Improving Adversarial Transferability via Intermediate-level Perturbation Decay
Authors: Qizhang Li
Yiwen Guo
Wangmeng Zuo
Hao Chen
Venue: NeurIPS 2023 poster (2023)
Keywords: adversarial examples
black-box attack
adversarial transferability

Abstract: Intermediate-level attacks that attempt to perturb feature representations following an adversarial direction drastically have shown favorable performance in crafting transferable adversarial examples. Existing methods in this category are normally formulated with two separate stages, where a directional guide is required to be determined at first and the scalar projection of the intermediate-level perturbation onto the directional guide is enlarged thereafter. The obtained perturbation deviates from the guide inevitably in the feature space, and it is revealed in this paper that such a deviation may lead to sub-optimal attack. To address this issue, we develop a novel intermediate-level method that crafts adversarial examples within a single stage of optimization. In particular, the proposed method, named intermediate-level perturbation decay (ILPD), encourages the intermediate-level perturbation to be in an effective adversarial direction and to possess a great magnitude simultaneously. In-depth discussion verifies the effectiveness of our method. Experimental results show that it outperforms state-of-the-arts by large margins in attacking various victim models on ImageNet (+10.07% on average) and CIFAR-10 (+3.88% on average). Our code is at https://github.com/qizhangli/ILPD-attack.

Improving Adversarial Transferability via Intermediate-level Perturbation Decay
Qizhang Li Yiwen Guo Wangmeng Zuo' Hao Chen
'Harbin Institute of Technology, Tennent Security Big Data Lab, 'Independent Researcher, 'UC Davis (ligizhang35, guoyiwen89 @gmail. com wmzuo@hit .ww.ehitteeuu..ee. edu.er chen@ucdavis.edd
Abstract
Intermediate- attacks that attempt to perturb feature representations following an adversarial direction drastically have shown favorable performance in crafting transferable adversarial examples. Existing methods in this category are normally formulated with two separate stages, where a directional guide required to be determined first and the scalar projection of the intermediate- perturbation onto the directional guide is enlarged thereafter. The obtained perturbation deviates from the guide inevitably in the feature space, and it is revealed in this paper that such a deviation may lead to sub-optimal attack. To address this issue, we develop novel intermediate-lewwe method that crafts adversarial examples within single stage of optimization. In particular, the proposed method, named intermediate-level perturbation decay (ILPD), encourages the intermediate-levs perturbation be in an effective adversarial direction and to possess a great magnitude simultaneously. In-depth discussion verifies the effectiveness of our method. Experimental results show that it outperforms state-of-the-art by large margins in attacking various victim models on ImageNet (+10.07% % on average) and CIFAR-I0 (+3.88 % on average). Our code is at httpss//gihhub..oogggggggg///DDp
Introduction
Adversarial examples be crafted without getting access to essential information (e.g., architecture
and parameters) of the victim models [34]. Due to their applicability of assessing Al safety in many
real-world deployment environments, recent years have witnessed steady increase in the study of
black-box adversarial examples 22 46 16] A considerable proportion of black-box attacks rely on transfcrability of adversarial examples, i.e., phenomenon where adversarial examples crafted targeting white-box substitute model can also fool unknown victims with a moderate success rate.
Despite being crucial to many attacks, the adversarial transferability has not been fathomed out. Some work attempts to regulate the intermediate- perturbation (discrepancy between the intermediate- level representation of adversarial examples and that of benign examples) to show large magnitude and align with an directional guided that can effectively maximize the prediction loss of model (20] To achieve this, they choose maximize the scalar projection of the intermediate-leva perturbation onto a directional guide. The determination of the directional guide of such methods various, and each the intermediate-Ievel perturbation from the well-motivated directional guide (as will be discussed in Section 3.I.. and it may deteriorate the attack performance on the substitute model and lead to sub-optimal transferability despite showing a large perturbation magnitude in the middle layer.
26
43 52
well-motivated. Though effective, such objective inevitably deviates
In this paper, we propose method that encourages the intermediate- levell perturbation to possess greater magnitude than a directional guide by its nature and to be in the same adversarial direction as that of the guide. This is achieved by introducing intermediate- perturbation decay (ILPD)
Yiwen Guo and Wangmeng Zuo lead the project. Correspondence Wangmeng Zuo (wmzuo @hi..edu.et...
37th Conference on Neural Information Processing Systems (NcurIPS 2023).

---

in a single stage of optimization. Extensive experiments were conducted to show that our ILPD outperforms existing state-of-the-arts by large margins attacking various victim models on CIFAR- 10 and ImageNet. Moreover, such method can further be readily integrated into a variety of existing transfer-based attacks.
Background and Related Work
Adversarial examples can be generated in white-box and black-box settings.
White-box attacks. In white-box settings, the architecture and parameters of the victim model are known to the adversary, and the gradient of the victim models can therefore be directly utilized to generate adversarial examples. Given victim model f R - R which has been trained to classify any imput, a typical way of generating adversarial examples is to maximize the prediction loss L[ + Ax), y) of f while constraining the lp norm of the perturbation Áx x to a benign input x, i.e., max Ax [[[(x + Ax), v), where is the perturbation budget and y/ is the ground-truth. FGSM [14 derives single gradient step to obtain the perturbation Ax 6 sign( Ix(((x), v)) in an lo setting. not otherwise mentioned, we denote [.(()),,)) as (:)) for simplicity of notation. For performing stronger attacks, iterative methods have also been proposed, e.g., I-FGSM [25) and PGD 332 which update the perturbation at the j-th iteration as
Ax, Clipáx (Ax + " sign( V + Ax
where 1) is the update step size and the Clipax operation ensures that the norm of perturbation does not exceed c.
Black-box attacks. Issuing attacks in black-box settings is much more challenging than in white-box settings due to the lack of information of the victim model. In general, neither the architecture nor the parameter of the victim model is accessible in the black-box settings, and the attacker can only obtain the prediction confidence or even only the predicted label, providing any input. Two lines of methods have been developed for crafting adversarial examples under such circumstances, i.e., query-based methods and transferbbased methods. Query-based methods advocate searching along promising directions 4
48) or estimating the gradient of victim models via zeroth-order while rransfer-based methods train substitute models to craft adversarial examples and can be query- free.
5.
49
optimization [ 22
23
Adversarial transferability. As the core of transfer-based attacks, the transferability of adversarial examples from substitute models to unknown victim models has been studied widely over recent years, and variety of methods have been proposed enhance it. Related to our work, some previous work also achieves improved transfcrability by modifying the gradient computation on substitute models. For instance, Guo et al. [15) advocated removing non-linear activations during back-propagatiio. especially in later layers of DNNs. Wu er al. [45] suggested to take gradients more through skip connections, exist, on the substitute models. In particular, intermediate- representations were
taken special care of in some prior arts (20 26 16 43 52
3 Perturbation Decay in the Feature Space
We revisit some existing attacks that operate on intermediate-level representations and identify their possible limitations in Section 3.1 and propose novel method to improve them in Section 3.2
3.1 Revisiting Intermediate-level Attacks
As transfer-basee based attacks, intermediate-level attacks are performed with at least a substitute model. Given a model input x, the output of an a-layer substitute model can be simplified as f(x) WT (W. Φ1 (WT x)), where, for E (1,..., a), Φ; an activation function, and W; E 1xn; parameterizes a layer in the model. Assume that the input is dimensions and there are e classes for prediction, then we have
n, and na c. Existing intermediate-level attacks decompose the model into a 3-layer feature extractor and an (a - lyy- classifier g, iee. we can formulate the model as s(x) = ((((x)) for any x. A motivation of intermediate-leve attacks is that different models might share the same low-level representations in h and it suffices to operate on the
output layer of h [20] 26).

---

A typical work of intermediate-level attack is ILA 20). It attempts to regulate the intermediate-level perturbation (i.e.. discrepancy between the intermediate-level representation of adversarial examples and that of benign examples) to show a large norm and to be close to directional guide. The directional guide in IIA is chosen as the discrepancy from benign representations that could be reached in the output space of h and leads to maximum prediction loss of f. given the perturbation budget. Since white-box attacks all devote to achieving maximal prediction loss, ILA can be performed with simply u-step baseline attack (e.g., I-FGSM) and the intermediate-level perturbation achieved by the baseline attack as the directional guide.
Let x + Ax, be the adversarial input achieved at the j-th step of the baseline attack, we denote 2.20 : h(x + Ax₂) as the intermediate- level representation of x + Ax,. Further, denote by the directional guide, then we can formulate it as (2) (w)
ILA maximizes the scalar projection, which is
v'(M(x + Ax) - 1(x)), S.
max
where 1/ /v|l2 is omitted as it does not affect the optimal solution. With such a learning objective, the norm of the vector projection is maximized if and h(x + Ax) - -h(x) form an acute angle. Since the direction of intermediiae-level perturbation is not restricted to be in exactly the same direction as that of the directional guide, the obtained intermediate-level perturbation often deviates from the directional guide in practice. Yet, the adversarial perturbations and such directional deviations normally leads to decrease in the prediction loss of the substitute model, even with large perturbation magnitude in the middle layer.
generally not robust enough (.
A quick experiment was conducted to examine the impact of such directional deviations. The experiment was conducted on CIFAR-10 [24] using VGG-19 [36] as the substitute model and another VGG-19 with the same h as the vic-
14
10
10-
Scaar projecttttoonn
12
10
tim model, just to simplify the analyses. The
directional guide v of ILA was obtained by 10-
steps I-FGSM following prior work [26] 16. (2). We evaluated the cross-entropy prediction loss of the models with various intermediate-Ievel perturbations to demonstrate how the attack per- formance can be affected by the scalar projec- tion (onto v) and the directional deviation (from v). Somewhat unsurprisingly, as depicted in Fig- ure when fixing the direction of intermediate- level perturbations, the perturbations with larger magnitude leads to more significant attack per- formance on both the substitute model and the victim model. More enticingly, with lnternediate-level perturbations showing similar scalar projection, those deviating more from the directional guide leads to lower prediction loss on the victim model and hence worse black-box attack performance. As illustrated in the figure, the ILA perturbation only slightly deviates from the directional guide (with a cosine similarity roughly 0.90), yet its attack performance is already inferior to that of the intermediate-lever perturbations along the direction of with even smaller magnitude. Follow-up up work of ILA, e.g., [26] [6], mostly focuses on developing more powerful directional guides, yet the deviation remains and the same problem persists.
3.0 uSy U.A
0MM 0,85 0.55
1.0
097
2314
0:93
0.55 0.55
Intamned atolooel peo peratbaiiors
intennoatteeenn pertarbulions
(a) Substitute model
(b) Victim mode!
Figure 1: How the prediction loss of (a) the substi- tute model and (b) the victim model vary with the scalar projection onto v and the direction deviation from v (i.e., the cosine similarity between v and h(x + Ax) - hx))). The purple box represents the results achieved by ILA.
3.2 Our Solution
Given Figure []] one may consider that a straightforward improvement of the intermediate- attacks is to instead maximize the magnitude of intermediate-leveer perturbation only along the direction of v. Nevertheless, most existing intermediate-level attacks consists of two separate stages which sequentially seeks v and maximizes perturbation magnitude, and they fail to take into account whether there exists a larger intermediate-level perturbation along the direction of v, given the perturbation budget in the input space of f.
3

