Blurred-Dilated Method for Adversarial Attacks
Authors: Yang Deng
Weibin Wu
Jianping Zhang
Zibin Zheng
Venue: NeurIPS 2023 poster (2023)
Keywords: Transferable adversarial example

Abstract: Deep neural networks (DNNs) are vulnerable to adversarial attacks, which lead to incorrect predictions. In black-box settings, transfer attacks can be conveniently used to generate adversarial examples. However, such examples tend to overfit the specific architecture and feature representations of the source model, resulting in poor attack performance against other target models. To overcome this drawback, we propose a novel model modification-based transfer attack: Blurred-Dilated method (BD) in this paper. In summary, BD works by reducing downsampling while introducing BlurPool and dilated convolutions in the source model. Then BD employs the modified source model to generate adversarial samples. We think that BD can more comprehensively preserve the feature information than the original source model. It thus enables more thorough destruction of the image features, which can improve the transferability of the generated adversarial samples. Extensive experiments on the ImageNet dataset show that adversarial examples generated by BD achieve significantly higher transferability than the state-of-the-art baselines. Besides, BD can be conveniently combined with existing black-box attack techniques to further improve their performance.

Blurred-Dilated Method for Adversarial Attacks
Yang Deng
Weibin Wu School of Software Engineering
School of Software Engineering
Sun Yan-sen University dengy730mai12 sysu. edu en
Sun Yat-sen University suwb368mail sysu. edu. en
Jianping Zhang
Zibin Zheng
Department of Computer Science and Engineering The Chinese University of Hong Kong jpzhangocse. cuhk. edu. .hk
School of Software Engineering
Sun Yat-sen University zhzibin@mail sysu. edu.
Abstract
Deep neural networks (DNNs) vulnerable adversarial attacks, which lead incorrect predictions. black-bor box settings, transfer attacks can be conveniently used to generate adversarial examples. However, such examples tend to overfit the specific architecture and feature representations of the source model, resulting in poor attack performance against other target models. To overcome this drawback, we propose a novel model modification-base. transfer attack: Blurred- Dilated method (BD) in this paper. In summary, BD works by reducing downsampling while introducing BlurPool and dilated convolutions in the source model. Then BD employs the modified source model generate adversarial samples. We think that BD can more comprehensively preserve the feature information than the original source model. thus enables more thorough destruction of the image features, which can improve the transferability of the generated adversarial samples. Extensive experiments on the ImageNet dataset show that adversarial examples generated by BD achieve significantly higher transferability than the stateoof-the-at baselines. Besides, BD can be conveniently combined with existing black-box attack techniques to further improve their performance.
Introduction
In recent years, deep learning has achieved great success in the field of computer vision. Despite the shining achievement, deep neural networks (DNNs) are vuinerable to adversarial attacks [ It is easy to deceive deep neural networks into making incorrect predictions by adding small adversarial perturbations to natural images, which are almost imperceptible to the human visual system 3 This has brought significant security implications with the wide application deep neural networks 4 S
Therefore, enhance the robustness of deep neural networks, more and more researchers have begun to focus on adversarial attacks and defenses.
Adversarial attacks can be mainly divided into two types: white-box attacks and black-box attacks. In white-box attacks as the model architecture and parameters, so adversarial samples can be directly produced through gradients with a high success rate. However, white-box attacks are often difficult to implement in reality because attackers cannot obtain all the information of the target model. Black-box attacks can overcome this problem. Prevalent black-box attacks can be generally categorized as query-baser and transfer-based. This paper mainly focuses transfer-basee black-bol attacks, where attackers
d attackers have access to all the information about the target model, such
"Corresponingg author.
37th Conference on Neural Information Processing Systems (NcurIPS 2023).

