Enhancing Transferable Adversarial Attacks on Vision Transformers through Gradient Normalization Scaling and High-Frequency Adaptation
Authors: Zhiyu Zhu
Xinyi Wang
Zhibo Jin
Jiayu Zhang
Huaming Chen
Venue: ICLR 2024 poster (2024)
Keywords: Adversarial attack
transferability
Vit
transformer
Primary area: societal considerations including fairness, safety, privacy

Abstract: Vision Transformers (ViTs) have been widely used in various domains. Similar to Convolutional Neural Networks (CNNs), ViTs are prone to the impacts of adversarial samples, raising security concerns in real-world applications. As one of the most effective black-box attack methods, transferable attacks can generate adversarial samples on surrogate models to directly attack the target model without accessing the parameters. However, due to the distinct internal structures of ViTs and CNNs, adversarial samples constructed by traditional transferable attack methods may not be applicable to ViTs. Therefore, it is imperative to propose more effective transferability attack methods to unveil latent vulnerabilities in ViTs. Existing methods have found that applying gradient regularization to extreme gradients across different functional regions in the transformer structure can enhance sample transferability. However, in practice, substantial gradient disparities exist even within the same functional region across different layers. Furthermore, we find that mild gradients therein are the main culprits behind reduced transferability. In this paper, we introduce a novel Gradient Normalization Scaling method for fine-grained gradient editing to enhance the transferability of adversarial attacks on ViTs. More importantly, we highlight that ViTs, unlike traditional CNNs, exhibit distinct attention regions in the frequency domain. Leveraging this insight, we delve into exploring the frequency domain to further enhance the algorithm's transferability. Through extensive experimentation on various ViT variants and traditional CNN models, we substantiate that the new approach achieves state-of-the-art performance, with an average performance improvement of 33.54\% and 42.05\% on ViT and CNN models, respectively. Our code is available at: https://github.com/LMBTough/GNS-HFA.

Published as a conference paper at ICLR 2024
ENHANCING TRANSFERABLE ADVERSARIAL AT- TACKS ON VISION TRANSFORMERS THROUGH GRADIENT NORMALIZATION SCALING AND HIGH- FREQUENCY ADAPTATION
Zhiyu Zhu', Xinyi Wang", Zhibo Jin',, Jiayu Zhang' & Huaming Chen University of Sydney', Universiti Malaya', SuZhou Yierqi²
ABSTRACT
Vision Transformers (ViTs) have been widely used in various domains. Similar to Convolutional Neural Networks (CNNs), ViTs are prone to the impacts of ad- versarial samples, raising security concerns in real-world applications. As one of the most effective black-box attack methods, transferable attacks can gener- ate adversarial samples on surrogate models to directly attack the target model without accessing the parameters. However, due to the distinct internal struc- tures of ViTs and CNNs, adversarial samples constructed by traditional transfer- able attack methods may not applicable to ViTs. Therefore, it is imperative to propose more effective transferability attack methods to unveil latent vulnerabil- itics in ViTs. Existing methods have found that applying gradient regularization to extreme gradients across different functional regions in the transformer struc- ture can enhance sample transferability. However, in practice, substantial gradient disparities exist
within the same functional region across different layers. Furthermore, we find that mild gradients therein are the main culprits behind re- duced transferability. In this paper, we introduce novel Gradient Normalization Scaling method for fine-grained gradient editing to enhance the transferability of adversarial attacks on ViTs. More importantly, we highlight that ViTs, un- like traditional CNNs, exhibit distinct attention regions in the frequency domain. Leveraging this insight, we delve into exploring the frequency domain to further enhance the algorithm's 's transferability. Through extensive experimentation on various VIT variants and traditional CNN models, we substantiate that the new approach achieves state-of-the-art performance, with an average performance im- provement of 33.54% and 42.05% on ViT and CNN models, respectively. Our code is available at: https://gitub..om//LNM LBB.:l/...oo.LM..B.BBBM Tough
INTRODUCTION
Vision Transformers (ViTs) has made significant strides in various domains, including image clas- sification (Chen et al., 2021a), semantic segmentation (Strudel et al. (021), and cross-modal tasks (Frank et al., 2021). However, current research suggests that ViT's are susceptible to adver- sarial samples, resulting in erroneous predictions (Shao et al. 202I). It is noteworthy that exist- ing studies on adversarial attacks primarily for Convolutional Neural Networks (CNNs) (Dong) eet al. 2018 Long et al. 2022 Zhang et al. 2022). and can't yield promising results when applied to VIT's (Bhojanapalli et al. (222). Considering the positive outcomes of adversarial attacks for robust- ness assessment and model defense development, it is imperative to formulate effective adversarial attack methods for detecting vulnerabilities in ViT models in safety-critical applications.
Adversarial attacks are generally categorized as white-box and black-box box attacks (Jin al. 2024). In white-box environment, the attacker has access information about the target model's 's architecture or gradients. Conversely, for black-box attacks, such information is not available, and the attackers can solely rely on the model's inputs and outputs construct adversarial samples. As one of the
"Corresponding author; huaming. @syddcyycdd..uuu

---

Published as a conference paper at ICLR 2024
MEP
gradheets
Sale
Potch anbaedingg
4:
Parb Enteidings
DCZ
IDCT
MLP
V
Model with GNS
Loss Funclion
Bar packproggiioon updale geadienls
Charaal
Wildi
Figure Illustration of our GNS-HFA method. Red links represent gradients backpropagation.
most effective black-box attack methods, transferable adversarial attacks can generate adversarial samples the local proxy model and directly transfer them to attack the target model (Jin et al.) 2023
Zhu et al. 2023 2024). Considering the black-box nature of ViT-based applications, we herein emphasize the black- box attack, in particular transferable adversarial attacks, for ViT models.
However, there are challenges for applying transferable attacks to ViTs. On one hand, due to inherent structural differences between ViTs and traditional CNNs (Wei et al. (022). the attack methods on CNNs (i.e., Spectrum Saliency map-based Attack (SSA) (Long et al. 2022 and Neuron Attribution- based Attack (NAA) (Zhang al. 2022) perform poorly VIT's (see Sec. 5.2). On the other hand, current transferable attacks on ViTs aim to improve the sample transferability by fine-tuning gra- dients and applying gradient regularization within different functional regions of the transformer structure (Zhang et al., 2023 Wei et al., 2022). We observe that, even within the same functional region, there exists a variance the impact of gradients from different channels on sample transfer- ability. In contrast, existing methods focus on an entire functional region, such as entire attention layer or MI.P layer, which results in limited transferability. Specifically, the Token Gradient Reg- ularization method (TGR) (Zhang et al., 2023) regularizes extreme gradients (see Sec. 4.1) within the same layer to enhance transferability. Pay No Attention method (PNA) (Wei et al. 2022) opti-
mizes adversarial samples by discarding certain number of gradients within the same layer. Yet, as different layers capture diverse features and information, regularizing or removing gradients from specific layers may cause significant information loss. Additionally, simply discarding the gradient can make the algorithm more susceptible to data perturbations or noise, impacting attack robustness.
To solve the challenges, in this paper, we present a novel Gradient Normalization Scaling (GNS) method for fine-grei ane-grained gradient editing. Through gradient normalization scaling, we scale mild gradients (see Sec. 4.1) in the backpropagation process to prevent overfitting during the training of adversarial samples. Moreover, inspired by SSA (Long al.) 2022), we observe that ViTs exhibit significant attention to high-frequency features through attribution visualization (Pan et al. 2021 Thus, we propose the High-Frequency Adaptation (HFA) method explore the sensitivity of tiTs adversarial attacks in different frequency regions. Specifically, we construct mask to differentiate between high-frequency and low- low-frequency information, allowing performance in high- high-frequency regions. Fig. presents the structure of our approach. We evaluate the proposed GNS-HFF method on various VIT variants and CNN models. Notably, compared with the taite-of-theaaae methods, approach achieves average improvement of 33 33.54% and 42.05% both on VIT and CNN models. Our contributions in this paper are summarized as follows:
targeted explorations of ViTs'
1. We observe that in the gradient backpropagation, mild gradients have significant impact sam- ple transferability. By accurately normalizing and scaling the identified mild gradients, we alleviate overfitting caused by gradient variations during the backpropagation process.
2