---

In this context, we aim to develop a novel method that seeks intermediate- perturbations to be in an adversarial direction and possess larger norms (or say larger magnitudes) compared directional guide in the same direction simultaneously. As with previous methods, we consider direction to adversarial if a guide along this direction achieves large prediction loss by itself when being fed to the substitute classifier g. The intermediate-lewe perturbation with a relatively larger magnitude can simply be obtained by amplifying the directional guide by yx in the middle layer. However, such an intermediate-leve perturbation may not be reachable with a limited perturbation budget, i.e., | p S. E, in the input space.
In light of all these considerations, we turn to the "dual" optimization problem and opt to maximize the prediction loss of g with a y "decayed" intermediate- perturbation (i.e.. (h(x+ Ax) - h(x))// which is regarded as the directional guide v). That is,
- max [[g(h(x)+ (h(x Ax) (xx)-n(xx))).. -()))))))))) Se
Ax) +L )(())), v).
max ||AXII
Since the method seems decays the intermediate-level perturbation from the benign features, we call it intermediate- perturbation decay (ILPD). Apparently, setting Y means attack without the perturbation modification and it makes the method equivalent to the baseline multi-step attack. While, enforcing T > 1 leads to decayed perturbation as desired. The operation of h(x + Ax)/y (7 1))(x)/7) /7) resembles the mixup augmentation [5T], except there is no randomness for y and is suggested to be relatively large to encourage larger perturbation magnitude and larger loss.
Figure 2 demonstrates the performance of our ILPD, together with that of ILA. Solid dots represent achievable performance of our ILPD with 1/7 E {1.0, 0.9...... 0.1}. while the blue cross mark * represents the per- formance of ILA in the figure. From the verti- cal axis, can be seen that the ILPD adversar- ial examples are capable of tricking the victim model into showing significantly larger pre- diction loss (4.08->4.54) despite possessing lower perturbation magnitude in the feature space, comparing with ILA examples. Given y in the concerned range, Il.oDobttieed per- turbation directions are very effective in the sense of being adversarial. See the shaded area which illustrates how the attack performance varies with the perturbation magnitude along with these directions in the middle layer.
6.5
u model
ILA
6.0
ILPD, 1/y
5.5
ILPD, 1/y
More powerful attack
5.0
ILPD. 1/y= 0.1
4.5
4.0
3.5
predicado
3.0
10
11
Intermediate perturbation magnitude Figure 2: Comparing the achieved attack perfor- mance and the intermediate-level perturbation mag- nitude of ILA and our ILPD. Darker colors of the solid dots indicate larger values of y. Best viewed in color.
worth noting that we normally suggest a relatively large y with y 2 2 (i.e, 1/7 S 0.5). The formulation of ILPD leads to a x larger perturbation magnitude anyway, than that of (h(x Ax) (x))//7 which is regarded as the directional guide v. However, given y being non-linear in practice, yx amplified intermediate-level perturbation does not truly lead to yx larger prediction loss of g. In particular, the obtained loss more difficult be guaranteed especially when 7 extremely large, e.g., >> 10 or, equivalently. 1/y < 0.1. Therefore, we simply apply with 0.1 < 11/ < 0.5 in our
main experiments in Section 5 Comprehensive ablation studies are deferred to Section 5.4
Analysis from the Gradient Alignment Perspective
Recall that the diversity in input gradients across models is the main obstacle to adversarial transfer- ability, thus, in this section, we analyze ILPD from the perspective of gradient alignment between the substitute and victim models, in order to shed more light on its effectiveness.
4.1 Impacting Factors of Gradient Alignment
Aiming at compromising an unknown victim model ft, a baseline transfer-based attack (e.g., I-FGSM) generate adversarial example white-box substitute model f. In fact, if VxLy(x+ Axy,y) y) R

---

0.32
60
0.30
Cosine similadly
50
rata (56)
0.28
between
-0
0.24
FSSM
Reploce V
20-
Replace 9,,1
Replaca (0.)
Replace (DV)
Replace boch
10
Replace both
20
40
40
Step!
Stop
Step
(a) Similarity of input gradients
(b) Success rate
Figure 3: How (a) the cosine similarity of input gradients and (b) success rate vary with I-FGSM iterations, using tens pairs of substitute and victim models. The shaded areas indicate the standard deviation of the pairs. Best viewed in color.
VxL5, (x Axj, y), then the obtained adversarial examples will be as powerful on the victim model. Yet, the input gradients are often not well-aligned, and, as depicted in Figure 3[a] after some initial iterations, the input gradient of , + Ax,, y) and that of , (x + Ax,, y) may be increasingly different increases, which is probably major obstacle to the adversarial transferability of multi-step attacks.
Let us delve deep into this. For simplicity of notations, the activation functions o; is restricted to ReLU, Then, the imput gradient VxL, + Ax,. y) can be written as the product of three terms:
VxL5(x + Ax,.9) v) = Vxl(x + Ax,) V Lg((2)))
a-1
(4)
Vxh((x+ Ax₂) B+1 II D. 1=++1
W
V 2/ L(z
following the chain rule, where (2(2) (1) provides a binary matrix whose diagonal entry is set to it corresponds nonzero activation within the i-th layer, and it is set 0 if otherwise. If there exist max pooling layers, they can be similarly formulated, and the gradient through these layers can also be given binary matrix in {D.)-
The input gradient of a victim model St (i.e., VxLa (x + Ax, y)) can similarly formulated as in Eq. 44. The diversity between VxLs(* + Ax,, y) and VxL5, (x + Ax,.y) probably comes from some difference in the activation masks {D.} and/or diversity in the gradients of L w.r.t. the logits (i.e.. Vz, L(zy. y) where is dropped for simplicity of notation). Note that the gradients of h are not concerned as it has been assumed in prior work that different models might share a similar h.
By replacing 1) activation masks in [D;} and/or 2) the gradient of L w.e.t the logits (i.e., Vz, L(zg. y)) with those obtained on the victim model, we are capable of analyzing how much impact they actually make. An experiment is thus conducted, using ten pairs of substitute and victim models with the VGG-19 architecture.
that the transferability can be remarkably improved by replacing any of them. Replacing V., L(Zg: v) seems more effective at initial iterations while replacing the activation masks leads to slightly more improvement at the end. Given the cross-entropy loss which evaluates the discrepancy between the prediction probabilities and the one-hot ground-truth vector y, we have L(z, y) p y where = s(z,) is vector containing all prediction probabilities and is the softmax function. That said, at initial iterations, the difference in p between the models a more influential factor, and, at later iterations, the difference in { {D.} becomes dominant.
As the adversarial example is optimized on the substitute model, the prediction of a I-FGSM example very likely to be less incorrect on the victim model even at the first iteration. Difference in p across models leads to difference in the input gradient, and it is possible that the difference become more and more severe, forming a vicious circle some sense.
4.2 Analysis of ILPD and Some Other Attacks
Recall that the input gradient obtained by ILPD at the j-th iteration is
Vxh(x+ + Ax,) V Venn L(g(Z))) (
(5)
5

---

0.30
1.FSMM
PP
60
0.28
60
Cosine similadly
50
5,p00r55 Catel (56)
0.26
0.24
30
0.2
IFGSM
10
40
Step!
Stop
Stop
(a) Similarity of input gradients
(b) Success rate
Figure 4: How (a) the cosine similarity of input gradients and (b) success rate change along with I-FGSM and ILPD iterations, using ten pairs of substitute and victim models. Shaded areas indicate the standard deviation. Best viewed in color.
in which (() 1/211 () + (1-3) )
(0) It can be regarded as replacing V in L(g(()))) y) in Eq. (4)
with the gradient of L w.r.f. to some less adversarial intermediate-lever perturbation 2(1) Less adversarial intermediate-level perturbations leads to less incorrect predictions, which probably aligns better with that of the victim model.
Figure 4 shows that ILPD leads to more aligned input gradient across models, especially after the first 20 iterations. The attack success rates are compared Figure [bb) and can be seen that, thanks the improved gradient alignment, ILPD is capable of generating examples in comparison to I-FGSM, achieving +44000% absolute gains at the 100-th iteration. More detailed analyses show that the ILPD examples lead to activation masks and prediction probabilities better aligned with those of the victim model.
transferable adversarial
In addition to ILPD, some other intermediate-level methods can also be seen beneficial to gradient alignment. In particular, for ILA [20], we have
(a) 2b
Zh
|z (w) (0)
z
112
V
(6)
L(g(z) ("), v) Lgg( ),
where the Taylor series is adopted to obtain the approximation. Therefore, optimizing Eq. at the j-th step an iterative optimizer can be considered as adopting the gradient w.r.f. 2n as replacement the gradient w.r.t. z Without injecting noise or augmenting data each iteration, ILA++ 26 16 and NAA [52] can also be approximately regarded replacing the gradient w.r.f. 2%
with the gradient w.r.f. 2i.
In addition to these efforts, Guo et al. proposed LinBP [15 which back-propagates linearly in later layers. can be regarded as replacing each D; with an identity matrix for computing input gradients. Though effective, it mainly takes care of {D.} and somehow ignores the difference of V L(zg v) across models.
Experiments
Experimental settings will be introduced in Section 5.1 We will compare solution with variety
of tfate-of-the-ase to evaluate its effectiveness in Section 5.2 We combine our solution with some existing methods to further improve the adversarial transferability in Section 5.3 and we perform some ablation studies in Section[5.4]
5.1 Experimental Settings
under f. constraint in the black-box setting. We focus on untargeted attacks and use I-FGSM attack as the back-end method, just like in previous work [6 11
Our experiments were conducted on CIFAR-10 24 and ImageNet 35
We set the perturbation budget to = 4 /25 and 8/255 for attacks on CIFAR-10 and NetgeNet, respectively. Further, on CIFAR-10, we used VGG-19 with batch normalization (6) the substitute model, and different VGG-19 with batch normalization,
28 42

