Logit Margin Matters: Improving Transferable Targeted Adversarial Attack by Logit Calibration
Authors: Juanjuan Weng
Zhiming Luo
Zhun Zhong
Shaozi Li
Nicu Sebe
Venue: NeurIPS 2022 Submitted (2022)

Abstract: Previous works have extensively studied the transferability of adversarial samples in untargeted black-box scenarios. However, it still remains challenging to craft the targeted adversarial examples with higher transferability than non-targeted ones. Recent studies reveal that the traditional Cross-Entropy (CE) loss function is insufficient to learn transferable targeted perturbations due to the issue of vanishing gradient. In this work, we provide a comprehensive investigation of the CE function and find that the logit margin between the targeted and non-targeted classes will quickly obtain saturated in CE, which largely limits the transferability. Therefore, in this paper, we devote to the goal of enlarging logit margins and propose two simple and effective logit calibration methods, which are achieved by downscaling the logits with a temperature factor and an adaptive margin, respectively. Both of them can effectively encourage the optimization to produce larger logit margins and lead to higher transferability. Besides, we show that minimizing the cosine distance between the adversarial examples and the targeted classifier can further improve the transferability, which is benefited from downscaling logits via L2-normalization. Experiments conducted on the ImageNet dataset validate the effectiveness of the proposed methods, which outperforms the state-of-the-art methods in black-box targeted attacks. The source code for our method is available at https://anonymous.4open.science/r/Target-Attack-72EB/README.md.

Logit Margin Matters: Improving Transferable Targeted Adversarial Attack by Logit Calibration
Anonymous Author(s)
Affiliation
Address
email
Abstract
Previous works have extensively studied the transferability of adversarial samples untargeted black-box scenarios. However, still remains challenging craft the targeted adversarial examples with higher transferability than non-targeted ones. Recent studies reveal that the traditional Cross- Pross-Entropy (CE) loss function is insufficient to learn transferable targeted perturbations due to the issue of vanishing gradient. In this work, we provide a comprehensive investigation of the CE function and find that the logit margin between the targeted and non-targeted classes will quickly obtain saturated in CE, which largely limits the transferability. Therefore, in this paper, we devote to the goal of enlarging logit margins and propose two simple and effective logit calibration methods, which are achieved by downscale the logits with a temperature factor and adaptive margin, respectively. Both of them can effectively encourage the optimization to produce larger logit margins and lead to higher transferability. Besides, show that minimizing the cosine distance between the adversarial examples and the targeted classifier can further improve the transferability, which is benefited from downscale logits via L.2-normalization. Experiments conducted on the ImageNet dataset validate the effectiveness of the proposed methods, which outperforms the state-of-the-e methods in black-box targeted attacks. The source code of our method is available at Link.
2
6
10
12
14
16
17
18
Introduction
20 In the past decade, deep neural networks (DNNs) have achieved remarkable success in various fields, e.g., image classification [24], image segmentation [19], and object detection [23]. However, Goodfellow et al. [5] reveal that the DNNs are vulnerable to adversarial attacks, in which adding imperceptible disturbances to the input can lead the DNNs to make incorrect prediction. Many following approaches [3, 4, 1, 27, 29] have been proposed to construct more destructive adversarial samples for investigating the vulnerability of the DNNs. [5, 18] also show that the adversarial samples are transferable across different networks, raising more critical robustness threat under the black-box scenarios. Therefore, it is vital to explore the vulnerability of the DNNs, which is very useful for designing robust DNNs.
21
22
23
24
26
28
29
Currently, most of the works [3, 29, 16, 10, 28, 6] have been devoted to the untargeted black-box attack, in which adversarial examples are crafted to fool unknown CNN models predict unspecified incorrect labels. For example, [3, 29] leveraged input-level transformation or augmentation to
30
31
32 improve the non-targeted transferability, [10] proposed a powerful intermediate feature-level attack.
[28, 6] demonstrated that backpropagating more gradients through the skip-connections can increase
34 the transferability. Despite the success in non-targeted cases, the targeted transferability remains challenging, which requires eliciting the black-box models into pre-defined target category label.
Submitted to 36th Conference on Neural Information Processing Systems (NeurIPS 2022). Do not distribute.

---

Loght
Lager
(a) Cross-Entropy
(b) Po+Trip
(c) Logit
Figure 1: The average Top-3 logits and logit margin of 50 adversarial samples trained by the Cross-
Entropy, Po+Trip and Logit loss functions for crafting the ResNet-50. (* Training and computation
details of this figure are in Section 3.1)
36 For learning the transferable adversarial samples in untargeted cases, most methods have leveraged the Cross-Entrope Entropy (CE) as the loss function. However, [15, 30] recently showed that the CE loss insufficient for learning the adversarial perturbation in the targeted case due to the issue of vanishing gradient. To deal with this issue, [15] adopt the Poincaré distance to increase the gradient magnitude during the optimization adaptively. [30] demonstrated that an effortless logit loss equal to the negative value of the targeted logits could alleviate the gradient issue and achieve surprisingly strong targeted transferability. Besides, [30] also showed that optimizing with more iterations can significantly increase the targeted transfcrability. Although [30] demonstrated that continually enlarging the logits of the targeted class improve the transfcrability of adversarial samples, it still does not thoroughly analyze the insufficient issue the CE loss function.
37
38
39
41
43
44
45
In this study, we take closer look at the vanishing gradient issue in the CE and find that the logit margin between the targeted and non-targeted classes will quickly get saturated during the optimization (as shown in Fig. (a)). Moreover, this issue will influence the performance of the perturbations and thus essentially limit the transferability. Specifically, along with the training 49
46
47
iterations in CE, we observe that the logits of the targeted and non-targeted classes increase rapidly in the first few iterations. However, after reaching the peak, the logit margin between the targeted and non-tare targeted classes will get saturated, and further training will decrease the logits simultancously 53 to maintain this margin. This phenomenon is mainly due to the fact that the softmax function in CE will approximately output the probability of the target class when reaching the saturated margin (e.g., 10). Thus, it raises the problem that the transferability will not be further increased even optimized with more iterations. While in practice, we encouraged to increase the transferability by maximizing both the logit for the targeted class and its margin against other non-targeted classes cross the decision boundaries of other black-box models.
51
55
57
58
59 In this paper, we devote to enlarging logit margins to alleviate the above saturation issue CE. Inspired by the temperature-scalinn used in the knowledge distillation [8], higher temperature T will produce a softer probability distribution over different classes. We firstly leverage this scaling technique into the targeted adversarial attack to calibrate the logits. Then the logits margin between the targeted and tor-tergeted classes will not be saturated after only a few iterations and will keep improving the transferability. On the other aspect, instead of using constant T, we further explored an adaptive margin- margin-based calibration by scaling the logits based on the logit margin of the target class and the highest non-target class. In addition, also investigate the effectiveness of calibrating the targeted logit into the unit length feature space by L.2normalization, which is equivalent to minimizing the angle between the adversarial examples and the targeted classifier.
61
69
65
57
68
89 Finally, we conduct experiments on the ImageNet dataset to validate the effectiveness of the logits calibration for crafting transferable targeted adversarial examples. Experimental results demonstrated that the calibration of the logits helps achieve a higher attack success rate than other state-of-the-an art methods Additionally, we tested the logit calibration in Generative Adversarial Networks (GANs)- 73 based TTP method [21] to train the target-class class-specific generators, which is also beneficial for increasing the transferability in the resource intenssve method.
71
2 Related Works
75
76 In this section, we give a brief introduction of the related works from the following two aspects: untargeted blx attacks and targeted attacks.

