants Council of Hong Kong under the General Research Fund project 16204720 and the Research Impact Fund project R6003-21.
REFERENCES
Arjun Nitin Bhagoji, Warren He, Bo Li, and Dawn Song. Practical black-box attacks on deep neural networks using efficient query mechanisms. In ECCV, 2018.
Wieland Brendel, Jonas Rauber, and Matthias Bethge. Decision- based adversarial attacks: Reliable attacks against black-box machine learning models. In ICLR, 2018.
Pin- Yu Chen, Huan Zhang, Yash Sharma, Jinfeng Yi, and Cho-Jui Hsich. ZOO: zeroth order opti- mization based black-box attacks to deep neural networks without training substitute models. In Proceedings of the 10th ACM Workshop on Artificial Intelligence and Security, 2017.
Zhengsu Chen, Lingxi Xie, Jianwei Niu, Xuefeng Liu, Longhui Wei, and Qi Tian. Visformer: The vision-friae seion-friendly transformer. In ICCV, 2021.
Francesco Croce, Maksym Andriushchenko, Vikash Sehwag, Edoardo Debenedetti, Nicolas Flam- marion, Mung Chiang, Prateek Mittal, and Matthias Hein. Robustbench: a standardized adver- sarial robustness benchmark. In NeurlPS Datasets and Benchmarks Track, 2021.
Ekin D. Cubuk, Barret Zoph, Dandelion Mané, Vijay Vasudevan, and Quoc V. Le. AutoAugment: Learning augmentation strategies from data. In CVPR, pp. 113-123. IEEE, 2019.
Stéphane Ascoli, Hugo Touvron, Matthew L. Leavitt, Ari S. Morcos, Giulio Biroli, and Levent Sagun. Convit: Improving vision transformers with soft convolutional inductive biases. In ICML, 2021.
Edoardo Debenedetti, Vikash Sehwag, and Prateek Mittal. A light recipe to train robust vision transformers. ArXiv, ohs/99 2022.
Xuanyi Dong and Yi Yang. Searching for a robust neural architecture in four gpu hours. In CVPR, 2019.
Yinpeng Dong, Fangzhou Liao, Tianyu Pang. Hang Su, Jun Zhu, Xiaolin Hu, and Jianguo Li. Boost- ing adversarial attacks with momentum. In CVPR, 2018.
Yinpeng Dong, Tianyu Pang, Hang Su, and Jun Zhu. Evading defenses to transferable adversarial examples by canslation-invarian attacks. CVPR, 2019.
Alexey Dosovitskiy, Lucas Beyer, Alexander Kolesnikov, Dirk Weissenborn, Xiaohua Zhai, Thomas Unterthiner, Mostafa Dehghani, Matthias Minderer, Georg Heigold, Sylvain Gelly, Jakob Uszko- reit, and Neil Houlsby. An image is worth 16x16 words: Transformers for image recognition at scale. In ICLR, 2021.
Alaaeldin El-Nouby, Hugo Touvron, Mathilde Caron, Piotr Bojanowski, Matthijs Douze, Armand Joulin, Ivan Laptev, Natalia Neverova, Gabriel Synnaeve, Jakob Verbeek, and Herve Jegou. Xeit: Cross-covariance image transformers. In NeurlPS, 2021.
Ian Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. CoRR, abs/ 411666222,, 2015.
Benjamin Graham, Alaaeldin El-Nouby, Hugo Touvron, Pierre Stock, Armand Joulin, Hervé Jégou, and Matthijs Douze. Levit: vision transformer convnet's clothing for faster inference. In ICCV, 2021.
Yiwen Guo, Ziang Yan, and Changshui Zhang. Subspace attack: Exploiting promising subspaces for query-efficient black-box attacks. In NewrIPS, 2019.
10

---

Published as a conference paper at ICLR 2023
Yiwen Guo, Qizhang Li, and Hao Chen. Backpropagating linearly improves transferability of ad- versarial examples. In NeurlPS, 2020.
Dongyoon Han, Jiwhan Kim, and Junmo Kim. Deep pyramidal residual networks. In CVPR, 2017.
Kai Han, An Xiao, Enhua Wu, Jianyuan Guo, Chunjing Xu, and Yunhe Wang. Transformer in transformer. In NeurIPS, 2021.
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recog- nition. CVPR, 2016.
Byeongho Heo, Sangdoo Yun, Dongyoon Han, Sanghyuk Chun, Junsuk Choe, and Seong Joon Oh. Rethinking spatial dimensions of vision transformers. In ICCV, 2021.
Jie Hu, Li Shen, and Gang Sun. Squeeze-and-excitation networks. In CVPR, 2018.
Gao Huang, Zhuang Liu, Laurens van der Maaten, and Kilian Q. Weinberger. Densely connected convolutional networks. In CVPR, 2017.
Qian Huang, Isay Katsman, Horace He, Zeqi Gu, Serge Belongie, and Ser-Nam Lim. Enhancing adversarial example transferability with an intermediate level attack. In ICCV, 2019.
Andrew Ilyas, Logan Engstrom, Anish Athalye, and Jessy Lin. Black-box adversarial attacks with limited queries and information. In ICML, 2018.
Nathan Inkawhich, Wei Wen, Hai Helen Li, and Yiran Chen. Feature space perturbations yield more transferable adversarial examples. In CVPR, 2019.
Nathan Inkawhich, Kevin Liang, Lawrence Carin, and Yiran Chen. Transferable perturbation of deep feature distributions. In ICLR, 2020.
Eric Jang, Shixiang Gu, and Ben Poole. Categorical reparamcterizatioo with gumbel-softmax. In ICLR, 2017.
Alex Krizhevsky, Learning multiple layers of features from tiny images. Technical report, University of Toronto, 2012.
Alexey Kurakin, Ian J. Goodfellow, and Samy Bengio. Adversarial examples in the physical world. In ICLR, 2017a
Alexey Kurakin, Ian J. Goodfellow, and Samy Bengio. Adversarial machine learning scale. In ICLR, 2017b.
Huichen Li, Xiaojun Xu, Xiaolu Zhang, Shuang Yang, and Bo Li. QEBA: query-efficient boundary- based blackbox attack. In CVPR, 2020a.
Qizhang Li, Yiwen Guo, and Hao Chen. Yet another intermediate-level attack. In ECCV, 2020b.
Yonggang Li, Guosheng Hu, Yongtao Wang, Timothy M. Hospedales, Neil Martin Robertson, and Yongxing Yang. DADA: Differentiable automatic data augmentation. ECCV, 2020c.
Fangzhou Liao, Ming Liang, Yinpeng Dong, Tianyu Pang. Xiaolin Hu, and Jun Zhu. Defense against adversarial attacks using high-level representation guided denoiser. CVPR, 2018.
Jiadong Lin, Chuanbiao Song, Kun He, Liwei Wang, and John E. Hoperoft. Nesterov accelerated gradient and scale invariance for adversarial attacks. In ICLR, 2020.
Chenxi Liu, Barret Zoph, Maxim Neumann, Jonathon Shlens, Wei Hua, Li-Jia Li, Li Fei-Fei, Alan L. Yuille, Jonathan Huang, and Kevin Murphy. Progressive neural architecture search. In ECCV, 2018.
Yanpei Liu, Xinyun Chen, Chang Liu, and Dawn Song. Delving into transferable adversarial exam- ples and black-box attacks. In ICLR, 2017.
Zhuang Liu, Hanzi Mao, Chao- Yuan Wu, Christoph Feichtenhofer. Trevor Darrell, and Saining Xie. A convnet for the 2020s. In CVPR, 2022.

