Pixel2Feature Attack (P2FA): Rethinking the Perturbed Space to Enhance Adversarial Transferability
Authors: Renpu Liu
Hao Wu
Jiawei Zhang
Xin Cheng
Xiangyang Luo
Bin Ma
Jinwei Wang
Venue: ICML 2025 poster (2025)
Keywords: Transferability
Adversarial Example
AI Security
Primary area: deep_learning->robustness
TL;DR: We shift the perturbation from pixel space to feature space and perturb important features multiple times along the direction of feature importance within the feature space.

Abstract: Adversarial examples have been shown to deceive Deep Neural Networks (DNNs), raising widespread concerns about this security threat. More seriously, as different DNN models share critical features, feature-level attacks can generate transferable adversarial examples, thereby deceiving black-box models in real-world scenarios. Nevertheless, we have theoretically discovered the principle behind the limited transferability of existing feature-level attacks: Their attack effectiveness is essentially equivalent to perturbing features in one step along the direction of feature importance in the feature space, despite performing multiple perturbations in the pixel space. This finding indicates that existing feature-level attacks are inefficient in disrupting features through multiple pixel-space perturbations. To address this problem, we propose a P2FA that efficiently perturbs features multiple times. Specifically, we directly shift the perturbed space from pixel to feature space. Then, we perturb the features multiple times rather than just once in the feature space with the guidance of feature importance to enhance the efficiency of disrupting critical shared features. Finally, we invert the perturbed features to the pixels to generate more transferable adversarial examples. Numerous experimental results strongly demonstrate the superior transferability of P2FA over State-Of-The-Art (SOTA) attacks.

Pixel2Feature Attack (P2FA): Rethinking the Perturbed Space to Enhance Adversarial Transferability
Renpu Liu 1
Hao Wu
Jiawei Zhang²
Xin Cheng'
Xiangyang Luo?
Bin Ma
Jinwei Wang"
Abstract
Adversarial examples have been shown de- ceive Deep Neural Networks (DNNs), raising widespread concerns about this security threat. More seriously, as different DNN models share critical features, feature-level attacks can gener- ate transferable adversarial examples, thereby de- ceiving black-box models real-world scenarios. Nevertheless, have theoretically discovered the principle behind the limited transferability of existing feature-level attacks: Their attack effec- tiveness is essentially equivalent to perturbing fea- tures in one step along the direction of feature importance the feature space, despite perform- ing multiple perturbations the pixel space. This finding indicates that existing feature-level attacks are inefficient in disrupting features through mul- tiple pixel-space perturbations. To address this problem, we propose P2FA that efficiently per- turbs features multiple times. Specifically, we directly shift the perturbed space from pixel to feature space. Then, we perturb the features mul- tiple times rather than just once in the feature space with the guidance of feature importance enhance the efficiency of disrupting critical shared features. Finally, we invert the perturbed features to the pixels to generate more transferable adver- sarial examples. Numerous experimental results strongly demonstrate the superior transferability of P2FA over Ofate-Of-The-AAe (SOTA) attacks.
Original image
FIA
RPA
DANAA
SFVA
BFA
Ours
Figure I. Comparison of existing fcature-level attacks (FIA (Wang et al., 2021), RPA (Zhang et al., 2022b). NAA (Zhang et al., 2022a). DANAA (Jin et al., 2023), SFVA (Ren et al.. 2023), and BFA (Wang al., 2024b)) and our attack. Adversarial examples are generated on the source model (ResNct-152) (He et al., 201 6a) to attack the target model (ResNet-50) (He et al., 2016a). Our attack keeps models from capturing important features of the object and focusing on entirely irrelevant regions instead, while existing feature-level attacks make models still focus object-related areas.
1. Introduction
DNNs have achieved significant success in various machine learning tasks (Girshick, 2015; He et al., 2016b; Krizhevsky et al., 2012). However, DNNs are vulnerable to adversar- ial examples (Szegedy, 2013), which add elaborate and imperceptible perturbations to original images to mislead DNNs. The existence of adversarial examples has raised concerns about the security of sensitive applications, such as autonomous driving and face recognition. Research on adversarial examples not only enhances the understanding of their underlying principles and the drawbacks of DNNs, but also contributes to improving the adversarial robustness of DNNs (Goodfellow et al., 2014), ensuring their stability and accuracy in diverse application scenarios.
'quual contribution 'School of Computer Science, Nanjing Uni- versity of Information Science and Technology, Nanjing, China State Key Laboratory of Mathematical Engineering and Ad- vanced Computing, Zhengzhou, China "School of Cyber Secu- rity and Information Law, Chongqing University of Posts and Teleconmunications, Chongqing, China "School of Cyber Se- curity, Qilu University of Technology (Shandong Academy of Sciences), Shandong. China 'College of Cryptology and Cyber Science, Nankai University, Tianjing, China. Correspondence to: Jinwei Wang 2004 oxy_icu sin..com>.
Numerous adversarial attacks (Carlini & Wagner, 2017: Xiao et al., 2018; Xie et al., 2019) have been proposed to generate ad adversarial examples, which are typically catego- rized into two types based on the attacker's knowledge of the target model: white-box attacks and black- box attacks. White-box attacks imply that the attacker has full access
2004@ 163 63mcom Xiangyang Luo <lu-
Proceedings of the ndnd International Conference Machine Learning. Vancouver, Canada. PMLR 267, 2025. Copyright 2025 by the author(s).

---

Pixel2Feature Attack (P2FA): Rethinking the Perturbed Space to Enhance Adversarial Transferability
to the knowledge of the target model (e.g., structure and parameters) to generate adversarial examples via gradient information. In contrast, in black-box attacks, the attacker attacks only through the inputs and outputs of the target model without detailed information about the internal struc- ture, parameters, training data, and so on, which makes black-box attacks more challenging and realistic. Therefore, we focus on black-box attacks in this work.
importance using Combined Feature Enhancement Trans- formation (CFET). BFA (Wang al., 2024b) categorizes image features into white-box and black-box features, and assesses feature importance by disrupting the white-box features.
However, existing feature-level attacks still suffer from in- efficiency. Specifically, by analyzing the loss functions of the above feature-level attacks, we mathematically demon- strate that they actually aim to perturb features along the direction of feature importance in the feature space. We experimentally validate this conclusion. Our results shows that the effect of existing feature-level attacks, which per- turb multiple times in pixel space, is no different from perturbing features in one step along the direction of feature importance in feature space. This inefficient perturbation in pixel space limits the attacks' ability to enhance the trans- ferability.
Based attack strategies, black-box attacks can be fur- ther categorized query-based attacks and transfer-based attacks. Query-based attacks (Brendel et al., 2017; Ilyas et al., 2018) approximate the gradient information through queries or employ intelligent search algorithms to explore the input space, thereby generating adversarial examples. However, query-based attacks are impractical in many real- world scenarios, such face recognition and autonomous driving, because a large number of queries are not allowed in these scenarios. In contrast, transfer-based attacks (Lin et al., 2019; Dong et al., 2019; Wang & He, 2021) are more realistic and flexible, as they do not require any knowledge of the target model. They first attack the local white-box surrogate model and then transfer the obtained adversar- ial examples directly to the unknown target model. The ability of adversarial examples to cross models and retain effectiveness is known as transferability.
To address the inefficiency of existing feature-level attacks, this paper proposes P2FA. Specifically, we shift the perturba- tion from pixel space to feature space and perturb important features multiple times along the direction of feature impor- tance within the feature space. The perturbed features are then used to generate corresponding adversarial examples via the feature inversion method. As illustrated in Fig. 1, compared to existing feature-level attacks, the adversarial example generated by the proposed P2FA keeps models from capturing important features of the object and focusing on entirely irrelevant regions instead. Extensive experi- ments on the ImageNet-NIPS dataset (Kurakin al., 2018) demonstrate that P2FA significantly improve adversarial transferability.
Recently, feature-level attacks (Zhou et al., 2018; Lu et al., 2020) have explored methods to improve the transferabil- ity of adversarial examples by targeting intermediate layers rather than directly perturbing the output layer of the surro- gate model. Since key features are shared between different DNN models (Ganeshan et al., 2019; Naseer et al., 2018), these feature-level attacks enhance transferability by max- imizing internal feature distortion to generate transferable adversarial examples.
The main contributions of this paper are summarized below:
We have theoretically identified the principle underly- ing feature-level attacks: These feature-level attacks aim to perturb feature in one step in feature space, along the direction of feature importance. We verified the conclusion experimentally. Our findings reveal the inefficiency of existing fcature-level attacks in disrupt- ing important features, which limits their transferabil- ity.
In feature-level attacks, the evaluation of feature importance significantly affects the effectiveness of the attacks. FIA (Wang et al., 2021) uses random pixel dropping transfor- mation and aggregates the transformed gradient to assess feature importance, suppressing model-specific features and highlighting object-related features. RPA (Zhang et al., 2022b) builds on FIA by recognizing the correlation be- tween neighboring elements in a natural image. It then ap- plies a random patch transformation to alter model-specific features, which improves the identification of key object features. In addition, NAA (Zhang et al., 2022a) attributes the model's 's output to each intermediate layer neuron and employs an approximation scheme for neuron attribution, allowing for an estimate of feature importance with reduced computational overhead. Based on this approach, DANAA (Jin et al., 2023) utilizes adversarial nonlinear path selection to expand the attack points, yielding more accurate fea- ture importance. SFVA (Ren et al., 2023) estimates feature
We propose P2FA, a new attack paradigm, to address the inefficiency issue and enhance adversarial transfer- ability. P2FA generates transferable adversarial exam- ples by perturbing important features multiple times in the feature space and then inverting the perturbed features back onto the image.
Extensive experiments have demonstrated that the pro- posed P2FA outperforms SOTA attacks in terms of transferability.
2

---

Pixel2Feature Attack (P2FA): Rethinking the Perturbed Space to Enhance Adversarial Transferability
2. Related Work
the baseline image to the features of the input, Ag represents the attribution of all neurons in the k-th layer of the model, and the parameter is used to balance the positive and neg- ative attributions, A( denotes the j-th dimension of the attribution Ag. while (pp()) and hn)() are the transformation functions applied to the positive and negative attributions, respectively. In practical, 7 is set to 1, and both (,)+)) and h (-) are set to linear functions.
Since Szegedy et al. (2013) discovered the adversarial ex- ample, numerous adversarial attack algorithms have been proposed to demonstrate the vulnerability of neural net- works. In this paper, we focus transfer-based attacks, which initially target a local white-box surrogate model and then apply the resulting adversarial examples to attack an unknown target model. The paper further examines two primary categories of transfer-based attacks: feature-level attacks and input transformations.
Double Adversarial Neuron Attribution Attack (DANAA) (Jin et al., 2023). DANAA improves upon NAA by attributing the model's output to an intermediate layer using adversarial nonlinear paths, thereby providing more accurate measure of the weights of individual neurons. The objective function of DANAA is presented in Eq. (4):
2.1. Feature-level Attack
Feature-level attacks primarily target the internal feature maps of the model. A common approach in feature-level attacks is to expand the gap in these feature maps during the generation of adversarial examples.
E(s(cade) - -fainn)))('())))))aa @ Tk:
(4)
Feature Importance-aware Attack (FIA) (Wang et al., 2021) FIA obtains feature importance by introducing an aggregated gradient, which is computed by applying random pixel dropping to the original image. The feature importance directs the adversarial examples to disrupt the key features, thereby enhancing their transferability. We denote the feature map of the k-th layer of surrogate model f as (+). and the feature importance as Aμ. The objective function of FIA is presented in Eq. (I):
where addv denotes the generated adversarial example, x' represents the baseline image, 7ke represents the the integra- tion of the gradient along a non-linear path from the features of the bascline image to the features of the input.
Salient Feature Variance Attack (SFVA) (Ren et al., 2023). SFVA applies CFET (patch level mask, random noise, scale transformation) to a clean copy of the image to estimate the feature weight of the k-th layer. This is used to compute the positive and negative salient variances, PV2 and NV,. The objective function of SFVA is presented in Eq. (5):
arg min godd
Σ ((AR @ (dd)))
(1)
arg max A - (P(())) + (NV,), podde
(5)
where @ represents the Hadamard product operation and aud denotes the generated adversarial example.
where TP(-) and (T(+) are transformation functions, and Å is the variance factor. In practical, λ is set to 1, and Tp(+) and (-) are set to identity functions.
Random Patch Attack (RPA) (Zhang et al., 2022b). RPA improves upon FIA by introducing the patch-wise random transformation to the original image, altering model-specific features to obtain a more accurate measure of feature impor- tance. The objective function of RPA is presented in Eq. (I). The difference from FIA's objective function lies in their distinct Ag.
Black-box Feature-driven Attack (BFA) (Wang et al.. 2024b). BFA divides image features into white-box fea- tures and black-box features, obtains the fitted image by disrupting the white-box features, and computes the fitted gradient for the images with different fitting degrees. Finally, the objective function is constructed based on the obtained fitted gradient and feature map. The objective function of BFA is presented in Eqs. (6) and (7):
Neuron Attribution-based Attack (NAA) (Zhang et al., 2022a). NAA proposes neuron attribution-basee attack that attributes model's output exclusively to each neuron in the intermediate layer. The objective functions of NAA are presented in Eqs. (2) and (3):
F = fa( @ 1 1-12
(6)
A = (Fa(2 - ff((z') @ IA,
(2)
ΣF w. Σ -F, F
arg max
arg min zadv
Σ hn(Aa)) 7 Σ hn AG)),
-
(3)
gadd F20
A 20
where 2 ade denotes the generated adversarial example, O represents the Hadamard product operation, represents the fitted gradient and w is the weight assigned to the control positive and negative factors.
where x' represents the baseline image, C represents the Hadamard product operation, IA represents the the integra- tion of the gradient along a straight line from the features of
3