---

78
2.1
Untargetd Black-box Attacks
79
After [25] exposed the vulnerability of deep neural networks, many attack methods [29, 4] have been proposed to craft highly transferable adversaries in the non-targeted scenario. We first review several gradient-based attack methods that focus on enhancing the transferability against black-box models.
80
81
82
Iterative-Fass Gradient Sign Method (I-FGSM) [14] is an iterative version of FGSM [5], which adds small perturbation with a small step size a in the gradient direction iteratively:
83
So I.
1 z + a sign V J v)),
84
where K denotes the adversarial image in the deh iteration, a e/T ensures the adversaries be constrained within an upper-bound perturbation through the In-norm when optimized by iterations.
85
86
Following the seminal I-FGSM [14], a series of methods have been proposed to improve the transfer- ability of attacking black-box models from different aspects, e.g. gradient-based, input augmentation- based. For example, the Momentum Iterative-FGrr FGSM (MI-FGSM) [3] introduces a momentum term to compute the gradient of the I-FGSM, encouraging the perturbation updated in a stable direction. The Translation Invariant-FGSM (TI-FGSM) [4] adopts a predefined kernel W to con- volve the gradient J y) at each iteration 4, which can approximated the average gradient over multiple randomly translated images of the input ãtz. On the other aspects, the Diverse Input-FGSI) (DI-FGSM) leveraged the random resizing and padding to augmentation the input & at each iteration. Currently, most targeted attack methods [15, 30, 21] simultaneously use the MI, TI and DI to form a strong baseline with better transferability.
87
88
89
90
91
93
94
95
96
2.2
Targeted Attacks
Targeted attacks are different from non-targeted attacks, which need to change the decision to 97
96
specific target class. [13] integrates the above non-targeted attack methods into targeted attacks to craft targeted adversarial examples. However, the performance is limited because it is insufficient to fool the black-box model only by maximizing the probability of the target class with the CE loss.
100
101
Pot Trip [15] found the insufficiency is mainly due to vanishing gradient issue in CE. Then, [15] leverage dthe Poincaré space as the metric space and further utilized Triplet loss to improve targeted
102
103
transferability by forcing adversarial example toward the target label and away from the ground truth
104
label. To further address this gradient issue, Logits [30] adopts simple and straightforward idea by directly maximizing the target logit to pull the adversarial examples close to the target class, which
105
106
can be ex expressed as:
Lagit =2((2,)
107
where z+(-) is the output logits of the target class.
108
On the other hand, many studies employ sssource-nttesivve approaches to achieve targeted attack, which train target class-specific models (auxiliary classifiers or generative models) on additional large-sces scale data. For example, the FDA methods [12, 11] used the intermediate feature distributions of
109
110
CNNs to boost the targeted transferability by training class-specific auxiliary classifiers to model layer- wise feature distributions. The GAP [22] trained a generative model for crafting targeted adversarial examples. Subsequently, [20] adopted relativistic training objective to train the generative model for improving attack performance and cross-domain transferability. Recently, the TTP [21] utilized the global and local distribution matching for training target class-specific generators for obtaining high targeted transferability. However, the TTP requires actual data samples from the target class and brings expensive training costs. Different from the above methods, we introduce three simple and effective logit calibration methods into the CE loss function, which can achieve competitive performance without additional data and training.
112
113
114
116
118
3 Method
120
121
Problem Definition Given a white-box surrogate model F, and an input not from the targeted
122
class I, our primary goal to learn an imperceptible perturbation 8 that can fool the F, to output the target for à + 8. Besides, the prediction of à will also be / when feeding to other unknown black-box surrogate models. The -nom is usually used to constrained the á within an upper-bound denoted as ||ó||o. S E.
124
3

---

128
For the surrogate model F,, we denoted the feature for the final classification layer of the input z as Φzz). The logit 2, category i computed by 2; W ((z) + b,, the W; and b, are the classifier weights and bias. The corresponding probability p, after the softmax is p. E55
127
128
129
3.1
Logit Margin
130
When successfully attacked the F,, the logit =e of the target class will be higher than the logits And of any other non-target class in the classification task. Their logit margins can be computed by,
G(((E)) 2t - 2nt = W 2 + +b W bnt-
(3)
132 [15, 30J showed that is insufficient to obtain transferable targeted adversarial samples that are only close to the target class while not away from true class and other non-targeted classes. Based on this property, encourages us to continually enlarge this logit margin to increase the separation between the targeted and other non-targeted classes.
134
136
To have a better understanding of the relationship between the logit margins and the targeted transferability, we visualize the average Top-3 logits (1 targeted class and other two non-targeted classes) of 50 random adversarial samples trained for crafted ResNet50 by the CE, Po+Trip, and the Logit loss functions with MI, DI and TI following [30]. We also compute the average logit margin of the targeted class against the Top-20 non-targeted classes. The logit and margin are shown in Figure I, and the transferability from ResNet50 to VGG16 is plot in Figure 2.
137
138
139
140
142
From Figure 1, we can observe that the logits of the geted class and the Top-2 non-tane mangereetedd classes increase rapidly the first few iterations for the CE and Po+Trip loss, as well as their logit margins. When reaching the peak, the margin is saturated, and the logits start de-
143
144
145
148
147
crease simultaneously to maintain the saturated margin.
Success Rate
148
By comparing the CÉ and Po+Trip, the Po+Trip needs fewer more iterations to reach the saturated status and thus shows marginal better transferability than CE, as
2
149
150
shown in Figure 2. In comparison, the Logit loss function will keep increasing the logits of the targeted category and the logit margin. Thus, the Logit loss function shows a much better targeted-atted
152
Ieera terations
154
success rate than CE and Po+Trip. On the other hand, the Logit loss also signifi- cantly increases the logits for other non-targeted classes.
Figure 2: The targeted attack success rate (%) on VGG-16 by using the ResNet-50 as the surrogate model.
156
157
To further analyze why the CE loss function saturated to this logit margin and explore the effectiveness of in- creasing the margin during training, in the following sections, we will revisit the cross-entropy loss function and introduce the logit calibration to achieve this goal.
158
160
3.2 Revisiting the Cross-Entropy Loss
162
Firstly, our objective is to maximize the logit margin in Eq. 3. After computing the gradient w.r.t. to ( we can get
8G 0Φ(x)
W. W
(4)
184 This gradient indicates that the adversarial feature ((t) needs to move towards the target class while apart from those non-target classes. Next, we compute the gradient w.r.t. ((8) the Cross-Entropp
165
186 loss function
LCE = - -log(pt) = -2 + log Σ )z))
(5)