---

utilize a substitute model to craft adversarial samples and apply these samples to attack black-box victim models 7
However, existing transfer-based black-box attacks can overfit to the source model 10 As a result, the discrepancies between the substitute model and target models, which stem from their differences in architectures, parameters, and other aspects, may lead to poor attack performance of the generated adversarial examples against the victim models.
Therefore, numerous endeavors have been made to enhance the transferability transfer-based attacks. The recent prominent techniques can be classified into three categories: gradient optimization, input augmentation, and model modification. Among them, the research direction that particularly interests is model modification based attacks. For example, the Intermediate- Level Attack (ILA) 12] and IL [3] generate transferable adversarial examples by attacking intermediate feature maps. Skip Gradient Method (SGM) [14 utilizes skip connections improve the transferability of adversarial samples. Linear Backpropagation (LinBP) [15] skips some non-linear activation layers during backpropagation. Although these attack techniques narrow the gap between the substitute model and the victim model, the transferability of the generated adversarial examples is still unsatisfactory. Additionally, they mostly focus on modifying the backpropagation of the source model while neglecting its forward propagation.
In this paper, explore whether modifying the architecture of the source model can enhance the transferability of adversarial attacks. We propose a novel model modification- based transfer attack: Blurred-Dilated method (BD). In short, BD works by reducing downsampling operations while introducing BlurPool [16] and dilated convolutions 17 in the source model. Then BD employs the modified source model to generate adversarial samples. Extensive experiments the ImageNet dataset confirm that BD can achieve significantly higher transferability than the state-of-the-art baselines.
In summary, our main contributions are as follows:
We propose a novel model modification- based transfer attack: Blurred-Dilated method (BD). BD reduces downsampling operations and adds BlurPool and dilated convolutions in the original source model. It then employs the modified source model to generate adversarial samples.
We conducted extensive experiments on the ImageNet dataset to validate the effectiveness of BD. Experimental results confirm that BD can consistently outperform the state-of-the the-art benchmarks by a large margin.
We show that the proposed BD can be conveniently combined with other transfer attacks to further improve their performance.
2 Related Work
To enhance the transfcrability of adversarial attacks, recent techniques can be categorized into three types: gradient optimization, input augmentation, and model modification.
Gradient optimization. The Fast Gradient Sign Method (FGSM) family is the mainstream method in this category. FGSM (2) perturbs clean example generate adversarial example by adding small perturbation along the direction of the gradient sign, using only one iteration. The Iterative Fast Gradient Sign Method (I-FGSM) 4 and the Projected Gradient Descent method (PGD) [6] are iterative versions of FGSM for constructing adversarial examples. In comparison to FGSM, which only takes a single step along the direction of the gradient sign, these iterative methods deliver better attack performance. Momentum Iterative Method (MI-FGSM) [8] integrates momentum into the gradient at each iteration, allowing previous gradients guide current updates.
Input augmentation. We briefly introduce some popular transfer attacks in this category. Diverse Input Method (DIM) [19] applies various transformations to input images in each iteration (c.g.. random resizing and padding).
Method (SIM) 22 optimizes perturbations utilizing the input images' scaled copies. In addition, the conslation-Invariaa Method (TIM) (1] applies preset kernel to the gradients with respect to the input images.
Model modification. Due to overfitting to the source model that is used to generate adversarial samples, the current transfer-based attacks usually exhibit limited transferabilityy Some researchers attempt to enhance the substitute model to improve the attack success rates. Since the decision