---

Published as a conference paper at ICLR 2024
2. Noting the phenomenon that ViTs pay attention to high frequency regions, we propose the fehhfrrquency adaptation method to stabilize the gradient update direction.
3. We present novel Gradient Normalization Scaling and High-Frequency Adaptation(GNS-HHe method to enhance the transferability of adversarial samples on ViTs.
4. We conduct extensive experiments to showease the superiority of our approach compared state- of-the-art transferable attacks on various ViT's and CNN models, achieving an average improvement of 33.54% and 42.05%. We also release the replication package of our GNS-HFA.
RELATED WORK
2.1 VISION TRANSFORMER
Vision Transformer (ViT) (Dosovitskiy et al. 2020 is type of deep neural network architecture based on self-attention, initially used in natural language processing but now widely applied in com- puter vision. Compared traditional CNNs and RNNs, it offers higher representational capacity and fewer disual-specifie biases, showing similar or superior performance in visual benchmarks (Han ct al. 2022). This has led the proposal of numerous ViT models.
ViT-B/16 (Dosovitskiy et al. 2020) is tailored for image classification, processing images in fixed- size blocks as sequential inputs. PiT-B (Heo et al. 202 employs pooling to enhance its capability, reducing spatial dimensions while increasing channel dimensions for improved information process- ing. CaiT-S/24 (Touvron et al., 202 deepens the Transformer and introduces classification labels for enhanced image classification performance. Visformer-S (Chen et al., (02 transforms the Transformer into a convolution-basee model, combining the advantages of both. DeiT-B (Touvron et al. 2021a) is another Transformer-basee model for image classification, effectively processing image data for improved performance. TNT-S (Han et al.) (002)) utilizes 'cross-shaped window self- attention' for efficient analysis of different image parts, enabling quick processing of large-scale images while maintaining high performance. ViVi-2256 (Graham et al. (021) is lightweight ViT with high classification accuracy and lower computational costs, ideal for resource-cone consurradd en- vironments. Con ViT-B (d' Ascoli et al. [021) combines convolution and Transformer strengths for image classification, employing a hybrid model structure achieve improved performance.
2.2 TRANSFERABLE BLACK-BOX ADVERSARIAL ATTACKS
Currently, transferable black-box adversarial attacks can be categorized into three main groups: feature-level attack methods, input transformation methods, and advanced gradient methods. Feature-level attack methods such as Neuron Attribution-base
Attack (NAA) (Zhang al., 2022), Feature Importance-awar Attack (FIA) (Wang et al. 2021) and Feature Disruptive Attack (FDA) Ganeshan et al. 2019) aim to find accurate estimates the importance of intermediate-layer neurons to perform transferable attacks. Input transformation methods involve transforming input image samples to enhance their transferability. Diverse Input Method (DIM) (Xie et al.) (209 intro- duces multiple randomly generated gradient directions and perturbs the samples along different di- rections to increase the diversity of adversarial samples. Translation Invariant Method (TIM) (Dong al. 2019) introduces translation invariance, generating adversarial samples with similar pertur- bations at different positions and scales. Since numerous studies have underscored the substantial correlation between DNNs and the frequency domain (Wang et al. 2020) Guo al. 2018 Yin et al. 2019), Spectrum Saliency Attack (SSA) (Long et al.] (202) explores the impact of gradients on DNNs the frequency domain to craft more transterable samples, addressing the limitations associated with spatial domain-only model augmentation.
Unlike input transformation methods and feature-level attack methods, gradient based methods enhance sample transferability by employing gradient update techniques. Momentum Iterative Method (MIM) (Dong et al.) 2018) introduces momentum to stabilize the gradient update direc- tion during iterative perturbation updates. Scale Invariance and Nesterov Iterative Method (SINI- FGSM) (Lin et al. 2019) utilize the Nesterov accelerated gradient technique to update perturbations while incorporating a invee-iivariatt attack approach to effectively target images with diverse scales. TGR (Zhang et al. 2023) and PNA (Wei et al. 2022) scale or remove gradients from the same layer to assess the transferability of adversarial samples VIT models. However, both TGR and PNA
3

---

Published as a conference paper at ICLR 2024
have shorteomings in accurately locating and regularizing the gradients which may lead to overfit- ting during the backpropagation process.
3 PRELIMINARIES
3.1 PROBLEM DEFINITION OF TRANSFERABLE ATTACKS
Given the source model fe. the initial sample z, and the target class y, in adversarial attacks, the goal is to discover perturbation 17" that maximizes the objective function L (fo(æ + n)) y). while satisfying the constraint ||z/|p I c. is essential to regulate the magnitude of the perturbation to prevent noticeable visual distortions resulting from adversarial manipulations. To achieve this, we apply constraints on the perturbation using Lp norms. Here, c is predefined upper bound representing the maximum perturbation size. Consequently, our attack objective be expressed as an optimization problem in Eq.
1 arg maxt (fo + m) s.t. |nlle Sc
(2) In the context of transferable attacks, as illustrated in Eq. once the perturbation rate 17" is deter- mined through Eq. [ our objective is to introduce perturbations generated on fo to magnify the loss functions of other black-box models. It's important to emphasize that the fo, in E is not equiv- alent to the in Eq. [ While these variables share similar goals, they possess distinct underlying structures. More specifically, we generate adversarial samples on the surrogate model denoted as fe. aiming execute successful adversarial attacks the black-box models represented by fo, to enhance the transferability of adversarial attacks across all black-bor box models.
max L (fe, (x + 1) M) Se: E [fo Je....., So..
3.2 MULTI-HEAD SELF-ATTENTION IN VITs
In ViT models, the Multi-head Self-Attention mechanism (MSA) allows the model to simultancously attend different parts of the sequence in different representation spaces, thereby improving the model's performance (Dosovitskiy et al. 2020). The key idea is to map the input sequence into multiple distinct subspaces and perform a self-attention operation in each subspaces. This enables the model to extract information from various perspectives or representations and then integrate this information to generate the final output. MSA typically involves the following key steps:
The input sequence is first mapped into multiple subspaces. Each subspace has its own weight matrices, typically denoted as Q (queries), K (keys), and V (values).
Initial projection:
Attention calculation: For each subspace, self-attention calculations are performed. This involves computing similarity scores between queries and keys and using these scores as weights to average the value vectors, resulting in attention outputs for each subspace.
Multi-head combination: The attention outputs from multiple subspaces are combined, often by concatenating adding them along a specific dimension.
Finally, the merged attention outputs are projected again through projection layer to produce the ultimate multi-head self-attention output.
Final projection:
METHOD
4.1 GRADIENT NORMALIZATION SCALING (GNS)
Feasibility of gradient fine-grained editing For CNN models, there exists similarity in fea- tures between the surrogate model and the target model. Leveraging this similarity, we can generate transferable samples from the surrogate model. However, transferable attacks on ViT models often exhibit the phenomenon of overfitting, wherein the attack success rate high on surrogate models but low the target model. TGR (Zhang et al. 2023) argues that such phenomenon is caused by extreme gradients during backward propagation, and removing these extreme gradients can signif- icantly enhance sample transferability. Specifically, extreme gradients are defined tokens whose
4