---

187
and get the gradient
Dica as 06(
ac. 0Φ(E)
Oz d0(3)
1 O c*
+
Σ ea
d5(
Σ 6
dzt
Ozi
Σ
+
E
Σ
Σ
E
02,
021
Σ -P. W.).
Ee 06(8)
0Φ(3))
168
From Eq. 6, we actually can find the CE loss function is designed to adaptively optimize the s(t) towards Wr and away from other W. However, after being optimized for several iterations, the p. of the non-targeted class will quickly approximate to and then significantly vanish the We W,.
169
170
Let's consider the case only with 2 classes (t and nt), we have the probabilities pt and Pnt as:
Pt e + c
+ c (nc-
172
(8) As shown in Figure 3, the Pt will get close to when 2; Znd > (e.g., Pnt R 2e when
Pxt e + g
+ e(=)-an))
173
21 Zyz = 20). In such a context, the gradient will significantly vanish. Recall that, in the CE loss function (Figure (a)), the logit margin between Top-1 and Top-2 logits first increases rapidly but will reach saturated status when approaching certain value. This further indicates that the optimization of the CE loss function is largely restrained when the logit margin reaches a certain value.
175
177
179
To this end, we raise the question if we explicitly enforce the optimization to enlarge the logit margin (zt znt), could we gel better transferable targeted udversarial samples?
181
182
To answer this, we propose to downscale the 2 2nt by a factor in the CE and extent the informative optimization for more iterations. Since in such circumstance,
183
184
2nt will be enlarger by the factor s. Specifically, suppose that the optimization will be saturated when
185
186
2nt and Zur in the CE will both approach the saturated value of Then, it is easy to infer that, for the latter case, Znt will be
2nt reaches a certain value v. Using
Figure 3: The probability of pe under different 2t 2nt-
197
189
V X 8.
3.3
Calibrating the Logits
191
To downscale the 2 znd during the optimization, we investigate three different types of logit calibrations in this study, i.e., Temperature-basee Margin-based and Angle-based.
192
193
3.3.1
Temperature-bast
194
Inspired by the Temperature -eaarlin used in the Knowledge distillation [8], our first logit calibration directly downscale the logits by a constant temperature factor T,
195
21
196
After introducing the T, the probability distribution p will be more softer over different classes. The corresponding gradient can be compute by:
197
OL dΦ(ā)
///T 1 0zz
1,00 7 0z
dz
(W, W:) T
E
05
Σ
Dr
(10)
The 6. will not quickly approach to after only few iterations.
In Figure (a)(b), we visualized the logits of using T = 5 and = 20. We can find that targeted logits and the logit margin will keep increasing as the same as the Logit in Figure 1. Meanwhile, the 201 trend of = 20 is very similar with the Logit [30] and we show that the Logit loss function can be
199
considered special case of calibrating the logits with a large T' in the supplementary.
5

---

(a) T=5
(b) T=20
(c)
Margin
Figure The average Top-3 logits and logit margin of 50 adversarial samples after the logit calibration for crafting the ResNet-50.
203
3.3.2
Margin-based
204
The previous Temperature-bant based logit calibration contains a hype-parameter T, which could be different for different surrogate model F.. To migrate this issue, further introduce adaptive -angin-bbsed logit calibration. Specifically, we calibrate the logits by using the margin between the Top-2 logits in each iteration, denoted as:
206
207
(11)
22
208
where & and &2 are the Top-1 and the Top-2 logit, respectively.
209
In this Margin-based logit calibration, we will enforce the p. and pi of the Top-1 non-target class at each iteration meet the following constraints:
210
=
1 E (Bc-
I+e-D
(12)
P1
(13)
1
212
Then, it can adaptively deal with the vamishing gradient issue in the original CE loss function. The logits and the margin shown in Figure 4 (c).
213
214
3.3.3
Angle-based
215
On the other aspect, different We usually has different norm. To further alleviate the influence of various norms, we calibrate the logit into the feature space with unit length by 1.2- .2-normalization,
216
w +())+ If omit the b,, this calibration is compute the cos(0) between ((i) and W,, and we term [ill|o(())
218
angle-based calibration. Since, this angle-based calibration will bound each logit smaller than one. Instead of using the CE loss function, we directly minimize the angle between the d(ā)) and the
219
220
targeted W,. The optimization loss function is:
W. ((t)
Loneine
(14)
|| ((+)
The angle-based classifiers have been widely using in Pice-Recognition task [17, 2]. In the experi- ments, we evaluate the performance of using different logit calibrations and their mutual benefits.
222
Experiments
223
Experimental Setup In this section, we evaluate the effectiveness of logit calibration for improving 225
transferable targeted adversarial attack. Following the recent study [30], we conduct the experiments the difficult ImageNet-Compatee
Dataset'. This dataset contains 1, 1,000 images with 1,000 unique
227
class labels corresponded to the ImageNet dataset. We implement our methods based on the source
'nttps://githut ccmm///overhann-lal/llleeee htt.l/eehhaa.laa///eeeeaaaneeeee http://wewwaaeeeeeee/////eeeeeee 13..0...n.........