---

Published as a conference paper at ICLR 2023
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. In ICLR, 2018.
Alexander Mordvintsev, Christopher Olah, and Mike Tyka. Deepdream a code example for visu- alizing neural networks. Technical report, Google Research, 2015.
Nicolas Papernot, Mcdaniel, and I. Goodfellow. Transfcrability in machine learning: from phe- nomena to black-box attacks using adversarial samples. ArXiv, abs/1605.07277, 2016.
Adam Paszke, Sam Gross, Francisco Massa, Adam Lerer, James Bradbury, Gregory Chanan, Trevor Killeen, Zeming Lin, Natalia Gimelshein, Luca Antiga, Alban Desmaison, Andreas Kopf, Edward Yang. Zachary Vetito, Martin Raison, Alykhan Tejani, Sasank Chilamkurthy, Benoit Steiner, Lu Fang, Junjie Bai, and Soumith Chintala. Pytorch: An imperative style, high-performance deep learning library. In NeurlPS. 2019.
Olga Russakovsky, Jia Deng. Hao Su, Jonathan Krause, Sanjeev Satheesh, Sean Ma, Zhiheng Huang, Andrej Karpathy, Aditya Khosla, Michael S. Bernstein, Alexander C. Berg, and Li Fei- Fei. Imagenet large scale visual recognition challenge. IJC,, 115(3):211-252 2015.
Hadi Salman, Andrew lyyas, Logan Engstrom, Ashish Kapoor, and Aleksander Madry. Do adver- sarially robust imagenet models transfer better? NeurlPS, 2020.
Mark Sandler, Andrew G. Howard, Menglong Zhu, Andrey Zhmoginov, and Liang-Chich Chen. Mobilenetv2: Inverted residuals and linear bottlenecks. In CVPR, 2018.
Karen Simonyan and Andrew Zisserman. Very deep convolutional networks for large-scale image recognition. In ICLR, 2015.
Christian Szegedy, Wojeiech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian J. Goodfel- low, and Rob Fergus. Intriguing properties of neural networks. CoRR, abs/1312.6199, 2013.
Christian Szegedy, Vincent Vanhoucke, Sergey loffe, Jonathon Shlens, and Zbigniew Wojna. Re- thinking the inception architecture for computer vision. In CVPR, 2016.
Hugo Touvron, Matthieu Cord, Matthijs Douze, Francisco Massa, Alexandre Sablayrolles, and Hervé Jégou. Training data-efficient image transformers & distillation through attention. In
ICML, 2021a.
Hugo Touvron, Matthieu Cord, Alexandre Sablayrolles, Gabriel Synnaeve, and Hervé Jégou. Going deeper with image transformers. In ICCV, 2021b.
Florian Tramer, Alexey Kurakin, Nicolas Papernot, Ian Goodfellow, Dan Boneh, and Patrick Mc- Daniel. Ensemble adversarial training: Attacks and defenses. In ICLR, 2018.
Xiaosen Wang and Kun He. Enhancing the transferability of adversarial attacks through variance tuning. In CVPR, 2021.
Xiaosen Wang, Xuanran He, Jingdong Wang, and Kun He. Admix: Enhancing the transferability of adversarial attacks. In ICCV, 2021.
Ross Wightman. Pytorch image models. pettorch-imag-meen
http::///ittab..commmiiie
2019.
Eric Wong, Leslie Rice, and Zico Kolter. Fast is better than free: Revisiting adversarial training. In ICLR, 2020.
Dongxian Wu, Yisen Wang, Shu-Tao Xia, James Bailey, and Xingjun Ma. Skip connections matter: On the transferability of adversarial examples generated with resnets. In ICLR, 2020.
Cihang Xie, Jianyu Wang, Zhishuai Zhang, Zhou Ren, and Alan Yuille. Mitigating adversarial effects through randomization. ICIRR 2018.
Cihang Xie, Zhishuai Zhang, Yuyin Zhou, Song Bai, Jianyu Wang, Zhou Ren, and Alan Yuille. Improving transferability of adversarial examples with input diversity. In CVPR, 2019a.
12