---

Published as a conference paper at ICLR 2024
backpropagated gradient magnitudes rank in the top-k or bottom-k among all tokens, with is being a hyperparameter. Obviously, the key for the surrogate model to produce transferable samples lies in those relatively large gradients. Therefore, if these extreme gradients attack capability of samples will change dramatically. To strike a halance between mitigating over- fitring and retaining attack capability, TGR directly sets unwanted extreme gradients to zero, which diminishes the involvement of gradients that possess attack capability. In this paper, we find that the extreme gradients in TGR are not the main culprits behind reduced transferability. Instead, as shown in Fig. 3] the occurrence of overfitting primarily resides in relatively small gradients (Further discussed in Appendix). These gradients, which we term as mild gradients, have minimal impact on attack capability. Therefore, they can be extensively scaled.
scaled or clipped, the
Also, an intuitive explanation of why mild gradients are more likely to cause overfitting that, due to the differing internal structures of ViTs and CNNs, ViT' employ self-attention mechanisms to capture both global and local information in images. This mechanism renders the model highly sensitive to subtle perturbation in inputs during the generation of adversarial samples. If gradients are too small, the update step is relatively small, making the model excessively sensitive to small changes in the training data, thus making overfitting more likely and affecting the quality of locally trained adversarial samples. On the other hand, for deeper ViT models, mild gradients may also contribute the vanishing gradient problem, preventing effective updates to the lower-level attention mechanisms and thereby affecting the training process of adversarial samples.
Precise scaling of mild gradients In VITs, the primary mechanism for handling features is the Multi-head Self-Attention structure. We perform fine-grained editing on the gradient information produced by the key parameters in the MSA structure, namely W W* and WV is worth noting that gradient information has the same dimensionality as the parameters. We can decompose the gradients into G {91: 92- ........... to the number of channels in the convolution kernel the number of multi-head attention), and it can be considered that each channel is independent (Zhang et al. 2023). Since the sign information can only represent the direction in the gradient, and does not determine the size of the gradient itself, we use the absolute value to ignore the directional information. To accurately identify the gradients to be scaled, we compute the absolute mean of the gradients for each channel, as shown in Eq.
where C represents the number of channels (corresponding Ic), Jc))
9ahe menn = P2, Me
= (abs((ass(p)) mean(abs(gz)),, ... meean (abs (9c)) ]
Here, abs(.) represents the absolute value. Then, we identify the channel that requires scaling:
index = :l: μ < p
(4)
We define gradients with magnitudes less than μ u a as mild gradients. Where μ represents the average value across C' channels. represents the standard deviation across C' channels, and the hyperparameter denotes the allowed deviation level. By adjusting the hyperparameter u, we can correspondingly adjust the range of mild gradients. It's worth noting that our ablation experiments prove that the choice of u is very general, and in most cases, excellent results can be achieved without the need for hyperparameter adjustment.
To distinguish which gradients in a chosen channel require scaling, we compute the deviation abs( == from the mean gradient for mild gradients. Scaling, as described in Eq. 5 is necessary due to the susceptibility of mild gradients to overfitting.
9t gi tanh
(abs
(1-- H1)
91
(5)
here we employ the tanh activation function to map deviation values. If gradient information ex- hibits significant deviation, then the relatively large gradients play a crucial role in attack capability and should not be removed. Therefore, using fanh activation function allows for the adaptive scaling of gradients. Alg. [ shows the specific process of our GNS method.
4.2 HIGH- FREQUENR ADAPTATION (HFA)
Exploring high-frequency features through masking Inspired by SSA (Long et al. 2022). in order further enhance the transferability of adversarial samples on ViTs, we employ frequency
5

---

Published as a conference paper at ICLR 2024
Algorithm GNS method
1: Input: gradient set G, deviation level u
2: G= [= 91.99." ... .9C
3: Jabs mean M1.H2. ... Pe | mean(abs(g1)), mean(abs(g2)), mean (abs (gc)) ]
4: μ mean mean(9abs.mean)
5: σ = std((aab.meann)
6: index
{1: 14
u+
7: for in index do
8: 91 = 9r tanh (abs (
9: end for
return G
Original
(b) Cai2-S/24 (c) ResNet-101
Eyperaraneer
Figure 2: Attribution visualization (Pan et al.,
Performances of removing mild gra- dients and extreme gradients on ViT-B/16
Figure 3:
2021 for different models frequency domain
exploration optimize the gradient update direction in ViTs. As shown in Fig. observe that, compared to traditional CNN models, ViTs tend to focus more on Therefore, need conduct targeted explorations of ViTs in high-frequency regions.
features.
(
(M+2)
maski
0,1,, mask E WWxHHS
(6)
W
1 = IDCT (DCT(++ (N ) N * mask)
(7)
In the frequency representation of the image, features near the top-left corner represent low- frequency features, while features near the bottom-right corner represent high-frequency features. In order to distinguish image features different frequency regions, as shown Eq. [6] we con- struct mask and adjust the frequency exploration level based different coordinate points. Here i = 0, ...,, W height of the image. As shown in Eq. 7 after multiplying with the corresponding noise, obtain the expression of the features the frequency domain. DCT represents the discrete cosine transforma- tion method proposed by Ahmed et al. (Ahmed et al. 1974). which is general method for frequency transformation. represents the perturbation magnitude. It is worth noting that if the original model has limited high-frequency information, the frequency exploration through multiplication may be- come ineffective. In such cases, it becomes necessary to introduce basic sigh-frequency information by adding and normalizing additional noise N(0 1) 255
= 0, 1.... , H. The image is 3-channel, where W and represent the width and
Transferable attack direction adaptation In Eq. g multiple frequency features generate more transferable gradient update direction when computed using the GNS-trained model for 0L(2) day
P. ØL (x5:1) Ox
(8)
x' 11 sign
Σ P
N
should be noted that we randomly select backpropagation frequency gradients and employ their average value update the adversarial sample in the current iteration. P. represents the gradients of the eeN-ntriined model relative to the frequency features zy. y represents the original label. represents the learning rate. Here sign(.) determines the gradient update direction. HFA utilizes