---

Pixel2Feature Attack (P2FA): Rethinking the Perturbed Space to Enhance Adversarial Transferability
Table The attack rates of the adversarial examples generated by FIA and its corresponding feature inversion attack (i.c..FIA*)
against the other models, using Inception-v3 v3 as surrogate model.
Inception-v3
Inception-v4
Inception-Resiee Resiion--
ResNet-50
ResNet-152
Vge-16
Vgg-19
86.2
78.7
82.0
75.4
85.1
83.7
FIA
99.3
87.2
79.4
82.9
75.8
85.8
84.5
Existing faature lovel attocks
Festur importzzee dgrinns (Aaoasdi.A.l)
toner product
Original imauee a
Feature imporsance
Original image x
BP
st
Feature maps fa(at"))
Adverser perturiation
AE ot
Surrugatc model
Poxel
Festure
Fixel
importacee dipriilen HIX
P2RA (Owrs)
Feature importance
Adversomal periurbation
W,
Fusuure IINS COSTIN
Featura maps fa(x?"r)
Perturhal
AB #1
Surrogate model
Rasure maps f
Pixel space
Feature space
Pixel space
Figure 2. Schematic representation of the perturbations in pixel space and feature space for the existing feature-level attacks (top) and proposed P2FA (bottom). objective function of existing feature-level attacks maximize the inner product feature importance W and feature maps fa (zf""") )) then generate adversarial examples by adding adversarial perturbation in the pixel space through hackpropagation. P2FA directly adds adversarial perturbation the feature maps in the feature space and generates adversarial examples through feature inversion.
2.2. Input Transformation
PIM introduces an amplification factor and a projection ker- nel into the step size during each iteration. This modification enables the generated adversarial noise to exhibit aggrega- tion characteristics and cover diverse discriminative regions across different DNNs, thereby enhancing the transferability of adversarial examples.
Input transformation improves the transferability of adver- sarial examples by data augmentation. Specifically,
Diverse Input Method (DIM) (Xie al., 2019). DIM ap- plies image transformations (random resizing and padding) in each iteration to improve the transferability of the adver- sarial examples.
3. Methodology
Translation-Invarian Method (TIM) (Dong et al., 2019). TIM improves the transferability of the adversarial exam- ples by optimizing the perturbation across set of translated images. This approach reduces the sensitivity of the gener- ated adversarial examples to the discriminative regions of the attacked white-box model.
3.1. Threat Model
We assume that the surrogate model is represented as f(-) + y where denotes the original image and y denotes the corresponding ground-truth label. Our objective is to generate an adversarial example add x + e by adding perturbation to original image, such that the target model f*(() is misled, resulting f
Patch-wise Iterative Method (PIM) (Gao et al., 2020).
(* A y. In feature-

---

Pixel2Feature Attack (P2FA): Rethinking the Perturbed Space to Enhance Adversarial Transferability
level attacks, the generation of adversarial examples can be formulated the following optimization problem (Detailed proof can be found in A.1 of the Appendix):
Algorithm 1 Pixel2Feature Attack
Input: original image and ground-truth label y. surrogate model f. intermediate layer k, the step size X, and the number of perturbations T
arg max (W, fa(2z (2)d))), s.t. s.t.llæ x1lp C. (8) gade
Output: The adversarial image x Initialize z6 = I, go = 0. μ =
where W denotes the feature importance, (+) denotes the k-th layer feature map of the surrogate model f. and ( denotes the inner product. f--norm is adopted to measure the distance between x and 2=dd,, and oc in this work.
for = 0 to
do
Calculate the feature importance We of zodv
9t+1 μ. 9: + W f& = fA (2 + A 19
9++1
x:dd FeatureI cnnturrenveesson/
3.2. Motivation
end for return 27d"
Building the established threat model, we identify and analyze the issue of attack inefficiency in existing feature- level attacks. To provide clear explanation, we need to introduce the following lemma.
toward [x(x) + 8. W. This suggests that the effect of the existing feature-level attacks, which involve multiple per- turbations in the pixel space, is effectively equivalent to perturbing the features in one step along the direction of feature importance in the feature space.
Lemma 3.1. Cauchy-Schwarc inequality. Let u, U E R" be arbitrary vectors. Then
(u. ||||||||0||
with equality holding if and only u= 8 u and s 2 O.
To validate the above conclusion, we conducted the follow- ing experiments:
Let us begin with the proof. First, we introduce fi (x). which independent of the optimization parameter, and rewrite Eq. (8) as follows
We employ existing feature-level attacks as baselines and derive corresponding feature inversion attacks based on the aforementioned conclusions. Specifically, we first perturb the features along the direction of feature importance as defined by the baseline in the feature space, and then gen- erate corresponding adversarial examples through feature inversion. The aforementioned conclusions are validated if the attack success rates and perturbation distribution of adversarial examples generated by the baselines and the corresponding feature inversion attacks are similar. Due page limitations, Table presents the experimental results under the setting where the baseline attack is FIA and the surrogate model is Inception-v3 (Szegedy et al., 2016). The complete experimental results are provided in Table 5 in A.2 of the Appendix.
arg max (arad)) - fx(2)), gade s.t. a|æ
(9)
x1Ip Se
Then, according to the Schwar-Schwarz inequality, it fol- lows that for any gddv {x-dv a| z=lp I c), the following inequality still holds:
{ W, (aadu- - fx()))
(10)
fa(())122
with equality holding if and only if fa (2.ado) - fx) 8 W (s 2 0). In other words, when
f (addv) = (x) + s. W, s.t. || 20pp c, (11)
We employ the Structural Similarity Index Measure (SSMM) (Wang et al., 2004) compute the distribution of the ad- versarial example perturbations generated by baselines and their corresponding feature inversion attacks. The computed SSIM value greater than 0.99 indicates that the perturbations are almost identical (The complete experimental results are provided in Table 5 A.2 of the Appendix).Tho experi- mental results indicate that the attack success rates of the adversarial examples generated by baselines and their cor- responding feature inversion attacks are comparable, and their perturbation distributions are almost identical. This validates the aforementioned conclusion.
Eq. (9) achieves its maximum value 5- ||| [1, and its optimal solution is also the optimal solution of Eq. (8).
In summary, we only need to perturb the feature (x) in one step along the direction of W to obtain the perturbed fea- ture (x) + 8 W, and obtain adversarial example through feature inversion that satisfies I| - ==Ip I The ob- tained adversarial example is the optimal solution of Eq. (8).
In practice, we additionally incorporate clip function to ensure that the crafted adversarial examples remain within the e-ball of x.
Consequently, we conclude that the feature-level attacks per- turb the intermediate layer features of the surrogate model
Therefore, the effect of the existing feature-level attacks, which involve multiple perturbations in the pixel space to
5

---

Pixel2Feature Attack (P2FA): Rethinking the Perturbed Space to Enhance Adversarial Transferability
destroy important feature, is effectively equivalent to per- turbing the features in one step along the direction of feature importance in the feature space. This inefficiency limits the transferability of existing feature-level attacks.
V J(N( D..) where 2/ xgde + I J(fa(z Dallla" xf de- notes the fitted image, 27 denotes adversarial examples generated by white-box attacks, y denotes the perturba- tion size, fa((=//)) denotes the black-box features of the fitted image. Finally, we employ the classical feature in- version algorithm (Du et al., 2018) to map the optimal perturbed features f% back to the pixel space, generat- ing adversarial examples. The detailed workflow of our P2FA is outlined in Algorithm 1. Code is available at: https: / /ttpt/ggttttttt/// com/ /WH -EP//EF...
3.3. Pixel2Feature Attack
Inspired by the conclusion in Sec. 3.2, we propose P2FA to address the inefficiency of existing feature-level attacks in disrupting important features. It perturbs important features multiple times in the feature space along the direction of dynamic feature importance, thereby enhancing the transfer- ability of adversarial examples. Specifically, as illustrated in Fig. 2, unlike existing feature-level attacks, P2FA trans- forms the perturbation space from pixel space to feature space. As described in Eq. (12), the optimization parame- ters are no longer adversarial examples in pixel space, but feature maps in feature space. We solve the optimization problem through multi-step iteration to achieve multiple perturbations of features in the feature space:
4. Experiments
4.1. Setup
Dataset. For a fair comparison, we adhere to previous work by utilizing the ImageNet-NIPSS dataset (Kurakin et al., 2018), which comprises 1000 images for the NIPS 2017 adversarial competition.
Target Models. We employ seventeen classification models as target models to evaluate the performance of different attacks. Among these, seven are normally trained models: Inception-V3 (Inc-v3) (Szegedy et al., 2016), Inception- V4 (Ine-v4) (Szegedy et al., 2017), Creption-ResNeee V2 (IncRes-v2) (Szegedy et al., 2017), ResNet-50 (Res-50) (He (Kes-152) (He et al., 201 6a),
arg max J(fk. fe
(12)
where f& denotes the feature map of the k-th layer of the surrogate model f. and J denotes the cross-entropy loss. In gradient-based attacks, cross-entropy J(r, v) -1, softmax (f (z)), where 1, is the one-hot vector en- coding class y. is used to update the input image x. We shift it to [(kk, y) = -Ly log softmax(f2 frost (ff)) for feature updates, where flast is the tost-k-th-layer model part.
et al., 2016 ResNet- VGG16 (6gg-16) (Simonyan, 2014), and VGG19 (Vgg- 19) (Simonyan, 2014). In addition, we select six advanced de- fense methods, including Adv-Inc-v3 (Kurakin et 2016), Adv-Ens-IncRes-v2 (Tramèr et al., 2017), random resizing and padding (R&P) (Xie et al., 2017), feature distillation (FD) (Liu et al., 2019), JPEG compression (JPEG) (Guo et al., 2017) and bit-depth compression (Bit-Red) (Liu et al., 2017). Finally, we select four vision transformers, including PÝT-S (Heo et al., 2021), CaiT-- (Touvron al., 2021b), DeÎT-B (Touvron et al., 202 Swin-B (Liu et al., 2021).
To ensure that the perturbation effectively disrupts important features, we adopt the feature importance to guide the per- turbation direction. Unlike existing feature-level attacks that maintain fixed feature importance, we dynamically update the feature importance in each iteration to capture more re- fined perturbation directions. In addition, to further improve the adversarial transferability, we introduce momentum to stabilize the update direction within the feature space and prevent the perturbed features from converging to a local optimum. The detailed update process for solving Eq. (12) as follows:
Baseline Methods. We select six advanced feature-level at- tack methods as our baselines: FIA ( (Wang et al., 2021), RPA (Zhang et al., 2022b), NAA (Zhang et al., 2022a), DANAA (Jin et al., 2023). SFVA (Ren et al., 2023), and BFA (Wang et al., 2024b). In addition, we integrated all the methods with two classic input transformation methods: PIM (Gao et al., 2020) and DIM (Xie et al., 2019), to compare the compatibility of the different attacks. When PIM and DIM are combined with the baselines and P2FA, we denote them as PIDI-FIA, PIDI-RPA, PIDI-NAA, PIDI-DANAA, PIDI- SFVA, PIDI-BFA, PIDI-P2FA. We also integrated all the methods with two up-to-date input transformation methods: BSR (Wang et al., 2024a) and SIA (Wang et al., 20h experimental results are provided in Table 6 and Table 7 in A.3 of the Appendix.)
g++1 p. gt +
Wt,
(13)
A = fa + +
-6+1
(14)
where y denotes the decay factor in the momentum, À de- notes the step size, and the feature importance Wt is derived from the -fate-of-the-art BFA (Wang et al., 2024b) and ap- plied iteratively as follows:
W₁ Σ (uleesy
(15)
Implementation Details, For a fair comparison, we adhere
6