---

Table The targeted transfer success rates (%) the single-model transfer scenario. (Results with
20/100/300 iterations are reported, and the highest one at 300 iterations is showed bold.)
Surrogate Model: ResNet50
Surrogate Model: 1ense
Attack
12
VGG16
IInc-33
RRes50
VGG16
IInc-33
CE
27.0/40.2/42.1
17.4/27.6/29.1
2.3/4.1/4.6
12.3/17.2/18.4
8.6/10.5/10.9
1.6/2.3/2.8
Po+Trip
27.9/51.2/54
17.9/35.5/34.7
3.2/6.8/7.8
11,0/14.8/15.00
7.3/9.2/8.6
1.6/2.8/2.8
Logit
31,4/64.0/71.8
23.8/55.0/62
3.1/8.6/10.9
17,4/38.6/8 6/43.5
13.7/33.8/37.8
2.3/6.6/7.5
T=5
33.3/69.9/77.8
24.8/59.9/66.
3.1/9.4/12.2
19.3/43.4/47.5
14.6/36.6/39.4
2.3/7.3/8.8
T=
31.6/68.5/77.0
23.6/58.5/66.
2.8/9.4/11.6
17.9/43.2/49.3
13.4/36.8/41.5
2.2/7.7/8.8
Margin
33.3/65.8/76.5
33.1/58.6/66
3.09.5/12.2
8/44
14.5/36.5/41.4
2.5/7.7/9.4
Angle
38.9/72.5/77.2
29. 29.2/60.7/65.2
4.4/10.7/11.1
20.6/43.2/47.8
16.5/35.7/39.3
3.0/7.7/8.9
Surrogate Model: VGG16
Surrogate Model: Inc-v3
Attack
RRes50
121
Inc-v33
+Res50
-Dessc121
+VGG16
CH
0.5/0.3/0.6
0.6/0.3/0.3
0/0/0.1
0.7/1.2/1.8
0.6/1.3/1.9
0.4/0.8/1.3
Po+Trip
0.7/0.6/0.7
0.7/0.6/0.5
1.0.0
10//.6/1.7
0.6/1.7/2.5
0.7/1.2/1.8
Logit
3,4/9.9/11.6
3.5/12.0/13,9
0.3/1.0/1.3
0.6/1.1/2.0
0.6/1.9/3.0
0,6/1.5/2.8
T=S
3.1/7.0/6.9
3.3/7.6/1.8
0,270.9/0.8
0.7/1.7/2.1
0.5/1.9/3.3
0,4/1.6/2.6
T= 10
3.6/9.0/9.7
3,4/10.5/11.7
3.2/1.1/1.3
0.5/1.3/1.9
0.6/2.0/2.7
0,4/1.5/2.8
Margin 3.3/10.3/1..0
3.5/12.5514.5
0.3/1.1/1.3
0.5/1,//1.7
0.7/2.1/3.1
0.5/1.7/2.7
Angle
0.4/0.7/0.5
0.6/0.4/0.5
0/0/0.1
0.8/1.8/2.6
0.8/2.2/3.0
0.9/1.7/2.4
code" provided by the Logit [30]. The same four diverse CNN models are used for evaluation, i.e., ResNet-50 [7]. DenseNet- 121 [9], VGG-16 with Batch Normalization [24] and Inception-v3 [26]. The perturbation is bounded by - < 16. The TI [4], MI [3] and DI [29] were used for all attacks,
229
and [|]]] = is set for TI. The I-FSGM is adopted for optimization with the a = 2. The attacks trained for 300 iterations
231
NVIDIA-2080 Ti GPU. We run all the experiments for 5 times, and report the average targeted transfer success rates (%). More experimental results can be found in the
233
supplementary.
4.1
Comparison with Other Methods in Single- Model Transfer
236 We first compare the proposed (temperature-basee
margin-based and angle-based) logit calibrations with the original CE, Po+Trip [15], and Logit [30] in the single-model transfer task. In this task, we take one surrogate model for training, and test the targeted transferability in attacking other models.
238
239
As shown in Table 1, the original CE loss function produces a worst performance than the Po+ Trip and Logit. But after performing the logit calibration in the CE loss function, we can find a significant performance boost compared with the original CE. All the calibration methods can outperform the Lggi,, especially when using the ResNet50 and Dense121 as the surrogate. These results indicate that the logit margin can significantly influence the performance of the targeted transferability. On the other aspect, we find that = 10 has better performance than T on the VGG-16, suggesting that different models may need different T. Instead of finding the best T for a different model, the Margin-based calibration can solve the issue and reach the overall best transferability all four models. However, we find that the Angle-based calibration is not working on the VGG16, which needs further investigation.
240
241
242
243
244
246
248
249
4.2
The Influence of Different T CE
250
In this section, we evaluate the influence of using different T in the CE loss function. The results are reported in Table From the Table, we can have the following observations. 1) The scaling factor T has significant influence on the targeted transferabiliiy. Specifically, there is a large decrease in performance when using small T 0.5. After increasing the T, we can observe the number of successfully attacked samples will increase. 2) The optimal T for different model is different. For example, T 5 can produce the overall best performance for ResNet50, Dense and Inception v3, while the VGG16 with fewer convolutional layers requires large T to obtain better transferability. and T 10 for ResNet50, Dense 121, and Inception v3. This is because that we use I-FSGM for optimization, which only considers the sign of the gradients. 4) Using larger T. the performance will be similar to the Logit loss function (see Table 1). We provide a deep analysis of this phenomenon in the supplementary material.
251
252
253
255
257
3) The performance are comparable when using
259
htttpp///ggthaa...o////aaagaagaa httpaa////...oogn//////atttteeee Tansfer
7