---

Table 1: Transfer-based attack performance ImageNet. The attacks are performed under the loc constraint with c = 8/255 in the untargeted setting.
Method ResNet
ResNet DenseNet
WRN
Inception RepVGG
VGG
Mixer
ConvNeXt
VIT
DeiT
Swin B
BEiT
-50
-152
-121
-101
v3
-B1
-19
-B
-B
-B
-B
-B
Average
L-GSM 38.20%
18. 88%
49.24%
47.62%
22.14%
33.54%
44.98%
9.00%
9.68%
4.42%
3.96%
5.16%
3.84%
22 36%
MI-FGSM
47.88%
25, 33.988%
59.96%
56.26%
30.42%
43.22%
54.28%
13.36%
13.18%
6.74%
5.80%
7.68%
6.62%
28.57%
DF-FGSM
74.24%
47.20%
90.28%
84.76%
50.84%
77.44%
83.50%
18.62 18.62%
29.76%
12.82%
11 16.96%
13.92%
14.12% 46.88%
TI-FGSM
38.72%
19.72%
49.60%
49.00%
22.72%
33.90%
45.86%
9.36%
9.20%
4.70%
3.90%
5.12%
4.08%
22.76%
FGSS
51.46%
28.68 38.62%
71.42%
65.82%
36.50%
47.60%
59.18%
12.42%
12.22%
6.34%
5.66% 6.28%
6.48%
31.54%
SGM
71.46%
72%
73.28%
74.26%
35, 86%
65.60%
75. 10%
19.08%
22.84%
10.66%
8.64%
12.26%
9.96%
40.59%
LinBP
73.00%
52.86%
81. 31.56%
78. 18%
39 40%
68.28%
81 14.55%
13 90%
15.80%
7.70%
5 3.82%
8.90%
7.98%
41.15%
Admix
63.52%
37.64%
71.94%
73.68%
31 84%
60.50%
70.92%
11.90%
15.14%
6.62%
5.10%
7.62%
6.24%
35. 59%
TAIG-R
66.26%
44.28%
87.50%
84.46%
59.32%
72.36%
80.94%
14.54%
10.96%
8.00%
9.56%
13.46%
43.88%
NAA
74.14%
58. 88.8
86.16%
84.34%
57.40%
76.80%
82. 92.96% 20.96%
19.86%
9.92%
8.42%
11.56% 11.36%
46. 36%
ILA++
75.28%
55.56%
84.78%
83.46%
50.98%
72.48%
78.48%
22.22%
30.28%
13.76%
12. 18% 16.50%
14.94% 46.99%
ILPD
83.96%
69.86% % 90.68%
90.28% 64.70%
85.90%
88.10% 29.82 %
44.54%
20.42%
01.42%21..525
57.06%
ResNet-18 18 18.2 PyramidNet 17). GDAS 10. WRN-28-10 50
ResNeXt-229 47 and
NenseNet-BC 19 as the victim models, following some prior work 15
26 16 All victim models
(except for the VGG-19 which was trained by ourselves) were pre-trained by others and directly collected for experiments. On ImageNet, we used a ResNet-50 [8] model as the substitute model, and
collect 13 victim models, including a different 5e [88 VGG-19 [36.. ResNet-112 [18), Inception v3 (37] a DenseNet-121 19]. WRN-101 [50]. a RepVGG-BI 1 9 a MLP Mixer-B [8]
a Con 31 a VYT-B 13 a DeiT-B 39 a Swin-B 30 and a BEiT-B 3
The image size of adversarial examples was 224 x 224 on ImageNet and 32 x 32 on CIFAR-10. 10, without crop, following prior work (2%] 42). We performed adversarial attacks on all test data in CIFAR-10 and 5000 randomly sampled examples from the ImageNet validation data. The adversarial examples obtained at each iteration of the attack should be clipped to [0. 1]. in order to ensure that only valid images are fed to DNNs. We run 100 iterations with a step size of 1 1/255 for all attack methods on both CIFAR-I0 and ImageNet this section, and we set smaller step size of e/100 for Section as we care more about the trend of overfitting before exhausting the perturbation budget. ILPD was performed at the output of the fourth VGG block for VGG-19 on CIFAR-10 and the output of the last building block of the second ResNet meta layer for ResNet-50 on ImageNet, with tuned in the range satisfying 0.1 < 1/7 S 0.5. The advanced version of ILA++ [I6] and NAA [52] are adopted as competitors. Since both methods inject some random transformations to the benign examples, when computing gradients, we also add Gaussian noise with a standard deviation of 0.05 to the benign examples at each iteration, for fair comparison. For competitors, we directly adopt their official implementations and dyper-parametee and we attack on the same CIFAR- 10 and ImageNet images for all methods. All experiments are performed on an NVIDIA V100 GPU.
5.2 Comparison with State-of-the-arts
The comparison results are summarized in Table I and 2 For ImageNet, 13 victim models, including four vision transformers, one multi-layer perceptron model, and a model that has the same architecture of the substitute model, adopted. For CI 7 victim models are adopted. We compare our method with a gradient stabilization method (i.e., MI-FGSM (II), some input augmentation methods (i.e., DI2-FGSM [46), TI-FGSM (12), SI-FGSM 28 and the recent Admix 422), compelling intermediiae-level attacks (i.e., ILA++ [16] and NAA (22)), some back-propagation modification
methods (i.e., SGM 45 and LinBP [15] and very recent method called TAIG 21
Experiment results in the tables show that our method outperforms all these competitors by large margins. Specifically, it can be seen that with the assistance of our ILPD, it is possible to achieve an average success rate of 57.06 % on ImageNet, which outperforms the second best (i.e., ILA++) by +10.07% On CIFAR- we achieve 62.82%. which outperforms the second best by %.
Attacking some newly designed models is challenging when using ResNet as the substitute model. The I-FGSM baseline can only achieve a success rate of less than 10% against these models (see the right half of Table 1 and even < 5% against some vision transformers. However, our method
http:///ihhhh..ommmmeemm///////h hutps//ghthilccmmm//iggaaaaaaarp models
7

---

Table 2: Transfer-based attack performance on CIFAR-10. The attacks are performed under the foc constraint with c = 4/255 in the untargeted setting.
Method
VGG-19
ResNet-18
WRN
ResNeXt
DonseNet
PyramidNet
GDAS
Average
I-FISM
71.18%
67.67%
51.28%
52.77%
48.74%
12.44%
36,23%
48.62%
MI-PGSM
73.56%
69 65%
53.55%
55.11%
50.36%
13.03%
38.07%
50.48%
DE-FGSM
77.40%
72.53%
56.68%
57.58%
51.68%
15.78%
40.70%
53.48%
TI-FGSM
71.32%
67.67%
51.53%
52.76%
48.63%
12.43%
36.44%
48.68%
SI-FGSM
70.51%
72.70%
55.73%
57.51%
53.65%
14.19%
39.77%
52.01%
LinRP
78.19%
75.08%
59.38%
57.89%
16.88%
43.56%
12%
Admix
78.17%
74.51%
58.18%
59.94%
55.69%
15.05%
42,42%
54,85%
TAIG-R
73.72%
71.25%
51.57%
52.72%
50.01 %
12.93%
39.64%
50.26%
NAA 71.16%
71.00%
56.62%
58.67%
56.68%
18.31%
46.25%
54, 54.30%
ILA++
79.77%
78.81%
63.36%
63. 33.911
60.38%
18.86%
47.51%
58, 94%%
TLPD
83.52%
81.63%
68.03%
67.97%
68.37%
19.44%
83.79%
62.82%
achieves impressive improvements attacking these models. For instance, compared with the I- FGSM baseline, when attacking the MLP-Mixer and ConvNeXt models, our ILPD obtains +20.82% and +34.86% absolute gains, respectively, and when attacking the vision transformers, our ILPD obtains an absolute gain of 199.14%.
Attack robust models. We also tested our method on the task of attacking robust mod- els. We collected a robust Inception v3 and a robust EfficientNet-BB BO from the timm 44] repository, and obtain robust ResNet-50 and robust DeiT-S 40 from Bai el al. [2's open-source repository as the victim mod- els. Adversarial examples generated on the ResNet-50 substitute model were applied for this experiment. Our ILPD is compared with DISM NAA, and ILA++ which are the most competitive methods in Table [ and we summarize the results in Table 3 It shows that method outperforms competitors in attacking these robust models and getting +4.13% improvement, compared with NAA, which is the second best method. In addition to the robust models, also test our method two advanced defense methods, i.e., random smoothing 77] and NRP [33]. Specifically, our ILPD achieves a success rate of 12.90% in attacking smoothed ResNet-50 on ImageNet, while the second best method (NAA) and the baseline show 11 11.84% and 7.20%, respectively. For NRP, the adversarial examples generated by our method can achieve average success rate of 20.03% after purification. Meanwhile, the second best method achieves 14.54% and the bascline achieves 9.39%.
Table 3: Performance in attacking robust ImageNet models. The attacks are performed under the for con- straint with c 8/255 in the untargeted setting.
Method
Inception v3 EfficientNer
(robust)
(robust)
ResNet-50
(rohust)
(robust)
DeiT-S
Average
LFGSM
11.68%
10.88%
9.10%
10.56%
10.56%
DF-FGSM
15.84%
34.04%
9.66%
11.02%
17.64%
22.86%
37.02%
10.80%
11.42%
20.53%
ILA+
18.22%
34.62%
10.46%
11.40%
18.68%
ILPD 25.30%
50.02%
11.42%
11.90%
24.66%
5.3 Combination with Existing Methods
Our method can be readily combined with other attacks. In this section, we evaluate the combination performance. We tried combining our method with different sorts of attacks, including a gradient stabilization method, i.e., MI-FGSM [ and two imput augmentation methods, i.e., DI2-FGSM [46] and Admix [52]. The results are reported in Table 4 It shows that the adversarial transferabillity can indeed be further improved by combining our method with these prior arts. Specifically, when combining with DI2-FGSM the best average success rate, i.e., 63.23 %, is obtained.
Table 4: Combination of our ILPD with MI-FGSM, DI-MGGMM, and Admix on ImageNet. The attacks use I-FGSM as the back-end attack and are performed under the fo constraint with 8/255 in the untargeted setting.
ResNet -50
ResNet DenseNet
WRN
Inception RepVGG
VGG
Mixer
CoawNeXt
VIT
DeiT
Swin B
BETT -B
Method
-152
-121
-101
v3
B1
-19
-B
-B
-B
-B
Average
MI-FGSM 47.88 25, 98%
59.96%
56.26%
30.42%
43.22%
54.28%
13.36%
13.18%
6.74%
5.80% 7.68%
6.62%
28.57%
+ILD 84.90% 72.22%
91.74%
91.42%
69.44%
87.66%
89.12%
34.62%
48.00%
25.20%
29.16%
30.022
59.84%
DI
FFF. 74.24% 47.20%
90.28%
84.76%
50.84%
77.44%
83.50%
18.62%
29.76%
12.82% 11 96% 13, 93.9
14.12% 46. 88%
+ILPD 85.26%
74.62% % 92.40% 91.36%
74.42%
88.74%
90.10%
37.98% 9
53.42% %
33..6336.......... 37.70%
63.23%
Admix
63.52% 37.64% 71 9.9
73.68%
31 844
60.50%
70.92%
11 9.%
15.14%
6.62%
5.10% 7.62% 6.24% 35.599
+ILPD
86.08% % 75.48% 92.48% 91.66% 70.44%
88.84%
90.52%
33.42%
47.94%
23.24%
29w.12%2296662999 29.78%
60.28%
hutps///gthhbbcccmyooooaaaiiiiit
8

