On Success and Simplicity: A Second Look at Transferable Targeted Attacks
Authors: Zhengyu Zhao
Zhuoran Liu
Martha Larson
Venue: NeurIPS 2021 Poster (2021)
Keywords: Adversarial attacks
targeted transferability
realistic evaluation
universal adversarial perturbations

Abstract: Achieving transferability of targeted attacks is reputed to be remarkably difficult. The current state of the art has resorted to resource-intensive solutions that necessitate training model(s) for each target class with additional data. In our investigation, we find, however, that simple transferable attacks which require neither model training nor additional data can achieve surprisingly strong targeted transferability. This insight has been overlooked until now, mainly because the widespread practice of attacking with only few iterations has largely limited the attack convergence to optimal targeted transferability. In particular, we, for the first time, identify that a very simple logit loss can largely surpass the commonly adopted cross-entropy loss, and yield even better results than the resource-intensive state of the art. Our analysis spans a variety of transfer scenarios, especially including three new, realistic scenarios: an ensemble transfer scenario with little model similarity, a worse-case scenario with low-ranked target classes, and also a real-world attack on the Google Cloud Vision API. Results in these new transfer scenarios demonstrate that the commonly adopted, easy scenarios cannot fully reveal the actual strength of different attacks and may cause misleading comparative results. We also show the usefulness of the simple logit loss for generating targeted universal adversarial perturbations in a data-free manner. Overall, the aim of our analysis is to inspire a more meaningful evaluation on targeted transferability. Code is available at https://github.com/ZhengyuZhao/Targeted-Tansfer.

On Success and Simplicity: A Second Look at Transferable Targeted Attacks
Zhengyu Zhao, Zhuoran Liu, Martha Larson Radboud University
fz.2hao.z.iuummllrro/// @cc.ruu.n
Abstract
Achieving transferability of targeted attacks is reputed to be remarkably difficult. The current state of the art has resorted to resource-intensive solutions that necessi- tate training model(s) for each target class with additional data. In investigation, we find, however, that simple transferable attacks which require neither model training nor additional data can achieve surprisingly strong targeted transferability. This insight has been overlooked until now, mainly because the widespread practice of attacking with only few iterations has largely limited the attack convergence to optimal targeted transferability. In particular, we, for the first time, identify that very simple logit loss can largely surpass the commonly adopted cross- entropy loss, and yield even better results than the resource-intensive state of the art. Our analysis spans a variety of transfer scenarios, especially including three new, realistic scenarios: an ensemble transfer scenario with little model similarity, a worse-case scenario with low-ranked target classes, and also a real-world attack on the Google Cloud Vision API. Results in these new transfer scenarios demonstrate that the commonly adopted, easy scenarios cannot fully reveal the actual strength of different attacks and may cause misleading comparative results. We also show the usefulness the simple logit loss for generating targeted universal adver- sarial perturbations in data-free manner. Overall, the aim of analysis is inspire a more meaningful evaluation on targeted transferability. Code available at chttpss//giithhe com http./////cnngggghh//rrrreeeeeee Tans
Introduction
Deep neural networks have achieved remarkable performance in various machine learning tasks, but are known to be vulnerable to adversarial attacks []] A key property of adversarial attacks that makes them critical in realistic, black-box scenarios is their transferability 2 3. Current work
adversarial transferability has achieved great success for non-targeted attacks 12 while several
initial attempts 3 4 [3] targeted transferability have shown its extreme difficulty. Targeted transferability is known to be much more challenging and worth exploring since it can raise more critical concerns by fooling models into predicting a chosen, highly dangerous target class.
However, so far state-of-the-a results can only be secured by resource pesource-intensive transferable attacks [6). Specifically, the FDA approach [14 [5] is based on modeling layer-wise feature distributions by training target-class -lass-specific auxiliary classifiers on large-scale labeled data, and then optimizing adversarial perturbations using these auxiliary classifiers from across the deep feature space. The TTP approach [16] is based on training larget-clas-speccfie Generative Adversarial Networks (GANs) through global and local distribution matching, and then using the trained generator to directly generate perturbations on any given input image.
In this paper, take second, thorough look current research on targeted transferability. Our main contribution the finding that simple transferable attacks that require neither model
35th Conference on Neural Information Processing Systems (NcurIPS 2021).

---

training nor additional data can actually achieve surprisingly strong targeted transferability. We argue that this insight has been overlooked mainly because current research has unreasonably restricted the attack convergence by only using small number of iterations (see detailed discussion in Section 3 Another key contribution of our work is, for the first time, demonstrating the general superiority of very simple logit loss, which even outperforms the resource-intensive state of the art.
In order to validate the general effectiveness of simple transferable attacks, in Section 4. we con- duct extensive experiments in a wide range of transfer scenarios. We test the commonly adopted single-mode and ensemble transfer scenarios, but also introduce three new scenarios that are more challenging and realistic: an ensemble transfer scenario with little model similarity, a worse-cass scenario with low-ranked target classes, and also real- woold attack on the Google Cloud Vision API. Experimental results in these new scenarios suggest that evaluation in only the commonly adopted, easy scenarios cannot reveal the actual strength of different attacks, and may cause misleading comparative results. Additional experiments in Section 4.2 have shown the better performance of the simple transferable attacks than the state-of-the-arr tion 4.3 inspired by the observation that the generated perturbations themselves reflect specific target semantics, we use the simple Logit attack to generate targeted Universal Adversarial Perturbations (UAPs) in a data-free manner. In contrast, recent advances in targeted UAPs [16-19] relied on large-scale optimization over additional data.
inteesiee approaches. Finally, in Sec-
have inevitably
Overall, we hope our analysis of the weakness of commonly adopted attack settings and transfer scenarios will inspire more meaningful evaluation on targeted transferability.
2 Related Work
In this section, we review existing simple transferable attacks (Section 2.1 intensive transferable attacks (Section 2.2 Finally, we discuss related work on generating universal adversarial perturbations.
and also recent resource-
2.1 Simple Transferable Attacks
We refer to transferable attacks that require neither model training nor additional data, but only use iterative optimization on a single (original) image as simple transferable attacks. Simple transferable attacks have been extensively studied in the non- con-targeted case [2], and also attempted in the
targeted case 3 4 20). These attacks are commonly built up on the well-known Iterative- Fast Gradient Sign Method (I-FGSM) [21 which can be formulated as:
z = 2/41 = x
sign(Va.(zz/. v:)).
where x denotes the perturbed image in the i-th iteration, and yo is the target class label. In order to ensure the imperceptibility. the added perturbations are restricted with respect to some T.p distance, i.e., satisfying || ae' x æ=1p I e. Current transferable attack methods have commonly adopted the Toc
distance, but can also be easily adapted to the L2 distance based on an L2 normalization 23
For the loss function ...,). .). most simple transferable attacks have adopted the Cross-Entropy (CE) loss. However, the CE loss has been recently shown to be insufficient in the targeted case due to its
decreasing gradient problem [20]. To address this problem, the authors in (20) have proposed the
Po+Trip loss, in which the Poincaré distance was used to adapt the gradients' magnitude:
Lp = (, v) = arccosh(1 + 5(u, v)),
2. 1 v
1(x')
8(u, 1) =
"
v = max 5, [[<x'']]
(1
where u is the normalized logit vector and is the one-hot vector with respect to the target class. E 10-5 is small constant ensure numerical stability. The following triplet loss is also integrated for pushing the image away from the original class while pulling it into the target class:
[(xx') ~11
LTrip DD(((')). vi) D(I(='), vo) + +r, D(1(z'), v) = [[((x') 1| 1
(3)
The overall loss function is then formulated as LpotTrip = Lro + XLTrip Note that in the original work, Po+Trip was evaluated the commonly adopted, easy ensemble transfer scenario, which only involves models with similar architectures.
2