---

Pixel2Feature Attack (P2FA): Rethinking the Perturbed Space to Enhance Adversarial Transferability
Table Success of different attacks against normally trained models. The first column shows surrogate models, the first lists target models and the last column represents the average attack success rate. The best results are highlighted in bold.
Model
Attack
Inc-v3
Inc-v4
IncRes-v2
Res-50
Res-
Vgg-16
Vgg-19
Average
FIA
98.8
86.2
78.7
82.0
75.4
85.1
83.7
84.3
RPA
98.7
86.6
81.8
85.4
79.5
86.4
85.0
86.2
NAA
97.7
81.0
73.9
78.4
72.1
81.9
79.2
80.6
Inc-v3
DANAA
98.1
82.3
76.7
81.3
73.6
84.8
81.8
82.7
SFVA
87.0
86.0
80.9
87.7
85.2
86.9
BFA
100.0
95.1
92.0
91.9
90.5
93.3
92.4
93.6
P2FA(Ours)
100.0
96.5
94.9
95.2
92.5
94.8
96.0
95.7
FIA
83.9
96.7
77.2
79.6
72.6
84.8
83.2
82.6
RPA
87,5
98.1
80.3
82.8
78.6
88.1
87.6
86.1
NAA
81.4
97.8
73.7
77.3
69.9
84.8
82.5
81.1
Inc-v4
DANAA
82.1
98.0
77.5
81.1
74.7
85.8
84,9
83.4
SFVA
86.7
98.2
79.0
82.6
78.2
88.6
87.1
85.8
BFA
94.8
99.5
90.6
91.4
88.9
93.6
92,6
93.1
P2FA(Ours)
96.3
100.0
92.2
93.6
91.1
95.8
95.0
94.9
FIA
75.7
74,5
92.9
69.8
62.5
77.0
73.7
75.2
RPA
78.8
78.9
91.9
76.9
68.0
78.6
76.9
78.6
NAA
70.4
70.0
91.9
68.4
59.0
73.9
72.1
72.2
IncRes-v2
DANAA
76.9
94.2
73.5
66.7
78.4
77.3
77.6
SFVA
81.0
78.7
93.7
77.7
71.3
81.1
79.8
80.5
BFA
92.3
91.6
99.3
87.1
83.2
87.0
86.3
89.5
P2FA(Ours)
93.7
93.5
100.0
90.8
86.5
91.1
91.5
92.4
FIA
76.2
78.4
62.5
98.0
100.0
91.9
88.7
85.1
RPA
87.4
86.3
74.2
99.0
100.0
95.1
94.4
90.9
NAA
81.7
79.5
97.8
99.9
92.5
91.2
87.8
Res-152
DANAA
84.8
83.2
74.7
98.4
100.0
93.1
92.7
89.6
SFVA
86.8
85.6
78.2
99.4
100.0
94.9
94.2
91.3
BFA
92.7
92.3
85.4
99.6
100.0
97.0
96.9
94.8
P2FA(Ours)
94.9
94.4
88.7
99.9
100.0
98.0
98.4
96.3
to the parameter settings of FIA (Wang et al., 2021). Specif- ically, we set the maximum perturbation to ε = 16 and the number integrations steps for the aggregated gradient to N 30. In addition, we set the decay factor to μ = 1.0 for all the baselines, as they are optimized using the momentum method. For the input transformation methods, we the transformation probability of the DIM to 0.7, the amplifica- tion factor of the PIM to 2.5 and the kernel size to 3. We select consistent intermediate layers for the feature-level attacks: Mixed .b for the Inc-v3 model, feature.6 for the Inc-v4 model, Conv2d_4a for the IncRes-v2 model and the last layer of block2 for the Res-152 model. For the proposed P2FA, We the step size to 10S, the number of perturba- tions to 3, and utilize the feature importance derived from BFA.
formers.
Attacking Normally Trained Models. Table 2 report the attack success rates of the adversarial examples generated by the proposed P2FA and baselines on normally trained mod- els. The results demonstrate that P2FA exhibits significant advantage over baseline attacks, with an average improve- ment of 2.1 % compared to the best results of baselines. In addition, our method can be integrated with the classic input transformation methods, PIM and DIM, to further improve the transferability. As shown in Table 3, the attack success rate of PIDI-P2FA significantly improves to 97.4% after combining PIM and DIM. In contrast, PIDI-BFA, the top- performing baseline, achieves average attack success rate of 93.3%. Furthermore, Table 6 also demonstrates the superiority of P2FA when combined with BSR or SIA in attacking normally trained models. All these experiments validate the effectiveness of P2FA.
4.2. Comparison of Transferability
In this section, compare the transferability between the proposed P2FA and the baselines. We select Inc-v3, Inc- v4, IncRes-v2, and Res-152 as surrogate model to generate adversarial examples, respectively. and then attack other normally trained models, defense models and vision trans-
A Attacking Defense Models. Next, we evaluate effective- ness of our proposed P2FA and other baseline attacks on the defense models. To enhance transferability, attack methods with the classic input transformation meth- ods PIM and DIM. The results in Table 4 demonstrate that
integrate all

---

Pixel2Feature Attack (P2FA): Rethinking the Perturbed Space to Enhance Adversarial Transferability
Table Success of different attacks integrated with PIM and DIM against normally trained models. The first column shows models, the first row lists target models and the last column represents the average attack success rate. The best results are highlighted in bold.
Model
Attack
Inc-v3
Inc-v4
IncRes-v2
Res-50
Res-152
Vgg-16
Vgg-19
Average
PIDI-FIA
89.3
79.0
87.2
86.8
87.6
PIDI-RPA
99.7
90.4
86.9
89.7
85.2
89.9
89.1
90.1
PIDI-NAA
98.0
83.0
78.6
83.3
75.9
85.3
83.0
83.9
Inc-v3
PIDI-DANAA
98.9
86.1
81.9
85.7
81.2
88.9
85.8
86.9
PIDI-SFVA
88.8
85.4
88.3
83.7
88.4
89.0
PIDI-BFA
100.0
95.7
93.0
93.2
91.2
93.8
92.7
94.2
PIDI-P2FA(Our))
100.0
98.4
97.3
97.3
96.7
97.0
97.4
97.7
PIDI-FIA
87.6
97.9
83.0
84.6
79.4
88.1
87.5
86.9
PIDI-RPA
91.4
99.1
86.1
87.1
84.3
90.0
89.6
89.7
PIDI-NAA
84.5
98.1
79.1
83.4
75.7
88.4
85.2
84.9
Inc-v4
PIDI-DANAA
85.7
97.5
80.8
84.1
78.6
88.0
87.2
86.0
PIDI-SFVA
88.0
98.4
81.1
86.0
81.6
90.4
87.9
87.6
PIDI-BEA
95.3
99.6
91.8
92.9
89.4
93.2
93.1
93.6
PIDI-P2FA(Ours)
98,9
100.0
96.9
97.2
95.8
97.9
97.9
97.8
PIDI-FIA
80.3
77.2
94.5
75.8
69.2
78.3
78.0
79.0
PIDI-RPA
83.3
81.2
94.1
80.0
73.3
82.0
78.9
81.8
PIDI-NAA
72.4
69.5
92.8
69.0
60.4
73.4
71.5
72.7
IncRes-v2
PIDI-DANAA
78.8
93.0
77.9
77.3
79.5
PIDI-SFVA
81.8
79.1
94.9
78.3
72.7
79.9
78.2
80.7
PIDI-BFA
92.6
90.8
99.1
87.2
83.1
88.1
86.3
89.6
PIDI-P2FA(OurS)
96.4
96.2
100.0
94.3
91.8
93.7
93.4
95.1
PIDI-FIA
88.6
87.6
79.6
98.8
100.0
95.3
94.2
92.0
PIDI-RPA
91.5
90.0
83.2
99.6
100.0
96.3
96.2
93.8
PIDI-NAA
85.4
84.6
79.9
92.3
90.7
Res-152
PIDI-DANAA
89.0
86.9
83.3
98.8
100.0
95.4
94.3
92.5
PIDI-SFVA
90.7
89.3
83.3
99.6
100.0
96.2
96.6
93.7
PIDI-BFA
93.9
93.1
89.2
99.7
100.0
97.4
97.4
95.8
(IDI-P2FA(OurS)
99.1
98.4
97.7
99.9
100.0
99.4
99.2
99.1
our proposed P2FA achieves an average attack success rate of 62.6%, surpassing all baselines by over 7.0%. Further- more, Table 7 also demonstrates the superiority of P2FA when combined with BSR or SIA in attacking defense mod- els. This indicates that our attack method highly effective in targeting defense models.
factor is the step size X, which determines the magnitude of perturbations along the direction of feature importance in the feature space. The second factor the number of perturbations T, representing how many times features are perturbed along the direction of feature importance. The final factor is the effect of the choice of feature importance the performance of our algorithm. Due to page limita- tions, the figures for the ablation study are shown in A.4 of the Appendix.
Attacking Vision Transformers. Finally, we evaluate the effectiveness of our proposed P2FA and other bascline at- tacks on the vision transformers. We integrate all attack methods with the classic input transformation methods PIM and DIM. The results Table demonstrate that our pro- posed P2FA achieves an average attack success rate of 74.9%, surpassing all baselines by over 15%. Furthermore, Table also demonstrates the superiority of P2FA when combined with BSR or SIA in attacking vision transformers. This indicates that our attack method poses significant threat to advanced vision transformers.
Step Size. We analyze the effect using different step sizes on P2FA. Using Inc-v3 the surrogate model, we evaluate step sizes of 10, 102. 103. 10 10S 10 analyze the transferability of the adversarial examples generated with different step sizes. The results shown in Fig. indicate that the attack success rate stabilizes when the step size exceeds 1 reaching its peak at 10a Consequently, we select 10 as the optimal step size.
Number of Perturbations. We analyze the effect of the number of perturbations along the direction of feature im- portance in the feature space P2FA. Using Inc-v3 surrogate model, we vary the number of perturbations from
4.3. Ablation Study
In this section, we conduct an ablation study to analyze the three key factors that affect our proposed P2FA. The first
8