---

95
50
Success (taee (16)
45
40
35
40
30
-35
25
UnnP
ILA++
30
NAA
LinBP
ILA++
1-1 1.211.2111
2-2
10
(a) ResNet-50
(b) VGG-19
Figure 5: How the average success rate change with different choices of position on (a) ImageNet trained ResNet-50 and (b) CIFAR-10 trained VGG-19. For the ResNet-50 model, "0" represent the stem layer and "1-1" represent the first building block of the first ResNet meta layer.
5.4 Ablation Study
The effect of position. As an intermediate-leve attack, our method needs to choose position to split in and 9. Such a position selection affects the performance all intermediate- attacks. We vary the position and compare our method with ILA++ [16), NAA [52), and LinBP [5] in Figure 5 The performance on ImageNet and CIFAR-10 are both tested, using ResNet-50 and VGG-19 as the substitute models, respectively. Apparently, our ILPD demonstrates consistently higher adversarial transferability on all choices of the position. In particular, our method significantly outperforms ILA++ NAA, and LinBP when choosing lower layer to split into h and g. When using ResNet-50 as the substitute model, choosing any of the first eleven layers (i.e., from "0" to "3-3"" can achieve an average success rate of more than 53% on ImageNet, even simply choosing the first layer will lead to an average success rate 53.1 12%, which is already superior to all competitors in Table 1
The effect of 7 We evaluate ILPD with vary- ing y on ImageNet and CIFAR-10 Figure [6] The victim models are the same as the ones in Table and Table 2 It can be seen that using 1/7 always leads to improved performance compared with the baseline (which is equivalent to adopting 1/7 1). On ImageNet, the op- timal performance is obtained with 1/7 = 0.1 (iee, ? 10) and ResNet- while, for CIFAR- 10, 1/7 = 0.3 (i.e., = 10/3) is more effective. ImageNet,
Success Rate (%)
Success Rate (%)
50
80
13
20
48
1/Y
1/y
(a) ImageNet
(b) CIFAR-10
Figure 6: How the average success rate changes with y using (a) ImageNet trained ResNet-50 and (b) CIFAR-10 trained VGG-19 the substitute models.
That
aim maximize the prediction loss of a perturbation which cut by 10x in the middle layer. It is possible that employing 7 10 leads to better performance ImageNet, yet we do not aim to carefully tune and would like to leave it to future work.
Conclusion
In this paper, have revisited some intermediate-level attacks and shown that, limited by their two- stage training scheme, the obtained intermediate- perturbations will deviate from the directional guides and such deviation largely impairs the attack performance of the crafted adversarial examples. In order to overcome this limitation, we have developed a method that performs attacks through single stage of optimization and guarantees the obtained intermediate-Ievell perturbation possesses larger magnitude when compared with a directional guide and exactly follows its direction that can effectively increase the prediction loss of the model. The developed method is formed as adopting intermediate- perturbation decay when computing gradients. Extensive experimental results on ImageNet and CIFAR- 10 have shown that our method outperforms state-of-the-are by large margins in attacking various victim models, including convolutional models, multi-layer perceptron model, vision transformers, and robust models. Moreover, we have shown that our method can easily combined with prior methods craft more transferable adversarial examples.

---

7 Acknowledgment
This material is based upon work supported by the National Science Foundation under Grant No. 1801751 and 1956364.
References
[1] Anish Athalye, Logan Engstrom, Andrew Ilyas, and Kevin Kwok. Synthesizing robust adversarial examples. In International conference machine learning, pages 284-293, PMLR, 2018.
[2] Yutong Bai, Jieru Mei, Alan Yuille, and Cihang Xie. Are transformers more robust than cnns? In Thith Conference on Neural Information Processing Systems, 2021.
[3] Hangbo Bao, Dong. Songhao Piao, and Furu Wei, Beit: Bert pre-training of image transformers. In International Conference on Learning Representations, 2021.
[4] Wieland Brendel, Jonas Rauber, and Matthias Bethge. Decision-based based adversarial attacks: Reliable attacks against black-box machine learning models. In ICLR, 2018.
[5] Jianho Chen, Michael Jordan, and Martin Wainwright. Hopskipjumpattack: A query-efficient decision- based attack. arXiv preprint arXiv: 1et::9904.02 994,02144, 2019.
[6] Pin- Yu Chen, Huan Zhang. Yash Sharma, Jinfeng Yi, and Cho-Jui Hsieh. Zoo: Zeroth order optimization based black box attacks to deep neural networks without training substitute models. In Proceedings of the 10th ACM Workshop on Artificial Intelligence and Security, pages 15-26. ACM, 2017.
[7] Jeremy Cohen, Elan Rosenfeld, and Zico Kolter. Certified adversarial robustness via randomized smoothing. In International Conference on Machine Learning. pages 1310-1320. PMLR, 2019.
[8] Francesco Croce and Matthias Hein. Minimally distorted adversarial examples with fast adaptive boundary attack. International Conference on Machine Learning, pages 1199--205... PMLR, 2020.
[9] Xiaohan Ding, Xiangyu Zhang, Ningning Ma, Jungong Han, Guiguang Ding, and Jian Sun. Repvgg: Making stylstyle convnets great again. In Proceedings the IEEE/CVF Conference on Computer Vision and Puttern Recognition, pages 13733-13742, 2021.
[10] Xuanyi Dong and Yi Yang. Searching for robust neural architecture in four gpu hours. In CVPR, 2019.
[11] Yinpeng Dong, Fangzhou Liao, Tianyu Pang, Hang Su, Jun Zhu, Xiaolin Hu, and Jianguo Li. Boosting adversarial attacks with momentum. In CVPR, 2018
[12] Yinpeng Dong, Tianyu Pang, Hang Su, and Jun Zhu. Evading defenses to transferable adversarial examples by translation-invariant attacks. In Proceedings of the IEEE/CVF Conference on Computer Vision and Puttern Recognition, pages 4312 2019.
[13] Alexey Dosovitskiy, Lucas Beyer, Alexander Kolesnikov, Dirk Weissenborn, Xiaohua Zhai, Thomas Unterthiner, Mostafa Dehghami, Matthias Minderer, Georg Heigold, Sylvain Gelly, et al. An image is worth 16x words: Transformers for image recognition scale. arXiv preprint arXiv:2010. / /9999, 2020.
[14] Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. In ICLR, 2015.
[15] Yiwen Guo, Qizhang Li, and Hao Chen. Backpropagating lincarly improves transferability of adversarial examples. In NewrlPS, 2020.
[16] Yiwen Guo, Qizhang Li, Wangmeng Zuo, and Hao Chen. An intermediate-level attack framework on the basis of linear regression. IEEE Transactions on Puttern Analysis and Machine Intelligence, 2022.
[17] Dongyoon Han, Jiwhan Kim, and Junmo Kim. Deep pyramidal residual networks. In CVPR, pages 5927-5935, 2017.
[18] Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In CVPR, 2016.
[19] Gao Huang, Zhuang Liu, Laurens Van Der Maaten, and Kilian Q Weinberger. Densely connected convolutional networks. In CVPR, 2017.
[20] Qian Huang. Isay Katsman, Horace He, Zeqi Gu, Serge Belongie, and Ser-Nam Lim, Enhancing adversarial example transferability with intermediate level attack. In ICCV, 2019.
10