---

developed based on the assumption that preventing the attack optimization from overfitting to the specific source model can improve transferability.. Such transfer methods can be easily plugged into different attacks without modifications, in contrast the above methods that need to apply new attack loss functions. In this paper, we consider three A 6 literature, as described the following text.
In addition to devising new loss functions, there are other transfer methods 6 8 9
[ of such transfer methods that have been widely used in the
Momentum Iterative-FGSM (MI-FGSM) [4] integrates momentum term, which accumulates previous gradients in order to achieve more stable update directions. It can be expressed as:
V Va V V will 2(41 x - (g.
9 p. 9,
(4)
where 9; is the accumulated gradients at the i-th iteration, and μ is a decay factor. Another similar technique that instead uses the Nesterov accelerated gradient was explored in [9].
Translation Invariant-FGSM (TI-FGSM) 6 randomly translates the input image during attack optimization in order to prevent the attack from overfitting to the specific source model. This approach inspired by the data augmentation techniques used for preventing overfitting normal model training. Instead of calculating gradients for multiple translated images separately, the authors have proposed an approximate solution to accelerate the implementation, is achieved by directly computing locally smoothed gradients on the original image via convolution with kernel:
(5) where W is the convolution kernel used for smoothing. TI-FGSM was originally designed for boosting transferability with adversarially-traines models as target models and has been recently shown that a smaller kernel size should be used when transferring to normally-trained models [12).
2/41 x a sign( W * aar y:)),
Diverse Input-FGSM (DI-FGSM) g follows a similar idea to TI-FGSM, but applies random resizing and padding for data augmentation. Another important difference is that DI-FGSM ran- domizes augmentation parameters over iterations rather than fixing them as TI-FGSM. The attack optimization of DI-FGSM can be formulated as:
2 = x a (V (T p).
(6)
where the stochastic transformation T(x', p) is implemented with probability p at each iteration. In Section 4.1 we demonstrate that simple transfer attacks with these three transfer methods can actually achieve surprisingly strong targeted transferability in a wide range of transfer scenarios.
2.2 Resource-Intensive Transferable Attacks
Due to the broad consensus that achieving targeted transferability is extremely difficult, recent researchers have resorted to resource-intensing approaches that require training target-class-pecifff models large-scale additional data. Specifically, the Feature Distribution Attack (FDA) [14] follows the same attack pipeline as the above simple transferable attacks, but requires auxiliary classifiers that have been trained additional labeled data as part of the source model. Each auxiliary classifier is a small, binary, one-versus-all classifier trained for a specific target class at a specific layer.
That is to say, the number of auxiliary classifiers is the number of layers that probed multiplied by
the number of target classes that are required to model 14] The attack loss function of FDA can be formulated as:
[i(('') Fi(x))22
LEDA= J(Fi(x)),
[
where each auxiliary classifiers (-) can model the probability that feature map at layer / is from specific target class Vr. FDA (N)) [15] extends FDA by aggregating features from L layers and also incorporating the cross-entropy loss H.,,)) of the original network F(.). The loss function of FDA 4xent can be expressed as:
LEDA +aent
=Σ A(LLDA (((L where Σ4=1. IEL
(8)
IEL
Very recently, TTP 16] has achieved state-of-the-arr targeted transferability by directly generating perturbations using claget-class-specifie GANs that have been trained via matching the distributions of
3

---

perturbations and a specific target class both globally and locally. Specifically, the global distribution matching is achieved by minimizing the Kullback Leibler (KL) divergence, and the local distribution matching is by enforcing the neighbourhood similarity. In order to further boost the performance, data augmentation techniques, such as image rotation, crop resize, horizontal flip, color jittering and gray-scale transformation, have been applied during model training. We refer the readers to [16] for more technical details of TTP.
These two transferable attacks, FDA FDA(N) +xent and TTP, are resource intensive due to the use of large- scale model training and additional data. However, in Section 4.2 we show that simple transferable attacks, which require neither model training nor additional data, can actually achieve even better performance than them.
2.3 Universal Adversarial Perturbations
Previous research has shown the existence of Universal Adversarial Perturbations (UAPs), i.e., a single image perturbation vector that fools classifier on multiple images [24]. UAPs have been extensively studied for non-targeted attacks (2 but also explored in the more challenging. targeted case 197. Although recent studies have shown comparable performance of using reconstructed class impressions
[25] or proxy datasets [18] to original training data, large-scale optimization over image data is still necessary for most existing methods. Differently, a data-free approach [26] has been proposed for non-targeted UAPs by iteratively optimizing randomly-initializz perturbations with objective of disrupting the intermediate features of the model multiple layers. However, this approach cannot be applied to targeted UAPs because targeted perturbations aim at specific direction but not random disruption in the non-targeted case. To bridge this gap. in Section [.3] we demonstrate how the simple Logit attack can be used to generate targeted UAPs in a data-free manner.
3 New Insights into Simple Transferable Attacks
In this section, we revisit simple transferable targeted attacks, and provide new insights into them. Specifically, we demonstrate that simple transferable attacks that are based on existing transfer methods (TI-, MI-, and DI-FGSM) need more iterations to converge, and attacking with a simple logit loss can yield much better results than the commonly adopted Cross-Entropy (CE) loss.
3.1 Existing Transfer Methods with More Iterations Yield Good Results
Existing attempts have concluded that using simple transferable attacks to achieve targeted trans- ferability is extremely difficult 3 13515. However, these attempts have been limited to the MI transfer method. Here, we tested all the three transfer methods. As can be seen form Figure [ integrating all the three transfer methods leads to the best performance. In particular, we find that using only DI can actually yield substantial targeted transferability, while using only TI MI makes little difference to the original poor targeted transferability. The fact that DI outperforms TI may be explained by the fact that DI randomizes the image augmentation parameters over iterations rather than fixing them as in TI. In this way. the gradients towards the target class become more generic and so avoid overfitting to the white-box source model. MI is essentially different from DI and TI because it can only stabilize update directions but not serve to achieve more accurate gradient directions towards a specific (target) class.
As we have pointed out in Section T. common practice of generating transferable targeted pertur- bations 13 15 20) has limited the attack optimization to few iterations (typically < 20). This is somewhat understandable given that extensive research on non-targeted transfcrability has done the same. However, as can be seen from Figure T. targeted attacks actually require much more iterations to converge to optimal transferability, in contrast to the fast convergence of non-targeted attacks. This implies that evaluating the targeted transferability under only few iterations is problematic. On the one hand, comparing different optimization processes that have not converged is not meaningful and may cause misleading comparisons (see evidence in Section 4.1) This observation consistent with the evaluation suggestion in 29 that restricting the number of iterations without verifying the attack convergence is one of the common pitfalls in evaluating adversarial robustness. Several advanced defenses have been defeated by simply increasing the number of iterations (30] On the other hand,