---

boundaries of different DNNs are different, employing an ensemble of source models is the most direct way to achieve this goal 77.. The Ghost Network [22] applies random dropout and skip connection erosion to simulate large number of source models. However, creating and employing an ensemble of source models still challenging and computationally expensive. Therefore, more works tend to focus on only one substitute model. Intermediate-LLvel Attack (ILA) [12] and ILA+
[3] craft transferable adversarial examples by attacking intermediate feature maps. Skip Gradient Method (SGM) [1] discovered that the gradient flow through skip connections can improve the transferability of adversarial samples. Therefore, SGM introduces decay factor to reduce the gradient of residual modules. Linear Backpropagation (LinBP) [15] skips some non- non-linear activation layers during backpropagation.
Different from previous model modification based transfer attacks that mainly focus on backprop- agation, our proposed BD considers both backpropagation and forward propagation. Extensive experiments on the ImageNet dataset verify that our proposed method can effectively narrow the gap between the substitute model and the victim models, and thus significantly improve the transferability of the generated adversarial samples. Compared with state-of-the-ar model modification-basee transfer attacks, our method can also achieve significantly better attack success rates.
3 Method
In this section, we provide a detailed introduction of our proposed technique. We first introduce our motivation in Section Then in Section [32 we elucidate BlurPool [16] and dilated convolutions 177, which are the key components in our proposed method. After that, we explain the general strategy of our proposed BD in Section 3.3 Finally, we present the implementation details of BD with popular architectures as examples in Section
3.1 Motivation
Based on our preliminary experiments, we observed that: (1) The adversarial samples generated by ResNet 23 usually have better transferability than those generated by other models. We think the reason may be that the skip connections of ResNet connect the lower-layer feature maps to the higher-layer feature maps, which helps transfer more low-level features and reduce the information loss caused by downsampling. Due to the large resolutions of the raw input images, models need to conduct downsampling multiple times, resulting in large amount of information loss. Besides, due to the structural differences between models, the discarded features are different. Therefore, preserving more low-level features, ResNet does, improve adversarial transferability. (2) On CIFAR- 10/100 24), the adversarial transferability between models usually better than that on ImageNet 25 15 Since the resolutions of the images on CIFAR-10/10 are smaller, there are fewer downsampling in the CIFAR-10/106 models. Therefore, different CIFAR-10/100 models all maintain more common low-level features, making the generated adversarial sample easy transfer.
Given the above observations, we think that employing a source model that can preserve more low-level features of an image can help to improve adversarial transfcrability. Such source model can guide adversarial samples to more thoroughly and precisely destroy the low-level features of a clean image. As result, the generated adversarial samples more transferable, since different models all use low-level features to extract high-level semantics and then make predictions. Although downsampling is widely used in various neural networks [26 23 27 28). downsampling will discard feature information [29), which will reduce the details of an image (i.e., the low-level features) during forward propagation and thus hinder the transferability of the generated adversarial examples. Therefore, we propose our Blurred- Dillated method (BD) to modify the source model to preserve more low-level features of an image. As result, the modified source model can generate more transferable adversarial samples.
3.2 BlurPool and Dilated Convolution
To preserve more low-level features of an image, we need to reduce downsampling in the original source models. To this end, we need to add BlurPool and dilated convolutions the original source models.
3

---

BlurPool. In convolutional neural networks (CNNs), pooling layers or ordinary convolutions with strides greater than 2 would conduct downsampling on the input feature map to reduce the size of the input feature maps and increase the model's receptive field. However, since some features are discarded in the downsampling process, information may be lost. Traditional pooling aggregates all pixels within the window to a single value. In contrast, BlurPool aims to minimize information loss caused by pooling operations via replacing the traditional pooling kernel with a Gaussian kernel. This method enables more detailed weighted averaging over features within the pooling window, while improving shift-invariance. Specifically, when using a Gaussian kernel (we adopt 4x4 to follow the previous work [16),, BlurPool applies Gaussian-
function to the neighborhood area around each feature for convolution calculation, and obtains a weighted average result. To further reduce the result's s feature map spatial size, common downsampling strategies (such as using large stride) are typically applied. Compared to the traditional pooling operations of simply selecting the maximum/average value within the window, BlurPool operations that use Gaussian-weighte averages can better preserve the relative positions and spatial relationships between features, thus alleviating the problem of information loss caused by pooling operations. BlurPool can be combined not only with pooling but also with strided-convolutions.
Dilated convolution. Traditional convolution operations only consider the point-wise product between the convolution kernel and the input. When using a dilated convolution, each specified position in the convolution kernel expands outward by a fixed number that is determined by the dilation rate. It enables the convolution kernel to process feature maps with a larger range of information while maintaining the same kernel size. In this way, by increasing the dilation rate, larger receptive field can be obtained, and a wider range of image features can be captured. Dilated convolution captures more contextual information and improves the ability of models to handle high-resolution images. In traditional CNNs, as the resolution of the input image increases, the number of layers usually needs increase accordingly. However, this leads a larger model size and higher computational costs. By using dilated convolutions, a larger receptive field can be achieved without increasing the model size. Therefore, it can better process high-resolution images.
3.3 General Strategy
If we remove all downsampling operations, the dimension of image features will maintain vast, making the forward and backward computations too expensive to complete. Therefore, we adopt an "early stop" strategy for downsampling operations, which only retains downsampling in the early layers of the source model. In our experiments, we usually retain half of the downsampling operations in the original source model. This prevents losing too much low-level feature information and allows CNNs to consider the low-level feature information when generating adversarial samples. To further reduce the loss of feature information caused by downsampling, we modify the downsampling operations in the early layers of the source model with BlurPool as follows:
MaxPool + MaxBlurPool: For max-pooling with a stride of s, it is changed into two parts: max- pooling with a stride of I and BlurPool with a stride of s.
Conv Cony BlurPll: For convolutions with stride of followed by the ReLU activation function, it is changed into two steps: convolutions with a stride of followed by the ReLU activation function and then BlurPool with stride of s.
AveragePool + BlurPool: For average pooling with a stride of 8, it is changed to BlurPool with a stride of s.
We then abandon the downsampling operations in the later layers of the source model. As result of removing downsampling operations, the feature map size will increase, which reduces the receptive fields of subsequent layers and decreases the amount of context information each neuron has for making predictions [30 Since contextual information is crucial for resolving ambiguities in local clues [31] this decrease in the receptive field is an undesired trade-off. Therefore, we use dilated convolutions to increase the receptive fields of higher layers, which compensates for the reduction in receptive fields caused by the removal of downsampling operations. This allows the modified source model to have the same or an even larger receptive field compared to the original model. In this way, the modified model can have global understanding of the image, which enables to generate adversarial perturbations that are more transferable.
4