---

[21] Yi Huang and Adams Wai-Kin Kong. Transferable adversarial attack based integrated gradients. arXiv preprint arXiv:2205. 2022.
[22] Andrew Ilyas, Logan Engstrom, Anish Athalye, and Jessy Lin. Black-box adversarial attacks with limited queries and information. In ICML, 2018.
[23] Andrew Ilyas, Logan Engstrom, and Aleksander Madry. Prior convictions: Black-box adversarial attacks with bandits and priors. In ICLR, 2019.
[24] Alex Krizhevsky and Geoffrey Hinton. Learning multiple layers of features from tiny images. Technical report. Citeseer, 2009.
[25] Alexey Kurakin, Ian Goodfellow, and Samy Bengio. Adversarial machine learning at scale. In ICLR, 2017.
[26] Qizhang Li, Yiwen Guo, and Hao Chen. Yet another intermediatc-leve attack. In ECCV, 2020.
[27] Qizhang Li, Yiwen Guo, Wangmeng Zuo, and Hao Chen. Making substitute models more bayesian can enhance transferability of adversarial examples. In The Eleventh International Conference on Learning Representattons, 2023.
[28] Jiadong Lin, Chuanbiao Song, Kun He, Liwei Wang, and John E Hopcroft. Nesterov accelerated gradient and scale invariance for adversarial attacks. arXiv preprint arXiv: 082981, 2019.
[29] Yanpei Liu, Xinyun Chen, Chang Liu, and Dawn Song. Delving into transferable adversarial examples and black-box attacks. In ICLR, 2017.
[30] Ze Liu, Yutong Lin, Yue Cao, Han Hu, Yixuan Wei, Zheng Zhang, Stephen Lin, and Baining Guo. Swin transformer: Hierarchical vision transformer using shifted windows. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 10012- -00222 2021.
[31] Zhuang Liu, Hanzi Mao. Yuan Wu, Christoph Feichtenhofer, Trevor Darrell, and Saining Xie. convnet for the 2020s. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 11976-1198,, 2022.
[32] Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. In ICLR, 2018.
[33] Muzammal Naseer, Salman Khan, Munawar Hayat, Fahad Shahbaz Khan, and Fatih Porikli. self- supervised approach for adversarial robustness. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages (62-271, 2020.
[34] Nicolas Papernot, Patrick McDaniel, and Ian Goodfellow. Transferability in machine learning: from phenomena to black-box attacks using adversarial samples. arXiv preprint preprintarXiv: arXiv:1605.07277 2016.
[35] Olga Russakovsky, Jia Deng. Hao Su, Jonathan Krause, Sanjeev Satheesh, Sean Ma, Zhiheng Huang. Andrej Karpathy, Aditya Khosla, Michael Bernstein, Alexander C. Berg, and Li Fei-Fei. Imagenet large scale visual recognition challenge. IJCV, 2015.
[36] Karen Simonyan and Andrew Zisserman. Very deep convolutional networks for large-scale image recogni- tion. In ICLR, 2015.
[37] Christian Szegedy, Vincent Vanhoucke, Sergey loffe, Jon Shlens, and Zbigniew Wojna. Rethinking the inception architecture for computer vision. In CVPR, 2016.
[38] Ilya O Tolstikhin, Neil Houlsby, Alexander Kolesnikov, Lucas Beyer, Xiaohua Zhai, Thomas Unterthiner, Jessica Yung. Andreas Steiner, Daniel Keysers. Jakob Uszkoreit, et al. Allp-mixer; An all-mip architecture for vision. Advances in Neural Information Processing Systems. 34:24261 -221222222222222 2021.
[39] Hugo Touvron, Matthieu Cord, Mathijs Douze, Francisco Massa, Alexandre Sablayrolles, and Herve Jegou. Training data-efficient image transformers & distillation through attention. In International Conference on Machine Learning, volume 139, pages 10347-10357, July 2021.
[40] Hugo Touvron. Mathhieu Cord, Mathhis Douze, Francisco Massa, Alexandre Sablayrolles, and Hervé Jégou. Training data-efficient image transformers & distillation through attention. In International Conference on Machine Learning, pages 10347-10357. PMLR, 2021.
[41] Chun- Tu, Paishun Ting, Pin-Yo Yu Chen, Sijia Liu, Huan Zhang. Jinfeng Yi, Cho-Jui Hsieh, and Shin- Ming Cheng. Autozoom: Autoencoder baseed zeroth order optimization method for attacking black-bor neural networks. In AAAI, 2019.

---

[42] Xiaosen Wang, Xuanran He, Jingdong, Wang. and Kun He. Admix: Enhancing the transferability of adversarial attacks. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 16158-16167, 2021.
[43] Zhibo Wang. Hengchang Guo, Zhiffi Zhang, Wenxin Liu, Zhan Qin, and Kui Ren. Feature importance- aware transferable adversarial attacks. Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 7639-7648, 2021.
[44] Ross Wightman.
Pytorch image models.
https://github.cm com/ rwightman/
pytorch- Lmage-models 2019.
[45] Dongxian Wu, Yisen Wang. Shu-Tao Xia, James Bailey, and Xingjun Rethinking the security skip connections resnet-like neural networks. In ICLR, 2020.
[46] Cihang Xie, Zhishuai Zhang, Yuyin Zhou, Song Bai, Jianyu Wang. Zhou Ren, and Alan Yuille. Improving transferability of adversarial examples with input diversity. In CVPR, 2019.
[47] Saining Xie, Ross Girshick, Piotr Dollár, Zhuowen Tu, and Kaiming He. Aggregated residual transforma- tions for deep neural networks. In CVPR, 2017.
[48] Ziang Yan, Yiwen Guo, Jian Liang, and Changshui Zhang. Policy-driven attack: learning query for hard-label black-box adversarial examples. In ICLR, 2021.
[49] Ziang Yan, Yiwen Guo, Changshui Zhang. Subspace attack: Exploiting promising subspaces for query-efficient black-box attacks. In NeurlPS, 2019.
[50] Sergey Zagoruyko and Nikos Komodakis. Wide residual networks. In BMVC, 2016.
[51] Hongyi Zhang, Moustapha Cisse, Yann N Dauphin, and David Lopez-Paz. mixup: Beyond empirical risk minimization, International Conference on Learning Representations, 2018.
[52] Jianping Zhang, Weibin Wu, Jen-tse Huang, Yizhan Huang, Wenxuan Wang, Yuxin Su, and Michael Lyu. Improving adversarial transferability via neuron attribution-base attacks. In Proceedings of IEEE/CVF Conference on Computer Vision and Puttern Recognition, pages 14993-15002, 2022.
12

---

A Experiment Results of Using Other Substitute Models
We compare our method with other intermediate-level attacks using various substitute model on ImageNet. The comparison results are summarized in T Three vision transformers and one multi-layer perceptron model are considered as the substitute models, including ViT-B [3]. DeiT-B 39 B [30], and a MLP Mixer-B [8]. The victim models are the same as those in Table 1 For ILPD, always split to be the first two blocks of these models and we fix 1/7 - 0.1. For NAA and ILA++ we tested the results of all possible intermediate layer selections and report the best results among them. The average success rates are compared as follows, and the victim models the same those in Table I of our paper. Experiment results in the table show that our method outperforms all these competitors by large margins.
Table Transfer-basee attack performance of using different substitute models on ImageNet. The attacks are performed under the fo constraint with 8/255 in the untargeted setting. "Average" is obtained on victim models different from the substitute model.
Substitute Method
ResNet -50
ResNet DenseNei -121
-152
WRN -101
Inception v3
RGG -B1
VGG
-19
Mixer -1
ConyNeXt
VIT
Deil
-B
8
BET
Average
ILA+
22.12%
17.44%
28.20%
21.28%
28.52%
29.30%
32.22%
47.06%
19,00%
97.22%
40.1298
29 50%
43.34%
29.84%
WT-B
45.74%
46.56%
ILPD
34.96%
32.64%
43.78%
37.38%
44.02%
44.60%
44.36%
S8.82%
36.38
96.42%
61.92%
54.16%
66.54%
46.63%
ILA+
20.92%
14,40%
24.704
18.00%
25.24
46%
33.00%
33.945%
18.24%
27.22%
87.54%
18 38%
19.72%
23.66%
DeTT-R
NAA
29.74%
25.04%
36.52%
30 26%
38.26%
39.18%
39.42%
45.78%
31.38%
39.42%
75.32%
31 54%
37.62%
35.35%
ILPD
40.14%
36.20%
42.02%
36,80%
40.82%
44.80%
43.76%
53.34%
45.68%
51.82%
81.74%
46.36
49.64%
44.28%
27.966%
25.48%
27.64%
96.6455
15.08%
20.815
Mixer-B
NAA
33.28%%
23.24%
42.92%
28, 86%
41.56%
41.48%%
43.88%
92.62%
26.54%
42.76%
52,889
74 64%
29.06%
35,939
29.84%
42.56%
34.40%
41.88%
44.44%
42.56%
91.569%
40,80%
58.36%
36.38
38.74%
41.72%
12.68%
13,44%
22.78%
13.23%
Swin-B
NAA
16.36%
13.10/
22.72%
54%
22, 90%
26.78%
28.84%%
22.04%
28 80%
17.70%
19:919
71 9.99
21.16%
21.41%
13