---

100
100
100
am
wb.
Lo
wb
lngt logt_ho
Success Rate (96)
80
G-3
Confidence (9%
80
bo
Ranking (th)
80
CF
Loch-788 bat.
40-
20-
20
100
200
200
Iterations
Iterations
0
100 150
300
Figure 2: White-box (wb) and black-box (bb) attack performance in terms the predicted confidence (left, higher is better) and ranking (right, lower is better) of the target class.
Iterations
Figure 1: Transfer success rates of simple transferable attacks using CE or logit loss in the non-targee targeee and targeted scenarios.
considering the realistic threat model, it is not meaningful artificially restrict the computational power of practical attack (e.g., to fewer than several thousand attack iterations) 33
3.2 A Simple yet Strong Logit Attack
Existing simple transferable attacks have commonly adopted the Cross-Entropy (CE) loss. However, as pointed out (20), during the attack optimization, the CE loss will cause the gradient to decrease and tend to vanish as the number of iterations is increased. To address this problem, the Po+Trip loss [20) takes a very aggressive strategy by arbitrarily reversing the decrease the gradient, i.c., gradually increasing the magnitude of the gradients over iterations. However, argue that this operation has led to too large step size, and as a result cause the attack optimization to overshoot the minima. Our results in Section 4.1 support this argument by showing that Po+ Trip even yielded worse results than CE in the ensemble transfer scenario with diverse model architectures, since the loss surface relatively non-smooth.
Here, for the loss function, we eliminate the final softmax function used in the CE loss and just backpropagate the gradients from the logit output:
Logit -1(2').
where le)) denotes the logit output with respect to the target class. Although the idea of attacking logits new, its superior performance in targeted transferability has not been recognized far. We also find that using the well-known logit-based loss, C&W W (32). yields consistently worse results (see detailed comparisons in Appendix A). Another logit loss that is similar the C& W loss has also been adopted by [18], but in the task of generating UAPs with large-scale data.
Below, show that this logit loss leads stronger gradients than the CE loss. As can be observed from Equation TO the gradient of the CE loss with respect to the target logit input, 21, will mono- tonically decrease as the probability of the target class, Pt. increases during attack optimization. In addition, due to the use of the softmax function, Pt will quickly reach 1, and as a result the gradient tends to vanish. This phenomenon makes the attack hard improve even with more iterations applied. Differently, as shown by Equation I1 the gradient of the logit loss equals a constant. In this way, the attack can keep improving as the number of iterations is increased. In Appendix B, we provide further comparisons on the trends of loss/gradient magnitude and the target logit value over iterations, which show that the logit loss leads to better results than both CE and Po+Trip.
e )=
LCE -1 log(pt) logg(
24 log( Σ e²
Ees
(10)
OLCE -1 Olog E es)) 0z,
e²
- +
-1 + Pt.
de
dz
Σ e
TT -
L Logit
2z,
(11)
dz
5

---

Table 1: Targeted transfer success rates (%) in the single-model transfer scenario. We consider three attacks with different loss functions: cross-entropy (CE), Poincaré distance with Triplet loss (Po+Tripp 20), and the logit loss. Results with 20/100/300 iterations reported.
Source Model: Res50
Source Model: Dense121
Attack
+Dense121
VVGGG
->Inc-v3
-Res500
+VGG1
-Inc-v3
CE
26,9/39 46/2.6
17.3/27.3/30.4
2.4/3.8/4.1
13.1/17.3/19.4
7.7/10.8/10,9
1.9/3.3/3.5
Po+Trip
06.7/53.0/54.7
18.8/34.2/34.4
2.9/6.0/5.9
10.1/14.7/14.7
6.7/8.3/7.7
2.1/3.0/2.7
Logit
29.3/63.3/7..5
24.0/55.7/62.7
3.0/7.2/9.4
17.2/39.7/43.7
13.5/35.3/38.7
2.7/6.9/7.6
Source Model: VGG16
Source Model: Inc-v3
Attack
RRes50
Densel11
-Incvv3
~Res50
12ense121
VVGG1
CE
0.7/0.4/0.6
0.5/0.3/0.1
0/0.1/0
0.6/2.1/2.4
0.8/2.5/2.9
0.7/1.6/2.0
Po+Trip
0.6/0.8/0.5
0.6/0.6/0.7
1/0.0
0.6/2.0/2.5
0.8/3.1/3.3
0.5/2.1/2.0
Logit
3.3/8.7/11.2
3.6/11.7/13.22
0.2/0.7/0.9
0.8/1.6/2.9
1.2/2.8/5.3
0.7/2.2/3.7
Experimental Evidence on Simple Transferable Attacks
In this section, we provide experimental evidence to show the general effectiveness of simple transferable attacks. Firstly, in Section 4.1 we evaluate the simple transferable attacks in a variety of transfer scenarios, including single-model transfer, ensemble transfer (easy and challenging scenarios), a worse-case scenario with low-ranked target classes, and a real-world attack on the Google Cloud Vision API. Then, in Section 4.2 we compare the simple transferable attacks with two otate-of-the-art resource-intensive transferable attacks, FDA (M) +xent [15] and TTP [16]. Finally, in Section 4.3 we apply the Logit attack achieving targeted UAPs in data-free manner.
Following recent work [4| 20]. we focus on targeted transferability of ImageNet-like images, which is known to be much more difficult than other data sets (e.g. MNIST and CIFAR-10) with smaller-size images and fewer classes, Specifically, we used the 1000 images from the development set of the MmageNet-CCopatiinn on Adversarial Attacks and Defenses. All these images are associated with 1000 ImageNet class labels and cropped to 299x299 before use. Our experiments were an NVIDIA Tesla P100 GPU with 12GB of memory.
Datase(" which was introduced along with the NIPS 2017 Competition
4.1 Simple Transferable Attacks in Various Transfer Scenarios
We tested three different attack losses: CE, Po+Trip 20 and Logit. All attacks used TI, MI, and DI with optimal hyperparameters provided in their original work. Specifically, || 5 was used for 'TI' as suggested by [12]. For each image, we used the target label that was officially specified in the dataset. If not mentioned specifically, all attacks were run with 300 iterations to ensure convergence. When being executed with batch size of 20, the optimization process took about three seconds per image. A moderate step size of 2 was used for all attacks, and the results were shown to be not sensitive to the setting of step size (see evidence in Appendix C). We considered four diverse classifier architectures: ResNet (33), DenseNet (34), VGGNet (35), and Inception [36]. Following the common practice, the perturbations were restricted by Loo norm with e 16.
Single-model transfer.
the targeted transferability when transferring between each pair of different model architectures. As can be seen, the logit loss outperformed CE and Po+Trip by large margin in almost all cases. When comparing different model architectures, we can find that the attacks achieved lower performance when transferring from the 6 or Inception-v3 than from ResNet50 or DenseNet121. This is consistent with the observations in [14 [5) and may be explained by the fact that skip connections ResNet50 and 2enseNet1 boosts transferability (37]. Another finding is that when using Inception-v3 the target model, the transfer success rates were always low. This might be explained by the heavily engineered nature of the Inception architecture, i.., the Inception architecture has multiple-size convolution and two auxiliary classifiers.
0/ ocapap/eeeaoaoooooooaaaaaaaaaoaa