---

Table 2: The structural details of Blurred-Diland -Dilaed DenseNet-121 (BD DN121).
Table 1: The structural details of Glurred-Dilltedd ResNett-50 (BD RN50).
Layer Name
Output Size
Configuration
Layer Name
Output Size
Configuration
7x cony, s=1 BlurPool, s=2
7x7 conv, 64, s=1 BlurPool, s=2
conv
112x112
conv1
112x112
3x3 maxpool, s=1 BlurPool, s=2
2x2 maxpool, s=1 BlurPool, s=2
pooling
56x56
pooling
56x56
dense layerl (x6)
1xl
conv2
1x1 conv, 64
56x56
3x3 cony
56x56
3x3 conv, 64
(x3)
xx1 conv, 256
transition layer!
56x56
1x1 conv
1xl conv, 128
28x28
BlurPool, s=2
conv3
x conv, 128
28x28
dense layer2 (x12)
1xl cony 3x3 conv
(x4)
(BlurPool when a=2)
28x28
1x conv, 512
transition layer2
28
1xl
1x conv, 256
conv4 (x6)
28x28
3x3 conv, 256, dr=2
dense layer3 (x24)
1x1 cony 3x3 cony, dr=2
1x conv, 1024
28x28
conv5
1x 1 conv, 512
transition layer3
28x28
1x1 conv
28
x3 conv, 512, dr=2 1x1 conv, 2048
(x3)
dense layer4 (x16)
1x1 cony 3x3 cony, dr=2
28x28
1x1
global average pool
classification
1x1
glohal average pool
1000-d
FC-1000 softmax
classification
FC-1000
1000-d
softmax
Finally, we fine-tune the modified BD model its original training set alleviate the accuracy drop caused by model modification. We employ the resultant BD models to generate adversarial samples to conduct transfer attacks.
3.4 BD Implementation Details
Our proposed BD can be conveniently applied to popular CNNs. Different source models may have slight differences in performing model modification. Therefore, we present the implementation details of BD with four popular architectures as examples in this section. In Tables 4 s means the stride, dr means the dilation rate, and BlurPool adopts Gaussian kernel size of 4 and stride of 2.
Blurred- ResNet-50. We apply our proposed BD to ResNet-50 23 to obtain the Blurred- Dilated ResNet-50 (BD RN50). Table [ shows the structural details of BD RN50. Specifically, we modify the first three downsampling operations with BlurPool. That is, for the first downsampling operation, change the stride of the 7x7 convolution from 2 to 1, and then add BlurPool layer. For the second downsampling operation, we change the stride of MaxPool from 2 to 1, and then add BlurPool layer. For the third downsampling operation, 2 to 1, and then add a BlurPool layer. At the same time, we remove downsampling operations in the subsequent layers maintain the feature map size at 28x28 As shown in Table [ dilated convolutions with a dilation rate of 2 are introduced in conv4 and conv5, respectively, except for conv4_1 and conv5_1.
change the stride of conv3 I from
Biirted-Dilated De1 We apply our proposed BD to DenseNet- 121 (27 to obtain the -Diated 121 (BD DN121). Table 2 shows the structural details of BD DN121. Specifically, we modify the first three downsampling operations with BlurPool. That is, we change the stride of the 7x7 convolution from 2 to 1, and then add BlurPool layer. We change the stride of the 3x3 3 MaxPool from to 1, and then add a BlurPool layer. We replace the first 2x2 average pool with a BlurPool layer. Furthermore, we remove the average pool in the last two transition layers. Similar to ResNet-50, dilated convolutions with a dilation rate of 2 are added to the final two groups of dense blocks shown in Table 2
except for dense layer3_ and dense layer4_1.
Blurred-Dilated VGG16. We apply our proposed BD to VGG16 26 to obtain the flurred-Dilated VGG16 (BD VGG16). Table B shows the structural details of BD VGG16. Specifically, the first three
5