---

Table 2: The targeted transfer success rates (%) by using different in CE loss function. (Results with 20/100/300 iterations are reported.)
Surrogate Model: ResNet50
Surrogate Model: Dense121
Attack
12
+VG11
-3nc-v3
Recs50
+VG16
Inc-v3
T=0.5
13.2/16.0/19.5
7.1/9.5/11.0
1.2/1.8/2.4
4.2/5.0/6.2
2.3/3.5/3.2
0.6/0.9/1.1
T=1
27.0/40.2/42.7
17.4/27.6/29.1
2.3/4.1/4.6
12.3/17.2/18.4
8.6/10.5/10.9
1.6/2.3/2.8
T=2
34.2/62.8/67.7
24.4/52.3/53.9
3.3/7.2/8.5
18.7/35.0/36.1
13.2/27.3/27.0
2.2/5.5/6.1
T=5
33.3/69.
24.8/59 9/66.1
3.1/9.4/12.2
19.3/43.4/47.5
14.6/36.6/39.4
2.3/7.3/8.8
T= 10
31.6/68.5/77.0
04.6/58.56664
2.8/9.4/11.6
77.9/43.2/49..
13,4/36.8/41.5
2.217.7/8.8
T= 20
30,4/65.6/744
22.9/55 4/63.6
3,2/9.0/11.6
17.6/40.3/4..2
13.4/35 4/40.1
2.3/6.7/8.7
Surrogate Model: VGG16
Surrogate Model: Inc-v3
Attack
Res55
>eense121
>Inc-v3
Rees5
Dense 121
VVGG1
T=0.5
0.2/0.1/0.2
0.1/0.1/0.1
0/0/0
0.3/0.9/0.9
0.3/0.8/1.4
0.3/0.6/1.3
T=1
0,5/0.3/0.6
0.6/0.3/0.3
0/0/0.1
0.7/1.2/1.8
0.6/1.3/1.9
0,4/0.8/1.3
T=2
1.6/1.8/1.8
1.8/1.9/1.6
0.2/0.2/0.2
0.6/1.5/2.0
0.4/1.7/2.2
0,5/1.2/2.0
T=5
3.1/7.0/6.9
3.3/7 6/7.8
0.2/0.9/0.8
0.7/1.7/2.1
0.5/1.9/3.3
0.4/1.6/2.6
T= 10
3.6/9.0/9.7
3,4/10.5/11.3 1.7
0.3/1.1/1.3
0.5/1.3/1.9
0.6/2.0/2.7
0.4/1.5/2.8
T=
3,4/9.7/11.1
3.6/12.7/13.8
0.3/L.2/1.3
0.5/L.4/2.3
0.6/188/3.1
0.5/1.6/2.4
4.3
The Targeted Success rates for Transfer with Varied Targets
262
In Table 3, we report the result of a worse-case transfer scenario by gradually varying the target class from the highest-ranked the lowest one, and have the following findings: 1) The three types of logit calibration methods can improve the targeted transfer success rate over the original CE. The angle-based calibration has the best performance. But, we notice that the margin- based calibration doesn't work well in this setting. 2) The Semperature-based (T=5/10) and the Angle-based calibrations can outperform the Logit loss by a large margin, especially the Angle-based calibration.
264
286
267
4.4
The Mutual Benefits of Different Calibration Methods
269
In this part, we evaluate the mutual benefits of combining different calibrations and can have the following findings. 1) Combining the T=5/10/20 and Margin, there is increase in performance compared with using one of them. This because that the gradient directions of these two methods are very similar. 2) Combining the T=5 and An- gle,
Table 3: Targeted transfer success rate (%) when varying the target from the high-ranked class to low.
271
273
2nd
10th
200th
500th
800th
1000th
Logit CE
83.7
83.2
74.5
71.5
64.9
52.4
275
77.4 58.6
26.9
23.7
16.7
7.0
observe further improvement when using ResNet50 and Dense 1 as the surrogate model, e.g., the transferable rate of "ResNet50 + Dense121" is increased to 82.4% with 300 itera-
CE/5
91.3 88.7
77.1
75.8
70.1
58.8
277
CE/10
89.0 87.8
81.0
79.2
73.5
62.5
Margin
87.4
81.7
61.3
51.6
43.1
23.0
278
Angle
92.4 89.1
80.3
79.2
76.1
66.3
279
280
tions. Since the Angle obtains poor performance on
281
VGG16, the transferable rates of corresponding combinations are also low in T=5/10+Angle, but
282
T=20+Angle can deal with this issue. 3) Combining the Margin and Angle, there are only slight
283
improvements on ResNet50 and Dense 121, while it can alleviate the negative effects caused by the angle-based calibration. Finally, by jointly considering the results in Table 1, 2 and 4, we suggest using T=5 Angle for CNNs with more layers and the single Margin-based calibration for CNNs with fewer layers to achieve better targeted transfer attack.
284
286
287
4.5
Comparison with The TTP Method
288 In this section, we further evaluate the proposed cemperature-basee logit calibration in the GAN-based targeted attacks. Following the setting TTP [21], we sampled 50K images from the ImageNet training set and 50K images from the Painting dataset", which are used to train the targeted generators from different source domains. Instead of using the distribution matching and neighborhood similarity matching loss [21], we only use the cross-entropy function for training the targeted generators while keeping other settings identical. More training and evaluation details used by TTP can be referred to [21]. We used the ResNet50 as the surrogate model and reported the results in Table 5.
289
290
291
292
293
294
Phttps: h/wwww kaggle. ctm/ wwt/////a/ttee//ee////e bintteerr-b-uuubbrr..

---

Table 4: The comparison combining logit calibrations. (The targeted transfer success rates (%)
with 20/100/300 iterations are reported.)
Surrogate Model: ResNet50
Surrogate Model: Densc121
Attack
121
VGGG1
-Inc-v3
RRes50
VVGG1
-Inc-v3
T=5 Margin
33.8/69.8/77.2
24.0/59.0/65.5
3.3/9.6/11.1
19.3/44.3/4..8
14.1/37.7/40.8
2.5/7.5/9.4
T=5 Angle
34.5/74.3/82.4
55.6666.5/7..2
3.6/10.5/13.1
20.3/52.7/61.9
15.8/45.0/53.6
2.3/9.2/12.7
T=10+ + Margin
32.7/69.5/71.
22.8/59.4/66,
12.9/9.7/11.5
18.3/44.1/44
13.7/36.9/41..
2.4/8.3/9.2
T=10 + Angle
8/.79/9.8/79.1
24.4/59 0/68
3.4/10.0/12.9
19.4/47 1
14,8/40. 1/47.0
2.5/8.3/11.0
T=20 + Margin
33.0/69.2/76.2
23.1/58.4/65.8
3.2/9.5/11.8
19.1/43.4/48.5
13.9/36.7/41.4
2.4/7.8/9.5
T=20 + Angle
34.2/68.6/76.5
24.7/58.7/66 6
3.4/9.7/12.7
20.0/44.4/50,
15.5/38.4/43 4/43.7
2.5
Margin + Angle
34.4/70.8/78.1
24.3/60.2/61
3.5/16,4/12.6
19.9/46.//5.77
15,2/39.348 3/44.5
2.7/8.2/9.9
Surrogate Model: VGGT6
Surrogate Model: Inc-v3
Attack
+Res50
1Dense121
IInevv3
+Res50
12ensc121
+VGG16
T=5 + Margin
3,5/10.2/11.4
3.7/12.4/14.6
0.3/1.1/1.3
0.5/1.4/1.6
0.6/2.1/2.9
0,3/1.7/2.8
T=5 Angle
2.2/2.5/2.3
2.4/2.6/2.3
0.2/0.1/0.2
6/2.1
0.6/2.0/3.1
0.5/1.7/2.5
T=10 + Margin
3.2/10.7/11.7
3.4/12.9/1.0
0.2/1.0/1.4
0.5/1.4/1.9
0.5/1.9/3.0
0,3/1.5/2.3
T=10 Angle
3.416.2/5.1
3.5/7.5/7.0
0.2/0.6/0.6
0.6/1.3/1.9
0.6/2.0/3.2
0.5/1.6/2.6
T=20 Margin
3.5/10.1/11.8
3.4/12.0/14.9
0.3/1.2/1.4
0.6/1.2/199
0.5/1.9/2.9
0.5/1.6/2.7
T=20 Angle
3.2/9.7/10.1
3.9/11.9/13.3
0.3/1.0/1.2
0.6/1.6/2.0
0.6/2.0/3.5
0.5/1.7/2.9
Margin Angle
3.3/9.8/11.11
3.5/12.6/14.6
0.3/1.2/144
0.6/1.4/2.0
0.6/1.7/3.1
0.5/1.5/2.6
Table 5: Comparison with TTP [21] on Target Transferablity. The averaged Top-1 1 targeted
accuracy (%) across 10 targets are computed with 49 95K ImageNet validation samples. Perturbation
budget: Lo I 16. # indicates the training surrogate model.
Dataset
Loss
ResNet50
VGGI9 BNN
Dense121
ResNet152
WRN-50-2
Average
TTP
97.02*
78.15
81.64
80,56
78.25
83.12
ImageNet
CE
97.15*
70.44
78.96
76.22
78.24
80.20
CE (T=5)
99.18*
86.65
90.55
90.30
93.22
91.98
TTP
96.63*
73.09
84,76
76.27
75.92
81.33
Painting
CE (T=S)
98.95*
82.97
87.07
87.81
91.70
89.70
295
From Table 5, we make the following findings, 1) By using ImageNet as the training dataset, the TTP shows better transferability than the CE in attacking other black-box models. The average targeted accuracy of TTP is around 3% higher than that of CE. 2) After downscale the logit by 5 in the CE loss function (CE (T=5)), we can observe significant boost of the Top-1 targeted accuracy for all models, reaching the average targeted accuracy of 91.1..98 11.98% (ImageNet). 3) For both ImageNet and Painting
296
297
298
299
300
as the training source, the CE (T=5) can surpass the TTP by a large margin (91.98% vs. 83.12% 99.70% vs. 81 81.33%). These experimental results demonstrate that the proposed temperate-based logit calibration also effective in training generator- based targeted attackers. Note that, compared to
302
TPP, our logit calibration has the benefit of without using any data from the target class.
Conclusion
304
305
In this study, we analyzed the logit margin in different loss functions for the transferable targeted attack, and find that the margin will quickly get saturated in the CE loss and thus limited the transferablity. To deal with this issue, we introduce to use logit calibrations the CE loss function, including Temperature-basee effectiveness of using the logit calibration in the CE loss function for crafting transferable targeted adversarial samples. The proposed logit calibration methods are simple and easy to implement, which can achieve faae--ff-the-r performance in transferable targeted attack.
307
Margin-based, and Angle-based. Experimental results verified the
309
311
312
Potential Social Impact. Our findings in targeted transfer attacks can potentially motivate the AI community to design more robust defenses against transferable attacks. In the long run, it may also be directly used for suitable social applications, such as protecting privacy. Contrariwise, some applications may use targeted transferable attacks harmful manner to damage the outcome of AI systems, especially in scenarios of speech recognition and facial verification systems. Finally, we firmly believe that our investigation this study can provide valuable insight for future researchers
313
314
315
317
by using the logit calibration for both adversarial attack and defense.