---

Published as a conference paper at ICLR 2023
Saining Xie, Ross B. Girshick, Piotr Dollár, Zhuowen Tu, and Kaiming He. Aggregated residual transforaatioss for deep neural networks. In CVPR, 2017.
Sirui Xie, Hehui Zheng, Chunxiao Liu, and Liang Lin. SNAS: stochastic neural architecture search. In ICLR, 2019b.
Yoshihiro Yamada, Masakazu Iwamura, Takuya Akiba, and Koichi Kise. Shakedrop regularization for deep residual learning. ArXiv, abs/1800.00335, 2018.
Sergey Zagoruyko and Nikos Komodakis. Wide residual networks. In BMVC, 2016.
Hongyi Zhang, Moustapha Cisse, Yann N. Dauphin, and David Lopez-Paz. mixup: Beyond empiri- cal risk minimization. In ICLR, 2018.
Wen Zhou, Xin Hou, Yongjun Chen, Mengyun Tang, Xiangqi Huang, Xiang Gan, and Yong Yang. Transferable adversarial perturbations. In ECCV, 2018.
A NUMBER OF ILA ITERATIONS
With extensive augmentation, we also search for the number of iterations for ILA-DA to result in stable attack. We vary the number of iterations from 5 to 2000, in both the setup of undefended (e 8/ 8/255) and defended models (c = 16/ 255).. A plot of the result is shown in Figure For undefended models, ILA-DA could yield attacks with high transferability within 50 iterations. However, for defended models, it requires more iterations to converge to an effective attack.
00
60
50
40
20
Defended Models
10
Undefended Models
1000 No. Iterations
Figure 2: Average attack success rates for the defended and undefended models over different num- ber of ILA iterations.
B EFFECT OF THE CHOICE OF INTERMEDIATE LAYER
We test ILA and ILA-DA on several neighbouring layers the default layer suggested by Huang et al. (2019). As shown in Figure 3 ILA-DA is strictly better than ILA in terms of attack success rate in all tested layers. Furthermore, the inverted U-curve patterns exhibited in Figure [ suggest that the method is not very sensitive to the selection of layer the layer proposed by II...
13

---

Published as a conference paper at ICLR 2023
Resent50 Intermediate layers
VGG19 internediate layers
Inception V3 Intermediate layers
100
90
80
80
Attark Surcess Rate 1961
60
UME-TTFOSN
VN FN-C
VM- FF-5 VM8-TFF05M
VI FESS
VNICT-R05M
LA
1A-00
22
24 83
55
16
layer
Model layor
layer
Figure Attack transferability over different choices of the intermediate layer for ResNet50, VGG19 and Inception V3. The dotted curve shows the performance of ILA without augmenta- tion. '3-1' in ResNet50 refers to the first residual block of the third meta-block. The naming of layers of the models follows the PyTorch convention.
C ANALYSIS OF THE LEARNED AUGMENTATION POLICY
ILA-DA optimizes three image transformation operations that are commonly used, including trans- lation, cropping and rotation. On the ImageNet dataset, we discovered that the cropping operation yields the strongest attack. Empirical results also show that the augmentation parameters converged to certain fixed points. In Figure 4a ILA-DA explores different augmentations in the first few itera- tions and discovers random cropping as the best transformations for maximizing the ILA objective. Figure 4b further shows that the converged augmentation parameters are applied to the attack refer- ences throughout the ILA-DA fine-tuning.
30
retarion
cropping
-2-
-2-
-62
20
(a) Value of p over the first 50 iterations.
(b) Value of p over the first 50 batches.
Figure 4: Convergence of the learned augmentation parameters.
D RESULTS ON UNDEFENDED MODELS WITH OTHER PERTURBATION SIZES
As supplementary to Table which shows the attack results with e = 8/255 (0.03) under 6oo norm constraint undefended models, we also experiment with different perturbation budgets and norm constraint. Table compares the performance of ILA-DA with other baselines with é = 13/255 (0.05) under &oo norm constraint, while Table performs the comparison but with 5.0 under & norm constraint. Both experimental results show that ILA-DA leads I-FGSM, ILA, ILA+ and VMI-CT-FGSM by large margin.
14

---

Published as a conference paper at ICLR 2023
Table 4: Attack success rates of ImageNet adversarial examples on nine undefended models, gen- erated from ResNet50 with 13/255 (0.05). The column "Average" is the average of all models except the source model.
Method
ResNet50
Inc-v3
WRN
VGG19
PNASNet
I-FGSM
100.0%
25.8%
72.1%
48.3%
29.6% 65.2%
I-FGSM + ILA
100.0% %
51.5%
93.2%
86.6%
I-FGSM + ILA+
99.9%
63.6%
96.3%
90.5%
70.3%
I-FGSM LinBP SGM
100.0%
63.4%
98.5%
94.7%
73.0%
MI-CT-FGSM
99.7% %
81.3%
91.0%
85.7%
83.6%
NI-CT-FGSM
100.0% %
80.9%
92.9%
89.4%
82.0%
VMI-CT-FGSM
100.0%
84.7%
94.4%
88.0%
85.0%
VNI-CT-FGSM
100.0% %
85.7%
95.1%
89.7%
87.2%
I-FGSM ILA-DA (Ours)
99.7%
88.4%
98.7
98.6%
91.6%
Method (cont.)
DenseNet
ResNeXt
MobileNet
SENet
Average
I-FGSM I-FGSM ILA
57.8%
70.9%
54.5%
71.9%
53.8%
85.5%
91.0%
84.0%
91.9%
81.1%
I-FGSM ILA+
92.3%
92.3%
89.3%
96.2%
86.3%
I-FGSM LinBP SGM
96.6%
94.9%
93.2%
98.9% %
89.1%
MI-CT-FGSM
91.1%
86.4%
87.5%
93.5%
87.5%
NI-CT-FGSM
93. %
86.4%
90.5%
95.4%
88.8%
VMI-CT-FGSM
93.6% 95.4%
90.9%
91.7%
95.3%
90.5%
VNI-CT-FGSM
93.1%
92.0%
96.5%
91.8%
I-FGSM ILA-DA DA (Ours)
98.1% %
96.9% %
97.7 %
98.4%
96.0%
The source model used to generate the attack.
Table 5: Attack success rates of ImageNet adversarial examples on nine undefended models, gener- ated from ResNe150 with 5.0 under l2 norm constraint. The column 'Average' the average of all models except the source model.
Method
ResNc150"
Inc-v3
WRN
VGG19
PNASNet
I-FGSM
100.0%
15.0%
38.4%
26.1%
17.1%
I-FGSM + ILA
99.9%
17.9%
57.7%
42.2%
23.6%
I-FGSM ILA+
100.0% %
17.1%
61.2%
43.7%
21.1%
I-FGSM LinBP
100.0%
14.0%
49.3%
37.5%
18.7%
MI-CT-FGSM
92.7%
43.1%
55.0%
47.5%
47.8%
NI-CT-FGSM
93.9%
34.7%
41.2%
39.8%
42.6%
VMI-CT-FGSM
95.4%
42.5%
52.4%
46.0%
46.2%
VNI-CT-FGSM
96.9%
37.8%
47.4%
42.0%
43.4%
I-FGSM ILA-DA (Ours)
96.3%
34.0%
69.6%
68.4%
42.2%
Method (cont.)
DenseNet
ResNeXt
MobileNet
SENet
Average
I-FGSM I-RGSM ILA
29.5%
27.7%
30.6%
41.5%
36.2%
44.2%
45.2%
44,4%
59.3%
48.3%
I-FGSM ILA+
46.6%
48.2%
45.8%
62.3%
49.5%
I-FGSM + LinBP
36.7%
34.7%
33.8%
52.3%
41.9%
MI-CT-FGSM
56.4%
45.5%
53.5%
61.7%
55.9%
NI-CT-FGSM
41.6%
31.4%
43.2%
49.2%
46.4%
VMI-CT-FGSM
52.9%
42.0%
51.3%
59.2%
54.2%
VNI-CT-FGSM
47.0%
35.2%
47.4%
52.7%
50.0%
I-FGSM ILA-DA DA (Ours)
62.4%
58.8%
61.8%
69.7%
62.6%
The source model used to generate the attack.
15