---

Table 4: The structural details of Blurred-Dilate MobileNerV2 (BD MobV2). t means the expan- sion factor. e means the channel number.
Table 3: The structural details of Blurred- Dilated VGG16 (BD VGG16).
Layer Name
Output Size
Configuration
3x3 conv, a=1 BlurPool, s=2
conv1
112x112
32
Layer Name
Output Size
Configuration
convO (x2)
224x224
3x3conv conv, 64
bottlenec11 (x1)
112x112
1x conv 3x3 dwise
1x1 conv
poolingl
112x112
2x2 maxpool, a=1 BlurPool, s=2
1x1 conv
bottleneck2 (x2)
3x3 dwise
56x56
24
(BlurPool when s=2)
conv (x2)
112x112
3x3 conv, 128
1x1 conv
pooling?
56x56
2x2 maxpool, s=1 BlurPool, s=2
bottleneck3 (x3)
28x28
(BlurPool when s=2) 1x conv
3x3 dwise
32
conv2
56x56
3x3 conv, 256
(x3)
bottlnnekk4 (x4)
x conv dwise
2x2 maxpool, s=l BlurPool, s=2
28x28
64
pooling3
28 x8
1x conv
conv3
bottleneck5 (x3)
1x conv xx3 dwise, dr=2 x conv
(x3)
28
3x3 conv, 512, dr=2
28 28
6
96
conv4 (x3)
28
3x3 cony, 512, dr=2
bottleneck6 (x3)
1x conv xx3 dwise, dr=2
x8
160
7x7
global average pool
conv
classification
FC-4096 FC-4096
bottleneck? (x1)
28 28
3x3 dwise
conv
320
1000-d
FC-1000
1x conv
softmux
conv2
28 x8
1xl conv
1280
1x1
glohal average pool
classification
FC-1000 softmax
1000-d
MaxPool layers are replaced with MaxBlurPool. That is, the stride of the MaxPool layers is changed I, followed by BlurPool layer with a Gaussian kernel size of 4 and stride of 2. Downsampling layers in the later stages are also removed to retain the feature map's size at 28 x2.28. Finally, as shown in Table the last two groups of standard convolutions layers are replaced with dilated convolutions having a dilation rate of 2, except for conv3_1.
Blurted-Dilated MobileNetV2. We apply proposed BD to MobileNetV2 (28 to obtain the Blurred- -Dllted MobileNetV2 (BD MobV2). Table Sable shows the structural details of BD MobV2. Specifically, stop downsampling when the feature map size reaches 28 x8x28 To this end, in the bottlenecks of the original model that execute downsampling operations, we change the stride from 2 to 1. Moreover, for the first three convolutional downsampling operations, of the convolution to 1 followed by a BlurPool layer. As shown in Table 4 dilated convolutions with dilation rate of are introduced in bottleneck5 and bottleneck6, except for bottleneck5_ I and bottleneck6_l.
change the stride
4 Experiments
Section 4.1 details our experimental settings. our experiments, we first verify the effectiveness of our proposed method in Section 4.2 Then in Section 4.3 we compare our proposed method with the state-of-the-an baselines. After that, we combine our proposed BD with other transfer attacks to further validate the effectiveness of our proposed method in improving adversarial transferability in Section 4.4 Finally, we conduct ablation studies to further analyze our proposed method in Section