---

References
319
320
[1] Jeremy Cohen, Elan Rosenfeld, and Zico Kolter. Certified adversarial robustness via randomized smoothing. In ICML, 2019.
[2] Jiankang Deng, Jia Guo, Niannan Xue, and Stefanos Zafeiriou. Areface: Additive angular margin loss for deep face recognition. In CVPR, 2019.
323
324
[3] Yinpeng Dong, Fangzhou Liao, Tianyu Pang, Hang Su, Jun Zhu, Xiaolin Hu, and Jianguo Li. Boosting adversarial attacks with momentum. In CVPR, 2018.
[4] Yinpeng Dong, Tianyu Pang, Hang Su, and Jun Zhu. Evading defenses to transferable adversarial examples by translation-invann invariant attacks. In CVPR, 2019.
327
328
[5] lan J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversar- ial examples. In ICLR, 2015.
66] Yiwen Guo, Qizhang Li, and Hao Chen. Backpropagating linearly improves transferabilitty of adversarial examples. In NeurIPS, 2020.
331
332
[7] Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In CVPR, 2016.
[8] Geoffrey Hinton, Oriol Vinyals, and Jeff Dean. Distilling the knowledge in neural network (2015). arXiv preprint arX 2015.
335
336
[9] Gao Huang, Zhuang Liu, Laurens Van Der Maaten, and Kilian Q Weinberger. Densely connected convolutional networks. In CVPR, 2017.
338
[10] Qian Huang, Isay Katsman, Horace He, Zeqi Gu, Serge Belongie, and Ser-Nam Lim. Enhancing adversarial example transferability with an intermediate level attack. In CVPR, 2019.
339
340
[1I] Nathan Inkawhich, Kevin Liang, Binghui Wang. Matthew Inkawhich, Lawrence Carin, and Yiran Chen. Perturbing across the feature hierarchy to improve standard and strict blackbox attack transferability. NerulPS, 2020.
342
343
[12]
Nathan Inkawhich, Kevin J Liang, Lawrence Carin, and Yiran Chen. Transferable perturbations of deep feature distributions. arXiv preprint arXiv:2004. /2519, 2020.
[13] Alexey Kurakin, Ian Goodfellow, and Samy Bengio. Adversarial machine learning at scale. arXiv preprint
346
2016
347
[14] Alexey Kurakin, Ian Goodfellow, and Samy Bengio. Adversarial examples in the physical world. In Artificial intelligence safety and security, pages 99-112. Chapman and Hall/CRC, 2018.
349
350
[15] Maosen Li, Cheng Deng, Tengjiao Li, Junchi Yan, Xinbo Gao, and Heng Huang. Towards transferable targeted attack. In CVPR, 2020.
[16] Jiadong Lin, Chuanbiao Song, Kun He, Liwei Wang, and John E Hopcroft. Nesterov accelerated gradient and scale invariance for adversarial attacks. 2020.
353
354
Weiyang Liu, Yandong Wen, Zhiding Yu, Ming Li, Bhiksha Raj, and Le Song. Sphereface: Deep hypersphere embedding for face recognition. In CVPR, 2017.
356
[18] Yanpei Liu, Xinyun Chen, Chang Liu, and Dawn Song. Delving into transferable adversarial examples and black-box attacks. In ICLR, 2016.
357
358
[19] Jonathan Long, Evan Shelhamer, and Trevor Darrell. Fully convolutional networks for semantic segmentation. In CVPR, 2015.
[20] Muhammad Muzammal Naseer, Salman H Khan, Muhammad Haris Khan, Fahad Shahbaz Khan, and Fatih Porikli. Cross-domain transferability of adversarial perturbations. NeurIPS, 2019.
361
362
[21]
Muzammal Naseer, Salman Khan, Munawar Hayat, Fahad Shahbaz Khan, and Fatih Porikli. On generating transferable targeted perturbations. In ICCV, 2021.
10