---

Pixel2Feature Attack (P2FA): Rethinking the Perturbed Space to Enhance Adversarial Transferability
Table Success of different attacks integrated with PIM and DIM against defense models and vision transformers. The first column shows source models, the first row lists target models and the last column represents the average attack success rate. The best results are highlighted bold.
Model
Attack
Adv-Ine-v3
Add-Ens-IncRes-ve
R&P
FD
JPEG
Bit-Red
P:T-S
CaiT-S
DeiT-B
Swin-B B
Average
PIDI-FIA
65.0
34.4
37.3
53.9
46.7
34.7
54.6
39.7
43.4
27.4
43.7
PIDI-RPA
66.7
45.7
41.9
62.2
47.2
49.0
49.2
PIDI-NAA
55.4
34.8
39.3
41.6
45.3
34.4
56.4
40.4
44,9
32.8
42.5
Ino-v3
PIDI-DANAA
$9.7
39.2
48.0
47.4
50.8
42.3
63.5
48.5
51.0
38.2
48.9
PIDI-SFVA
61.3
48.8
49.2
40.3
62.2
46.0
51.5
48.2
PIDL-FA
72.4
45.9
50.5
57.8
57.1
46.3
73.4
59.3
59.6
46.2
56.9
PIDI-P2FA(Ours'
76.7
51.8
$8.0
63.3
61.3
52.8
85.2
73.0
75.9
60.3
65.8
PIDI-FIA
60.7
36.6
40.7
52.2
43.7
37.3
54.7
40.1
40.3
32.5
43.9
PIDI-RPA
62.2
44.8
42.1
62.4
45.8
47.6
PIDI-NAA
51.5
35.5
38.9
41.9
44.5
35.8
58.2
41.9
45.1
37.4
43.1
Inc-v4
PIDI-DANAA
55.2
40.7
46.4
45.7
44.2
44.3
61.5
49.1
50.5
43.5
48.1
SFVA
58.0
44.5
63.7
50.4
PIDI-BFA
66.5
46.6
51.4
53.5
51.4
46.1
72.7
56.4
58.7
49.6
55.3
PIDI- PIDI-P2FA(Oury)
71.8
52.5
$7.9
59.6
55.0
52.1
84,9
73.2
74.6
65.7
64.7
PIDI-FIA
64.2
40.9
42,5
54.6
44.7
41.2
43.2
31.7
32,0
21.8
41.7
PIDI-RPA
66.6
$2.1
43.1
43.3
PIDI-NAA
51.8
37.8
38.6
46.6
42.3
37.9
42.1
30,9
33.5
24.5
38.6
IncRes-v2
PIDI-DANAA
58.6
47.8
$2.5
51.8
47.8
50.7
53.4
41.5
42.4
34.6
48.1
SFVA
43.6
PIDI-BFA
72.6
61.2
61.4
60.8
56.8
60.8
64.6
52.9
53.1
40.8
58.5
PIDI-P2FA
79.9
65.8
68.8
67.7
62.9
68.0
78.5
68.7
67.4
54.7
68.2
PIDI-FIA
57.3
33,5
38.9
54,1
45.5
34.5
52,9
36.7
41.8
30.2
42.5
PIDI-RPA
59.8
47.3
$3.5
PIDI-NAA
52.8
38.4
44.7
47.1
48.4
38.3
68.1
50,9
56.5
47.6
49.3
Res-152
PIDI-DANAA
55.0
41.2
49.0
50.6
50.6
44.1
72.5
56.0
60.5
54.1
53.4
PIDI-SEVA
71.4
56.3
PIDI-BFA
61.6
45.0
50.6
56.4
55.8
45.3
78.2
59.7
66.6
55.5
57.5
PIDI-P2FA(Ours)
71.6
55.2
62.6
66.8
63.6
53.8
92.4
82.2
84,9
76.4
71.2
to 10 to analyze their effect on transferability. The results, as illustrated in Fig. 4, demonstrate that the attack success rate peaks when the number of perturbations 3. Conse- quently, we select as the optimal number of perturbations for our study.
robustness of various models.
A Acknowledgment
This work is supported by National Natural Science Foun- dation of China (Grants No. 62472229, U24B20179, U23A20305, U23B2022, 62371145, 62272255, 62302248), the National Key R and D Program of China (Grants No. 2021QY0700), Zhongyuan Science and Technology Innovation Leading Talent Project China (Grants No. 2 214200510019) and the Open Project the State Key Lab- oratory of Tibetan Intelligent Information Processing and Applica tion (Key Laboratory of Tibetan information pro- cessing, Ministry of Education) (Grants No. 2024-Z-003).
Feature Importance. We analyze the impact of employing different feature importance assessment methods on P2FA. Using Inc-v3 as surrogate model, we incorporate the fea- ture importance metrics from FIA, RPA, NAA, DANAA, SFVA, and BFA into our algorithm. The results are shown Fig. indicating that the highest performance is achieved when utilizing the feature importance derived from BFA. Therefore, select the feature importance of BFA and dynamically compute it in each iteration.
Impact Statement
5. Conclusion
This paper presents work whose goal is to advance the field of Machine Learning. There are many potential societal consequences of our work, none which we feel must be specifically highlighted here.
In this paper, we propose P2FA to generate highly trans- ferable adversarial examples. The proposed P2FA shifts the space of perturbation from pixel space to feature space directly and perturbs the features multiple times along the direction of feature importance in the feature space to more efficiently destroy important features. We conducted exten- sive experiments to demonstrate the superior performance of P2FA as compared to those state-of-the-at methods, and our method can serve as a benchmark for evaluating the
References
Brendel, W., Rauber, and Bethge, M. Decision-based ad- versarial attacks: Reliable attacks against black-box ma-

---

Pixel2Feature Attack (P2FA): Rethinking the Perturbed Space to Enhance Adversarial Transferability
chine learning models. arXiv preprini arXiv:1712.0444: 2017.
Jin, Z., Zhu, Z., Wang, X., Zhang, J., Shen, J., and Chen, H. Danaa: Towards transferable attacks with double adver- sarial neuron attribution. In International Conference on Advanced Data Mining and Applications. pp. 456-470. Springer, 2023.
Carlini, N. and Wagner, D. Towards evaluating the robust- ness of neural networks. In 2017 ieee symposium security and privacy (sp), pp. 39-57. Icve, 2017.
Dong, Y. Pang, T., Su, H., and Zhu, J. Evading defenses to transferable adversarial examples by mansslationinvariinn attacks. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition. pp. 4312-4321, 2019.
Krizhevsky, A., Sutskever, I., and Hinton, G. E. Imagenet classification with deep convolutional neural networks. Advances in neural information processing systems, 25, 2012.
Kurakin, A., Goodfellow, I., and Bengio, S. Adversarial ma- chine learning at scale. arXiv preprint arXiv:1611.01236 2016.
Du, M., Liu, N., Song, Q. and Hu, X. Towards explanation of dnn-based prediction with guided feature inversion. In Proceedings of the 24th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining, Pp- 1358-1367, 2018.
Kurakin, A., Goodfellow, I., Bengio, S., Dong, Y., Liao, F., Liang, M., Pang, T., Zhu, J., Hu, X., Xie, C., al. Adversarial attacks and defences competition. In The NIPS 17 Competition: Building Intelligent Systems, pp. 195-231. Springer, 2018.
Ganeshan, A., BS, V., and Babu, R. V. Fda: Feature disrup- tive attack. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pp. 8069-8079, 2019.
Lin, J., Song, C.. He, K., Wang, L., and Hopcroft, J. E. Nesterov accelerated gradient and scale invariance for adversarial attacks. arXiv preprint MeXiv:/90..060 2019.
Gao, L., Zhang, Q. Song. J., Liu, X., and Shen, H. T. Patch- wise attack for fooling deep neural network. In Computer Vision-ECCV 2020: 16th European Conference, Glasgow, UK, August 23-28, 2020, Proceedings, Part XXVIII 16, pp. 307-322. Springer, 2020.
Liu, J., Sun, W., and Liu, Y. Bit-depth enhancement via convolutional neural network. International Forum on Digital TV and Wireless Multimedia Communications, pp.
Girshick, R. Fast r-cnn. arXiv preprint 1xXiv:550400005 2015.
255 264.264. Springer, 2017.
Goodfellow, I. J., Shiens, J., and Szegedy, C. Explain- ing and harnessing adversarial examples. arXiv preprint arXiv: 2014.
Liu, Z., Liu, Q. Liu, T. Xu, N., Lin, X., Wang, Y., and Wen, W. Feature distillation: Dnn-oriented jpeg compres- sion against adversarial examples. In 2019 IEEF/CVE Conference on Computer Vision and Pattern Recognition (CVPR), pp. 860-868. IEEE, 2019.
Guo, C., Rana, M., Cisse, M., and Van Der Maaten, L. Countering adversarial images using input transforma- tions. arXiv preprint
2017.
He, K., Zhang. X., Ren, S., and Sun, J. Deep residual learn- ing for image recognition. In Proceedings of the IEEE conference computer vision and pattern recognition, pp. 770-778, 2016a.
Liu, Z., Lin, Y., Cao, Y., Hu, H., Wei, Y., Zhang, Z., Lin, S., and Guo, B. Swin transformer: Hierarchical vision transformer using shifted windows. In Proceedings of the IEEE/CVF international conference on computer vision, pp. 10012-10022, 2021.
He, K. Zhang, X., Ren, S., and Sun, J. Identity mappings in deep residual networks. In Computer Vision-ECCV 2016: 14th European Conference, Amsterdam, The Netherlands, October 11-14, 2016, Proceedings, Part IV 14, pp. 630- 645. Springer, 2016b.
Lu, Y., Jia, Y. Wang. J., Li, B., Chai, W., Carin, L., and Veli- pasalar, S. Enhancing cross-task black- transferability of adversarial examples with dispersion reduction. In Proceedings of the IEEE/CVF conference on Computer Vision and Pattern Recognition, pp. 940-949, 2020.
Heo, B., Yun, S., Han, D., Chun, S., Choe, J., and Oh, S. Rethinking spatial dimensions of vision transformers. In Proceedings of the IEEE/CVF international conference on computer vision, pp. 11936-1199 11945, 2021.
Naseer, M., Khan, S. H., Rahman, S., and Porikli, F. Task- generalizable adversarial attack based on perceptual met- ric. arXiv preprint arXiv:1811 0.0000, 2018
Ilyas, A., Engstrom, L., Athalye, A., and Lin, J. Black- box adversarial attacks with limited queries and informa- tion. In International conference on machine learning, pp. 2137-2146. PMLR, 2018
Ren, Y., Zhu, H., Sui, X., and Liu, C. Crafting transferable adversarial examples via contaminating the salient feature variance. Information Sciences, 644: 19273, 2023.
10

---

Pixel2Feature Attack (P2FA): Rethinking the Perturbed Space to Enhance Adversarial Transferability
Simonyan, K.
Very deep convolutional networks for large- scale image recognition. arXiv preprint 140.:v:4499/5500 2014.
Wang, Z., Guo, H., Zhang, Z., Liu, W., Qin, Z., and Ren, K. Feature importance-aware transferable adversarial attacks. In Proceedings of the IEEE/CVF international conference on computer vision, pp. 7639-7648, 2021.
Szegedy, C. Intriguing properties of neural networks. arXiv preprint arXiv:1312.6199 2013.
Xiao, C., Li, B., Zhu, J.-Y,, He, W., Liu, M., and Song, D. Generating adversarial examples with adversarial networks. arXiv preprint 1xXiv:1801.020 2018.
Szegedy, C., Vanhoucke, V., loffe, S., Shlens, J., and Wojna, Z. Rethinking the inception architecture for computer vi- sion. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 28 2818-2826, 2016.
Xie, C.,, Wang. J., Zhang, Z.., Ren, Z.,, and Yuille, A. Miti- gating adversarial effects through randomization. arXiv preprint 1rXiv: 171.00991, 2017.
Szegedy, C., Ioffe, S., Vanhoucke, V., and Alemi, A. Inception-v4, inception-resnet and the impact of residual connections on learning. In Proceedings of the AAAI conference on artificial intelligence, volume 31, 2017.
Xie, C., Zhang, Z.,, Zhou, Y., Bai, S., Wang. J., Ren, Z., and Yuille, A. L. Improving transferability adversarial examples with input diversity. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pp- 2730-2739, 2019.
Touvron, H., Cord, M., Douze, M., Massa, F., Sablayrolles, A., and Jégou, H. Training data-efficient image transform- ers distillation through attention. In International con- ference on machine learning. pp. 10347-10357. PMLR, 2021a.
Zhang, J., Wu, W., Huang, J.-t., Huang, Y., Wang, W., Su, Y., and Lyu, M. R. Improving adversarial transferability via neuron attribution- attacks. In Proceedings of the IEEE/CVF Conference Computer Vision and Pattern Recognition, pp. 14993-15002, 2022a.
Touvron, H., Cord, M., Sablayrolles, A., Synnaeve, G., and Jégou, H. Going deeper with image transformers. In Proceedings of the IEEE/CVF international conference on computer vision, pp. 32-42, 2021b.
Zhang, Y., Tan, Y.aa., Chen, T., Liu, X., Zhang, Q., and Li, Y. Enhancing the transferability of adversarial examples with random patch. In IJCAI, pp. 1672-1678. 2022b.
Tramèr, F, Kurakin, A., Papernot, N., Goodfellow, I,, Boneh, D., and McDaniel, P. Ensemble adversar- ial training: Attacks and defenses. arXiv preprint arXiv: 10Xiv11005.0m 170.007204 2017.
Zhou, W., Hou, X., Chen, Y., Tang, M., Huang, X., Gan, X., and Yang. Y. Transferable adversarial perturbations. In Proceedings of the European Conference on Computer Vision (ECCV), pp. 452-467, 2018.
Wang, K., He, X., Wang, W., and Wang, X. Boosting adversarial transferability by block shuffle and rotation. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp.
2024a.
Wang, M., Wang, J., Ma, B., and Luo, X. Improving the transferability of adversarial examples through black-box feature attacks. Neurocomputing, 595:1 2024b.
Wang, X. and He, K. Enhancing the transferability of adver- sarial attacks through variance tuning. In Proceedings of the IEEE/CVF conference computer vision and pattern recognition, pp. 1924-1933, 2021.
Wang, X., Zhang, Z., and Zhang, J. Structure invariant transformation for better adversarial transferability. In Proceedings of the IEEE/CVF International Conference on Computer Vision pp. 4607-4619, 2023.
Wang, Z., Bovik, A. C., Sheikh, H. R., and Simoncelli, E. P. Image quality assessment: from error visibility to struc- tural similarity. IEEE transactions on image processing, 13(4))600-612, 2004.