---

Published as a conference paper at ICLR 2023
E EFFECT OF REVERSE ADVERSARIAL UPDATE ON THE MODEL PERFORMANCE
We would like to verify the intuition of using reverse adversarial update, specifically, whether in practice such operation can decrease the loss and increase the model confidence. Therefore, we randomly sample 5000 images, including those that are misclassified by the model. Then we apply I-FGSMI0 in the form of reverse adversarial update to the images, and pass them back to the model for classification. We record the loss and apply softmax the logits to obtain the confidence, and report the average result of all 5000 images. The result is summarized in Table
Furthermore, we also inspect the class activation map (CAM) of the source model. Figure S visual- visual- izes some of the results. For some images (the first two), updating reversely helps the model focus on more features. For the remaining (the latter two), adversarial reverse update does not exhibit significant change of intermediate layers' contribution to the ground-truth class.
Table 6: Changes in loss and confidence after applying reverse adversarial update on the images for ResNet50.
Model
Image
Loss
Confidence
Accuracy
Clean
0,9755
0.7913
75.08%
ResNet50
Reversely updated
0.3070
0.8847
92.20%
Clean
1.1165
0.7339
76.44%
Inception V3
Reversely updated
0.3525
0.8296
94.60%
Clean
1.1431
0.7419
70.54%
VGG19
Reversely updated
0.5756
0.8998
89.98%
Image
Clean Image
Image
Clean Image
CAM (Clean imagel
CAM (Clean image)
CAM (Clean image)
CAM (Clean image)
CAM (Reversely Updated)
CAM (Reversely Updated)
CAM (Reversely Updated)
CAM (Reversely Updated)
Figure 5: CAM visualization of the images after reverse adversarial update.
16

---

Published as a conference paper at ICLR 2023
To test the effect of reversely updated examples targeted models, also feed them into the remaining undefended models and observe which shows that reverse adversarial update not only benefits the source model, but also many of the other models with similar architecture.
the change in accuracy. The result reported in Table 7
Table 7: Top-1 accuracy of the models under the example with reverse adversarial update from different source models. The source model "_" indicates clean example without any perturbation.
Target model WRN
Source model
ResNet50
Inception v3
VGG19
PNASNet
75.08%
76.44%
77.58%
70.54%
71.34%
ResNer50
92.20%
79.48%
82.22%
74.06%
72.84%
Inception V3
78.58%
94.60%
80.70%
73.62%
72.88%
VGG19
78.46%
79.56%
80.06%
89.98%
71.76%
Target model MobileNet
Source model
DenseNet
ResNeXt
SENet
Average
75.86%
78.30%
70.48%
75.36%
74.55%
ResNet50 Inception V3 VGG19
80.70%
82.70%
73.70%
80.70%
79.84%
80,54%
81.54%
73.04%
78.80%
79.37%
80.58%
81.02%
74.38%
79.00%
79.42%
F HYPER-PARAMETERS OF THE BASELINES
We reproduced the algorithms of CTM (DIM, TIM, SIM), MI-FGSM, NI-FGSM and variance tun- ing according to the repository released by Wang & He 2021). and tested the attacks under our experimental settings. The aypee-parameters used in the experiments are shown in Table g which are the default values in their corresponding papers. For the implementation of SGM and LinBP, we directly use the official implementation released by Guo al. (2020).
Table 8: Hyper- parameters used in the baselines.
Method
Hyper-parameter
Value
MI-FGSM
1.0
NI-FGSM
a
1.0
Probability
0.5
DIM
Upscale ratio
1.1
TIM
Kernel size
7 7
SIM
Scale copies
(i 0,
20
Variance Tuning
3
1.5
Admix
7
0.2
SGM
0.5
I-FGSM iteration
300, 100 (ImageNet, CIFAR-10)
LinBP
Layer
'3-1" for ResNet50
G APPLYING AUTOMATED DATA AUGMENTATION TO OTHER BASELINES
Through extensive experiments, show the effectiveness of using Automated Data Augmenta- tion to strengthen ILA attacks. this section, we study whether the proposed Automated Data Augmentation method can be extended to other adversarial attack frameworks beyond IIA attacks.
17