---

Published as a conference paper at ICLR 2024
Algorithm 2 HIA method
1: Input: input feature 2, number of frequency samples explored N, perturbation magnitude learning rate 7) number of iterations T
W41 (42)
2: mask
k == =,0,12
mask E RW*Hx3
WXH
3: xº
4: for in range(T) do
5: for in (ange(N) do
6:
J. TDCT (DCT(x* N(O, -555)) ((1,)) mask)
++1
p!+ aL (x
using the GNS-trained model to calculate OL(1))
7:
057
8: end for
x 1+1 x² + 1 sign (+ E p.t1)
9:
10: end for
return 2+11
the gleaned high-frequency information to adjust the update process of adversarial samples. This ensures that the generated adversarial examples better conform the ViTs structure, thus can more stably cross the decision boundaries of target models. Alg. 2 shows the specific process of HFA.
EXPERIMENTS
In this section, we conduct our experimental setup following the literature (hhag et al. 2023) to facilitate fair comparison of various attack methods. Extensive analyses are performed on both VIT and CNN models. The details of our experimental setup are as follows.
5.1 EXPERIMENTAL SETUP
Baselines: Nine methods are selected as competitive baselines in this experiment, among which two transferable adversarial attack methods, TGR (Zhang et al.] 2023) and PNA (Wei et al. 2022). are developed specifically for ViT model advancements. The remaining methods, SSA (Long al.)
2022), BIM (Kurakin et al. 2018), PGD (Madry et al. 2017). DI-FGSM (Xie et al. 2019), TT- FGSM (Dong al. 2019), MI-FGSM (Dong al. 2018). and SINI-FGSM (Lin et al. 2019).
optimized for CNN models. TGR chosen as the primary competitive baseline against our method.
In this experiment, we employ dataset that is entirely consistent with our primary com- petitive baseline, TGR (Zhang et al. 2023), and currently the best-performing transferable attack method CNNs, SSA (Long et al.] (022). This dataset comprised randomly selected 1000 images from the ILSVRC 2012 validation set (Russakovsky et al. 2015).
Dataset:
Models: In this experiment, substantial number of models selected to align completely with TGR, encompassing eight VIT models and seven CNN models. The ViT models included Le VTT- 256 (Graham et al. [202]) PiT-B (Heo et al. (202)) DeiT-B (Touvron et al. (2021a), ViT-B/16 (Doso- vitskiy et al. 20200. TNT-S (Han et al. 2022 ViTViT-B (d' d'cooili et al. 2021). Visformer-S (Chen al. 202 and CaiT-S/24 (Touvron al. 202Tb). Among them, ViT-B/16. Visformer-S, PÝT-
B, and S/24 are used as surrogate models to train transferable samples. The CNN models are Inception-và (Inc-v3) (Szegedy al. 2016), Inception-ve v4 (Inc-v4) (Szegedy et al. 2017]. Inception- ResNet-v2 (IncRes-v2) (Szegedy et 2017), and ResNet-101 He et al. (2116). Additionally. three models with enhanced adversarial robustness through ensemble training are selected: the ensem- ble of three adversarial trained Inception-v3 (Ine-v3-adv-3) (Tramer et al.) (0077), the ensemble of four adversarial trained Inception-v3 (Inc-v3-adv-4) (Tramèr et al. 2017). ) and Inception- Resnet-v2 (IncRes-v2-adv) (Kurakin et al. 2016).
We choose to employ the Attack Success Rate (ASR) as the evaluation metric for different attack methods. ASR calculates the proportion of samples in the dataset for which the adversarial attack method successfully misleads the model into classifying them incorrectly. Therefore, higher ASR value indicates stronger attack capability of the method.
Evaluation Metrics:

---

Published as a conference paper at ICLR 2024
Table 1: ASR on ViT and CNN Models. The table includes various adversarial attacks on different surrogate models including ViT and CNN architectures. The best results are in bold (%).
Samgaic
Methed
LeW12-235
FYE-8
DallsB
WEBGS
TNS-5
CosVillS
Valoman
Iac.e3
Teckes
Rechit
1nc-05
1as05
Taclos
TUBL
03.00%
35.15 15.1/4
19.00%
09.00
91.47%
15,475
60.50%
09.00%
55, 13.40%
50.00%
45.215
51.355
35.80%
38-475
33.20%
PNA
72-32%
94.559
91.0%%
11,395
43.02%
71 11.35%
37.40%
33,075
313875
24.35%
23.475
$7.395
RIM
14.30%
8896
56.16
100009
34-066
15.095
16.31%
48200
101006
10.03
18.9%
7.975
5.90%
3.49%
VIT-2016
DE FGSM
34.10%
97 505
55.00%
00.33 03.5%
49.00
19.075
57.50%
56 109
29 93.906
50.09%
15.0%%
35.00 55.995
23.00%
31.87%
17.055
16 116
79.07
07.879
106
11.07%
25.31G
91 505
18
18.039
13.87%
16.995
15.89
17.81%
FOSM
457099
39 006
75.30%
100,095
65 13.50%
76. 13.995
45.000
77 07.00
55 0060
44.85%
16.3%%
43 1060
36.506
56.50%
311055
CNS-RDA (Dkm))
76,91
76.0%
$3.00%
17.60%
73.77%
92.435
67.38%
64.10%
21.655
63.18%
$1,91%
55.3055
41.37%
TGR
70.10%
01.50%
66.32%
43.55%
73,35%
53,099
300,0755
07.85%
36.30%
73.59%
65.305
71,47
43.50%
38,975
23,9975
SSA
106
1055
71-9955
30%
11/6
76.22
31.00
97%
RIM
34 505
10.0%%
5.855
16.79%
10- 00-00
16 1775
14 08.8755
19 03135
13.9%%
15 100
1.0%%
6.005
7.0%
PGDD
306
103/3
222 22205
00-95 00-005
11/6
1995
70 13539
11 11.0%
[7 202
1.05
1000
35,075
11.49%
TI RO-SS
36 135
1955
18802
76/005
04.00%
794 3775
74 13.605
55.000
19.75
19 10:
15505
43.59%
51.375
11.000
003326
-1.50%%
44.00%
43.22%
2/200
-1275
15.2%
SINE
CIN IIFA (DNnS)
02.355
11.05
$0.M15
59.6%
100 1075
01.205
06.3015
45.005
02334%
14/055
$5.40%
TGR
100009
65.20%
65.4%%
56.50%
42.90%
73.594
51.10
51,579
43.305
SSA
64.209
16.485
67.00%
06 00/
633755
66.55
15.35
S1MB5
+4.00
$13875
PNA
51.01
2552
15
55.33
51 4075
47.82%
11215
11 11:0:
22:35
12,60%
10000%
5.0%
RTB
RGD
12.00%
09
21.87%
11.0%
1885
21107
56. 10.10%
134455
34.30%
36.55
25, 25.80%
11 11.395
31.675
14.955
13008
33,99
1195
13.05
11995
12:09
1545
13:455
3-15
MEJEESM
26 115
1000975
54.75
22.44
15:381
44.50%
31 31-196
25 23.555
35.13%
31105
16 14:05
15.31%
SINLFOSM
52.00%
61.30%
33.3544
27.10
46.39%
2119%
1110%
CIS- (D6P))
SUAFS
$7.505
35,915
92.8%
75.875
1530%
TUR
27:075
31.30%
3500875
05.04%
01.22%
77 77.59%
58.056
$3359
41.00
07.
13,05
71.05
08
(6.35%
611
PSA
$3.8/
12.30%
65477
11:355
50.57%
96. 12/5
41.21%
45.43%
41:305
4450%
51.89
2:335
21
C27
DEFGSM
PGID
25.1596
01307
01.30 3/3
23,6PF
67:85
15.32%
6335%
36.39
-310%
7540%
$4.305
64.80%
19. 45/
33:075
$1.10%
51.29%
46395
15,355
15.375
43.45
54.09
1.375
33.375
1500
213355
4334
MI-FESM
54.37%
T1/
M0.35
15.005
988
43.00%
15.975
443355
31.35%
33.05
213375
SINI FOSM
80%
02.3%%
72.5%
82.500
93 105
1000005
53-5066
00.439
47/07%
$8.009
16.91%
Table 2: Performance comparison of VIT and CNN models with different u
ViT
CNN
LeViT 256
DelE
VIT B/16
TNTS
ConVil
Vistormer 5
Call 5/24
V3
Inc
Inciees
-v2
RenNet
-101
-adr-33
Inc-c3
-tal-4
Inc-933
-V2oady
IncRes
-1
75.50%
09.90%%
91.30%
99.70%
85.97%
91.90%
71.50%%
91.77%
65.55A
51.1095
56.80%
61.8075
55.30%
53.10%
45.30%
-0.6
44.40%
69.40%
91 9190%%
99.875
85.505
92.20P
71.27%
91. 105
66.004
62.20%
57. 17.37%
61.50 01:9975
52.80%
53. 375
46.20%
20.5
40.40%
10.10%
02: 57F
09:875
85.975
91. 71770P
71.675
91.29%
66. 41
62. 10.09
57 17.975
61 19.997
54.00%
53. 51.2996
45.80%
-0.
74.405
70.30%
02: 57F
99 00.9
86.706
92 APFS
21.209
93.09%
66.077%
62.509
57 77.975
61. 5.55
54.00%
$4.2095
47.30%
-0.2
74.50%
70.00%
02: 22.70PS
90:905
87 10%
92.107
72.375
92.30%
66.80%
64.305
59 20.275
62.209
53.50%
54.70%
47.50%
0
70.30%
02 42-4
90.905
87.60%
92.30'5
72,0075
10%
67.90%%
63.306
59 10%
62.50 12.90%
52.90%
$4.30%
47.30%
0.2
76.00%
70.50%
02:70/%
99.90%
87.70%
93.20/6
72.90%
92.30%
67.80%%
64.10%
5%. 13.207
63. 5..50%
53.50S
54.50%
47.50%
0.4
40%
50.70%
93.20P%
99 9175
85.209
92.90P
73.00%
91.0%%
67 81Ps
58 8mm
60. 1999
53.90%
$4 7976
47.0056
06
99 9078
85.005
93.10%
72.8076
58 9i5
0.8
75.00%
49 60%
30P
99 9078
93.10%
73.5076
92.9
67. 209
0099
10%0
75.70%
70.30%
93. 10%
90 0079
92.60'
74.107%
92. 02.30%
68. 30%
63.005
905
63.00%
54.50%
90.
47.50%
Parameter Setting: We set the allowed deviation level to 1, the number of frequency samples explored N to 20, the number of iterations T to 10, and the perturbation magnitude e to 16. Further- more, normalize the perturbation magnitude by e/255.
5.2 EXPERIMENTAL RESULT
As shown in Tab. I our method outperforms the existing methods both on ViT and CNN models. Specifically, our method demonstrated an overall improvement of 57.80% compared to all compet- itive baselines. In detail, it exhibited 33.54% average improvement on ViT models and 42.05% average improvement on CNN models. In comparison to the primary competing model TGR, our method exhibited average improvement of 15.04%, with a 9. 9.72% improvement ViT models and a 20.35% improvement on CNN models. When compared to the best bert-performing transferable attack method SSA on CNNs, our method demonstrated an average improvement of 12.32%, with 13.94% improvement on ViT models and a 10.71% % improvement on CNN models.
5.3 ABLATION STUDY
The effect of parameter u on GNS-HEA In the experiment, we fixed N at 20 and e at 16. The parameter was systematically varied within the range of -1 to 1, with increments of 0.2. It is evident in Tab. 2 that as u approaches 1, GNS-HFA has an optimal performance. Nevertheless, is worth noting that the overall impact on GNS-HFA's performance remains relatively modest.
8