---

Table 2: Targeted transfer success rates (%) in the commonly adopted, easy ensemble transfer scenario, where the hold-out target model (denoted by --) and the ensemble models share similar architectures. Results with 20/100 iterations are reported.
Attack
-Inc-v3
-Inc-v4
-IncRes-22
-Res50
-Res101
-Res152
Average
CE
48.8/85.3
47.2/83.3
47.5/83.9
50.9/89.8
58.5/93.2
56.7/90.7
51.6/87.7
Po+Trrp
59.3/84.4
55.0/82.4
51.4/80.8
56.9/85.0
60.5/87.9
57.6/85.7
56.8/84.4
Logit
56.4/85.5
52.9/85.8
54.4/85.1
57.5/90.0
64.4/91.4
61.3/90.8
57.8/88.1
100
ResNet50
100
100
100
Incva
Success Rate (%0
Lagit
Logit
Success Rate (96
Logt
Success (%)
Loge
80
CE
80
80
CE
CE
Pa+Trp
Success Rate
Po+TMp
Po-
Po+T71p
60
60
40-
40-
40
40
20:
20
20
0-
100
200
300
100
200
100
200
300
100
20c
300
Iterations
Iterations
Iterations
Iterations
Figure 3: Targeted transfer success rates (%) in our challenging ensemble transfer scenario, where
each hold-out target model shares no similar architecture with the source models used for ensemble.
Ensemble transfer in both easy and challenging scenarios. A common approach to further boost- ing transferability is to generate perturbations the common practice, we simply assigned equal weights to all the source models. We first look at the commonly adopted ensemble transfer scenario [4] 6 20 38 in which each hold-out target model shares a similar architecture with some of the white-box ensemble models. As can be seen from Table [ the transfer success rates of all three attacks have got saturated when given enough iterations to converge. As result, this transfer scenario could not fully reveal the actual strength of different attacks. We can also observe that Po+Trip performed better than the CE loss only when the attack optimization is unreasonably restricted to 20 iterations, but became even worse with enough iterations. This finding suggests that evaluating different attacks under only few iterations may cause misleading comparative results.
ensemble of white-box source models. Following
We next considered more challenging transfer scenario with no architectural overlap between the source ensemble models and the target model, in order to fully reveal the potential of different attacks. This scenario is also more realistic since it is hard for an attacker know the specific architecture of a real-world target mode. Figure 3 shows that in this scenario, the Logit largely outperformed CE and Po+Trip. In addition, the results of both CE and Logit were substantially improved over the single-model transfer results reported in Table [I However, Po+Trip performed even worst in some cases maybe because its use of arbitrarily increasing the gradient magnitude has caused the optimization to overshoot the minima in this ensemble transfer scenario where the loss surface relatively non-smooth due to the model diversity. Note that as in the single transfer scenario, transferring to Inception-và v3 is still the most difficult.
A worse-case transfer scenario with low- ranked target classes. In conventional security studies, comprehensive evalu- ation commonly involves a range of at- tack scenarios with varied difficulty. Ex- isting work on white-box ad adversarial at-
Table 3: Targeted transfer success rates (%) when vary- ing the target from the high-ranked class to low.
Attack
2nd
10th
200th
500th
800th
1000th
CE
89.9
76.7
49.7
43.1
37.0
25.1
tacks [32] 21 23 38) has also looked different cases with varied difficulty regard- ing the ranking position of the target class in the prediction list of the original image.
Po+Trip
82.6
77.6
58.4
53.6
49.1
38.2
Logit
83.8
81.3
75.0
71.0
65.1
52.8
Specifically, the best case, the targeted success is basically equal to non-targeted success, i.e., an attack is regarded to be successful as long as it can succeed any arbitrary target other than the original class. the average case, the target class is randomly specified, while in the worst case, the class.
target is specified as the
7

---

Table 4: Non-targeted and targeted transfer success rates (%) of different attacks on Google Cloud Vision.
Target class:
"analog doock'
Target cluss:
"mountain bike"
CE
Po+Trip
Logit
Figure 4: Successful targeted adversarial images on Google Cloud Vision generated by the Logit attack with ensemble transfer. More examples can be found in Appendix D.
Targeted Non-targeted
7
8
18
51
44
51
However, the best of our knowledge, current evaluation of transfer-based attacks has been limited to the best and average cases. To address this limitation, we consider worse-case transfer scenario by varying the target from the highest-ranked class gradually to the lowest one. As can be seen from Table 3 there exists a non-negligible correlation between the ranking position of the target class and the targeted transferability. More specifically, becomes increasingly difficult as the target moves down the prediction list. We can also observe that the results with higher-ranked targets might not reveal the actual strength of different attacks as in the more realistic, worse cases with lower-ranked targets. In particular, only looking the best case with the highest-ranked target may lead to misleading conclusion that CE leads to the most effective attack. This finding suggests that a more meaningful evaluation on targeted transferability should further increase difficulty beyond the current best and average cases.
Transfer- attacks on Google Cloud Vision. Most existing work on fooling real-world com- puter vision systems has been focused on the query-based attacks, where a large number of queries are required [39]41]. Although several recent studies have also explored real-world transfer- based attacks, they were limited to face recognition and the non-targeted attacks 44 In contrast, we applied the simple transferable attacks in the more challenging, targeted case on more generally- used image recognition system, the Google Cloud Vision API. Specifically, we used the targeted adversarial images generated on the ensemble of all four diverse source models with 300 iterations.
The API predicts list of semantic labels along with confidence scores. Specifically, only the top classes with confidence no lower than 50% are returned, and at most 10 classes are shown. Note that the confidence score here targeted and non-targeted transfcrability. Since all returned labels are with relatively high confidence (2 50%), we do not limit our measure of success rates only top-1 I class. Instead, for non-targeted success, we measured whether or not the ground-truth class appeared in the returned list, while for targeted success, whether or not the target class appeared. Due to the fact that the semantic label set predicted by the API does not exactly correspond to the 1000 ImageNet classes, we treated semantically similar classes as the same class.
a probability (which would sum one). We measured both the
Treporss the results averaged over 100 images that originally yield correct predictions. As can be seen, in general, achieving targeted transfer success is much more difficult than non-targeted success. In particular, the Logit attack achieved the best targeted transferability, with quasi-imperceptible perturbations shown in Figure Our results reveal the potential vulnerability of Google Cloud Vision against simple transfer-based attacks, which require no query interaction.
4.2 Simple vs. Resource-Intensive Transferable Attacks
In this subsection, we compared simple transferable attacks with state-of-the-art resource-intensive models
approaches, TTP [16] and FDA (N) [15. which necessitate training on additional data.
Compared with TTP. We compared the Logit attack with the state-of-the-a TTP, which based on training surget-caas-speciffe GANs on additional data. We tested both Logit and TTP on our dataset following the "10-Targets (all-source)" setting in [16). We chose ResNet50 as the white-box model in the single-model transfer scenario and an ensemble of ResNet 18. 500 101,152} } in the ensemble transfer scenario. DenseNet121 and VGG16_br are tested as the target models. Note that the same knowledge of the white-box model is available to both attacks but it is leveraged in different ways.
8