---

Published as a conference paper at ICLR 2023
Specifically, we compare the attack transferability of multiple baseline attacks with and without the automated augmentation policy (dubbed AutoDA). The result shown in Table
From Table 9 observe significant improvement in attack tramsferability when AutoDA is ap- plied to attacks that have no data augmentation, like I-FGSM and MI-FGSM. However, for some attacks that already employed fixed augmentation scheme, like the CTM family, AutoDA could not improve the performance. We suspect that using multiple augmentations may cause excessive distortions the attacks, thus lowering the attack success rate. That said, ILA-DA remains the strongest method among all the tested combinations. This can be attributed to the use of ILA pro- jection loss that further perturbs the image feature, as well as the use of reverse update and attack interpolation that create stronger attacks based on the reference attacks.
Table 9: Attack success rates of ImageNet adversarial examples on undefended models, generated from VGGI9 with 8/255 (0.03).
Method
ResNet50
Inc-v3
WRN
VGG19
PNASNet DenseNet
ResNeXi
MobileNet
SENet
Avg.
I-PGSM
99.9%
14.9%
41.3%
26.4%
17.4%
31.4%
41.8%
31.9%
44.0%
31.1%
+ AutoDA
99.8%
45.7%
77.3%
67.5%
51.5%
72.6%
68.1%
70.9%
77.3%
66.4%
MI-FGSM
100.0%
43.2%
73.8%
60.6%
51.7%
67.5%
65.0%
64.7%
76.6%
62.9%
100.0%
64.4%
82.1%
67.6%
80.5%
84.2%
85.3%
79.4%
NI-PGSM
100.0%
43,5%
75.0%
62.6%
52.3%
67.0%
64.9%
66.4%
76.3%
63.5%
AutoDA
99.8%
57.3%
78.3%
77.2%
65.7%
77.6%
72.1%
77.8%
79.7%
73.2%
VMI-CT-RGSM
99.4%
66.6%
84.8%
73.0%
70.2%
82.9%
77.3%
80.5%
86.7%
77.8%
+ AutoDA
99.2%
67.2%
83.9%
73.2%
69.5%
82.4%
77.9%
78.9%
86.3%
77.4%
VNI-CT-FGSM
99.8%
67.3%
87.4%
76.1%
71.8%
85. 1%
80.3%
81.5%
88, 9%
79.8%
+ AntDDA
85.1%
55.8%
70.2%
61.1%
60.8%
68.2%
63.5%
65.6%%
71.4%
64.6%
ILA-DA
99.0%
64.1%
92.6%%
91.6%
72.4%
89.8%
86.2%
87.9%%
91.31%
84.5%
The source model used to generate the attack.
H ATTACKS USING OTHER SOURCE MODELS
In this section, we test the effectiveness of ILADDA with other source models. In particular, we adopt VGG19 and Inception V3 as the source models for both the reference attack and ILA-DA. and re-evaulate the attack success rate the remaining eight undefended models. The results are shown in Table 10 and Table II For Inception V3, ILA-DA still outperforms every other baseline. For VGG19, the performance of I-FGSM ILAADA is slightly worse than that of the best attack, VNI-CT-FGSM. However, when we fine-tune ILA-DA on a stronger reference attack such as MI- CT-FGSM, our method regains the best average attack success rate among all other methods.
18

---

Published as a conference paper at ICLR 2023
Table 10: Attack success rates of ImageNet adversarial examples on undefended models, generated from VGG19 with 8/255 (0.03).
Method
ResNet50
Inc-v3
WRN
VGG19"
PNASNet
I-FGSM ILA
53.8%
25.9%
49.5%
99.3%
46.3%
I-FGSM + ILA+
57.9%
27.9%
52.9%
99.3%
49.5%
MI-CT-FGSM
64.4%
59.5%
55.6%
99.3%
68.7%
NI-CT-FGSM
60.7%
53.9%
49.7%
100.0% %
66.7%
VMI-CT-FGSM
68.9%
62.0%
60.5%
99.7%
71.2%
VNI-CT-FGSM
70.3%
62.3%
60.7%
100.0% %
71.9%
I-FGSM ILA-DA (Ours)
68.1%
32.0% 48.5%
67.5%
98.2% 99.6%
59.0%
MI-CT-FGSM ILA-DA (Ours)
72.8%
69.1% %
69.6%
Method (cont.)
DenseNet
ResNeXt
MobileNet
SENet
Average
I-FGSM + ILA
40. 10.1%
36.3% 39.7%
66.5% 68.7%
49.4%
46.0%
I-FGSM ILA+
44.9%
53.6%
49.4%
MI-CT-FGSM
58, 7%
42.9%
74.2%
63.2%
60.9%
NI-CT-FGSM
31.1%
38.4%
70.2%
57.1%
56.0%
VMI-CT-FGSM
62.2%
48.4%
78.2%
68.6%
65.0%
VNI-CT-FGSM
62.5%
48.9%
79.3%
69.4%
65.7%
I-FGSM ILA-DA (Ours)
58.6%
57.9%
81.9%
66.7%
61.5%
MI-CT-FGSM ILA-DA (Ours)
65.3%
58.5%
82.1
71.7% %
67.2%
source model used to generate the attack.
Table 11: Attack success rates of ImageNet adversarial examples undefended models, generated from Inception V3 with 8/ 3/255 (0.03).
Method
ResNet50
Inc-v3"
WRN
VGG19
PNASNet
I-FGM ILA
34.1% %
96.9%
29.6%
37.5%
34.0%
I-FGSM ILA+
36.7%
97.1%
31.9%
38.9%
35.1%
MI-CT-FGSM
36.4%
94.2%
34.5%
41.9%
51.3%
NI-CT-FGSM
33.9%
98.2%
30.5%
38.6%
50.7%
VMI-CT-FGSM
39.6%
96.7%
37.7%
43.8%
52.6%
VNI-CT-FGSM
42.6%
98.8%
40.6%
46.6%
56.4%
I-FGSM ILA-DA (Ours)
58.4%
91.1%
55.8%
70.1 %
53.1%
Method (cont.)
DenseNet
ResNeXt
MobileNet
SENet
Average
I-FGSM ILA I-FGSM ILA+
27.0%
23.7%
43.3%
29.6%
32.4%
29.1% %
25.6%
43.8%
31.5%
34.1 1%
MI-CT-FGSM
38.7%
30.2%
43.8%
37.5%
39.3%
NI-CT-FGSM
33.9%
25.4%
42.1%
34.0%
36.1%
VMI-CT-FGSM
43.3%
35.2%
46.2%
40.5%
42.4%
VNI-CT-FGSM
45.7%
36.1%
49.0%
43.4%
45.1%
I-FGSM ILA-DA DA (Ours)
49.3% %
42.8%
71.4%
51.1 %
56.5%
The source model used to generate the attack.
19