---

Pixel2Feature Attack (P2FA): Rethinking the Perturbed Space to Enhance Adversarial Transferability
A. Appendix.
A.I. Proof
FIA: The optimization problem FIA is
arg min E O fa(c=d))) = (Si, for (z(d))))
(16)
where Ag denotes the aggregate gradient,
(x) (1) (1)
A
Mb Mn. Bernoulli(1 - pa),
(17)
where Ag 8l(z.))
(z) and I(-.0) v) denotes the logits output with respect to the true label y. Let W = =- A
The optimization
problem of FIA can ultimately be rewritten as
arg max (W, f(((zau))). godv
(18)
The only difference between RPA and FIA the different transformation in Eq. (17), which will result different feature importance W, but does not affect the structure of the optimization problem. Therefore, the optimization problem of RPA also be rewritten as
RPA:
arg max (W, fl((zdd)). gadv
(19)
NAA: The optimization problem of NAA is
arg min Σ (A -y Σ (-m(-A(6)
(20)
ndd
1 20
147<0
where
A (falzadu) fa(x')) 111 1A
= (Da(aady) - Sa()') 1 Σ
OF (Zm. 0f((m))
(21)
m=1
where V). denotes the softmax output of the true label and = (1
m )ar + n.. In practical, 1 and fn()) are linear functions mapping to themselves, i.c./p(x) = I, hn)(x) = x. Eq. (20) can be rewritten as
ΣA
falzado - fa(x'), 1 Σ
aF y) af(((m)) /
arg min godds
(22)
which is equivalent to
Σ m==1
FF(xm v) Ofe (
Sa(caddo).
arg min audd
(23)
Σm=1
(F(mm))) (Pm))
Let W
The optimization problem of NAA can eventually be rewritten as
Em
arg max (W, (x( godv
(24)
12

---

Pixel2Feature Attack (P2FA): Rethinking the Perturbed Space to Enhance Adversarial Transferability
DANAA: DANAA differs from NAA only in that the paths used to compute Imm in W in Eq. (23) different, which will result in different W, but does not affect the structure of the optimization problem. Therefore, the optimization problem of DANAA can also be written as
arg max (W, fo(xxdd))) goddv
(25)
SFVA: The optimization problem of SFVA is
arg max À (PV() + TN (NV)).
(26)
pade
where the positive salient variance PV of the k-th layer feature map is denoted as
PV = Σ [MP(x) - (od
(27)
the positive salient maps (x) is denoted as
(x(x) {0
Mi(x) if Mxx) 20
(28)
otherwise
the negative salient variance NV, of the k-th layer feature map is denoted as
NV = Σ (x) M (z
(29)
the negative salient maps (x) is denoted as
Mi(x))
if (.) 0 otherwise
MF((2) = (o 0
(30)
the salient feature maps M(x) = W o fa(x), whereli** denotes the optimal feature weights. In practical, = 1 and TP(-). (-) are identity functions, i.c. (z) = I, TN (x) r. Eq. (26) can be rewritten
arg max PV& + NV- Σ (x)(x) M (2
Σ (x) -M" (zddo
zadv
Σ Mp() + E Mc -
Σ MP (sadoo) + Σ M (aado))
MM(()) (aldua
Σ [[wr o fx(()) - W o fa
(W. (w")J(x>> Sa Sa(aadr))
(31)
Let W - and removing the terms that are not related to the optimization parameters, the optimization problem of SFVA can finally be rewritten
arg max (W, Se(xxdu)) zadv
(32)
BFA: The optimization problem of BFA is
arg max
ΣF-w
Σ
(33)
zddu
F20
F20
where F= fe (x @ 7 + 12 and denotes the fitted gradient. In the official code, w is set to 1.0 which degrades the optimization problem
arg max ΣF
Σ Sa o T 12 12.
(34)
gadu
13

---

Pixel2Feature Attack (P2FA): Rethinking the Perturbed Space to Enhance Adversarial Transferability
Since 2 is a constant term independent of the optimization parameters, Eq. (34) can be rewritten
arg
Σ fk(w 3 1= (T, ( (T,
(35)
Let W the optimization problem of BFA can be finally rewritten as
arg max (W, f&e fz(()d)))
(36)
gody
In summary, the above optimization problems of feature-level attacks all equivalent
arg max (W, f6(22du)) gadv
(37)
where W denotes the feature importance.
A.2. The Attack Success Rates of the Adversarial Examples Generated by Feature-level Attacks and Their Corresponding Feature Inversion Attacks (Table 5)
A.3. Success Rate of Different Attacks Integrated with BSR or SIA Against Normally Trained Models, Defense Models and Vision Transformers (Table 6, Table 7)
A.4. Ablation Study Figures(Fig. 3, Fig. 4, Fig. 5)
300
Attack Success
hoxe
heBle vp
las
0
Figure 3. The effect of the choice of step size attack success rate. Using Inc-v3 surrogate model, different step sizes chosen generate adversarial examples and their success rates are reported against different target models.
14

---

Pixel2Feature Attack (P2FA): Rethinking the Perturbed Space to Enhance Adversarial Transferability
hevd
Wy
10
Number Perturbations
Figure The effect choice of number of perturbations on attack success rate. Using Inc-v3 surrogate model, different numbers of perturbations are chosen to generate adversarial examples and their success rates are reported against different target models.
1000
575
20.0
(4)
15.0
hood
infles
Fas
825
Fer 157
Vpp
Importoncs
Figure 5. The effect of feature importance selection attack success rate. Using Inc-v3 as surrogate model, the proposed feature importance assessment methods in different feature-level attacks are selected generate adversarial examples their success rates are reported against different target models.
15

---

Pixel2Feature Attack (P2FA): Rethinking the Perturbed Space to Enhance Adversarial Transferability
Table The attack rates and the value of SSIM of the adversarial examples generated by feature-level attacks and their corresponding Feature Inversion Attacks. The first column shows surrogate models, the first row lists target models and the last column represents the value SSIM. Average represent the average attack success rates. denotes Feature Inversion Attack.
Model
Attack
Inception-v3
Inception-v4
Inception- Resinet-eeeeeee-e ResNet-50 ResNet-152
Vgg-
Vgg- 19
Average
SSTM
FIA
98.8
86.2
78.7
82.0
75.4
85.1
83.7
84.3
0.9978
FIA*
99.3
87.2
79.4
82.9
75.8
85.8
84.5
85.0
RPA
98.7
86.6
81.8
85.4
79.5
86.4
85.0
86.2
0.9966
RPA
99.0
87.1
82.4
86.0
80.4
86.6
85.9
86.8
NAA
97.7
81.0
73.9
78.4
72.1
81.9
79.2
80.6
0.9972
NAA
98.6
81.8
74.7
82.3
80.1
81.4
Inc-v3
DANAA
98.1
82.3
76.7
81.3
73.6
84.8
81.8
82.7
0.9945
DANAA
98.8
83.3
77.5
82.1
74.5
85.3
82.4
83
SFVA
98.8
87.0
83.0
86.0
80.9
87.7
85.2
86.9
0.9937
SFVA*
99.3
87.7
84.1
86.2
81.2
88.0
86.1
87.5
BFA
100.0
92.0
9T.9
93.3
0.9945
BFA
100.0
96.1
92.3
92.6
91.6
94.2
92.7
94.2
FIA
83.9
96.7
77.2
84.8
82.6
0.9967
FIA
84.4
97.2
78.
80.3
72.7
85.2
84.1
83.1
RPA
87.5
98.1
80.3
82.8
78.6
88.1
87.6
86.1
0.9974
RPA
88.1
98.7
81.1
83.3
79.4
89.0
88.2
86.8
NAA
81.4
97.8
73.7
77.3
84.8
0.9956
NAA
82.2
98.4
74.7
78.1
70.1
85.5
83.2
81.7
Inc-v4
DANAA
82.1
98.0
77.5
81.1
74.7
85.8
84.9
83.4
0.9956
DANAA
82.5
98.6
78.7
82.2
75.2
86.1
85.3
84.1
SFVA
86.7
98.2
79.0
82.6
78.2
88.6
87.1
85.8
0.9984
SFVA*
87.2
98.6
79.9
83.3
79.2
88.9
86.4
BEA
94.8
99.5
90.6
91.4
88.9
93.6
92.6
93.1
0.9947
BFA
95.3
99.6
91.2
91.9
89.6
94.2
93.4
93.6
FTA
75.7
74.5
92.9
69.8
62.5
77.0
73.7
75.2
0.9936
FIA
76.6
75.1
93.0
70.8
63.2
77.7
74.2
75.8
RPA
78.8
78.9
91.9
76.9
68.0
78.6
76.9
78.6
0.9951
RPA
79.2
79.6
92.5
77.8
79.7
79.3
NAA
70.4
70.0
91.9
68.4
59.0
73.9
72.1
72.2
0.9977
NAA
70.9
70.7
92.7
69.2
59.9
74.5
73.1
73.0
IncRes-v2
DANAA
76.9
76.1
94.2
73.5
66.7
78.4
77.3
77.6
0.9959
DANAA
77.4
76.7
94.9
74.4
67.2
79.3
78.3
78.3
SFVA
81.0
78.7
93.7
77.7
71.3
81.1
79.8
80.5
0.9964
SFVA*
81.8
79.4
94.3
78.7
71.8
81.9
80.3
81.2
BFA
92.3
91.6
99.3
87.1
83.2
87.0
86.3
89.5
0.9951
BFA*
93.2
92.6
99.5
88.0
84.1
87.8
87.1
90.3
FIA
76.2
78.4
62.5
98.0
100.0
91.9
88.7
85.1
0.9973
FIA
76.9
79.2
63.2
98.5
100.0
92.5
89.5
85.7
RPA
87.4
86.3
74.2
100.0
94.4
90.9
0.9975
RPA
87.9
87.2
74.8
99.3
100.0
95.9
95.2
91.5
NAA
81.7
79.5
71.8
97.8
99.9
92.5
91.2
87.8
0.9963
NAA
82.3
80.4
72.2
98.5
99.9
93.4
92.0
88.4
Res-152
DANAA
84.8
83.2
74.7
98.4
100.0
93.1
92.7
89.6
0.9966
DANAA
85.6
84.1
75.1
98.8
100.0
93.7
93.1
90.1
SFVA
86.8
85.6
78.2
99.4
100.0
94.9
94.2
91.3
0,9961
SFVA*
87.2
86.4
78.9
99.6
100.0
95.5
95.2
91.8
BEA
92.7
92.3
85.4
99.6
100.0
97.0
96.9
94.8
0.9976
3FA
93.3
92.8
86.2
99.7
100.0
97.8
16