---

Specifically, for the Logit attack, the white-box model is used as source model for iterative attack optimization, while for TTP, it used as discriminator during training the GANs.
As shown in Table 5 under the commonly adopted 16, the Logit attack can achieve comparable results to TTP in all cases. Specifi- cally, we can observe that the model ensemble is more helpful to Logit than for TTP. This might be because even with the single model as the discriminator, TTP can leam good enough fea- tures of target semantics by training with the objective of matching the perturbation and tar- get class distributions with large-scale data. The clearer target semantics learned by TTP can be confirmed by comparing the unbounded pertur- bations achieved by TTP (e.g.. Figure in (16]) with those by the Logit shown in Figure
Table 5: Targeted transfer success rates (%) of Logit vs. TTP in single-model and ensemble trans- fer scenarios under two norm bounds.
Bound
Attack
D121
V16
D121-ens
V16-ens
TTP
79.6
78.6
92.9
89.6
Logit
75.9
72.5
99.4
97.7
TTP
37.5
46.7
63.2
66.2
Logit
44.5
46.8
92.6
87.0
This fact that TTP perturbations heavily rely on semantic patterns of the target class might cause TTP to degrade under lower norm bounds. To validate this assumption, we further compared Logit and TTP under c very large margin in the ensemble transfer scenario. The different comparing results for the two perturbation sizes also suggest that comparing attacks only under a single perturbation size may not reveal their characteristics.
As expected, the Logit attack consistently surpassed TTP, especially with
"com"
"peacock"
"tennis ball"
Table 6: Targeted transfer success rates (%) of unbounded adversarial images by different attacks with the same iteration budget.
FDA(1) *xent
CE
Po+Trip
Logit
Res50- 121
65.8
69.3
88.1
84.1
Figure 5: Unbounded adversarial examples that reflect target semanties. More examples can be found in Appendix E.
Res50~VVG116
4
54.1
67.8
74.2
Compared with FDA 4xent. We compared the three simple transferable attacks (CE, Po+Trip, and Logit) with FDA +x)nt on generating unbounded adversarial images, in consistence with "distal transfer" in 15 Specifically, the adversarial perturbations were initialized as random Gaussian noise and allowed to be as large as possible. Although such unbounded adversarial images may not be practically compelling, they can provide better isolated indication on transferability by climinating the dependency on the source images and the bound restrictions. The results were averaged over 4000 image examples, each of which was optimized towards a random target class. As suggested by [T5], the MI transfer method was removed since empirically harms the performance in this unbounded case.
Table/]]sowe that all the three simple transferable attacks achieved stronger targeted transferability than FDA 4xx)nt... As can be seen from Figure 5 the unbounded adversarial perturbations can somehow reflect the target semantics. This finding suggests that achieving targeted transferability relies on robust, semantic features [45] that are expected to be learned by various models and also understood by humans. In this way, achieving targeted transfcrability is fundamentally different from non-targeted transferability, for which attacking non-robust features is known to be sufficient [45). is also worth noting that in practical scenarios with small norm bounds, the semantically-aiii -aligned perturbations would not be expected to change human judgements.
4.3 Simple Logit Attack for Targeted UAPs in Data-Free Manner
The above observation that the perturbations can reflect certain target semantics motivates us to apply the Logit attack to achieving targeted Universal Adversarial Perturbations (UAPs), which can drive multiple original images into a specific target class. Existing attempts at achieving targeted UAPs have mainly relied on large-scale optimization over additional data [1-19. However, the
We conducted comparisons only in this setting since the authors have not (yet) released their source code.

---

peacock
panda
CF
Table Success rates (%) of targeted UAPs generated by CE and Logit attacks for differ- ent models.
Attack
Inc-v3
Res50
Dense121
VGG16
Loga
CE Logit
2.6
9.2
8.7
20.1
4.7
22.8
21.8
65.9
Figure 6: UAPs 16, VGG16) with differ- ent classes using CE and Logit. More exam- ples can be found in Appendix F.
simple Logit attack can be easily extended to generate targeted UAPs in data-free manner. The only difference from the above transferable Logit attack that here a mean image (all pixel values set as 0.5 out of [0,1]) is used as the original image.
In our experiment, for each target class, we generated single targeted UAP vector (e 16) with 300 iterations and applied it to all 1000 images in our dataset. 7 the results averaged over all the 1000 ImageNet classes. As can be seen, the logit loss can yield substantial success, remarkably outperforming the CE loss. This can be confirmed by Figurefo which shows the Logit attack can yield more semantically-alinnes perturbations than CE. This observation also supports the claim from [8]] that universal perturbations contain dominant features, and images act like noise with respect to perturbations.
Conclusion and Outlook
In this paper, have demonstrated that achieving targeted transferability is not difficult current work concludes. Specifically, we find that simple transferable attacks can actually achieve surprisingly strong targeted transferability when given enough iterations for convergence. We have validated the effectiveness of simple transferable attacks a wide range of transfer scenarios, including three dewly-inrroduced challenging scenarios. These challenging scenarios have better revealed the actual strength of different attacks. In particular, we demonstrate that a very simple Logit attack is superior in all transfer scenarios, achieving even better results than the state-of-the-ar resource-intensive approaches. We also show the potential usefulness of the Logit attack for generating targeted universal adversarial perturbations in data-free manner. Overall, we hope our findings will inspire future research to conduct a more meaningful evaluation on targeted transferability. Our future work will focus on studying why different model architectures yield different transferability. In particular, the very low success rates when targeting Inception-v3 should be explored. Moving forward, there needs to be more comprehensive discussion on the resource consumption of different attacks from multiple aspects, such as training and inference time, hardware resources, and data size.
Strong transferability can obviously benefit black-box applications of adversarial images for social good, such as protecting user privacy [2 43 46] In addition, it will also motivate the community design stronger defenses given our finding that even simple attacks can generate highly transferable adversarial images. It remains a possibility that our methodology may be misused by malicious actors to break legitimate systems. However, we firmly believe that the help that our paper can provide to researchers significantly outweighs the help that it may provide an actual malicious actor.
Acknowledgments
This work was carried out on the Dutch national e-infrastructure with the support of SURF Coopera- tive.
10