Reviews:
[{"review_id": "GACuEEwZka", "reviewer": "Reviewer_ncUa", "summary": "This paper notes that ILA (intermediate level attack), which maximizes projection onto a guide attack, suffers when the direction of the attack ends up differing from the direction of the guide, even when the projection is large. Thus, they propose that instead of allowing the direction to vary from a guide, we should simply look for attacks that have large intermediate magnitudes.\n\nThis motivates their approach (called Intermediate Level Perturbation Decayed). They then demonstrate that this approach results in significantly improved performance across a wide range of models.", "questions": "See above.", "limitations": "N/A", "rating": 6, "confidence": 3, "soundness": 3, "presentation": 2, "contribution": 3, "strengths": "Overall, I think the issue the authors identify with ILA is well motivated, and the improvements are fairly significant. In particular, the experiments investigating gradient alignment are fairly convincing about what ILPD is doing, as well as the analysis of existing attacks.", "weaknesses": "My primary issue with this paper was that I found the presentation confusing. Although the motivation for why we might prefer an approach that doesn't differ in direction from an original \"guide\" attack is solid, the actual motivation of the approach used was much less clear to me, and not particularly intuitively presented. From my understanding, the attack is essentially \"simulating\" reducing the strength of the perturbation at some intermediate stage, but this interpretation isn't presented in the paper.\n\nIn particular, upon first reading, this line was particularly confusing to me.\n\n> seeks intermediate-level perturbations to be in an adversarial direction and to possess larger norms (or say larger magnitudes) compared to a directional guide in the same direction simultaneously\n\nSince if there was a perturbation of the input that could lead to a strictly larger perturbation along the same direction as a guide, I would expect that to be already found by standard optimization procedures. I believe the part I missed from my first reading is that there is no \"directional guide\" - in comparison with ILA (a 2 step procedure), this is a 1 step attack.\n\nAlthough I think I now have some intuitive understanding of the paper's attack, it doesn't quite match the author's explanation, and I think the paper would benefit from improving the clarity of section 3.2\n\n", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thanks for your positive feedback. Our response to comments about our presentation is provided as follows. \n\n**Response:** The common belief in intermediate-level attacks, _e.g._, ILA, ILA++, and NAA, is that a larger magnitude of intermediate-level perturbations along the guide leads to improved transferability of adversarial examples. Thus, these methods achieve their goals via a two-stage mechanism, _e.g._, performing I-FGSM first to obtain the directional guide and maximize the scalar projection of the intermediate-level perturbation onto the directional guide.  \n\nHowever, in this paper, we point out that the learning objective of these methods inevitably leads to intermediate-level perturbations deviating from the guide, and such a directional deviation of intermediate-level perturbation, even subtle, does great harm to the transferability. Therefore, we seek the intermediate-level perturbation $h(\\mathbf{x}+\\mathbf{\\Delta x}) - h(\\mathbf{x})$ whose direction is already aligned with an adversarial directional guide $\\mathbf{v}$ and, simultaneously, possess larger magnitudes than it. This is achieved by defining $\\mathbf{v} = \\frac{1}{\\gamma} (h(\\mathbf{x}+\\mathbf{\\Delta x}) - h(\\mathbf{x}))$ as the directional guide and optimizing Eq. (3) in the paper. In the paragraph below Eq. (3), we have mentioned that the method seems to reduce the strength of the intermediate-level perturbation during optimization, from a dual perspective, and this is actually why we call it intermediate-level perturbation decay (ILPD). The effectiveness of such an intermediate-level perturbation decay, from another perspective, is explained in Section 4.2.  \n\nAlthough the method can be interpreted superficially as decaying intermediate-level perturbations during optimization, our in-depth motivation is to encourage the finally achieved intermediate-level perturbation to be larger than a directional guide and have the same direction as the directional guide.  \n\nWe are more than glad to follow the suggestions from the reviewer and revise Section 3.2 to make it clearer.\n"}, {"review_id": "9b3yJRG5NY", "reviewer": "Reviewer_pWZd", "summary": "The authors first introduce the observation that traditional Intermediate-Level Attack (ILA) and some subsequent works deviate from the directional guides, resulting in sub-optimal transferability. With such observation, the authors propose Intermediate-Level Perutbration Decay (ILPD), a one-staged optimization that decays the intermediate perturbation strength in return for amplified directional guide, and thus higher adversarial transferability.\nExperiments on ImageNet and CIFAR-10 show that the proposed ILPD method outperforms SOTA transfer-based attacks in different types of models as well as robust models.\n", "questions": "1. Regarding the ILA++ baseline, I would like more clarification on the base attack in ILA++ for directional guidance. Since two attacks are applied in series, how are they balanced to sum up to 100 iterations?", "limitations": "Weakness #3 is briefly discussed in the paper. To me, the search for hyper-parameters will be the major limitation of this work. ", "rating": 7, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1. Claims and speculations in the paper are well grounded by theoretical analysis as well as empirical studies. From the hypothesis of directional deviation in Figure 1, then the introduction of the ILPD and verification in Figure 2, studies and discussion are organized layer by layer, which is an enlightening experience to read through.\n2. Apart from showing the analysis of ILPD, the authors extend the discussion to previous works such as ILA++, NAA and LinBP. I particularly like the authors’ attempt to replace $D_i$ and $\\nabla_{z_g}L(\\mathbf{z}_g, y)$ to study the transferability in the gradient aspect.\n3. Although the modification the authors propose is a simple math trick by scaling up the influence from the directional guide, the optimization falls back to one-staged and no longer resembles lLA, which is sufficiently novel.\n4. The experiments are conducted in a large variety of models, both normal and robust, both CNNs and ViTs. Ablation study and hyper-parameters study are performed to understand the method in an in-depth manner.\n", "weaknesses": "I could not spot any major weaknesses in this paper. The following points are mostly minor and understandable:\n\n1. Although the authors perform evaluations on robust models, the choice of models does not align with what used to be evaluated in the previous works (i.e. the NeurIPS 2017 Competition, some models with ensemble adversarial training, etc.). \n\n2. The number of attack iterations is fixed to be 100, which is quite large considering most baselines perform only 10-20 iterations in their experiments. Plus the observation in Figure 4(b), does it imply the proposed method has a slow convergence and requires more iterations to yield transferable attacks?\n\n3. The performance of ILPD seems to be quite sensitive to the choice of $\\gamma$. For example, Figure 2 suggests setting $1/\\gamma \\approx 0.5$ might probably obtain good transferability. However, in Figure 6(a), setting $1/\\gamma = 0.5$ can have a success rate >15% lower than the optimal choice. For a new dataset, it is hard to determine a good starting $\\gamma$ due to the difference in Figure 6(a) and 6(b).\n\n#### Grammar mistakes:\n- Line 148: the method **seems decays**\n- Line 212: **a** I-FGSM example\n- Line 214:  the difference **become**\n- Line 254 **a** Inception v3\n\nHere are only a few. The authors are recommended to check the paper thoroughly for the remainings.\n\n---\n\nIn summary, this paper is very well-written and provides a lot of evidence to support its claims. The only weaknesses that I could identify are largely outweighed by its strengths. Therefore I recommend accepting this paper.\n", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thanks for your positive feedback. Our responses to the comments are provided as follows.  \n&nbsp;  \n\n> Although the authors perform evaluations on robust models, the choice of models does not align with what used to be evaluated in the previous works (i.e. the NeurIPS 2017 Competition, some models with ensemble adversarial training, etc.).  \n\n**Response:** We appreciate the comment. The NeurIPS 2017 Competition provides a robust Inception v3 and a robust Inception ResNet v2 which is trained to be robust to an ensemble of adversarial examples. The performance on the robust Inception v3 has been shown in our paper already (in Table 3). We now provide comparative results on the robust Inception ResNet v2 (with ensemble adversarial training) as follows. It can be seen that the advantage of our method is still obvious.  \n\n|  ensemble adv. train.   | I-FGSM | DI$^2$-FGSM | NAA | ILA++ | ILPD |\n|:---------------------:|:-------:|:---------------:|:----:|:------:|:-------:|\n| Incepction ResNet v2 |   6.28%  |   8.68%       | 8.06%  | 10.02% | **13.12%**   |  \n&nbsp;  \n\n> The number of attack iterations is fixed to be 100, which is quite large considering most baselines perform only 10-20 iterations in their experiments. Plus the observation in Figure 4(b), does it imply the proposed method has a slow convergence and requires more iterations to yield transferable attacks?\n\n**Response:** Despite some previous work used 10-20 iterations to evaluate transfer-based attacks, in practice, many attacks cannot converge well within only 10-20 iterations (as observed in many other papers, _e.g._, [1]). Thus, to ensure a fair comparison, we used 100 iterations with a step size of $1/255$ for each method to guarantee convergence of all methods, just like in many papers, _e.g._, [2][3].  \n\nIn Figure 3 and Figure 4, we used a smaller step size of $\\epsilon / 100$ to observe the trend of overfitting before exhausting the perturbation budget as mentioned in the paper (lines 262-263). Given such a small step size, more iterations are required to demonstrate superiority indeed. However, in practice, our method does not exhibit slow convergence, and we have compared it with I-FGSM, NAA, and ILA++ on ImageNet as follows. We show how the average success rate of different methods varies with the maximum number of optimization iterations. The victim models are the same as those in Table 1 in our paper.  \n\n  |          | 10 iterations    | 20 iterations    | 40 iterations    | 60 iterations    | 80 iterations    | 100 iterations   |\n  |:--------:|:--------:|:--------:|:--------:|:--------:|:--------:|:--------:|\n  | I-FGSM | 16.95% | 20.86% | 22.38% | 22.34% | 22.40% | 22.36% |\n  | NAA    | 35.11% | 42.78% | 45.27% | 45.91% | 46.16% | 46.36% |\n  | ILA++  | 41.76% | 45.98% | 46.54% | 46.88% | 46.94% | 46.99% |\n  | ILPD   | **42.16%** | **50.64%** | **55.50%** | **56.51%** | **56.83%** | **57.06%** |  \n&nbsp;  \n\n> The performance of ILPD seems to be quite sensitive to the choice of $\\gamma$. For example, Figure 2 suggests setting $1 / \\gamma \\approx 0.5$ might probably obtain good transferability. However, in Figure 6(a), setting $1/\\gamma=0.5$ can have a success rate >15% lower than the optimal choice. For a new dataset, it is hard to determine a good starting $\\gamma$ due to the difference in Figure 6(a) and 6(b).