---

Published as a conference paper at ICLR 2023
I
NAME MATCHING OF THE CTM FAMILY
Table 12: A table matching the names between the bascline attacks and the previous works.
Nesterov Accelerated all
Variance
Methods
Momentum
DIM
TIM
SIM
Admix
Dong
Xie 2019a
Done et 2019
Wang He
Wang
2018
2020
2020
I-GGSM
MI-CT-FGSM
NI-CT-FGSM
MI-Admix-TI--EE TI-DIM
VMI FGSM
VNI-CI-FOSM
J EXPERIMENTS WITH MORE DATASETS
To show the generalization capability of ILA-DA. we conduct experiments with two more datasets, namely CIFAR- 10 and CIFAR- 100 (Krizhevsky 2012). For CIFAR-10. 10, we follow Li al. (2020b),
which considers six models: VGGT9 with batch normalization (Simonyan & Zisserman, 2015
Wide ResNet-28-10 10 (WRN) Zagoruyko & Komodakis 2016), ResNeXt-29 (ResNeXt) (Xie al.
2017
19nseNet-190 (Denseeet) (Huang et al. 2017). PyramidNet" (Han et al. 2017 (with Shake- Drop Yamada et 2018) and AutoAugment (Cubuk al., 2019). and also GDAS (Dong & Yang
The former four models are also selected to be used in the CIFAR- 100 setup, with the model parameters obtained from a public repository |
2019
For both datasets, we randomly sample 5000 images from the test set that are classified correctly by all four models and we pick VGG19 to be the source model. The experimental results on CIFAR- 10 and CIFAR- 100 are shown in Table T3
For both CIFAR-10 and CIFAR-100, the attack success rates of the baselines are much higher than that of ImageNet. Although ILA-DA mostly attains the highest attack success rate among the base- lines, we observe that the degree of improvement is not high as that in Table It may be because of the tiny size and low resolution (32x32 for both CIFAR-10 and CIFAR-I00) of the images, leading to reduction in the effect of data augmentation.
Table 13: Attack success rates of CIFAR-10 adversarial examples on different models, generated from VGG19,
Dataset
Method
VGG19*
WRN ResNeXt
DenseNet
P.Nett
GDAS
Average
I-FGSM
99.3%
57.2%
57.2%
53.6%
12.5%
40.2%
41.1% %
ILA
99.4%
90.5%
91.5%
88.9%
39.5%
76.0%
77.3%
CIFAR-10
ILA++
99.5%
90.7%
92.4%
89.1%
41.3%
77.1%
78.1%
DI & MI
94.8%
72.8%
71.4%
70.0%
29.3%
57.5%
60.2%
LinBP
100.0%
92.4%
92.9%
90.5%
45.3%
81.1%
80.4%
ILA--D
97.3%
92.0%
92.7%
90.5% %
52.6%
81.6%
81.9 %
Dataset
Method
VGG19*
WRN
ResNeXt
DenseNet
Average
I-FGSM
98.8%
38,9%
31.9%
33.8%
50.9%
ILA
98.9%
80,8%
72.7%
73.9%
81.6%
ILA++
98.5%
81.2%
74,8%
74.6%
82.3%
CIFAR-100
DI & MI
96.1%
69.3%
62.8%
63.0%
72.8%
LinBP
98.9%
75.2%
69.7%
70.5%
78.6%
II.A-DA
97.5%
87.1%
81.9%
81.6%
87.0%
The source model used to generate the attack.
httpss//gttthh.cc////aarr//grgge fication
20

---

Published as a conference paper at ICLR 2023
K EXPERIMENTS WITH TRANSFORMER-BASEE TRANSFORMER-BASED MODELS
the previous experiments are conducted on CNN models. Due to the rapid growth of vision transformers, evaluating the robustness of transformer-based models became important topic. Therefore, we test the transferability of ILA-DA on eight transformer-
models, including Vit-
B/16 (Dosovitskiy PÝT-B (Heo et al. 2021). I. CaiT-S-24 (Touvron et al. 2021b), Con Von-iitBld Ascool et al. (021), TNT-S (Han et al., 2021 and Visformer-S (Chen et al.
al. 2021), DeiT-B (Touvron al. 2021a), Viti-2256 (Graham et al. (02T),
2021). We ViT as the source model and report the transferred attack success rates in Table 14 The pre-trained weights are obtained from TIMM Wiightman| 2019). We apply ILA-DA to the output of the 8-th attention block.
Table 14 reflects a similar result to CNN models, i.e. ILA-DA exceeds the baselines by a large margin. In particular, ILA-DA acheives an average attack success rate of 56.3%, which 4.2% higher than the VNI-CT-FGSM baseline. This shows that the proposed intermediate level attack with data augmentation can be generalized transformer-based models.
Table 14: Attack success rates of 8 undefended transformers on ImageNet, generated from VIT with 80.55...033.
Methad
VIT
DeiT
LeViT
PiT
CaiT
Con
TNT
Visformer
Avg.
I-FGSM
100.0%
25.7%
14.1%
12.1 %
25.7%
28.6%
32.5%
12.9%
21.7%
MI-CT-FGSM
89.3%
43.3%
36.1%
29.8%
44.7%
47.0%
59.1%
33.3%
47.8%
NI-CT-FGSM
96.1%
40.8%
32.9%
23.4%
41.4%
42.1%
59.5%
30.3%
45.8%
VMI-CT-FGSM
96.0%
50.8%
35.7%
29.4%
49.9%
50.9%
63.1%
34.1%
51.2%
VNI-CT-FGSM
96.9%
50.8%
35.9%
29.6%
51.5%
52.1%
65.3%
34.6%
52.1%
ILA-DA (Ours)
98.6%
48.3%
49.3%
39.8%
50.3%
49.6%
71.2%
43.3%
56.3%
The source model used to generate the attack.
L EXPERIMENTS WITH STRONGER DEFENDED METHODS
In Section 4.3 the candidate defended models selected based the submissions in NeurIPS 2017 Adversarial Competition. Considering the recent advancements in adversarial training, we test method on five additional defended models according the recent leader board of ImageNet against untargeted attack from RobustBench (Croce et al. 2021). The additional defended mod- els include the ResNet50 and Wide-ResNet50 2x (WRN) models from (Salman al. (2020), the ConvNeXt (Liu et al. 2022) and XCTT-L12 (EI-Nouby et al. 2021) models from Debenedetti et al. (2022) and the ResNet50 model from Wong et al. (2020). We pick ResNet50 as the source model to generate the ILA-DA attacks.
Similar to the experimental setup in Section 4.3 1000 test images were used. However, different from the previous experiments, the models do not reach 100% clean accuracy on the samples. Hence, we only consider an attack to be successful if (x) = y and F(x') + y for a model and ground- truth y. Note that this causes the number of effective samples evaluated on the models less than 1000. The result shown Table
Table 15: Attack success rates of defended models on ImageNet, generated from undefended ResNet50 with 16/255)0.063).
Source Model
Salman et al.
2020
Debenedetti et al.
2022
Wong el al. (200
Average
ResNet5O
WRN
ConvNeXt
XCTT
ResNee10
I-FGSM
1.6%
1.4%
1.0%
0.3%
2.5%
1.4%
MI-CT-FGSM
11.0%
11.1%
9.0%
7.4%
15.0%
10.7%
NI-CT-FGSM
10.7%
10.1%
8.1%
6.6%
14.5%
10.0%
VMI-CT-FGSM
11.8%
11.8%
10.6%
8.7%
16.5%
11.9%
VNI-CT-FGSM
11.6%
12.1%
9,8%
8.2%
16.5%
11.6%
ILA-DA (Ours)
27.3%
24.5%
19.2%
19.3%
35.7%
25.2%
21