---

References
[1] Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, lan Good- fellow, and Rob Fergus. Intriguing properties of neural networks. In ICLR, 2014.
[2] Ian Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. In ICLR, 2015.
[3] Yanpei Liu, Xinyun Chen, Chang Liu, and Dawn Song. Delving into transferable adversarial examples and black-box attacks. ICLR, 2017.
[4] Yinpeng Dong, Fangzhou Liao, Tianyu Pang, Hang Su, Jun Zhu, Xiaolin Hu, and Jianguo Li. Boosting adversarial attacks with momentum. In CVPR, 2018.
[5] Wen Zhou, Xin Hou, Yongjun Chen, Mengyun Tang, Xiangqi Huang, Xiang Gan, and Yong Yang. Transferable adversarial perturbations, In ECCV, 2018.
[6] Yinpeng Dong. Tianyu Pang, Hang Su, and Jun Zhu. Evading defenses to transferable adversarial examples by consslatio-invariinn attacks. In CVPR, 2019.
[7] Qian Huang, Isay Katsman, Horace He, Zeqi Gu, Serge Belongie, and Ser-Nam Lim. Enhancing adversarial example transferability with an intermediate level attack. In ICCV, 2019.
[8] Cihang Xie, Zhishuai Zhang, Yuyin Zhou, Song Bai, Jianyu Wang. Zhou Ren, and Alan L Yuille. Improving transferability of adversarial examples with input diversity. In CVPR, 2019.
[9] Jiadong Lin, Chuanbiao Song, Kun He, Liwei Wang, and John E Hopcroft. Nesterov accelerated gradient and scale invariance for adversarial attacks. In ICLR, 2020.
[10] Yingwei Li, Song Bai, Yuyin Zhou, Cihang Xie, Zhishuai Zhang, and Alan Yuille. Learning transferable adversarial examples via ghost networks. In AAAI, 2020.
[11] Weibin Wu, Yuxin Su, Xixian Chen, Shenglin Zhao, Irwin King, Michael R Lyu, and Yu- Yu-Wing Tai. Boosting the transfcrability of adversarial samples via attention. In CVPR, 2020.
[12] Lianli Gao, Qilong Zhang, Jingkuan Song. Xianglong Liu, and Heng Tao Shen. Patch-wise attack for fooling deep neural network. In ECCV, 2020.
[13] Nathan Inkawhich, Wei Wen, Hai Helen Li, and Yiran Chen. Feature space perturbations yield more transferable adversarial examples. In CVPR, 2019.
[14] Nathan Inkawhich, Kevin Liang, Lawrence Carin, and Yiran Chen. Transferable perturbations of deep feature distributions. In ICLR, 2020.
[15) Nathan Inkawhich, Kevin J Liang, Binghui Wang, Matthew Inkawhich, Lawrence Carin, and Yiran Chen. Perturbing across the feature hierarchy to improve standard and strict blackbox attack transfcrability. In NeurIPS, 2020.
[16) Muzammal Naseer, Salman Khan, Munawar Hayat, Fahad Shahbaz Khan, and Fatih Porikli. On generating transferable targeted perturbations. In ICCV, 2021.
[17] Omid Poursaeed, Isay Katsman, Bicheng Gao, and Serge Belongie. Generative adversarial perturbations. In CVPR, 2018.
[18] Chaoning Zhang, Philipp Benz, Tooba Imtiaz, and In So Kweon. Understanding adversarial examples from the mutual influence of images and perturbations. In CVPR, 2020.
[19] Philipp Benz, Chaoning Zhang, Tooba Imtiaz, and In So Kweon. Double targeted universal adversarial perturbations. In ACCV, 2020.
[20] Maosen Li, Cheng Deng, Tengjiao Li, Junchi Yan, Xinbo Gao, and Heng Huang. Towards transferable targeted attack. In CVPR, 2020.
[21] Alexey Kurakin, Ian Goodfellow, and Samy Bengio. Adversarial examples in the physical world. In ICLR, 2017.

---

[22] Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. In ICLR, 2018.
[23] Jérôme Rony, Luiz G. Hafemann, Luiz S. Oliveira, Ismail Ben Ayed, Robert Sabourin, and Eric Granger. Decoupling direction and norm for efficient gradient-based Lg adversarial attacks and defenses. In CVPR, 2019.
[24]
Seyed-Mohsen Moosavi-Dezfonl Alhussein Fawzi, Omar Fawzi, and Pascal Frossard. Univer- sal adversarial perturbations. In CVPR, 2017.
[25] Konda Reddy Mopuri, Phani Krishna Uppala, and R Venkatesh Babu. Ask, acquire, and attack: Data-free UAP generation using class impressions. In ECCV, 2018.
[26] Konda Reddy Mopuri, Aditya Ganeshan, and R Venkatesh Babu. Generalizable data-free objective for crafting universal adversarial perturbations. IEEE TPAMI, (166) 2018.
[27] Muzammal Nascer, Salman H Khan, Harris Khan, Fahad Shahbaz Khan, and Fatih Porikli. Cross-domain transferability of adversarial perturbations. In NeurlPS, 2019.
[28] Yingwei Li, Song Bai, Cihang Xie, Zhenyu Liao, Xiaohui Shen, and Alan L Yuille. Regional homogencity: Towards learning transferable universal adversarial perturbations against defenses. In ECCV, 2020.
[29] Nicholas Carlini, Anish Athalye, Nicolas Papernot, Wieland Brendel, Jonas Rauber, Dimitris Tsipras, Ian Goodfellow, Aleksander Madry, and Alexey Kurakin. On evaluating adversarial robustness. In arXiv preprint arXiv: 190200605, 2019.
[30] Florian Tramer, Nicholas Carlini, Wieland Brendel, and Aleksander Madry. On adaptive attacks adversarial example defenses. In NeurlPS, 2020.
[31] Anish Athalye, Nicholas Carlini, and David Wagner. Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples. In ICML, 2018.
[32] Nicholas Carlini and David Wagner. Towards evaluating the robustness of neural networks. In IEEE S&P, 2017.
[33] Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In CVPR, 2016.
[34] Gao Huang, Zhuang Liu, Laurens Van Der Maaten, and Kilian Q Weinberger. Densely connected convolutional networks. In CVPR, 2017.
[35] Karen Simonyan and Andrew Zisserman. Very deep convolutional networks for large-scale image recognition. In ICLR, 2015,
[36] Christian Szegedy, Vincent Vanhoucke, Sergey Ioffe, Jon Shlens, and Zbigniew Wojna. Re- thinking the inception architecture for computer vision. In CVPR, 2016.
[37] Dongxian Wu, Yisen Wang, Shu-Tao Xia, James Bailey, and Xingjun Ma. Skip connections matter: On the transferability of adversarial examples generated with resnets. In ICLR, 2020.
[38] Florian Tramèr, Alexey Kurakin, Nicolas Papernot, Ian Goodfellow, Dan Bonch, and Patrick McDaniel. Ensemble adversarial training: Attacks and defenses. In ICLR, 2018
[39] Pin- Yu Chen, Huan Zhang, Yash Sharma, Jinfeng Yi, and Cho-Jui Hsieh. Zoo: Zeroth order optimization based black-box attacks to deep neural networks without training substitute models. In AfSec, 2017.
[40] Wieland Brendel, Jonas Rauber, and Matthias Bethge. Decision-based adversarial attacks: Reliable attacks against black-box machine learning models. In ICLR, 2018.
[41] Andrew Tlyas, Logan Engstrom, Anish Athalye, and Jessy Lin. Black-box adversarial attacks with limited queries and information. In ICML, 2018.
12