\n\n**Response:** In the paper, we suggest using $\\gamma \\geq 2$ (_i.e._, $1/\\gamma \\leq 0.5$ line 172) to narrow the search for such a hyper-parameter. Figure 6 further shows that our method outperforms all its competitors with $1/\\gamma$ in a wide range of $[0, 0.3]$ and $[0.1, 0.6]$ on ImageNet and CIFAR-10, respectively, showing that the choice of $1/\\gamma$ is not a big concern to ensure its experimental superiority over all state-of-the-arts. In practice, the attacker could tune the hyper-parameters using a variant of the substitute model as the victim on a small validation set of, for instance, 200 examples, on their data to ensure performance. As for Figure 2, it adopts the same victim model as in Figure 1, which shares the same $h$ with the substitute model, thus might be slightly different from practical victim models and requires a different value of $1/\\gamma$ to reach optimal attack. In general, the evaluated victim models in, for instance, Table 2 share a similar optimal $1/\\gamma$ to be compromised fully.  \n&nbsp;  \n\n> Grammar mistakes.\n\n**Response:** Thanks for pointing out the typos. We will fix them in the updated version.  \n&nbsp;  \n\n> Regarding the ILA++ baseline, I would like more clarification on the base attack in ILA++ for directional guidance. Since two attacks are applied in series, how are they balanced to sum up to 100 iterations?\n\n**Response:** For previous intermediate-level attacks that require two-stage optimization, we do not count the number of iterations in their first-stage optimization in the 100 iterations. That is, if we count them all together, then these methods require more than 100 iterations to reach their performance reported in our paper.  \n&nbsp;  \n&nbsp;  \n\n[1] Zhengyu Zhao, et al. Towards Good Practices in Evaluating Transfer Adversarial Attacks. In arXiv 2022.  \n[2] Yi Huang, et al. Transferable Adversarial Attack Based on Integrated Gradients. In ICLR 2021.  \n[3] Yiwen Guo, et al. Backpropagating Linearly Improves Transferability of Adversarial Examples. In NeurIPS 2020.  \n"}, {"review_id": "zcXGWkLN3M", "reviewer": "Reviewer_XQBy", "summary": "This paper presents an approach to enhancing the transferability of adversarial examples in a black-box scenario. Previous studies have typically followed a two-stage process involving the derivation of effective guiding directions and subsequently maximizing the perturbation magnitudes accordingly. Unfortunately, this approach often deviates from the intended guides, resulting in suboptimal performance. In contrast, the authors introduce a one-stage method that utilizes a decayed perturbation function and an analysis tool to investigate the sources of deviation. Through extensive experiments, the authors demonstrate the effectiveness of the proposed approach.", "questions": "1. The experiment settings seem to be different from prior work. What does the *different* mean in Sec 5-1? Why didn't the authors report the same architecture attack performance?\n2. Meanwhile, the performance of ILA++ reported in the paper is different from the original paper. What would be the root reason for it?", "limitations": "1. The authors do not report the variance of the experimental results.", "rating": 5, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 2, "strengths": "1. The paper is well-written, and the motivation is sound.\n2. The analysis provides insights and could serve as a tool for future work.\n3. Extensive experiments verify the effectiveness of the proposed method.", "weaknesses": "1. Despite the empirical effectiveness, the proposed method is not well-explained. Or, at least, it is unclear to me. The authors may like to elaborate more on how the \"dual\" equation (Eq. 3) is derived and provide insights into the equation. There seem to be some alternatives. For example, one can maximize $\\mathcal{L}(h(x+\\Delta x))$. What would be the role of $h(x)$ in this formulation?\n\n2. Following the previous point, the proposed method looks incremental or empirical finding to me if it lacks proper insights.\n\n3. In L152, what is the link to the mixup? The authors mentioned it, but it needed further discussion in depth.\n\n4. In Section 4, the analysis lacks the baseline ILA. The audiences will be interested in whether the proposed method improves the prior work as motivated by the authors in the introduction.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thanks for your feedback. Our responses to the comments are provided as follows.  \n&nbsp;  \n\n> Despite the empirical effectiveness, the proposed method is not well-explained. Or, at least, it is unclear to me. The authors may like to elaborate more on how the \"dual\" equation (Eq. 3) is derived and provide insights into the equation. There seem to be some alternatives. For example, one can maximize $L (h(x+\\Delta x))$. What would be the role of $h(x)$ in this formulation? \n\n**Response:** Our motivation is summarized as follows to make it clearer.  \n* The common belief in intermediate-level attacks, _e.g._, ILA, ILA++, and NAA, is that a larger magnitude of intermediate-level perturbations along the directional guide leads to improved transferability of adversarial examples. These methods achieve their goals via a two-stage mechanism, _e.g._, performing I-FGSM first to obtain the directional guide and enlarge the projection of the intermediate-level perturbation onto the directional guide.  \n* However, in this paper, we point out that the directional deviation of intermediate-level perturbation from the guide, even subtle, does great harm to the transferability. Therefore, we seek the intermediate-level perturbation $h(\\mathbf{x}+\\mathbf{\\Delta x}) - h(\\mathbf{x})$ that is in an adversarial direction $\\mathbf{v}$ and to possess larger magnitudes compared to $\\mathbf{v}$, simultaneously.  \n* It is achieved by defining $\\mathbf{v} =  \\frac{1}{\\gamma} (h(\\mathbf{x}+\\mathbf{\\Delta x}) - h(\\mathbf{x}))$ as the directional guide and optimizing it to be adversarial in Eq. (3) in the paper. From such a definition, we know that the magnitude of the achieved intermediate-level perturbation naturally shows a larger magnitude than $||\\mathbf{v}||$, thus the goal is achieved.  \n\nWe appreciate the suggestion about alternative options, but $L(h(\\mathbf{x}+\\mathbf{\\Delta x}))$ (if $L$ is defined to be the cross-entropy loss as in our paper) can NOT be directly optimized. Not sure if the reviewer actually meant to say $L (g(h(\\mathbf{x}+\\mathbf{\\Delta x})), y)$. If yes, we would like to remind the reviewer that this is equivalent to the baseline attack, _i.e._, I-FGSM, and it is not beneficial to transferability. We agree that there may exist alternatives, yet, from our perspective, the chosen formulation is the most straightforward and effective implementation accordingly to our motivation.  \n&nbsp;  \n\n> In L152, what is the link to the mixup? The authors mentioned it, but it needed further discussion in depth.\n\n**Response:** As has been discussed in lines 151-153 and lines 172-178, after rewriting the objective, our solution resembles performing mixup on the intermediate-level feature representations between adversarial and benign examples. Yet, in our solution, there is no randomness for $\\gamma$ and the mix ratio $1/\\gamma$ of the optimized subject is suggested to be relatively small ($\\leq 0.5$). If we follow the mixup to use a random mix ratio sampled from a Beta distribution, then the optimization of adversarial examples hardly converge, as the ratio on the optimized subject change drastically during optimization.  \n&nbsp;  \n\n> In Section 4, the analysis lacks the baseline ILA. The audiences will be interested in whether the proposed method improves the prior work as motivated by the authors in the introduction.\n\n**Response:** We would like to politely remind the reviewer that we have discussed ILA from the perspective of gradient alignment in Section 4 already (specifically, in lines 228 - 234). Moreover, we have conducted comprehensive empirical comparisons between our method and other intermediate-level attacks (including ILA++ and NAA) in Section 5. These methods outperform ILA according to our experimental results and similar results in many previous papers. To be concrete, in our experiment, ILA achieves an average attack success rate of 44.80% on ImageNet, while ILA++, NAA, and our solution achieve 46.99%, 46.36%, and 57.06%, respectively.  \n&nbsp;  \n\n> The experiment settings seem to be different from prior work. What does the different mean in Sec 5-1? Why didn't the authors report the same architecture attack performance?\n\n**Response:** In Section 5.1, since a VGG-19 is used as the substitute model, we adopt an independently trained VGG-19 which has different weights but the same architecture as one of the victim models to make the evaluation more practical. Note that, in a black-box setting, it is less likely that the victim adopts exactly the same model as the substitute model, but it is more possible that the architecture is the same.  \n&nbsp;  \n\n> Meanwhile, the performance of ILA++ reported in the paper is different from the original paper. What would be the root reason for it?\n\n**Response:** As has been discussed in lines 257-258, this is because of differences in pre-processing. In this paper, we don't crop images before feeding them to the models, following some recent work [1][2], while, in the ILA++ paper the images were cropped.  \n&nbsp;  \n\n> The authors do not report the variance of the experimental results.\n\n**Response:** For compared methods that involve randomness, the standard deviation of their multiple run results is relatively small (generally smaller than 0.30% to be specific) compared to their performance gap, thus it does not affect the conclusions. We will add such results to our paper.  \n&nbsp;  \n&nbsp;  \n\n[1] Jiadong Lin, et al. Nesterov Accelerated Gradient and Scale Invariance for Adversarial Attacks. In ICLR 2019.  \n[2] Xiaosen Wang, et al. Admix: Enhancing the Transferability of Adversarial Attacks. In ICCV 2021."}, {"review_id": "izwYguX8tP", "reviewer": "Reviewer_maPS", "summary": "In this paper, the authors propose an intermediate-level attack method with a single stage of optimization to improve attack transferability. When computing gradients, it adopts intermediate-level perturbation decay to process a larger magnitude. The experiment validations on the ImageNet and CIFAR-10 datasets are given to demonstrate its effectiveness to improve the attack transferability.", "questions": "1. Figure 1 does not give an intuitive visualization about the problem of existing intermediate-level attacks. The motivation of this paper should be stated clearly.\n2. Lack of related works with existing intermediate-level attack methods. The whole construction of this paper should be improved.\n3. How about the transferability with other types of models as the substitute model?\n4. Fix the typos and polish this paper again.\n", "limitations": "Limitations not clearly elaborated.", "rating": 5, "confidence": 4, "soundness": 2, "presentation": 2, "contribution": 2, "strengths": "1. The proposed method presents a single stage with a larger magnitude rather than two stage training.\n2. The proposed method is a pluggable module that can be deployed in other attack methods.\n3. The experiments are thorough with various victim models, including CNNs, MLP, vision transformers, and robust models.\n", "weaknesses": "1. From Figure 1, there is no obvious difference between the victim model and the substitute model. The reviewer is confused that these two figures are less related to the statement in Section 3.1. \n2. The construction of this paper is disordered. The authors introduce the existing intermediate-level attack method with the proposed method, which covers the contribution of the proposed method. The authors should highlight its own contribution.