---

Table 5: The attack success rates of adversarial samples generated by different source models, with MI-FGSM as the optimization algorithm. The best results are bold.
Source Model
RN50
IncV3
Inc
IncRes
SE154
VGG19
DN201
PNASNet
Average
16/255
100%
67.0%
57.1%
54.5%
69.2%
82.8%
88.3%
63.7%
72.8%
RN50
8/255
100%
44.9%
37.1%
30.3%
47.6%
63.3%
73.3%
39.3%
54.5%
4/255
100%
22.9%
19.0%
10.6%
25.5%
43.8%
47.4%
17.9%
35.9%
16/255
99.9%
93.6%
93.8% %
91.7%
95.1% %
97.2%
99.1%
96.4%
95.9%
BD RN50
8/255
99.8%
80.1% %
79.7 %
74.6%
83.7%
91.2%
95.0%
81.0%
85.6
4/255
99.5%
49.8% %
47.7 %
41.8%
58.1%
71.7%
75.9%
52.9%
62.2% %
16/255
79.6%
67.0%
69.7%
55.6%
69.5%
99.5%
70.0%
71.4%
72.8%
VGGI6
8/255
58.9%
41.0%
43.2%
28.0%
44.9%
98.1%
46.0%
44.0%
50.5%
4/255
35.5%
21.6%
21.7%
11.4%
23.9%
92.0%
27.2%
22.2%
31.9%
16/255
92.0%
82.0% %
84.1
73.5%
86.3%
99.8%
87.3%
86.3%
86,4% %
BD VGG16
8/255
78.6%
58.8%
63.5 %
46.0% %
64.7%
99.0%
65.5%
66.4%
67.8%
4/255
51.3%
31.6% %
34.9 %
18.9 %
34.7%
95.7%
39.0%
33.1%
42.4%
16/255
90.3%
71.7%
63.8%
60.2%
73.3%
85.0%
95.3%
69.7%
76.2%
DN121
8/255
77.0%
45.3%
42.9%
33.5%
49.7%
64.0%
84.2%
42.9%
54.9%
4/255
52.6%
26.3%
21.6%
12.1%
25.7%
43.4%
62.3%
20.2%
33.0%
16/255
96.4%
84.5%
82.0 %
76.4%
87.5%
94.3%
97.3%
87.7%
88.3% %
BD DN121
8/255
86.7% %
63.44 %
59.0 %
50.1
66.6% %
80.6%
89.5%
65.1%
70.1 %
4/255
64.3%
36.3% %
35,3 %
21.6 %
37.2%
59.5%
68.8%
35.6%
44.8% %
16/255
76.6%
58.3%
49.9%
44.0%
59.2%
84.4%
68.4%
49.1%
61.2%
MobV2
8/255
54,4%
36.
30.4%
20.8%
38.0%
63.7%
47.6%
26.2%
39.7%
4/255
33.8%
21.5%
17.1%
7.7%
18.3%
43.6%
27.1%
14.1%
22.9%
16/255
89.8%
82.7%
76.8 %
69.5
79.4%
95.0%
87.9%
76.9%
82.3%
BD MobV2
8/255
70.7%
60.1 %
55.8 %
44.6 %
53.7%
81.7%
67.1
51.5%
60.7 %
4/255
42.4%
32.6% %
30.0% %
18.2 %
27.6%
59.5%
39.5%
24.6%
34.3% %
4.1 Experimental Settings
Datasets. Consistent with the previous works 188 21 we use the -omeeeteb-o dataset
in the NIPS 2017 adversarial competition [32 as the test set to generate adversarial samples. This dataset contains 1000 images with a resolution of 299 x 299 x 3. After modifying source models with our BD, we fine-tune the modified source models with the ImageNet training set 25 to recover their classification accuracy.
Source and target models. For source models, we choose model from each of the ResNet 23) VGG (26). DenseNet (27). and MobileNet (28) families, i.c., ResNet-50 (RN50), VGG16, DenseNet- 121 (DN121), and MobileNetV2 (MobV2). For comparisons with the state-of-the-art techniques, we follow their choice to use RN50 as the source model. For target models, we select popular models following previous works 13
14 15] including VGG19 26 Inception-v3 (IncV3) (33) Inception-v4 (4nc 34, SENet154 (SE154) [35). ResNet-50 (RN50) (23 DenseNet-201 (DN201) 27], Inception Inception-ResNet- ResNet-v2 (IncRes) 34. and PNASNet (36] We use open-source pretrained models
that are collected from torchvisior and a GitHub repository
Compared baselines. To validate the superiority of our proposed method, compare it with the state-of-thh-arr model modification--aal based transfer attacks, including LinBP [5] ILA 12] and
ILA++ 13]
Parameter settings. Whenever the size of the images does not match the model's input size, we resize the images to the input size of the model. We mainly focus on untargeted attacks under the l constraint. We set the maximum perturbation e to three different values: 16/255, 8/255, and 4/255.
7