---

Pixel2Feature Attack (P2FA): Rethinking the Perturbed Space to Enhance Adversarial Transferability
Table Success of different attacks integrated with BSR SIA against normally trained models. The first column shows souree models, the first row lists target models and the last column represents the average attack success rate. The best results are highlighted in bold.
Model
Attack
Inc-v3
Inc-v4
IncRes-v2
Res-50
Res-152
Vgg-16
Vgg-19
Average
BSR-FIA
86.3
78.9
75.4
88.1
85.1
85.5
BSR-RPA
99.8
89.4
84.3
87.4
79.9
89.6
88.1
88.4
BSR-NAA
99.9
85.1
78.7
83.0
76.6
86.9
84.1
84.9
BSR-DANAA
99.2
85.8
79.0
82.5
76.8
87.0
85.6
85.1
BSR-SFVA
87.8
85.8
78.8
88.1
85.8
87.1
BSR-BI BFA
100.0
91.2
86.7
88.5
84.5
90.6
89.6
90.2
BSR-P2FA(Oury)
100.0
98.7
96.2
97.3
96.2
97.3
97.7
97.6
Inc-v3
SIA-FIA
100.0
94.0
89.1
92.0
86.8
93.5
93.2
92.7
SIA-RPA
99.9
94.8
93.6
91.0
94.3
94.9
94.3
SIA-NAA
99.9
93.9
92.4
88.9
92.2
92.9
SIA-DANAA
99.9
95.3
91.8
94.0
90.6
94.5
93.1
94.2
SIA-SFVA
100.0
95.1
91.3
94.8
90.2
94.2
93.5
94.2
SIA-BFA
100.0
97.0
94.7
96.4
93.9
96.3
96.1
96.3
SIA-P2FA(Ours)
100.0
99.5
98.6
99.3
99.5
99.3
BSR-FIA
88.1
99.5
80.1
86.2
79.3
92.6
89.9
88.0
BSR-RPA
100.0
82.8
81.5
92.4
89.8
BSR-NAA
87.8
99.9
79.2
83.4
75.9
89.8
88.4
86.3
BSR-DANAA
87.9
98.6
80.9
86.0
79.1
90.9
89.6
87.6
BSR-SFVA
90.3
99.6
80.5
86.0
79.4
91.0
89.9
88.1
BSR-BFA
92.6
99.4
86.4
89.6
84.0
93.4
93.0
91.2
BSR-P2TA(Ours)
100.0
97.1
98.2
98.2
Inc-v4
SIA-FIA
94.0
100.0
86.9
92.8
87.8
95.1
94.6
93.0
SIA-RPA
96.1
100.0
90.7
93.4
90.3
96.5
96.2
94.7
STA-NAA
94.5
99.9
89.7
92.9
88.8
95.0
94.0
93.5
SIA-DANAA
94.6
99.8
89.6
95.3
94.8
94.2
SIA-SFVA
95.2
100.0
90.4
93.6
90.6
95.8
95.2
94.4
SIA-BFA
96.6
99.7
93.5
95.2
92.6
96.1
96.2
95.7
STA-P2FA(OUrs)
99.6
100.0
98.7
99.6
98.9
99.6
99.6
99.4
BSR-FIA
81.8
77.5
98.7
75.5
66.3
81.9
79.3
80.1
BSR-RPA
85.0
82.9
98.7
80.4
72.6
85.2
82.2
83.9
BSR-NAA
77.5
75.6
97.0
73.2
66.7
78.9
75.5
77.8
BSR-DANAA
80.5
78.3
95.7
77.2
67.3
81.8
79.3
80.0
BSR-SFVA
83.6
79.6
96.9
78.2
71.2
82.2
80.5
81.7
BSR-BFA
88.2
87.1
99.0
83.2
75.4
86.8
84.2
86.3
BSR-P2FA(OurS)
95.7
95.8
100.0
93.5
90.1
93.6
92.8
94.5
IncRes-v2
SIA-FIA
89.8
87.8
88,9
SPA-RPA
94.1
92.6
99.9
89.7
85.5
91.3
91.5
92.1
SIA-NAA
91.8
90.0
99.7
88.6
83.6
90.0
87.9
90.2
SIA-DANAA
93.7
91.1
99.2
89.4
85.4
90.9
91.6
91.6
STA-SFVA
94.3
91.6
99.4
90.7
87.2
90.6
90.5
92.0
SIA-BFA
94.2
99.5
90.1
92.6
94.0
SIA-P2FA(Ours)
99.5
98.4
99.9
98.1
97.4
98.0
98.3
98.5
BSR-FIA
79.0
77.9
64.3
100.0
94.3
93.3
86.8
BSR-RPA
86.5
83.1
70.6
99.5
100.0
96.3
95.7
90.2
BSR-NAA
84.0
82.9
73.7
98.6
100.0
95.1
93.4
89.7
BSR-DANAA
88.0
86.1
76.9
99.1
99.9
95.4
94.4
91.4
BSR-SFVA
84.9
94.7
91.3
BSR-BEE BFA
90.6
88.8
80.2
99.6
100.0
97.3
96.7
93.3
BSR-P2FA(OurS
98.8
98.3
96.4
99.9
100,0
99.8
99.7
99.0
Res- 152
SIA-FIA
86.0
85.7
73.3
99.6
100.0
96.5
96.2
91.0
SIA-RPA
89.5
80.8
100.0
98.1
97.6
94.0
STA-NAA
90.7
84.0
99.8
100.0
97.9
94.6
SIA-DANAA
94.2
92.7
87.5
99.8
100.0
98.5
98.1
95.8
STA-SFVA
93.1
91.9
84.6
99.9
100.0
98.1
97.9
95.1
SIA-BFA
95.3
94.3
87.7
99.8
100.0
98.3
98.6
96.3
SIA-P2FA(Ours)
99.2
98.8
100.0
100.0
99.9
99.9
99.2
17

---

Pixel2Feature Attack (P2FA): Rethinking the Perturbed Space to Enhance Adversarial Transferability
Table 7. Success rate of different attacks integrated with BSR or SIA against defense models and vision transformers. The first column shows source models, the first row lists target models and last column represents the average attack success rate. The best results are highlighted in bold.
Model
Attack
Adv-Ine-v3
Adv-Ens- Mn--Enn--ncRes-22
R
FD
JPEG
Bit-Red
PIT-S
CafT-S
DeiT-B
Swin-B
Average
BSR-FI FIA
52.6
24.3
28.1
38.1
40.0
23.8
40.0
24.4
29.9
18.9
32.0
BSR-RPA
56.1
29.4
40.1
43.6
29.6
49.6
31.8
37.7
22.7
37.5
BSR-NAA
53.8
33.4
37.8
40.6
44,0
33.5
54.8
38.0
42.7
28.2
40.7
BSR-DANAA
56.0
34.0
38.8
41.2
44.9
33.8
55.5
38.3
44.9
31.0
41.8
BSR-SFVA
55.2
41.6
45.7
33.2
36,9
43.0
40,9
BSR-BFA
57.7
31.6
37.3
42.2
46.4
31.8
59.3
37.5
44.5
29.3
41.8
BSR-P2FA(OurS)
77.8
50.2
56.3
61.5
60.6
50.4
82.8
69.3
74.4
SS.7
63.9
Inc-v3
SIA-FIA
62.4
48.7
47.8
33.8
38.5
43.1
SIA-RPA
67.8
40.9
43.6
50.1
53.9
40.6
66.5
46,0
50.2
36.8
49.6
SIA-NAA
65.1
45.4
49.5
49.4
55.7
45.0
71.6
$4.0
57.4
44.3
53.7
SIA-DANAA
69.1
53.0
48.6
74.5
57.8
59.4
56.8
SIA-SFVA
66.4
45.3
49.4
52.2
56.9
45.1
70.6
53.6
55.1
42.6
53.7
BIA-BFA
72.6
49.4
54,2
59.2
46.1
76.9
59.0
62.7
$7.3
SIA-P2FA(OUrS)
83.2
72.1
70.9
61.7
91.0
81.4
81.9
73.8
BSR-FIA
48.4
26.3
26.4
33.5
BSR-RPA
50.8
29.3
34.6
39.5
39.4
29.3
48.5
30.3
34.7
25.4
36.2
BSR-NAA
51.0
34.1
38.4
38.8
42.9
33.8
55.8
38.6
41.1
40.5
BSR-DANAA
54,9
40.4
41.7
36.3
55.6
41.3
44.4
42.3
BSR-SFVA
51.5
34.4
40.5
39.7
43.7
34.6
55.8
39.7
42.3
32.2
41.4
BSR-BR BBA-BBA
56.0
41.0
41.2
31.7
57.4
38.5
42.6
31.6
41.0
3SR-P2FA(Ours)
74.5
59.1
54.5
86.5
70.9
75.5
65.7
Inc-v4
SIA-FIA
37,9
34.1
36.9
46.
44.8
33.9
$4,2
34.8
40.1
29.6
41.2
SIA RPA
60.5
39.3
48.6
47.9
39.7
62.5
42.3
45.8
35.8
46.6
SIA-NAA
62.2
48.5
47.1
68.7
52.1
$3.9
$2.9
SIA-DANAA
64,9
50.2
52.5
51.7
54.5
50.3
72.6
55.3
57.1
46.4
55.6
SIA-SPVA
60.8
48.0
51.2
49.7
55.2
47.4
72.7
55.7
55.9
48.8
54.5
SIA-BFA
65.7
$3.2
46.5
73.9
55.8
$8.7
SIA SIA- (2ur)
79.7
63.4
65.8
69.6
67.7
63.8
91.7
N2.8
X3.1
75.4
74.3
BSR-FIA
57.1
32,6
33.1
43.3
41.2
32.7
33,8
21.3
25.6
12.7
33.3
BSR-RPA
63.5
42.7
43.4
48.5
47.2
42.8
46.3
30.9
35.1
20.4
42.1
BSR-NAA
56.4
43.5
33.5
34.3
BSR-DANAA
59.0
44.3
44.4
46.0
46.1
44.2
49,5
36.5
37.6
23.9
43.2
BSR-SFVA
58.5
42.5
47.5
48.5
42.4
48.9
36.2
38.8
24.2
48.2
BSR-BFA
65.4
45.7
47.1
47.3
45.7
52.9
37.6
39,4
25.0
45.5
BSR (2FA(
79.7
64.7
67.6
66.1
62.5
65.3
76.0
63.9
66.9
48.9
66.2
IncRes-v2
SIA-FIA
68.1
56.8
46.0
48.5
34.00
38.7
45.9
SIA-RPA
74,3
57.8
62.4
46.7
49.4
56.0
SIA-NAA
70.8
61.0
60.7
58.5
60.5
61.2
62.9
$3.0
50.7
40.2
58.0
SIA-DANAA
73.4
64.7
60.3
64.6
64.8
67.9
56.3
$4.9
42.2
61.4
SIA-SFVA
70.6
61.9
61.9
62.4
68.5
56.7
55.8
60.6
SIA-BEA
78.1
67.6
66.2
63.9
66.3
67.3
72.1
60.3
59.8
44.8
64.6
SIA P2FA(OurS)
87.8
76.7
75.7
77.2
75.1
76.3
87.8
80.9
81.9
67.8
78.7
BSR-FIA
41.4
24.6
36.2
35.4
20.4
35.8
20.1
26.8
27.6
BSR-RPA
43.4
24.9
38.4
40.7
24.9
48.7
26.2
34.3
23.5
33.6
BSR-NAA
47.0
34.1
40.1
41.2
45.2
34.4
63.8
43.8
50.5
38.2
43.8
BSR-DANAA
47.7
39.6
42.2
32.9
63.8
42.1
50.2
43.6
BSR-SFVA
48.6
39.2
43.2
45.7
32.7
62.5
42.4
49.5
43.3
BSR-BFA
48.4
30.1
37.6
42.3
46.5
30.2
61.4
38.3
49.6
32.9
41.7
Re5-1.52
BSR P2FA(OurS)
70.5
61.5
62.9
61.5
$2.7
90.3
77.3
83.2
72.9
68.6
SIA-FIA
44.9
25.6
29.9
40.7
38.3
25.7
46.2
26.0
33.7
24.8
35.6
SIA RPA
48.4
30.4
37.3
43.9
44.4
30.8
$6.4
33.2
43.0
33.7
40.2
SIA-NAA
54.7
41.2
47.4
48.8
51.2
40.5
74.0
53.3
60.9
52.2
SIA-DANAA
55.5
41.4
47.6
50.2
52.3
41.1
72.6
51.5
59.9
47.6
52.0
SIA-SFVA
54.5
40.4
46.1
48.7
52.1
39.9
71.9
51.1
57.2
45.4
50.7
SIA-BFA
54.8
43.6
54.1
37.8
73.6
49.1
59.6
45.9
SIA-P2FA(OurS)
70.2
55.0
59.4
68.4
54.8
90.4
80.6
83.1
70.3
18