---

Published as a conference paper at ICLR 2024
Table Performance comparison of VIT and CNN models with different N
VIT
CNN
LeVi 256
PTB
DefT B
VT Bri6
TNTS
ConVI
Vistomerr
Call S/24
Isc x3
Inc xi
Inckes -12
ResNet
-101
-ads-3
Ine-53
-adv-4
Inc-v3
-V/vadv
IncRes
75.20/6
69.20%
92.10%
59,805
N7.207%
92.50%
72.20%
92.209%
66.80%
62.4775
58.709%
61.30%
53,309
53.505
45.50%
76.9016
70.10%
93.90%
59.907
87.507%
92.80%
72.50%
92.50%
67.20k6
62 62.705
58.8078
61.80%
54,00%
54.10%
46.0015
75.0015
70.20%
93,709
59.907
85. 0076
92.7005
73.20%
92. 42.60%
67.20%
64.30%
59,307
62.70%
54.309
54.70%
47.4016
20
70.3015
70.10%
93,50%
99.90%
88.00%
92.9995
73.70%
92.80%%
68.00%
63.40%
59.10%
03.00%
54,90%
54.50%
47.9016
Table 4: Performance comparison of ViT and CNN models with different e
CNN
LeViT 256
Dell
VIT B/16
INT
ConVIT B
Visfomeer
Cull S/24
Isc
Inc
Incites
Ren-eet
-ath-3
Inc.v3
-3dh-4
Inc-r3
-V2-ady
IncRes
40.90%
30.20%
66. 66.30%
07.90%
50.417
65.00%
40.40%
67.90%
35.80%
32.4295
27.70%
32, 805
25.209
24,00%
20.505
76.301
70.109
93. 63.50%
99,909
13.79%
92,909
85.007%
92.80%
68.001
63. 43.4
59.10%
63.00%
54,908
$4.50%
47.90%
24
$9.0016
83. 2099
97.90%
100,009
97.405 4376
97,809
87.88 80.5
85.40%
$2.40%
81 2395
76.60%
90,035
70.70%
70.90%
63.50%
32
94.5015
90.80%
98.701
100,005
97.80%
99,40%
98,00%
93.40%
88.90%
36.60%
85,10%
86.10%
81,30%
79.00%
74.70%
We find that, regardless of the value of u, removing mild gradients always has higher attack success rate than removing extreme gradients. This means that removing mild gradients can remediate the overfitting concern when the local surrogate VIT model trains adversarial examples, leading the enhancement of the transferability of adversarial examples. Therefore, in this work, we consider mild gradients exhibit a stronger correlation and have thus helped to improve the transferable adversarial attack success rate against the VIT models.
The effect of parameter N on GNS-HEA this experiment, we u to and to 16, and varied N at values of 5, 10, 15, and 20. As shown in Tab. 3 the performance of GNS-HFA consistently improves while N increases. Notably, the optimal performance achieved when N is 20.
(a) Original
(b) c
(c) c 16
(d) E 24
(c) = 32
Figure 4: Adversarial attack sample at different
The effect of parameter on GNS-HFA the experiment, we set u to 1 and to 20. We change the value of 16, 24, and 32. can be observed that with the increase of e, there is significant improvement in the performance of GNS-HFA, particularly evident in the ViT model, where the ASR surpasses 90% when e set 32. However, this could attributed an excessive level of perturbation on the images. In Fig. 4 it is evident that as increases, the perturbation on the images becomes more pronounced. Nevertheless, at of 16, the perturbation remains relatively inconspicu- ous while still achieving comparatively effective adversarial attack. Hence, the selection of can be customized for specific real-world requirements for varying degrees of attack effectiveness.
CONCLUSION
In this paper, we highlight the challenges existing transferable attacks on VITs, particularly in accurately locating and regularizing the gradients that lead to overfitting during the backpropagation process. Therefore, we present the Gradient Normalization Scaling and High-Frequency Adapta- tion method (GNS-HFA) method for fine-grained gradient editing and transferable attack direction adaptation, which significantly enhances the transferability of adversarial samples on ViTs. Exten- sive experiments conducted various ViT variants and conventional CNN models demonstrate the superiority of our approach. We anticipate that this work could shed some light in this direction by providing the replication package publicly.

---

Published as a conference paper at ICLR 2024
REFERENCES
Nasir Ahmed, T. Natarajan, and Kamisetty R Rao. Discrete cosine transform. IEEE transactions on Computers, 100(1):90-99) 93, 1974.
Srinadh Bhojanapalli, Ayan Chakrabarti, Daniel Glasner, Daliang Li, Thomas Unterthiner, and An- dreas Veit. Understanding robustness of transformers for image classification. In Proceedings of the JEEE/CVF international conference on computer vision, pp. 10231-10241, 2021.
Chun-Fu Richard Chen, Quanfu Fan, and Rameswar Panda. Crossvit: Cross-attention multi-scale vision transformer for image classification. In Proceedings of the IEEE/CVF international con- ference computer vision, pp. 357-366, 2021a.
Zhengsu Chen, Lingxi Xie, Jianwei Niu, Xuefeng Liu, Longhui Wei, and Tian. Visformer: The vision-friendly transformer. In Proceedings of the IEEE/CVF international conference on computer vision, pp. 589-598, 2021b.
Yinpeng Dong, Fangzhou Liao, Tianyu Pang, Hang Su, Jun Thu, Xiaolin Hu, and Jianguo Li. Boost- ing adversarial attacks with momentum. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 9185-9193, 2018.
Yinpeng Dong, Tianyu Pang, Hang Su, and Jun Zhu. Evading defenses to transferable adversar- ial examples by translatonniivvaiiae attacks. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 4312-4321, 2019.
Alexey Dosovitskiy, Lucas Beyer, Alexander Kolesnikov, Dirk Weissenborn, Xiaohua Zhai, Thomas Unterthiner, Mostafa Dehghani, Matthias Minderer, Georg Heigold, Sylvain Gelly, et al. An image is worth 16x16 words: Transformers for image recognition at scale. arXiv preprint arXiv:2010. 11929, 2020.
Stéphane A'cool,,, Hugo Touvron, Matthew L Leavitt, Ari S Morcos, Giulio Biroli, and Levent Improving vision transformers with soft convolutional inductive biases. In Inter- national Conference on Machine Learning, pp. 2286-2299 PMLR, 2021.
Sagun. Convit:
Stella Frank, Emanuele Bugliarello, and Desmond Elliott. laniougend or vision- for-language?
cross-modal influence in multimodal transformers. arXiv preprint arXiv:2109.04444, 2021.
Aditya Ganeshan, Vivek BS, and R Venkatesh Babu. Fda: Feature disruptive attack. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pp. 1069-8079 2019.
Benjamin Graham, Alaaeldin El-Nouby, Hugo Touvron, Pierre Stock, Armand Joulin, Hervé Jégou, and Matthijs Douze. Levit: vision transformer convnet's clothing for faster inference. In Proceedings of the IEEE/CVF international conference on computer vision, pp. 12259-12269, 2021.
Chuan Guo, Jared Jared S Frank, and Kilian Q Weinherger. Low frequency adversarial perturbation. arXiv preprint
2018.
Kai Han, An Xiao, Enhua Wu, Jianyuan Guo, Chunjing Xu, and Yunhe Wang. Transformer in transformer. Advances in Neural Information Processing Systems, 14:15908-1500 2021.
Kai Han, Yunhe Wang, Hanting Chen, Xinghao Chen, Jianyuan Guo, Zhenhua Liu, Yehui Tang, An Xiao, Chunjing Xu, Yixing Xu, et al. A survey on vision transformer. IEFE transactions on pattern analysis and machine intelligence, 45(1):87-110, 2022.
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recog- nition. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp- 770-778, 2016.
Byeongho Heo, Sangdoo Yun, Dongyoon Han, Sanghyuk Chun, Junsuk Choe, and Scong Joon Oh. Rethinking spatial dimensions of vision transformers. In Proceedings of the IEEE/CVF International Conference Computer Vision, pp. 11936-11945 2021.
10