---

384
[22]
Omid Poursaeed, Isay Katsman, Bicheng Gao, and Serge Belongie. Generative adversarial perturbations. In CVPR, 2018.
385
366
[23] Shaoqing Ren, Kaiming He, Ross Girshick, and Jian Sun. Faster r-enn: Towards real-time object detection with region proposal networks. NeurIPS, 2015.
367
368
[24]
Karen Simonyan and Andrew Zisserman. Very deep convolutional networks for large-scale image recognition. In ICLR, 2015.
369
370
[25] Christian Szegedy, Wei Liu, Yangqing Jia, Pierre Sermanet, Scott Reed, Dragomir Anguelov, Dumitru Erhan, Vincent Vanhoucke, and Andrew Rabinovich. Going deeper with convolutions. In CVPR, 2015.
372
373
[26]
Christian Szegedy, Vincent Vanhoucke, Sergey Ioffe, Jon Shlens, and Zbigniew Wojna. Re- thinking the inception architecture for computer vision. In CVPR, 2016.
375
[27]
Florian Tramèr, Alexey Kurakin, Nicolas Papernot, Ian Goodfellow, Dan Boneh, and Patrick McDaniel. Ensemble adversarial training: Attacks and defenses. In ICLR, 2018
376
377
28
Dongxian Wu, Yisen Wang, Shu-Tao Xia, James Bailey, and Xingjun Ma. Skip connections matter: On the transferability of adversarial examples generated with resnets. In ICLR, 2020.
378
[29] Cihang Xie, Zhishuai Zhang, Yuyin Zhou, Song Bai, Jianyu Wang, Zhou Ren, and Alan L
380
Yuille. Improving transferability of adversarial examples with input diversity. CVPR, 2019.
381
[30] Zhengyu Zhao, Zhuoran Liu, and Martha Larson. On success and simplicity: A second look at transferable targeted attacks. NeurIPS, 34, 2021.
Checklist
383
384
1. For all authors...
385
(a) Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope? [Yes]
387
(b) Did you describe the limitations of your work? [No]
388
(c) Did you discuss any potential negative societal impacts of your work? [No] No negative
389
effects
(d) Have you read the ethics review guidelines and ensured that your paper conforms to them? [Yes]
391
392
2. If you are including theoretical results...
(a) Did you state the full set of assumptions of all theoretical results? [Yes]
(b) Did you include complete proofs of all theoretical results? [Yes]
395
3. If you ran experiments..
396
(a) Did you include the code, data, and instructions needed to reproduce the main experi- mental results (either in the supplemental material or URL)? [Yes] See abstract.
398
(b) Did you specify all the training details (e.g., data splits, hyperparameters, how they were chosen)? [Yes] See Section 4.
389
400
(c) Did you report error bars (e.g., with respect to the random seed after running ex- periments multiple times)? [No] We report the average of running experiments times.
401
(d) Did you include the total amount of compute and the type of resources used (e.g., type of GPUs, internal cluster, or cloud provider)? [Yes] See URL in abstract
404
405
4. If you are using existing assets (e.g., code, data, models) or curating/releasing new assets...
(a) If your work uses existing assets, did you cite the creators? [Yes]
(b) Did you mention the license of the assets? [Yes]
408
(c) Did you include any new assets either in the supplemental material or as URL? [No]
409
(d) Did you discuss whether and how consent was obtained from people whose data you're
using/curating? [No] The code and data are public
11

---

(c) Did you discuss whether the data you are using/curating contains personally identifiable information offensive content? [No] No use of personally identifiable information or objectionable content.
412
414
5. If you used crowdsourcing or conducted research with human subjects...
415
(a) Did you include the full text of instructions given to participants and screenshots, applicable? [N/A]
(b) Did you describe any potential participant risks, with links Institutional Review Board (IRB) approvals, if applicable? [N/A]
418
(c) Did you include the estimated hourly wage paid to participants and the total amount spent on participant compensation? [N/A]
420
12