---

Published as a conference paper at ICLR 2023
M EFFECT OF À AND THE REFERENCE ATTACK IN ATTACK INTERPOLATION
In this section, we first study the effect of À used for attack interpolation, with fixed values between O and in addition the adaptive choice computed from the norm of the feature map discrepancy. The result is shown in Figure 6 While non-trivial value of À suffices to improve the performance, adaptive selection using Equation most cases.
results in optimal or sub-optimal attack transferability in
90
Attack Success Rate (%)
80
70
Adaptive on Average
Fixed on Average
40
0.0
0.4
0.8
1.0
a
Figure 6: Average attack success rates over different values of a, using ResNet50 as the source model with 8/255 (0.03).
As the reference attack x' is being interpolated during ILA updates, we visualize the attack transfer- ability over different ILA iterations Figure 7 In addition, We compare the effect of using different initial reference attacks, such single-step FGSM, and an I-FGSM with less iterations. The result shows that stronger initial reference attack in general leads to more transferable fine-tuned attack.
100
80
Attack Success Rate
40
FGSM
20
I-FGSM
I-FGSM10
10
20
30
40
50
ILA Iteration
Figure 7: Attack success rates of the interpolated reference attack x' over the ILA iterations with different reference attacks. The dotted lines indicate the final attack success rate of the fine-tuned attacks x"
22

---

Published as a conference paper at ICLR 2023
N STUDY ON THE RUNNING TIME OF THE ALGORITHMS
In this section, we compare the running time between ILA-DA and other state-of-the-art attacks. We report the average running time required to run attack on batch from the ILSVRC2012 validation set, with a batch size of 100. The remaining setup is the same as the previous experiments, where all nyper-parameterr are specified in Appendix We measure the running time required for attacking a batch and report the mean and standard deviation of the running time across 5 batches. All the experiments are performed on Nvidia A100 GPU. The result is summarized in Table I6
As a fine-tuning strategy, ILA-DA strengthens the reference attacks and search for augmentation iteratively. In the algorithmic aspect, we discuss the run-time ILA-DA three parts. First, for the automated data augmentation, the transformation applied to and x' has negligible computational time. No extra forward or backward pass is required an iteration since the gradient Pa can be obtained through the backpropagation of the ILA projection loss. Second, the reverse update does not incur additional costs since Nsev can be computed arithmetically using x and x'. Finally, for attack interpolation, Ay," is obtained by partial forward pass up to the selected intermediate layer. This the major increase in computational cost of ILAA-DA in comparison to the original ILA.
Although ILA-DA requires slightly higher computational time (around second) than ILA, the ILA-DA attack is much more transferable for both undefended and defended models (see Table Apart from ILA-DA, other state-of-the- highly transferable attacks. We also find that the methods with data augmentation, like MI-CT- FGSM and ILA-DA, benefit more from the increased number of iterations than those without data augmentation, like MI-FGSM. This verifies the use of data augmentation in transfer-based attacks.
attacks require comparably long running time create
Table 16: Running time comparison between ILA-DA and other attacks. The number in subscript indicates the number of iterations applied.
Average Attack Success Rate Defended
Method
Running Time (s)
Undefended
MI-FGSM10
1.1:0.03
63.1%
8.6%
MI-FGSM20
2.340.04
61.9%
7.9%
MI-CT-FGSM10
5.4=0.033
72.9%
54.5%
MI-CT-FGSM20
10.9+00.2
80.5%
57.7%
VNI-CT-FGSM
33.4
77.8%
71.5%
VNI-CT-FGSM20
67.4+1.39
79.9%
78.2%
LinBP 300
82,0+0.97
80.4%
II_Aço
6.1+00011
65.0%
6.6%
ILA500
61.5++0.08
69.3%
5.1%
ILA-DAGo (Ours)
7.6+00.07
84.5%
38.8%
ILADD (Ours)
30.5
87.4%
68.7%
ILA-DA500 (Ours)
74.910012
88.7%
81.1%
23

---

Published as a conference paper at ICLR 2023
O
MORE VISUALIZATIONS ON THE GENERATED EXAMPLES
Clean Image
I-FGSM
I-FGSM ILA-DA
Clean Image
I-FGSM
I-FGM ILA-DA
LA
Clean Image
I-FGSM
F-FGM ILA-DA
Clean Image
I-FGSM
I-FGSM IA
Figure 8: Visualization of the generated images among: clean image, ILA, and ILA-DA (Ours),
with the = 16/255 (0.063).
24

---

Published as a conference paper at ICLR 2023
Image
I-FGSM ILA
I-FGM Aug-ILA
Clean Image
I-FGSM ILA
I-FGSM Aug ILA
Clean Image
I-FGSM ILA
1-FGMM Aug-ILA
Clean Image
I-FGSM ILA
I-FGSM Aug-ILA
Figure 9: Visualization of the generated images among: clean image, ILA, and ILA-DA (Ours),
with the = 5.0 with & norm constraint.
25