---

Published as a conference paper at ICLR 2024
Zhibo Jin, Zhiyu Zhu, Xinyi Wang, Jiayu Zhang, Jun Shen, and Huaming Chen. Danaa: Towards transferable attacks with double adversarial neuron attribution. In International Conference on Advanced Data Mining and Applications, pp. 456-470. Springer, 2023.
Zhibo Jin, Jiayu Zhang, Zhiyu Zhu, and Huaming Chen. Benchmarking transferable adversarial attacks, 2024.
Alexey Kurakin, lan Goodfellow, and Samy Bengio. Adversarial machine learning at scale. arXiv preprint 161i (61.0166,,. 2016.
Alexey Kurakin, Ian J Goodfellow, and Samy Bengio. Adversarial examples in the physical world. In Artificial intelligence safety and security, pp. 99-112. Chapman and Hall/CRC, 2018.
Jiadong Lin, Chuanbiao Song, Kun He, Liwei Wang, and John E Hopcroft. Nesterov accelerated gradient and scale invariance for adversarial attacks. arXiv preprint arXiv: 06281, 2019.
Yuyang Long, Qilong Zhang, Boheng Zeng, Lianli Gao, Xianglong Liu, Jian Zhang, and Jingkuan Song. Frequency domain model augmentation for adversarial attack. In Computer Vision-ECCV 2022: 17th European Conference, Tel Aviv, Israel, October 23-27, 2022, Proceedings, Part IV, pp. 549-566. Springer, 2022.
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. arXiv preprint arXiv:1706.06083 2017.
Deng Pan, Xin Li, and Dongxiao Zhu. Explaining deep neural network models with adversarial gradient integration. In Thirtieth International Joint Conference on Artificial Intelligence (IJCAI), 2021.
Olga Russakovsky, Jia Deng. Hao Su, Jonathan Krause, Sanjeev Satheesh, Sean Ma, Zhiheng Huang, Andrej Karpathy, Aditya Khosla, Michael Bernstein, Alexander C. Berg, and Li Fei-Fei. ImageNet Large Scale Visual Recognition Challenge. International Journal of Computer Vision (IJV), 115(3)221122) 252, 2015. doi: 10. 10.1007/s1 1263-015-0816.y.
Rulin Shao, Zhouxing Shi, Jinfeng Yi, Pin-Yu Yu Chen, and Cho-Jui Hsieh. On the adversarial robust- ness of vision transformers. arXiv preprint arXiv:2 /5670, 2021.
Robin Strudel, Ricardo Garcia, Ivan Laptev, and Cordelia Schmid. Segmenter: Transformer for semantic segmentation. In Proceedings of the IEEE/CVF international conference computer vision, pp. 7262-7272, 2021.
Christian Szegedy, Vincent Vanhoucke, Sergey loffe, Jon Shlens, and Zbigniew Wojna. Rethink- ing the inception architecture for computer vision. In Proceedings of the IEEE conference computer vision and pallern recognition, pp. 2818-2826 2016.
Christian Szegedy, Sergey loffe, Vincent Vanhoucke, and Alexander Alemi. Inception-v4, inception- resnet and the impact of residual connections on learning. In Proceedings of the AAAI conference on artificial intelligence, volume 31, 2017.
Hugo Touvron, Matthicu Cord, Matthijs Douze, Francisco Massa, Alexandre Sablayrolles, and Hervé Jégou. Training data-efficient image transformers & distillation through attention. In International conference on machine learning, pp. 10347-10357. PMLR, 2021a.
Hugo Touvron, Matthieu Cord, Alexandre Sablayrolles, Gabriel Synnaeve, and Hervé Jégou. Going deeper with image transformers. In Proceedings of the IEEE/CVE international conference on computer vision, pp. 32-42, 2021b.
Florian Tramèr, Alexey Kurakin, Nicolas Papernot, Ian Goodfellow, Dan Boneh, and Patrick Mc- Daniel. Ensemble adversarial training: Attacks and defenses. arXiv preprint arXiv:1705.00 072004, 2017.
Haohan Wang, Xindi Wu, Zeyi Huang, and Eric P Xing. High-frequency component helps explain the generalization of convolutional neural networks. In Proceedings of the IÉEE/CVF conference computer vision and pattern recognition, pp. 8684-8694, 2020.

---

Published as a conference paper at ICLR 2024
Zhibo Wang, Hengchang Guo, Zhifei Zhang, Wenxin Liu, Zhan Qin, and Kui Ren. Feature importance-awwe aware transferable adversarial attacks. In Proceedings of the IEEE/CVE international conference on computer vision, pp. 7639-7648, 2021. 2021.
Zhipeng Wei, Jingjing Chen, Micah Goldblum, Zuxuan Wu, Tom Goldstein, and Yu-Gang Jiang. Towards transferable adversarial attacks on vision transformers. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 36, pp. 2668-266622 2676, 2022.
Cihang Xie, Zhishuai Zhang, Yuyin Zhou, Song Bai, Jianyu Wang. Zhou Ren, and Alan L Yuille. Improving transferability of adversarial examples with input diversity. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pp. 2730-2739, 2019.
Dong Yin, Raphael Gontijo Lopes, Jon Shlens, Ekin Dogus Cubuk, and Justin Gilmer. fourier perspective model robustness in computer vision. Advances in Neural Information Processing Systems, 32, 2019.
Jianping Zhang, Weibin Wu, Jen-tse Huang, Yizhan Huang, Wenxuan Wang, Yuxin Su, and Michael R Lyu. Improving adversarial transferability via neuron attribution-bant based attacks. Pro- ceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 14993- 15002, 2022.
Jianping Zhang, Yizhan Huang, Weibin Wu, and Michael R Lyu. Transferable adversarial attacks vision transformers with token gradient regularization. In Proceedings of the IEEE/CVF Con- ference on Computer Vision and Pattern Recognition, pp. 16415-16424, 2023.
Zhiyu Zhu, Huaming Chen, Jiayu Zhang, Xinyi Wang. Zhibo Jin, Qinghua Lu, Jun Shen, and Kim- Kwang Raymond Choo. Improving adversarial transferability via frequency-base stationary point search. In Proceedings of the 32nd ACM International Conference on Information and Knowledge Management, pp. 3626-3635, 2023.
Zhiyu Zhu, Zhibo Jin, Xinyi Wang, Jiayu Zhang, Huaming Chen, and Kim-Kwand Kim-Kwang Raymond Choo. Rethinking transferable adversarial attacks with double adversarial neuron attribution. 1EEE Transactions on Artificial Intelligence, 1(01):1-11, 2024.
12