Reviews:
[{"review_id": "eqDmaQ47r91", "reviewer": "Reviewer_qX4X", "summary": "This work proposed three different calibration methods, temprature-based, margin-based and angle-based temperature scaling to enlarge the margin between targeted logit and non-target logits to improve transferability of targeted adversarial attacks. This work is highly inspired by the work [1] and perform experiments to show the proposed methods are better than other existing methods.\n\n\n[1] \"On Success and Simplicity: A Second Look at Transferable Targeted Attacks\".\nZhengyu Zhao, Zhuoran Liu, Martha Larson. NeurIPS 2021.", "questions": "In general, it leaves me a poor impression when I realize the great similarity between the Related Works in this work and that in [1]. Although the authors try to reframe the sentences, it's still very unprofessional to structure related works with such a strong similarity with another existing work. ", "limitations": "See above.", "rating": 2, "confidence": 5, "soundness": 2, "presentation": 1, "contribution": 2, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "First of all, after comparing the related work in [1] and this work, there is a huge amount of overlapping of the equations or rewriting the sentences. This significantly destroys the overall quality of the work.\n\nSecond, the improvement of the proposed method over [1] is marginal compared to the improvement of [1] over cross-entropy loss.\n\nThird, the contribution of this work is limited. Although the authors proposed different temperature-scaling based methods to improve transferability of targeted attacks, which only achieve limited experimental gains, this work did not provide extra useful insight to this research area.\n\n[1] \"On Success and Simplicity: A Second Look at Transferable Targeted Attacks\". Zhengyu Zhao, Zhuoran Liu, Martha Larson. NeurIPS 2021.", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"ethics_review_area": ""}, "extra_text": {}}, {"review_id": "bNMs61pCbvC", "reviewer": "Reviewer_Boef", "summary": "This paper designs a new logit calibration method which is inspired by knowledge distillation. The method uses logit calibrations in the CE loss function so that it can improve the targeted adversarial attack with higher transferability than other attack methods with cross-entropy loss. Except for the primary temperature-based method, this paper designs margin-based and angle-based methods to solve different surrogate models and different norms.", "questions": "Firstly, for the influence of different $T$ in CE, this paper claims that when the surrogate model is VGG16 and Inc-V3, a larger $T$ obtains better transferability. However, I am curious about is there a limitation of $T$ on VGG16 and IncV3. For example, after the ASR achieves 600, the performance of the targeted attack will decrease when $T$ continually increase. And then, although this method is based on CE, it would be better if the authors designed a new name to describe it.", "limitations": "The relationship between temperature-based, margin-based, and angle-based logit calibration is unclear. This paper claims that the margin-based one is designed to face different surrogate models, and the angle-based one is designed to solve the influence of various norms. However, in the experiments, the performance on T=5, T=10, Margin, and Angle does not prove the relation between them. This paper does not evaluate which method is the best for the targeted attack, or in other words, which option should I choose if I need to achieve the highest attack success rate?", "rating": 5, "confidence": 4, "soundness": 3, "presentation": 2, "contribution": 2, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "The strengths of this paper are:\n\nThis paper designs a new cross-entropy (CE) loss function to improve the targeted adversarial attack, which performs better than Logit (NIPS21).\n\nExcept for the temperature-based method, this paper designs margin-based and angle-based methods to solve different surrogate models and norms.\n\nThe weakness of this paper are:\n\nThis paper follows `Zhengyu Zhao, Zhuoran Liu, and Martha Larson. On success and simplicity: A second look at transferable targeted attacks. NeurIPS, 34, 2021.' from academic writing skills and code in specific. However, instead of Zhao et al. designing the Logit loss and using it to generate universal adversarial perturbations, this paper's method does not have any additional functions such as UAP. \n\nMoreover, this paper's method only exceeds the Logit loss by around 10%, which is not a significant improvement. Therefore, this paper lacks novelty.\n\nThe equation 14 seems to have some mistakes. On the left of the equation, would $z_{i}$ be $\\tilde{z}_{i}$?\n\nA few grammar problems in this paper should be improved. For example, in line 275, it should be \"be similar to\"; in line 23, it should be \"Following many approaches\"; in line 27, it should be \"it is vital to explore.\"\n", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"ethics_review_area": ""}, "extra_text": {}}, {"review_id": "JcXe9C2n82K", "reviewer": "Reviewer_WQZv", "summary": "The paper targets improving the transferability of adversarial attack using the logit calibration. Despite the recent success in untargeted black-box attacks, the targeted transferability of adversarial attacks remains challenging. The paper takes a closer look at the vanishing gradient issue in the CE loss function which is commonly used to learn transferable adversarial samples and suggests that the logit margin between the targeted and non-targeted classes quickly gets saturated during the optimization process. So, to improve transferability they aim to enlarging logit margins which consequently reduce saturation and  enable longer optimization and iterations. The paper investigates three different types of logit calibrations including temperature-based, angle-based and margin-based inspired by previous studies and techniques.  Experiment conducted using ImageNet dataset and different methods including ResNet50, DenseNet-121, VGG-16 and Inception-v3. Results are compared to SOTA methods including Po+Trip, Logit, and TTP. ", "questions": "- There is a large novelty overlap between [30] and the current method. It is proper to get the similarity and distinction discussed upfront. Specifically,  discussion around CE starting line 36 is getting very confusing and blurry going through line 56. Vanishing gradient and the use of Logit loss has been discussed and proposed in previous arts, for example [30]. This gets discussed later at line 145+ and in method, however, I feel the contribution of the current work can get discussed in a more clear way and upfront in introduction. \n\nExperiments are limited and can get improved:\n- First the organization of the results is not optimized or ideal. (1) Following Table 1, 2 and 3 is very hard and replacing this with line graphs that capture progress through iterations would be very beneficial. (2) Overall collective of Table 1, 2, 3 seems to be more exploratory and ablation tables rather than the main results. The main message that I read from these two tables are T=10, 20 and a combination of Margin + Angle or T + Angle can result in the best outcome. So, why not introduce a single best receipt and present everything else as ablations? (3) Also I would suggest sticking with conventional methods such as heat-map to summarized heavy tables, as it is a norm in adversarial attack literature.  [21] have good examples of result presentations.\n\n- One relevant question, is also as Table 2 suggests the best outcome is coming from T=10 or T=20 so why in Table 3 we analyze the effect of combining logits as T=5 +Margin or Angle? If any underlying study suggests this, results should be provided.  \n\nThe results could be strengthened by:\n- Providing experiments on another dataset (e.g., CIFAR-10, MNIST, SVHN) Since the proposed method works well on ImageNet, it could only be a minor concern.\n- Incorporating study of a real-world attack for example the Google Cloud Vision API.\n- Providing targeted success rates for transfer with varied targets.\n", "limitations": "I cannot find any specific discussion around the potential negative social impact of this work. Also, the limitation of the method was not addressed in the paper.\n\nTo improve this part, discussion around the benefits of adversarial attack research can get discussed. Potentially this can motivate the AI community to design stronger defenses against transferable attacks, and  in the long run such results can be directly used for social good applications, such as protecting privacy. On the contrary, there are applications that can benefit from transferable attacks in a harmful manner to damage the outcome of any AI system, e.g. imaging a scenario that someone uses such attacks to intrude with the outcome of a medical AI device.  \n\nI also suggest that authors discuss the limitation of the work, failure cases and processing time.\n\nOverall, I enjoy reviewing this paper and looking forward to reading the authors' responses. \n", "rating": 5, "confidence": 4, "soundness": 2, "presentation": 3, "contribution": 2, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "Strength:\n- Quality: The writing quality is very good, very easy to follow, there are areas that can be improved but nothing major.\n- Clarity: Very clear. Easy to understand the motivation and the thought process of different method’s component. \n- Significance and novelty: Novelty is a bit limited and built up mostly on top of previous methods,  but it is also not a weakness because this work attempts to solve an interesting problem and the analysis and results are valuable. The results are somewhat important. Mostly inspired by Logit [30], future researchers might use the suggested logit calibration and increase the number of iterations for targeted attacks.\n\nWeaknesses:\n- The quality of results and presentation of it could be improved significantly. (see below)\n- The distinction between [30] and this paper should be clarified and the introduction in page 2 [line 36-56] can benefit from a re-writing. (see below)\n", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"ethics_review_area": ""}, "extra_text": {}}, {"review_id": "IDrIEbjfT7Y", "reviewer": "Reviewer_SQcN", "summary": "The authors propose a novel and effective method to improve the transferability of adversarial attacks. They increase the logit margins between targeted and non-targeted classes, which can quickly become saturated in cross-entropy loss.", "questions": "Could authors provide any interpretation of the results in Table 1? For example, why do Margin and Angle have better performance when the surrogate models are VGG17 and Inc-v3, but have lower performance for ResNet50 and Dense121?", "limitations": "N/A", "rating": 6, "confidence": 5, "soundness": 3, "presentation": 2, "contribution": 3, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "Strengths:\n1. The findings are very interesting and the motivation is well-explained.\n2. Comprehensive experiments are presented and the combining logit calibrations have significantly better performance than previous methods.\n\nWeaknesses:\n1. The proposed method has various settings and hyper-parameters. Compared to the simple Logit method, the proposed method needs more effort for tuning or need combining logit calibrations to achieve better performance. This can make the method less attractive to the community.\n3. There is no theoretical analysis to support the empirical findings.\n2. The presentation of the results needs to be improved. All tables contain tons of numbers, which makes it hard for the reader to get the point in a short time.", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"ethics_review_area": ""}, "extra_text": {}}]

Author rebuttal:

Decision: Reject