---

Table 6: The attack success rates of different transfer attacks, with MI-FGSM as the optimization algorithm and ResNet-50 as the source model. "Average" presents the average attack success rates against black-box models, i.e., all target models except ResNet-50. The best results are in bold.
Method
RNS0
IncV3
Inc
IncRes
SEI54
VGGI9
DN201
PNASNet
Average
16/255
99.9%
73.8%
69.3%
68.1%
80.8%
91.0%
92.0%
73.6%
78.4%
ILA
8/255
100%
47.8%
43.0%
38.2%
53.7%
74.5%
72.7%
42.5%
53.2%
4/255
100%
24.5%
21.7%
13.7%
29.5%
49.6%
49.8%
20.4%
29.9%
16/255
100%
76.3%
75.5%
71.1%
82.8%
94.3%
94.1%
79.7%
82.0%
ILA+
8/255
100%
51.6%
51.5%
44.1%
61.2%
79.4%
82.1%
54.9%
60.7%
4/255
100%
28.1%
26.2%
18.4%
36.0%
57.5%
59.0%
25.7%
35.8%
16/255
100%
81.4%
78.7%
73.3%
85.7%
94.8%
96.9%
78.9%
84.2%
LinBP
8/255
100%
54.4%
52.1%
43.8%
60.8%
81.3%
81.2%
49.3%
60.4%
4/255
99.9%
30.0%
25. 1
16. %
33.0%
59.4%
54.9%
21.5%
34.3%
16/255
99.9%
93.6 %
93.8%
91.7
95.1 %
97.2%
99.1%
96.4%
95.3%
BD (Ours)
8/255
99.8%
80.1 %
79.7%
74.6% %
83.7 %
91.2 %
95.0%
81.0%
83.6 %
4/255
99.5%
49.8 %
47.7% %
41.8 %
58.1% %
71.7 %
75.9%
52.9%
56.8 %
Table 7: The attack success rates of different combined methods, with MI-FGSM as the optimization algorithm and ResNet-50 the source model. "Average" presents the average attack success rates against black-box models, i.c., all target models except ResNet-50. The maximum perturbation e 16/255. The best results are in bold.
Method
RN50
V3
Inc
IncRes
SE154
VGG19
DN201
PNASNet
Average
ILA
99.9%
73.8%
69.3%
68.1%
80.8%
91.0%
92.0%
73.6%
78.4%
BD+ILA
99.9%
95.0%
94.2%
94.2%
96.6%
99.1%
99.1%
95.6%
96.3%
LinBP
100%
81.4%
78.7%
73.3%
85.7%
96.9%
78.9%
84.2%
BD+LinBP
100%
96.6%
95.9%
95.2%
97.7%
99.4%
99.4%
96.7%
97.3%
ILA+LinBP
100 %
85.2%
84.9%
80.5%
89.0%
97.7%
97.7%
85.8%
88.7%
BD+ILA+LinBP
100%
97.6%
97.2%
96.0% %
97.9
99.4%
99.5%
97.5 %
97.9 %
The step size a is set to 2/255 when < 16/255, and 1/255 when = 8/255 or 4/255. For MI-FGSM, we set the decay factor μ = 1.0. The iteration number 7 = 10. ILA/ILA++ runs 10 iterations after 10 iterations' baseline attacks. For competitors, we adopt their official implementations. The parameter settings for the combined attacks the same. All experiments were performed with an NVIDIA V100 GPU.
4.2 The Effectiveness of BD
Frepors the attack performance of our method against different models. As we can see, when the source model is modified with our BD, the transferability of the generated adversarial samples greatly improved across all source models. Specifically, our method improves the average attack success rates across all target models by 10.5%-31.19% %. Notably, when the maximum perturbation is 16. the lowest adversarial transferability from Re target models is 54.5%. Our proposed BD increases it to 91.7%, which is an increase of 37.2% The experimental results confirm the effectiveness of our proposed BD in generating highly transferable adversarial samples with different source models.
4.3 Comparisons with the Baselines
repprss the attack success rate of our BD and all the competitors against the target models, with MI-FGSM as the optimization algorithm and ResNet-50 as the source model. It can be seen that our proposed BD significantly outperforms the kate-offthe-an model modification-base transfer attacks across all target models at different levels of perturbation budgets. Specifically, in the black-box scenarios, we achieve an average attack success rate of 95.3%, 83.6%, and 56.8%, under e 16/255, 8/255, and 4/255, respectively. In contrast, the state-of-the-an -he baselines have the highest average
8