---

Published as a conference paper at ICLR 2024
A THE EFFECT OF REMOVING MILD GRADIENTS AND EXTREME GRADIENTS RESPECTIVELY ON THE CAIT-S/24 MODEL
Effect of Method diant Remeval
Remove mil gradients <+o Harrove esdrame gradients
77.25
77.00
Shocecy
76.50
26.25
75.75
75.50
-0.25
0.25
Methodiu
Figure 5: Removing mild gradients and extreme gradients respectively on the CaiT-S/24 model
As shown Fig. 5 constructed the adversarial samples on the CaiT-S/24 model by removing mild gradients and extreme gradients respectively, and calculated the average attack success rate after these adversarial samples were transferred attack other VIT and CNN models. Different hyperparameters in the table adjust the division range of mild gradients. In transferable attacks, the transferability adversarial samples can be largely affected by overfitting during local training. thus showing different attack success rates on the target models. Therefore, we believe that higher average attack success rate represents a lower possibility overfitting.
B THE IMPACT OF GNS AND HFA ON SAMPLE TRANSFERABILITY
Table 5: Ablation study GNS only, HFA only, both used and none used
VIT
CRN
Madred
LaViT-255
715-3
DuT::
VIE-80
Vadieaann
Ca75044
lscnd
IxcRoe12
Recher-10 ID1
Tac-shade-3
Tac ho-t--ah-4
GANUONE
88 90
906
73 9m
89 815
67
27 999
55 83.0%
$1.00
38 199
58
$1305
20TH
76,92
70079
35.
19.00%
9600P
02.909
13.00%
92.9%
55.009
63.00
35,00
05.003
34535
$4.30% 47,005
75.375
We conducted ablation experiments for GNS only or HFA only in Tab. the same parameters in Sec.5.1 of the main paper. The experimental results indicate that, compared attack methods without either GNS or HFA (average success rate of 42.24%), both GNS and HFA play nearly equally crucial roles in enhancing the transferability of adversarial samples (averaging 62.49% and 62.40%, respectively). The strategy to combine GNS and HFA together yields the best algorithm performance (average 73. 73.20%), demonstrating that gradient normalization and scaling for 'mild gradients', coupled with frequency domaann exploration, effectively improve the transferability of adversarial samples. The results of the ablation experiments align with our assumptions regarding the roles played by GNS and HFA.
13


Reviews:
[{"review_id": "AOf4xFJRTb", "reviewer": "Reviewer_98px", "summary": "In this submission, the authors proposed a gradient normalization scaling and high frequency adaptation for vision transformers. Specifically, the authors proposed to improve the generalization ability of ViTs by using gradient normalization. Moreover, the authors proposed a high frequency adaptation approach to guide the back-propagation in ViTs. Experimental results on several public datasets for adversarial attack have illustrated the effectiveness of the proposed method.", "questions": "Please conduct ablation studies using only GNS or HFA to demonstrate the effectiveness of those two methods.", "limitations": "", "rating": 5, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 2, "strengths": "1. The paper is easy to follow.\n2. The idea is well motivated and presented.", "weaknesses": "The contribution is marginal, since the gradient normalization was demonstrated in [1], please discuss the major differences.\n\n[1] Wu, Y. L., Shuai, H. H., Tam, Z. R., & Chiu, H. Y. (2021). Gradient normalization for generative adversarial networks. In Proceedings of the IEEE/CVF International Conference on Computer Vision (pp. 6373-6382).", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "waXh4QqsCg", "reviewer": "Reviewer_6tAt", "summary": "In order to enhance the transferability of adversarial attacks on ViTs, this paper introduces a novel gradient normalization scaling method for fine-grained gradient editing. After calculating the distribution of gradients, tanh is used for scaling the gradients that are considered as prone to cause overfitting and have minimal impact on attack capability. A high frequency adaptation method is proposed to explore the sensitivity of ViTs to adversarial attacks in different frequency regions, on the premise that ViTs shows different attention areas from CNNs in frequency. DCT transformation is conducted to obtain high frequency features, and then reverse transformation is put afterward to feed into the network for backpropagation. From the comparison of Attack Success Rates on ViT and CNN models, this work achieves better performance, enhancing the transferability of adversarial samples on ViTs.", "questions": "1.\tIn your Abstract, after a one-sentence introduction to ViT, quickly talk about enhancing the transferability of adversarial attacks on ViTs is somewhat discontinuous. Adding an introduction to adversarial attacks in between would make it smoother. There are many more logical breaks like this. \n2.\tStructure illustration figure can be more detailed/comprehensible. Figure annotations could provide more explanation. \n3.\tThere should be more explanations about how mild gradients and extreme gradients in Figure 3 react to your specific parameters (briefly introduce u here instead of later), and why mild gradients are the easiest to overfit. Besides, why is µ + u ∗ σ the watershed between mild and extreme gradients? \n4.\tNormalization and scaling seem to be one and the same.\n5.\tGive more arguments for tanh and frequency transformation.\n6.\tGNS-HFA is a combination, so does each part fit your hypothesis? What role do they play? Which one contributes more?", "limitations": "", "rating": 5, "confidence": 3, "soundness": 3, "presentation": 2, "contribution": 2, "strengths": "1. This paper comes up with a novel problem space.\n2. Utilizing normalization, or scaling is innovative.\n3. Achieved better attack transferability performance than SOTA methods.", "weaknesses": "1.\tLack of soundness of mild gradients and extreme gradients.\n2.\tNormalization and scaling process is insufficiently demonstrated.\n3.\tMiss rationale of utilizing high frequency. Is frequency transformation for better ViTs or for better attacks?\n4.\tAblation study is insufficient to evaluate the impact of your two components on the final method performance and verify their importance.\n5.\tSome sentences contain grammatical errors, such as missing subjects.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "VDJXwQfP95", "reviewer": "Reviewer_Qpbi", "summary": "This paper proposes a method to increase the tranferrability of adversarial attacks across Transformer models. The key idea is to attenuate mild gradients and to do frequency adaptive perturbation of the input signal.\n\nAfter rebuttal, I decided to increase my score to reflect the answers.", "questions": "Questions:\n\n1. What are \"strong\" and \"mild\" gradients? These terms are assumed to be understood by the reader, but never explicitly defined. At the least, one would expect some informal definition to give the reader some intuition.\n\n2. The definition of \"channels\" in a Transformer model is unclear. For conv nets, it is obvious what this refers to. It seems to refer to the number of attention heads, but it was not too clear.\n\n3. It is unclear why attentuating certain types of gradients (\"mild\") leads to better transferability. Is there an intuition that the authors can provide for this phenomenon?\n\n4. The HFA method was quite unclear to me (and I guess it will be to many readers). \n\n5. How are the GNS and HFA methods combined?  \n\n6. What exactly do the results in Table 1 show us? Is there one model on which the adversarial attacks were generated, and the remaining were the rates of success?", "limitations": "", "rating": 6, "confidence": 4, "soundness": 2, "presentation": 1, "contribution": 2, "strengths": "The comperhensive numerical results in the paper across a number of architectures and attack methods shows the benefits of the approach, consistently achieving very high transferrability scores. The method itself seems quite simple to implement.", "weaknesses": "This paper was written in a manner which made it very difficult for me to follow the exact approach. I have a number of questions below which I hope the authors will address. I am not up to date on the latest adversarial literature and therefore it may be that I have missed obvious ideas, but nevertheless I think the authors should write the paper for a general ICLR audience rather than adversarial sub-field experts. I am willing to re-visit my rating if the authors can provide satisfactory answers to the questions below, which are mostly to do with the very opaque setup in the paper.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (poster)