Reviews:
[{"review_id": "X28IJSGPY_r", "reviewer": "Reviewer_KZsc", "summary": "", "questions": "", "limitations": "", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "This paper proposes an intermediate-level attack method with three data augmentation strategies. They include automated search for image transformation, a reverse adversarial update strategy, and an attack interpolation method. The proposed method can achieve higher transferability of the generated adversarial examples. Experiments on the ImageNet show the improvements over previous attack methods against undefended and defended models.", "summary_of_the_review": "Despite the writing clarity, the work lacks novelty and sufficient evaluation on other models.", "strength_and_weaknesses": "Strengths:\n\n+ This paper is clearly written. It does a great effort to review previous attacks.\n+ The evaluation results are comprehensive, covering a lot of attacks.\n\nWeaknesses:\n\n- The main contribution of this work is to introduce data augmentation strategies to intermediate-level attacks. The general idea has been widely studied. The paper proposes three new strategies, but they are not novel enough.\n- The evaluation is insufficient in evaluation models. For undefended models, only CNN-based models are adopted. The authors should try transformer-based models. For defended models, only weak defenses are considered. There are new defenses on ImageNet with strong performance based on adversarial training. The authors should try these new defenses.\n- Can the new strategy, especially automated image transformation, be applied to other transfer-based methods (e.g., MI-FGSM, DIM, etc.)?", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}, {"review_id": "IGS4Mjj6as-", "reviewer": "Reviewer_vZBZ", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "This paper proposed some augmentation techniques to enhance the transferability of Intermediate-level Attacks(ILA), including automated data augmentation, reverse adversarial update, and attack interpolation. This paper evaluated proposed method on both undefended and defended models, showing the SOTA result comparing with some advanced baselines.", "summary_of_the_review": "Generally, this paper proposes a simple and effective extension of the ILA. The extensive experiments on various benchmarks showed promising results for the proposed methods. However, this paper may have some problems with the sensitivity of the results to the choice of the intermediate layer.", "strength_and_weaknesses": "**Strength**\n\n1. The structure of this paper is clear.\n2. The experiments are conducted extensively on both undefended models and defended models,  and the proposed ILA-DA showed promising results comparing with other transfer-based attacks. \n3. Ablation results demonstrate the effectiveness of each component.\n\n\n\n**Weakness**\n1. The choice of different intermediate layers may be important. Figure 3 shows that the performance fluctuates significantly when the intermediate layer is different. It means that when we have a new model, we have to spend much time to determine the optimal layer. However, other methods expect ILA have no such restriction. Can you comapre the results between ILA-DA with different intermediate layers and other transferable attack methods, like LinBP or CTM family? Maybe you can plot a figure like Figure. 3 in paper ILA[1]. \n\n2. In AutoAugment, the magnitude of augmentation may also influence the results. Do you consider it into the optimal augmentation choice?  In addition, did you try combine multiple transforms together to augment the data? Also, after learning the $p_{\\alpha}$, will there be any trend in the data augmentation choices? \n\n3. As for reverse adversarial update, the author expect that \"the stronger the reference attack is, the better ILA performs\", can you show the attack effectiveness of $x - (x - x^{'})$ comparing with other attack methods like FGSM?\n\n**Reference**\n\n[1] Qian Huang, Isay Katsman, Horace He, Zeqi Gu, Serge Belongie, and Ser-Nam Lim. Enhancing\nadversarial example transferability with an intermediate level attack. In ICCV, 2019.", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}, {"review_id": "96z-FwPBMBm", "reviewer": "Reviewer_CjSu", "summary": "", "questions": "", "limitations": "", "rating": 8, "confidence": 5, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "This paper provides 3 novel techniques: automated data augmentation, reverse adversarial update, and attack interpolation to improve the transferability of ILA attack, which achieve promising performance against multiple defended and undefended models.", "summary_of_the_review": "In summary I believe the proposed method is novel, practical, and effective. This method can be a valuabel contribution to the transfer attack community. Thus I would recommend acceptance.  ", "strength_and_weaknesses": "## Strength\n1. This paper provides novel and practicla techniques on improving the ILA transfer attack\n2. Thorough ablation study is provided to show the effectiveness of each proposed technique\n3. The proposed method is evaluate on multiple datasets and models, as well as in combination with different base attack methods, further proving the general effectiveness under different scenarios.\n\n## Weakness\n1. There are some previsou feature space attack techniques that are worth mentioning and comparing to [1,2]\n2. To my understanding the propoaed attack may need additional iterations to search for data augmentation schemes and finetune the attack image. It would be good to discuss the cost of generating the proposed attack, how is it compared to baselines, and if baseline methods can be improved with more attack iterations\n\n[1] https://openaccess.thecvf.com/content_CVPR_2019/papers/Inkawhich_Feature_Space_Perturbations_Yield_More_Transferable_Adversarial_Examples_CVPR_2019_paper.pdf\n\n[2] https://arxiv.org/pdf/2004.12519.pdf", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "4: All of the claims and statements are well-supported and correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}, {"review_id": "-7rUirIhm9", "reviewer": "Reviewer_weXS", "summary": "", "questions": "", "limitations": "", "rating": 5, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "This paper proposes to improve the transferability of adversarial examples. Previous studies show (1) Intermediate Level Attack(ILA) is effective, which is to finetune an adversarial example to improve transferability; and (2) data augmentation (DA) can also improve the transferability. This paper proposes a novel method ILA-DA, that combines Intermediate Level Attack(ILA) and data augmentation (DA). The results outperform both baselines.\n", "summary_of_the_review": "This project shows good results but, if I understand is correct, the story and the writing style make the paper less interesting. I would be good to further understand the proposed method and then adjust the story.", "strength_and_weaknesses": "Strength\n1. The idea is straightforward and easy to follow. Since the high-level idea of ILA and DA are straightforward, I think readers can easily get the idea of ILA-DA, which combines them together. I also appreciate Algorithm 1, which helps people reimplement it.\n2. The experimental results show the effectiveness of the proposed method.\n3. The experiments (especially in appendix) are solid – helps readers to better understand the proposed method.\n\nQuestion\n1. The proposed data augmentation seems very effective. Wondering if it can only be applied to ILA? If my understanding is correct, the idea of the proposed augmentation is not specifically designed for ILA, and can also be applied to other transfer-based adversarial attacks?\n\nWeakness\n1. In figure 1, I see the perturbation generated by ILA+DA is more significant than I-FGSM noise. I assume this is because the human vision is not perfectly align with the perturbation budget ϵ = 16/255. If so, maybe it would be convincing to also test on some other perturbation budget pattern (eg, under L2 norm metric) that might align better with human vision.\n2. Writing: although this paper is easy to follow, I think readers may misunderstand that the improvement is trivial because both ILA and DA improve the transferability. Actually, I think the data augmentation is interesting and can be applied to other frameworks as well. It could be helpful if the authors can write more interesting findings and insights.\n", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}]

Author rebuttal:

Decision: Accept: poster