---

[42] Valeriia Cherepanova, Micah Goldblum, Harrison Foley, Shiyuan Duan, John Dickerson, Gavin Taylor, and Tom Goldstein. LowKey: Leveraging adversarial attacks to protect social media users from facial recognition. In ICLR, 2021.
[43] Arezoo Rajabi, Rakesh Bobba, Mike Rosulek, Charles Wright, and Wu-chi Feng. On the (im) practicality of adversarial perturbation for image privacy. PoPETs, 2021.
[44] Shawn Shan, Emily Wenger, Jiayun Zhang, Huiying Li, Haitao Zheng, and Ben Zhao. Fawkes: Protecting privacy against unauthorized deep learning models. In USENIX Security, 2020.
[45] Andrew llyas, Shibani Santurkar, Dimitris Tsipras, Logan Engstrom, Brandon Tran, and Aleksander Madry. Adversarial examples are not bugs. they are features. In NeurlPS, 2019.
[46] Martha Larson, Zhuoran Liu, Simon Brugman, and Zhengyu Zhao. Pixel privacy: Increasing image appeal while blocking automatic inference of sensitive scene information. In MediaEval Multimedia Benchmark Workshop. 2018.
[47] Zhuoran Liu, Zhengyu Zhao, and Martha Larson. Who's afraid of adversarial queries? the impact of image modifications on content-based image retrieval. In ICMR, 2019.
[48] Seong Joon Oh, Mario Fritz, and Bernt Schiele. Adversarial image perturbation for privacy protection a game theory perspective. In ICCV, 2017.
Checklist
1. For all authors...
(a) Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope? [Yes]
(b) Did you describe the limitations of your work? [Yes] We described the limitation in
the first sentence of the final section.
(c) Did you discuss any potential negative societal impacts of your work? [Yes] We discuss them at the end of the final section.
(d) Have you read the ethics review guidelines and ensured that your paper conforms to them? [Yes]
2. If you are including theoretical results...
(a) Did you state the full set of assumptions of all theoretical results? [N/A]
(b) Did you include complete proofs of all theoretical results? [N/A]
3. If you ran experiments..
(a) Did you include the code. data, and instructions needed to reproduce the main ex- perimental results (either in the supplemental material or as URL)? [Yes] The code (including instructions and a link to data we have used) has been submitted as the supplemental material.
(b) Did you specify all the training details (e.g., data splits, hyperparameters, how they were chosen)? [Yes] Our experiments did not involve any model training, but all the algorithm details were specified.
(c) Did you report error bars (e.g., with respect to the random seed after running experi- ments multiple times)? [No] We fixed the random seed for all the experiments. Now the main randomness comes from the p in the existing method, DI (see Eq. 6). We confirm that it has little impact on the results.
(d) Did you include the total amount of compute and the type of resources used (e.g., type of GPUs, internal cluster, or cloud provider)? [Yes] We mentioned the run time of the attacks and our hardware settings in Section
4. If you are using existing assets (e.g., code, data, models) or curating/releasing new assets...
(a) If your work uses existing assets, did you cite the creators? [Yes] In Section
(b) Did you mention the license of the assets? [Yes] In footnote of Section
13

---

(c) Did you include any new assets either in the supplemental material or as a URL? [N/A] We did not use any new assets.
(d) Did you discuss whether and how consent was obtained from people whose data you're 're using/curating? [Yes] In the same footnote above.
(e) Did you discuss whether the data you using/curating contains personally identifiable information or offensive content? [Yes] In the same footnote as above.
5. If you used crowdsourcing or conducted research with human subjects...
(a) Did you include the full text of instructions given to participants and screenshots, applicable? [N/A]
(b) Did you deseribe any potential participant risks, with links to Institutional Review Board (IRB) approvals, applicable? [N/A]
(c) Did you include the estimated hourly wage paid to participants and the total amount spent on participant compensation? [N/A]
14