Reviews:
[{"review_id": "O5AovNezpv", "reviewer": "Reviewer_ASTV", "summary": "In this paper, the authors propose Pixel2Feature Attack (P2FA) to enhance the transferability of feature-based attack across different DNN models.\n\nTo enhance the efficiency, the proposed P2FA shifts the disturbance space from the pixel space to the feature space. Specifically, P2FA perturbs feature maps within the feature space by following the direction of dynamically updated feature importance, and then generate adversarial samples through feature inversion.\n\nExperiments using the ImageNet benchmark dataset demonstrate that the proposed P2FA method achieves the better attack transferability compared to state-of-the-art approaches. Moreover, ablation study is conducted to analyze the impact of training factors on the attack success rate.\n\n## update after rebuttal\n\nThank you to the author for addressing the raised questions. However, several critical concerns remain unresolved.\n\nThe rebuttal provides derivations suggesting that Eq. 11 serves as an upper bound for Eq. 8. However, there is no explicit connection established between the solutions of Eq. 8 and Eq. 11. Therefore, the conclusion that perturbing features once is equivalent to perturbing pixels multiple times remains questionable.\n\nMoreover, the methodology heavily relies on the feature importance computed by the BFA method, resulting in interactions between the input pixel space and the feature space during perturbation training. As a result, the specific contribution of perturbing the feature space remains unclear.\n\nFor these reasons, I have decided to maintain my original score of “Weak Reject”.", "questions": "", "limitations": "", "rating": 2, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We thank the reviewer for their valuable feedback, which we address below. (If the latex formula is not rendered, please refresh the page.)\n\n# Q1: Theoretical Proof  \n\nWe appreciate the reviewer spotting an error in Eq. (11). We omitted the constraint on $x^{adv}$. Next, we will focus on rigorously proving that multiple pixel-space perturbations in Eq. (8) equal a single feature-space perturbation along feature importance $W$. First, we equivalently rewrite Eq. (8) as: \n$$\n\\underset{x^{adv}}{\\arg \\max} \\langle W, f_k(x^{adv}) - f_k(x) \\rangle,~ s.t.~||x^{adv} - x ||_p \\leq \\epsilon.\n$$\nThen, using the Cauchy–Schwarz inequality ($\\langle u, v \\rangle \\leq  ||u||_2||v||_2$, equality when $u = s \\cdot v, s \\geq 0$), the following inequality still holds:\n$$\n\\left \\langle W, f_k(x^{adv}) - f_k(x) \\right \\rangle \\leq ||W||_2 || f_k(x^{adv}) - f_k(x) ||_2\n$$\nwith equality holding when $f_k(x^{adv}) = f_k(x) + s \\cdot W (s \\geq 0)$ and $||x^{adv} - x||_p \\leq \\epsilon$, also achieving the optimum. The role of $s$ is to ensure that the adversarial example obtained through feature inversion satisfies $||x^{adv} - x||_p \\leq \\epsilon$. In practice, we additionally add a clip function to ensure this. In other words, we only need a single feature-space perturbation $s \\cdot W$ and satisfy the $\\epsilon$-ball to achieve the optimum of Eq. (8). Experiments in Sec. 3.2 also validates the correctness of the claimed conclusion. We’ll update the manuscript with a more detailed version of this proof and revise Fig. 2.\n\n# Q2: Efficiency  \n\nWe clarify that efficiency in the submitted manuscript refers to fewer perturbation iterations ($T=3$ for P2FA vs. $T=10$ for baseline). As you rightly noted, efficiency also includes time efficiency. To fairly compare time efficiency, we tuned BFA’s hyperparameters ($T$, $N$) to match P2FA’s success rate on ImageNet-NIPS with Inception-v3 on an RTX 4090. P2FA ($T=3, N=30$) achieves 84.1% average success in 0.616s/example, while BFA ($T=50, N=200$) reaches 83.9% but in 1.577s/example. BFA is 2.5x slower than P2FA. We’ll add detailed data to the revised manuscript.\n\n# Q3: SIA and BSR  \n\nSIA and BSR are two highly commendable works. In response to your feedback, we have conducted additional experiments integrating P2FA with SIA and BSR. Partial experimental results are presented in the table below. \n\n| Attacks  | Inc-v3* | IncRes-v2 | Res-152 | Vgg-16 | Swin-B | DeiT-B | PiT-S | CaiT-s | Avg. |\n| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |\n| BFA+BSR  | 100.0 | 89.1 | 85.7 | 92.0 | 34.3 | 45.8 | 62.6 | 46.5 | 69.5 |\n| P2FA+BSR | 100.0 | 96.2 | 96.2 | 97.3 | 56.6 | 73.6 | 83.1 | 69.1 | **84.0** |\n| BFA+SIA  | 100.0 | 93.4 | 92.6 | 95.9 | 47.1 | 66.0 | 76.8  | 64.0 | 79.5 |\n| P2FA+SIA | 100.0 | 98.9 | 98.7 | 99.4 | 68.1 | 81.8 | 91.5 | 80.8 | **89.9** |\n\nResults show P2FA+SIA and P2FA+BSR achieve higher transferability than SOTA BFA with SIA and BSR. Full results will be added to the revision.\n\n# Q4: Step Size  \n\n## Q4.1: Large Step Size\n\nP2FA requires a large step size for effective perturbations due to **small $W_t$ values (the average order of magnitude is between $10^{-6}$ and $10^{-5}$) relative to the intermediate layer’s feature $f_{k,t}$ (the average order of magnitude is $10^{-1}$)**.  \n\n## Q4.2: Low Sensitivity Beyond $10^3$\n\nClipping within the $\\epsilon$-ball limits the feature-space perturbation range when $s > 10^3$, reducing sensitivity. The average values of pre- and post-clip features confirm this.\n\n| $s$    | Pre-clip$(t=0/1/2)$        | Pose-clip$(t=0/1/2)$ |\n| --- | --- | --- |\n| $1$    | 0.674/0.675/0.678  | 0.675/0.677/0.678    |\n| $10$   | 0.679/0.680/0.683  | 0.675/0.677/0.678    |\n| $10^2$ | 0.726/0.732/0.739 | 0.675/0.679/0.682    |\n| $10^3$ | 1.410/1.509/1.566   | 0.697/0.731/0.757    |\n| $10^4$ | 10.930/11.316/11.544  | 0.766/0.820/0.848    |\n| $10^5$ | 108.424/110.887/112.908  | 0.788/0.837/0.860    |\n| $10^6$ | 1075.449/1096.937/1114.703 | 0.790/0.838/0.861    |\n\n## Q4.3: Meaning of $s$\n\n$s$ is the scaling factor from the Cauchy–Schwarz inequality, acting as the step size along $W$. We’ll clarify this in the revision.\n\n# Q5: Defense Models  \n\nRegrettably, we were unable to find PyTorch versions of Ens3-Inc-v3, Ens4-Inc-v3, and Adv-IncRes-v2, but tested P2FA on PiT-S, CaiT-S, DeiT-B, and Swin-B from RPA, showing higher transferability (see Reviewer Li9f’s Q1). Lastly, if you could kindly provide a solution for utilizing above defense models in PyTorch, we would be delighted to conduct further validation of our proposed method. \n\n# Q6: Eq. (12)  \n\nIn gradient-based attacks, cross-entropy $J(x, y) = -\\mathbb{1}_y \\cdot \\log \\text{softmax}(f(x))$ is used to update the input image $x$. We shift it to $J(f_k, y) = -\\mathbb{1}_y \\cdot \\log \\text{softmax}(f_k^{post}(f_k))$ for feature updates, where $f_k^{post}$ is the post-$k$-th-layer model part. We’ll add this explanation to the revision.\n\n---\n\nWe sincerely thank you for enhancing our manuscript’s quality.", "claims_and_evidence": "1. The claim that perturbing multiple times in the pixel space is equivalent to perturbing once in the feature space lacks rigorous theoretical support.\n\n2. Regarding the efficiency of feature attacks, this paper focuses solely on the attack success rate but lacks an analysis of efficiency itself, such as computational time cost.\n\n3. The feature importance $W_t$ is updated using the fitted image obtained from the input space in each iteration. However, this approach does not effectively address the previously stated inefficiency issues.", "methods_and_evaluation_criteria": "Yes, the proposed methods and evaluation criteria are relevant and appropriate for addressing the problem.", "theoretical_claims": "In Section 3.2, it is unclear how the conclusion that “perturbing multiple times in pixel space” equals “perturbing once along the direction of feature importance in feature space” was derived from Eq.11. To be specific, Eq.11 does not have a closed-form solution; Eq.11 should be a constrained optimization problem, rather than the simplified representation shown in Figure 2.", "experimental_designs_or_analyses": "1. The input transformation methods (e.g., PIM and DIM) considered are not the most up-to-date. \n\n2. In Table 4, only two defended CNN models are used as target models. To ensure a more comprehensive evaluation, additional models should be included, refer to the experimental settings used in FIA and RPA.\n\n3. In Section 4.1, the rationale behind choosing a large step size in the feature space for the experiments is unclear. Additionally, no clear justification is provided for defining the number of perturbations as 3.", "relation_to_broader_scientific_literature": "This paper focuses on the literature of feature-based attacks, leveraging feature importance from the BFA method to generate adversarial samples.", "essential_references_not_discussed": "This paper discusses both feature-based attacks and input transformation attacks. However, the cited input transformation attacks are not up-to-date, as recent methods such as SIA [1] and BSR [2] are not included in the discussion.\n\n[1] Structure Invariant Transformation for better Adversarial Transferability. ICCV 2023.\n\n[2] Boosting Adversarial Transferability by Block Shuffle and Rotation. CVPR 2024.", "other_strengths_and_weaknesses": "1. Eq.12 does not clearly explain how the cross-entropy loss is defined between $f_k$ and $y$.\n\n2. The experiment demonstrates that the proposed method enhances attack transferability; however, there is no clear evidence indicating an improvement in efficiency.", "other_comments_or_suggestions": "In line 214, the parameter $s$ is introduced, but its role is not clearly explained in this context.", "questions_for_authors": "1. Could the authors provide further clarification on why perturbing the feature only in the feature space can achieve the optimal solution of Eq.11 under the L-infinity constraint?  \n\n2. As the feature importance $W_t$ is iteratively updated from the input space, this additional computation raises concerns regarding the algorithm's time efficiency. Could the authors provide a comparison of P2FA’s efficiency against state-of-the-art methods?\n\n3. Could the authors clarify why PIM and DIM were integrated with feature-based attacks while recent input transformation methods, such as SIA and BSR, were not considered?\n\n4. Could the authors clarify why this optimization algorithm requires a large step size to update the feature map in the latent feature space? Additionally, in Fig.3, why is the attack performance not sensitive to the hyperparameter, particularly when the step size exceeds $10^3$?", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "hiAQWrhpRv", "reviewer": "Reviewer_Li9f", "summary": "This paper theoretically analyzes that existing multi-feature-based attack methods are essentially equivalent to perturbing features once. Correspondingly, a P2FA is proposed to perturb the feature spaces multiple times, by shiting the perturb space from pixel to feature. Extensive experiments were conducted to demonstrate the effectiveness of the proposed method. Overall, this paper proposes the P2FA from a novel and interesting point with sufficiently theoretical analysis. I think this finding can enhance most feature-based adversarial attacks.", "questions": "", "limitations": "", "rating": 3, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "# Q1: Lack of Transformer-based models\n\nYou rightly pointed out that Transformer-based models dominate contemporary research, and there is a legitimate interest in understanding how our proposed attack performs against these more advanced architectures.\n\nIn response to your comment, we have followed your suggestion and expanded our experimental evaluation to include four Transformer-based models: Swin Transformer (Swin-B)[1], Data-efficient Image Transformer (DeiT-B)[2], Pooling-based Vision Transformer (PiT-S)[3], and Class-Attention in Image Transformers (CaiT-S)[4]. These Transformer-based models were used as target models by the recent work RPA[5]. The preliminary results are shown in Table 1 (more experimental results can be found in Reviewer ASTV's Q3), demonstrating that our attack method remains effective against these models and outperforms the current SOTA feature importance-based attack, BFA. Detailed results and analysis will be incorporated into the revised manuscript.