\n3. For the experiments, the authors only use the ResNet-50 model as the substitute model to test the attack transferability on other models. However, a cross-model evaluation could be better, i.e., using MLP or transformers to test on other types of models. \n4. The writing of this paper needs to be improved. \n- For the introduction, the authors do not provide a brief introduction of the proposed method. \n- For the related work, the white-box attack is less related to this paper. And existing intermediate-level attack methods are missed.\n- There are also some typos.\na) In line 31, be discuss -> be discussed.\nb) In line 327, there exists two duplicate ‘to all competitors’.\n", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thanks for your feedback. Our responses to the comments are provided as follows.  \n&nbsp;  \n\n> From Figure 1, there is no obvious difference between the victim model and the substitute model. The reviewer is confused that these two figures are less related to the statement in Section 3.1.\n\n**Response:** Figure 1 is given to show the negative impact of the directional deviation from the guide in middle layers. In Figure 1, we can observe that with a similar scalar projection, more severe deviation leads to lower prediction loss on both the substitute model (Figure 1(a)) and the victim model (Figure 1(b)). We use blue and orange colors to indicate different ranges of prediction loss in the two subfigures, and it can be seen that lower prediction loss is generally achieved on the victim model.  \n\nThe intermediate-level perturbation obtained by ILA is marked by the purple box in the figure. The figure further demonstrates that ILA leads to directional deviation from the guide (as its x-axis value, _i.e._, the cosine similarity, is smaller than 1.0), and, in particular, if such a deviation can be addressed, higher attack performance can be achieved by adversarial examples whose intermediate-level perturbations are even smaller (as darker colors, _i.e._, higher prediction loss, can be achieved with points on the y-axis whose scalar projections are even smaller than that of the ILA point). We have discussed these points in detail in the last paragraph in Section 3.1.  \n&nbsp;  \n\n> The construction of this paper is disordered. The authors introduce the existing intermediate-level attack method with the proposed method, which covers the contribution of the proposed method. The authors should highlight its own contribution.\n\n**Response:** Section 3.1 not only introduces previous intermediate-level attacks, but also discusses and analyzes their limitations which inspire our work, _i.e._, ILPD. We believe such a discussion is also part of our contributions and it will inspire future work in this field. Moreover, without such a gentle introduction and discussion, it will be more difficult to capture the motivation of our method. We are more than glad to highlight more about the contribution of this paper in our revision.  \n&nbsp;  \n\n> For the experiments, the authors only use the ResNet-50 model as the substitute model to test the attack transferability on other models. However, a cross-model evaluation could be better, i.e., using MLP or transformers to test on other types of models.\n\n**Response:** We appreciate the suggestion and have done such a comparison on ImageNet, by using ViT-B, DeiT-B, Swin-B, and MLP Mixer-B as the substitute models. $h$ is always split to be the first two blocks of these models and we fix $1/\\gamma=0.1$. For NAA and ILA++, we tested the results of all possible intermediate layer selections and report the best results among them. The average success rates are compared as follows, and the victim models are the same as those in Table 1 of our paper.  \n\n| Substitute model | NAA | ILA++ | ILPD |\n|:------------------:|:-----:|:-------:|:-------:|\n| ViT-B                   |        43.52%      |      35.02%    |       **46.63%**    |\n| DeiT-B                 |        35.35%      |     23.66%     |      **44.28%**     |\n| Swin-B                |          21.41%     |      13.23%     |     **36.77%**       |\n| MLP Mixer-B       |       33.18%       |     20.81%    |      **41.72%**      |  \n&nbsp;  \n\n> For the introduction, the authors do not provide a brief introduction of the proposed method. \n\n**Response:** As has been discussed in the paper, since the name of the proposed method itself contains much information, we have briefly introduced our method in the introduction section as \"In this paper, we propose a method that encourages the intermediate-level perturbation to possess a greater magnitude than a directional guide by its nature and to be in the same adversarial direction as that of the guide. This is achieved by introducing intermediate-level perturbation decay (ILPD) in a single stage of optimization.\" We are more than glad to introduce more in an updated version of the paper.  \n&nbsp;  \n\n> For the related work, the white-box attack is less related to this paper. And existing intermediate-level attack methods are missed. \n\n**Response:** Since I-FGSM is considered as the baseline and it was first introduced as a white-box method, we briefly introduce white-box attacks in Section 2. Notations are also given during such a brief introduction. Following your suggestion, we will consider revising Section 2 to further simplify such an introduction, and we will perform a more comprehensive literature review in this section.  \n&nbsp;  \n\n> There are also some typos. a) In line 31, be discuss -> be discussed. b) In line 327, there exists two duplicate ‘to all competitors’.\n\n**Response:** The authors would like to thank the reviewer for pointing out typos. All of them will be addressed in an updated version of the paper. "}, {"review_id": "HNfziwEVYR", "reviewer": "Reviewer_ektX", "summary": "The paper addresses the limitations of intermediate-level attacks, highlighting how their two-stage training scheme leads to perturbations that deviate from directional guides, significantly impairing attack performance. To overcome this limitation, the authors propose a single-stage optimization method that ensures intermediate-level perturbations have larger magnitudes and precisely follow the directional guides, effectively increasing model prediction loss. Extensive experiments on ImageNet and CIFAR-10 demonstrate that the proposed method outperforms existing techniques when attacking various victim models. Furthermore, the paper shows that the proposed method can be easily combined with prior approaches to craft more transferable adversarial examples.\n\n\n\n\n", "questions": "1 Line 200-201. It is reasonable that the gradients of $h$ are not concerned, but why $W_{\\beta+1}$ (after the intermediate layer) not considered? \n\n2 If change the surrogate model, do you need to adjust the intermediate position and $\\gamma$?", "limitations": "The method appears to be sensitive to the parameters $\\gamma$ and the choice of intermediate layer for splitting h and g. However, in real-world scenarios, it is often impractical to tune these parameters effectively based on the victim models. ", "rating": 6, "confidence": 5, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "This paper recognizes the limitations of current intermediate-level attacks and proposes a novel method named ILPD. This method crafts adversarial examples using a single stage of optimization, encouraging the intermediate-level perturbation to be both in an effective adversarial direction and possess a significant magnitude simultaneously. A large number of experiments demonstrate that ILPD outperforms SOTA methods by large margins. ", "weaknesses": "The method seems sensitive to $\\gamma$ and the intermediate layer to split h and g. ", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thanks for your positive feedback. Our response to the comments is provided as follows.  \n&nbsp;  \n\n> The method seems sensitive to $\\gamma$ and the intermediate layer to split $h$ and $g$.\n\n**Response:** Just like all other intermediate-level attacks, although our ILPD needs to tune the position to achieve its optimal performance, we can observe from our discussions in Section 5.4 that our method is less sensitive to the choice of position compared to other methods. Moreover, accordingly, to experiments in the ILA paper, the optimal choice of position can actually be found on the substitute model itself thus it is generally not a concern. As for $1/\\gamma$, Figure 6 in the paper shows that our method outperforms all its competitors with a wide range of $1/\\gamma$ ($[0, 0.3]$ and $[0.1, 0.6]$ on ImageNet and CIFAR-10, respectively), showing that the choice of $1/\\gamma$ is not a big concern to ensure its superiority over state-of-the-arts.  \n&nbsp;  \n\n> Line 200-201. It is reasonable that the gradients of $h$ are not concerned, but why $W_{\\beta + 1}$ (after the intermediate layer) not considered?\n\n**Response:** We appreciate the comment. Indeed, the difference in $W_{\\beta + 1}$ between the substitute model and the victim models also affects the transferability. However, such a gap cannot be easily bridged, unless we modify the parameters of the substitute model to make it more similar to the victim parameters, which seems infeasible from our perspective. By contrast, the difference in activation masks in $\\{D_i\\}$ and/or diversity in the gradients of $L$ _w.r.t._ the logits can be somehow reduced by modifying the intermediate-level representations on the substitute model, thus we mainly discuss them in our paper.  \n&nbsp;  \n\n> If change the surrogate model, do you need to adjust the intermediate position and $\\gamma$?\n\n**Response:** To show whether the same hyper-parameters work on different substitute models, we conduct an experiment on ImageNet to compare the performance of ResNet-50, ViT-B, DeiT-B, Swin-B, or the MLP Mixer-B as the substitute model. $h$ is always split to be the first two blocks of these models and we fix $1/\\gamma=0.1$ for them. For NAA and ILA++, we tested the results of all possible intermediate layer selections and report the best results among them. The average success rates are shown as follows and results are compared with the I-FGSM baseline, NAA, and ILA++. The victim models are the same as those in Table 1 in our paper. It can be seen that the obvious superiority of our ILPD holds.  \n\n| Substitute model | NAA | ILA++ | ILPD |\n|:------------------:|:--------:|:-----:|:-------:|\n| ResNet-50        |   46.36%     |  46.99%   |   **57.06%**    |     \n| ViT-B                   |        43.52%      |      35.02%    |       **46.63%**    |\n| DeiT-B                 |        35.35%      |     23.66%     |      **44.28%**     |\n| Swin-B                |          21.41%     |      13.23%     |     **36.77%**       |\n| MLP Mixer-B       |       33.18%       |     20.81%    |      **41.72%**      |  "}]

Author rebuttal:

Meta-review: The paper proposes a one-stage optimization method that improves the alignment between the directional guide and feature perturbations in crafting the black-box adversarial attack. The paper initially received somewhat mixed reviews of two Weak Accepts, one Accept, one Borderline Reject, and one Reject. The primary concerns raised by the reviewers were about the clarity of the paper, the choice of the baseline methods and experiment settings, and comparisons with more surrogate models. The authors adequately addressed most concerns in the rebuttal, hence all reviewers recommend acceptance. The AC agrees with the reviewers’ decision. The authors should update the camera-ready paper to include the changes suggested by the reviewers during the review process.
Decision: Accept (poster)