Reviews:
[{"review_id": "VNFbP8H1JY-", "reviewer": "Reviewer_Q2rC", "summary": "The authors emphasize in this work that a simple logit loss attack may achieve competitive results as a targeted attack assuming a high number of iterations. The authors aim to alert the community in common attacks evaluation practices weakness.", "questions": "", "limitations": "", "rating": 7, "confidence": 2, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "The paper is very clear, easy to follow, and introduces relevant related work. To the best of my knowledge, their contribution is original as it highlights the transferability potential of attacks with various loss functions (including author proposal) in the context of 100 (and above) iterations.", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "Authors provide experiments results. However, as often in this field, they do not document any theoretical proof. Also, the authors claim: “directly using the C&W loss performs worse than [proposed] logit loss. For example, in the single-model transfer setting with the ResNet50 as the white-box source model, the C&W loss yields 20% worse performance on average” I would suggest documenting this further.\n\nThe author’s experiments are under an epsilon value of 16/255; I encourage them to provide some results with a lower value (e.g 8/255) as transferability may be more challenging with a less noticeable perturbation.\n\n\n\n", "review_text": "", "extra_scores": {"needs_ethics_review": "No", "ethics_review_area": "", "time_spent_reviewing": "3"}, "extra_text": {}}, {"review_id": "DzUYye3vRQk", "reviewer": "Reviewer_1r48", "summary": "This work introduces techniques to improve the targeted transferability of adversarial examples. The authors mainly propose to use the simple logit loss for this purpose. The transferability is evaluated in three scenarios, including a real-world attack against the Google Cloud Vision API. The technique is also shown in the context of universal adversarial perturbations.", "questions": "", "limitations": "", "rating": 6, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "## Originality\nThe originality of this work is rather limited and it is not clearly distinguishable from previous works. I will elaborate in the following:\n\n### Increased number of attack iterations increases targeted transferability\nTo the best of my knowledge, this is the first work pointing out this phenomenon. But in the end, this is “just” a hyper-parameter choice, and therefore not much of a novelty. As the authors correctly noted, each work should verify the correct choice of hyperparameters [30]. Hence, it is less a merit of this work, but more of a fault of previous works. Anyway, this message should be communicated to the community, and I appreciate the author's effort in doing so, but I would not consider this a major novelty or contribution of this work. \n\n### Logit Loss\nThe introduced logit loss is indeed not new and similar to the C&W loss. The authors describe that the C&W is less efficient than the used logit loss, however, they fail to provide qualitative results and to describe their exact setup. It is therefore difficult to judge their assessment (line 192). The C&W loss has a parameter c manipulating the “overshoot” of the highest logit in the targeted scenario, which was initially introduced to limit the perturbation magnitude. This parameter, therefore, introduces a trade-off between the attack strength (or worse-case performance similar to Table 3) and the perturbation magnitude. Setting c to large values (ideally infinity), lets the targeted logit increase in an unbounded manner, very similar to the used logit loss. The main difference remains that the second-highest logit is still taken into account in the optimization process in the C&W loss. I would have valued a more in-depth analysis and discussion of the loss functions: For example, testing the targeted transferability and resulting perturbation magnitude with the C&W loss over increasing c-values, compared to the used logit loss.\n\n### Evaluation scenarios \nI appreciate the thorough evaluation of the different scenarios in Sec. 4.1. Especially the worse-case transfer setting with low-ranked target classes is insightful. Also, a real-world attack on the Google Cloud Vision API is interesting and emphasizes the need for research on adversarial examples. I value this as a contribution of this work, which can be a good evaluation template for future works. \n\n### Data-free and training-free targeted UAPs\nI do not agree with the authors' claim that their approach is training-free since an optimization (training) for “300 iterations“ (line 340) is still required. [19] also optimizes the perturbation directly, without training a separate network. [19] also tested a logit loss (see [19] Table 2). In fact, I can not distinguish the proposed approach from [19], and the authors failed to provide such a distinction and in which sense the shown approach is novel. The authors should clarify that, and ideally, provide a direct comparison with [19].\n\n## Quality\nOverall, the quality of this work is good. As mentioned above, a few claims are not well supported, such as the inferior performance of the C&W loss or the training-free statement of UAPs. \n\n## Clarity: \nOverall, this work is well written and organized and includes supplementary material.  \n\n## Significance: \nThe results are somewhat important. For one, this work notes again that researchers should follow common guidelines when testing attacks. I believe that future researchers might use the logit loss and an increased number of iterations for targeted attacks. \n\nOverall, this paper is difficult to judge. On the positive side, the paper is well written with a good evaluation of the targeted attacks. However, the technical contribution is rather limited and the paper is vague at some points (Evaluation of the C&W loss) or makes wrong claims (training-free). Hence I am judging this paper as marginally below the acceptance threshold, but am looking forward to the author's rebuttal to address my concerns and the other reviewers' opinions. ", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "The authors did not properly state the limitations of their work, nor provided a paragraph about the social impact. \n", "review_text": "", "extra_scores": {"ethical_concerns": "No ethical concerns regarding this work.\n", "needs_ethics_review": "No", "ethics_review_area": "", "time_spent_reviewing": "2.5"}, "extra_text": {}}, {"review_id": "CfPcZwjN3rw", "reviewer": "Reviewer_ML4S", "summary": "For the targeted attack in transferable and universal settings, this work has two major findings: (1) longer iteration is beneficial for improving the performance; (2) logit loss is more powerful than common CE loss.\n", "questions": "", "limitations": "", "rating": 4, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "Originality: limited. The two contributions in the summary have already been widely known. Longer iteration is useful for improving performance. For example, in most UAP related papers, they use longer iterations to either directly optimize the UAP or training a generative network. In the specific task of transferable attack, [1] has shown the same effect. Even we assume that no one has reported this phenomenon, this is no more than a parameter-tuning. Longer training increases the performance, which is well expected. Regarding the second contribution, logit loss and other loss has been proposed in [2,3]. It is suggested that the authors clearly discuss these losses in previous works unless the authors intend to claim logit loss is first proposed in this paper and no other works have attempted to propose similar losses.\n\nQuality: The writing quality is excellent.\nClarity: Very clear. Easy to understand\nSignificance: At least not very significant to me but it is also not a weakness because this work attempts to solve an interesting problem with solid results\n\n[1] Boosting Transferability of Targeted Adversarial Examples via Hierarchical Generative Networks. Link:https://arxiv.org/pdf/2107.01809.pdf\n[2] Understanding adversarial examples from the mutual influence of images and perturbations. CVPR2020\n[3] Cross-domain transferability of adversarial perturbations. \n", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "Overall, this paper is written well and easy to understand. The main limitations of this work are as follows:\n(a) low novelty. Neither longer iteration or logit loss is novel to me (I might be biased).\n(b) claiming logit loss as the main technical finding without clearly discussing similar losses in previous works. If logit loss is not first proposed in this work, the authors should be clear on it. \n(c) What about results on other benchmark datasets, such as MNIST, SVHN? Since the proposed method works well on ImageNet, it is only a minor concern.\n(d) Comparison with recent work [1]? For this review, the authors do not need to compare with [1] because it is not published yet. My review is not influenced by [1]. But I suggest the authors cite and compare with it in the future revision if possible. Especially, [1] also uses long iterations and propose/discuss other losses.\n\nI enjoy reviewing this paper. My concern (a) can be biased and the authors should not be discouraged by it. Since  ", "review_text": "", "extra_scores": {"ethical_concerns": "No ethical concerns for me.", "needs_ethics_review": "No", "ethics_review_area": ["I don’t know"], "time_spent_reviewing": "20+ hours"}, "extra_text": {}}, {"review_id": "1_ZtLybQzL2", "reviewer": "Reviewer_eWPQ", "summary": "This paper argues that the common practice of limiting the attack iteration in transferable attack research unreasonable, which is proved by the fact that simple transferable attasks with logit loss can achieve high targetted transferability if the attack can be optimized to a much larger number of iterations. The proposed attack can achieve competitive performance to SOTA resource-intensive attacks under various settings, and can be extended to a effective way of geerating targetted universal adversarial perturbations.", "questions": "", "limitations": "", "rating": 7, "confidence": 5, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "This paper provides an interesting yet inspiring observation on simple transferable attacks. I like the argument that it's misleading to compare methods that are not fully converged, and find the claims of the paper well supported by experiment results. Although this paper does not provide much novel methods or theortical analysis, I believe the findings in the paper can have large impact to the field and encourage people to test transfer attacks with a larger attacking iteration in future works.\n\nAs the paper is overall well written, I do have some questions:\n1. In Table 5 its interesting to see that logit attack performs significantly better in ensemble transfer setting than in a single model. Is this a coincidence? Any explaination on this?\n2. The author mentions when discussing Fig 5 that logit attack will \"attack the robust feature\" to boost transferability. As this may hold in unbounded attack, in practical bounded setting the small purterbation allowed may not be enough for the attack to capture the targetted robust feature, as the reason why robust feature are robust is that they will not be easily changed under small perturbation. A more careful discussion/experiment is needed for this argument.\n3. The discussion on the exact attack complexity is not adequate. As the author mentions the logit attack as \"simple attack\", it do need much more optimization steps for each attacking image comparing to other methods like TTP or FDA. In the case of attacking a large amount of images, this difference in attack generation cost will gradually fill in the gap of the cost setting up other attacking algorithms. A more detailed discussion is needed on what's the cost of setting up attacks like FDA, what's the difference in the cost of attacking a single image, under what condition will the overall cost (setting up and attack) of the logit attack is smaller. This will help readers understand if the logit attack is practically appliable.\n4. The paper discusses UAP generation based on the logit attack, yet does not show what the final UAP looks like and what's its strength comparing to the range of the image.\n\nIn summary I believe the paper is worth accepting given its potential large impact on the field, yet the outstanding concerns may undermine the quality of the work. I would love to increase my score if th author can comment on my concerns.\n\n\n## Edit after rebuttal\n\nAfter reading the rebuttal and other reviewers' review, I find the main concern lies in the novelty and significance of this work. On this point personally I agree with the point raised by the author in their reply to Reviewer 1r48 and their public comment, that even this seems like a simple fix it still opens a new and important aspect that future researchers can reflect on previous works and evaluate their own work in a more complete manner. With this being said I don't think this should be a reason of rejection.\n\nAs for my own concerns in the initial review, I think they are well responded by the author in the rebuttal. I would suggest the author to include those points mentioned in the rebuttal into the paper if accepted. Namely, logit attack enables the further improvement on attack success rate than TTP, and the fact that logit attack not only require less set up time but also require no additional training data and hardware.\n\nWith my concerns resolved, I would like to increase my score to 7 and argue for acceptance of this work.", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "The discussion on the attack generation cost is inadequate. See my question 3 in previous section for detail.", "review_text": "", "extra_scores": {"needs_ethics_review": "No", "ethics_review_area": "", "time_spent_reviewing": "3.5"}, "extra_text": {}}]

Author rebuttal:

Meta-review: The paper shows a simple logit loss can yield competitive results with the state of the arts for transferable targeted attacks. Some reviewers had concerns regarding the contributions and the originality of this work. One reviewer suggested that the main contribution of the paper feels like an improved hyper-parameter tuning. Reviewers were happy with authors' responses during the rebuttal. Overall, I feel the paper lacks depth in the contributions. I'd suggest authors to include more analysis/experiments in the revised draft.  
Decision: Accept (Poster)