\n\n**Table 1. Attack Success Rates of P2FA(Ours), BFA, and their Combinations with Input Transformations on Transformer-based Models, Using Inception-v3 as the Surrogate Model**\n\n| Model | Attack | Swin-B | DeiT-B | PiT-S | CaiT-S | Avg. |\n| :-: | :-: | :-: | :-: | :-: | :-: | :-: |\n| Inc-v3 |      BFA    |   42.0   |   52.8   |   68.8   |   52.8   |   54.1   |\n| Inc-v3 |   P2FA(**Ours**)    | **43.4** | **55.7** | **70.7** | **53.3** | **55.8** |\n| Inc-v3 |      PIDI-BFA       |   46.2   |   59.6   |   73.4   |   59.3   |   59.6   |\n| Inc-v3 | PIDI-P2FA(**Ours**) | **60.3** | **75.9** | **85.2** | **73.0** | **73.6** |\n\nWe believe this extension not only addresses the limitation you identified but also enhances the practical relevance of our findings to the current research landscape. We will include a discussion of this limitation, the newly added experimental results, and our planned follow-up experiments in the revised manuscript to reflect your suggestion adequately.\n\n[1] Liu Z, Lin Y, Cao Y, et al. Swin transformer: Hierarchical vision transformer using shifted windows[C]//Proceedings of the IEEE/CVF international conference on computer vision. 2021: 10012-10022.\n\n[2] Touvron H, Cord M, Douze M, et al. Training data-efficient image transformers & distillation through attention[C]//International conference on machine learning. PMLR, 2021: 10347-10357.\n\n[3] Heo B, Yun S, Han D, et al. Rethinking spatial dimensions of vision transformers[C]//Proceedings of the IEEE/CVF international conference on computer vision. 2021: 11936-11945.\n\n[4] Touvron H, Cord M, Sablayrolles A, et al. Going deeper with image transformers[C]//Proceedings of the IEEE/CVF international conference on computer vision. 2021: 32-42.\n\n[5] Zhang Y, Tan Y, Chen T, et al. Enhancing the Transferability of Adversarial Examples with Random Patch[C]//IJCAI. 2022, 8: 13.\n\n# Q2: Clarification of innovations\n\nRegarding innovation concerns, this paper offers two key contributions.\n\n- **Innovation 1: Discover the inefficiency of existing feature importance-based attacks through mathematical proofs.** We would like to highlight that our work stems from a comprehensive analysis of existing feature importance-based attacks. Through mathematical proofs (the latest proof see Reviewer ASTV's Q1) and experimental validation, we reveal that existing feature importance-based attacks, relying on **multiple** **pixel**-space perturbations, equate to just **one step** in the **feature** space along feature importance. Therefore, the perturbation efficiency of existing feature importance-based attacks is inefficient, which also motivates the proposed P2FA to apply **feature**-space perturbations directly to improve the perturbation efficiency.\n\n- **Innovation 2: A new paradigm for transforming perturbed space from pixel to feature space.** Based on the above proof and experiments, P2FA shifts perturbation from pixel to feature space, applying multiple efficient perturbations to critical features, boosting transferability across models. This redefines feature importance-based attack paradigms, and we will clarify these innovations in the revised introduction and methodology sections.\n\nWe are grateful for your feedback, which has prompted us to refine our exposition. In the revised manuscript, we will expand the discussion in the introduction and methodology sections to clearly articulate this innovation and underscore our contributions.\n\n# Q3: Poorly expressed\n\nWe thank you for noting ambiguity in our phrasing: “is effectively equivalent to perturbing the features only once along the direction of feature importance in the feature space.” We meant one perturbation step in the feature space matches the effect of multiple pixel-space perturbations. To avoid confusion, we will revise it to: “is effectively equivalent to perturbing the features in one step along the direction of feature importance in the feature space.” This clarification will improve readability in the updated manuscript.", "claims_and_evidence": "Most claims are supported by its experiments and analysis.", "methods_and_evaluation_criteria": "Yes.", "theoretical_claims": "Yes.", "experimental_designs_or_analyses": "Yes.", "relation_to_broader_scientific_literature": "This paper contributes to the trustworthiness AI.", "essential_references_not_discussed": "Yes.", "other_strengths_and_weaknesses": "This paper demonstrates good originality in terms of the integrated analysis of existing feature-level attacks. Also, there is sufficient derivation and experimental evidence to validate the correctness of their conclusion. The insightful conclusion drawn in this paper may offer valuable inspiration for future research endeavors. \n\nHowever, the target classification models chosen, though classic, are not sufficiently advanced. Also, they are all CNN-based. Most of models are built upon Transformer nowadays, so people may want to know the performance of your attack on more advanced Transformer models.\n\nAnother weakness is that the proposed attack method lacks innovation, since it is largely based on previous works.", "other_comments_or_suggestions": "In your derived conclusion “is effectively equivalent to perturbing the features only once along the direction of feature importance in the feature space”, I am not sure “once” refers to one step or updating in one direction only. If you mean perturbing in only one direction, is there a clearer way to express it instead of “once”?", "questions_for_authors": "No.", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "pC05kDyBp7", "reviewer": "Reviewer_NAVH", "summary": "This paper introduces Pixel2Feature Attack (P2FA), a novel approach aimed at enhancing the transferability of adversarial examples in black-box attacks. The main point of the paper is to address the inefficiency of existing feature-level attacks, which tend to perturb features multiple times in pixel space, leading to limited transferability.", "questions": "", "limitations": "", "rating": 3, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We are grateful to the reviewer for their valuable feedback, and we will address the following issues in our response. (If the latex formula is not rendered, please refresh the page.)\n\n# Q1: Explanation of Feature Importance Assessment Methods\n\nIn Sec. A.1 of the appendix, we provided a brief introduction to the feature importance assessment methods used in different feature-level attacks. However, we did not offer sufficient details regarding the implementation of these methods or the distinctions between them. Next, I will provide a detailed explanation.\n\n- **FIA**: In FIA, feature importance $W$ can be expressed as\n  $$\n  W = -\\bar{\\Delta} _ k^x = -\\frac{\\sum _ {n=1}^N \\Delta _ k^{\\mathcal{T} _ n(x)}}{|| \\sum _ {n=1}^N \\Delta _ k^{\\mathcal{T} _ n(x)} || _ 2}, ~~ \\mathcal{T} _ n(x) = x \\odot M _ {p _ d}^n, ~~ M _ {p _ d}^n \\sim Bernoulli(1 - p _ d),\n  $$\n  where $\\bar{\\Delta} _ k^x$ denotes the aggregate gradient, $\\Delta_k^x = \\frac{\\partial l(x, y)}{\\partial f_k(x)}$, $l(\\cdot, y)$ denotes the logits output concerning the ground-truth label $y$, and $M_{p_d}^n$ is a binary matrix that satisfies the $Bernoulli(1 - p_d)$ distribution, where $p_d$ represents the random pixel dropping rate. Therefore, the aggregated gradient $\\bar{\\Delta}_k^x$ can be summarized as performing a batch of random pixel-dropping transformations on the original image and then unitizing the gradient sum of the feature maps of the transformed images.\n\n- **RPA**: The difference between RPA and FIA lies only in the different transformation $\\mathcal{T}$, which results in different feature importance $W$. Specifically, FIA applies random pixel-dropping transformations to the image, while RPA first generates a mask $M$ of the same size as $x$, which is a matrix with all elements of 1. Then, $M$ is divided into regular, non-overlapping patches $P$, with each patch size being $n^2$. Next, we randomly select a subset of patches with the probability of $P_m$: $P_{p_m}=Rand(P,p_m)$ and modify them to follow a uniform distribution: $P_m \\sim U[0,1)$. Therefore, the transformation $\\mathcal{T}$ of RPA can be expressed as $\\mathcal{T}_n(x) = x \\odot M$.\n\n- **NAA**: In NAA, the feature importance $W$ can be expressed as follows:\n  $$\n  W = -\\frac{\\sum_{m=1}^n \\frac{\\partial F(x_m, y)}{\\partial f_k(x_m)}}{|| \\sum_{m=1}^n \\frac{\\partial F(x_m, y)}{\\partial f_k(x_m)} ||_2}\n  $$\n  where $F(\\cdot, y)$ denotes the softmax output of the true label $y$, $x_m = (1 - \\frac{m}{n})x' + \\frac{m}{n} x$ and $x'$ denotes a baseline image. Therefore, the feature importance $W$ of NAA can be understood as taking $n$ points along the linear path from the baseline image $x'$ to the input image, calculating the unitized result of the gradient sum of the feature map of these $n$ points, and finally adding a negative sign.\n\n- **DANAA**: The difference between DANAA and NAA lies only in that the paths used to compute $x_m$, which results in different feature importance $W$. DANAA uses a non-linear path instead of the linear path. Specifically, $x^m = x^0 + \\sum_{k=0}^{m-1} \\Delta x^k$, where $\\Delta x^k = lr \\cdot \\text{sign}\\left( \\frac{\\partial F(x^k)}{\\partial x^k_i} \\right) + N(0, \\sigma)$, $\\frac{\\partial F}{\\partial x^k_i}(\\cdot)$ is the partial derivative of $F$ to the $i$-th pixel, $lr$ denotes learning rate and $N(0,\\sigma)$ denotes Gaussian noise.\n\n- **SFVA**: In SFVA, the feature importance $W$ can be expressed as follows:\n  $$\n  W = -\\hat{W}^*=-\\frac{1}{c} \\sum_{i=1}^{N}\\frac{\\partial F(x'_i)}{\\partial f_k(x'_i)}\n  $$\n  where $\\hat{W}^*$ denotes the optimal feature weights, $x'_i=Scale(Mask(x)+\\gamma_i)$. Specifically, we sequentially perform random mask, random addition of noise, and scale transformation on the original image $N$ times, and then compute the unitized result of the gradient sum of the feature map of the transformed images.\n\n- **BFA**: In BFA, feature importance $W$ can be expressed as follows:\n  $$\n  W =I = \\frac{1}{N}{\\sum_{m=1}^N \\frac{\\partial F(x_m^{IF}, y)}{\\partial f_k(x_m^{IF})}}\n  $$\n  where $x_m^{IF}$ denotes the fitted image at the $mth$ iteration. Specifically, we compute the average of the fitted gradients of the fitted images with different degrees of fit to represent the feature importance $W$.\n\n# Q2: Lack of Transformer-based models\n\nThe target models we selected, while classic, may not be sufficiently advanced and are exclusively CNN-based. We have additionally included four Transformer-based models, i.e., PiT-S, CaiT-S, DeiT-B, and Swin-B, as target models. The experimental results are presented in the response to Reviewer ASTV’s Q3 and Reviewer Li9f’s Q1. These results demonstrate that our proposed P2FA continues to exhibit higher transferability, further substantiating the effectiveness of our approach.\n\nFinally, we express our gratitude for your valuable feedback, which will greatly contribute to improving the quality of our manuscript. We look forward to your response.", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "Yes", "theoretical_claims": "Yes", "experimental_designs_or_analyses": "Yes", "relation_to_broader_scientific_literature": "/NA", "essential_references_not_discussed": "/NA", "other_strengths_and_weaknesses": "## Strengths\nThe theoretical identification of the principle underlying feature-level attacks, which reveals the inefficiency of existing methods in disrupting important features.\n\nThe proposal of P2FA, which shifts perturbations from pixel space to feature space, improving the efficiency and transferability of adversarial examples.\n\n## Weaknesses\nWhile the paper mentions using different feature importance assessment methods in the ablation study, it does not provide sufficient details on how these methods are implemented or how they differ from each other. \n\nThis paper not compare the performance of VIT backbone.", "other_comments_or_suggestions": "/NA", "questions_for_authors": "/NA", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Meta-review: This paper presents P2FA, a method to enhance the transferability of feature-based attack across different DNN models. The experimental results show the superiority of the proposed method, though missing references and missing baselines are pointed out. At the same time, concerns about the quality of the paper were raised.
Decision: Accept (poster)