---

Table 8: The attack success rates of different BD variants, with MI-FGSM as the optimization algorithm and ResNet-50 as the source model. "Average" presents the average attack success rates against black-box models, i.e., all target models except ResNet-50. The maximum perturbation c 16/255. The best results are in bold.
BD Variants
RN50
IncV3
IncV4
IncRes
SE154
VGG19
DN201
PNASNet
Average
BD w/ BlurPool only
99.6%
80.6%
78.3%
76.0%
87.8%
93.9%
94.3%
87.1%
85.4%
BD w/ dilated conv only 99.8%
66.4%
58.6%
56.4%
72.9%
83.8%
84.7%
66.3%
69.9%
BD
100
87.9 %
86.8 %
84.2%
93.5%
95.3%
98.0%
91.5 %
91.0%
Table 9: The attack success rates on the CIFAR-10 and CIFAR-100 datasets, with MI-FGSM as the optimization algorithm. The best results are in bold.
Dataset
Snurce Model
WRN
ResNeXt
VGG19
DN-BC
Average
16/255
95.1%
96.0%
96.1%
93.5%
95.2%
RN20
8/255
79.1%
83.3%
78.4%
76.5%
79.3%
CIFAR-I0
4/255
48.7%
54.0%
43.3%
46.3%
48.1%
16/255
97.3%
97.8%
97.6%
96.0%
97.2%
BD RN20
8/255
84.7 %
88.0%
82.4%
82.1% %
84.3% 3
4/255
54.7% %
60.8%
47.0%
51.8%
53.6%
16/255
95.4%
94.4%
94.3%
93.3%
94,4%
RN56
8/255
82.3%
80.5%
82.2%
78.8%
81.0%
CIFAR-100
4/255
60.4%
58.5%
61.8%
57.3%
59.5%
16/255
97.2%
96.8%
96.1
96.0% %
96.5%
BD RN56
8/255
87.1 %
85.6%
85.0%
85.2%
85.7 %
4/255
66.0% %
64.5%
64.9%
64.1%
64.9 %
attack success rates of only 84.2%, 60.7%, and 35.8% under the same settings, respectively. In the white-box setting, since BI) ResNet-50 is different from the original ResNet-550, and we use BD ResNet-50 generate adversarial samples, the attack success rates are slightly lower than 100%. However, we note that the performance drop is negligible.
4.4
Combining with Existing Methods
Since our BD preserves the core architecture of the source model, it can be combined with previous transfer attacks such as LinBP and ILA. The results are presented in Table with MI-FGSM as the optimization algorithm and ResNet-50 as the source model. We can see that our BD can significantly further promote the transferability of adversarial samples when combined with other transfer attacks. Specifically, BD significantly improves the black-box attack success rates of ILA and LinBP by an average of 17.9% and 13.1% respectively. When combining BD with ILA and LinBP in the black-box settings, the average attack success rate can reach 97.9%, and the lowest attack success rate can be increased to 96.0%, compared to only 80.5% achieved by combining IIA and LinBP.
4.5 Further Analysis
To verify the contribution of each component in BD, we conduct an ablation study by removing the BlurPool component and the dilated convolution component from BD, respectively. Table 8 reports the attack success rates, with MI-FGSM as the optimization algorithm and ResNet-50 as the source model. The maximum perturbation is set to 16/255. We can see that the removal of the BlurPool component and the removal of the dilated convolution component lead to a decrease in black-box attack performance by 21.1% and 5.6% on average, respectively. These results suggest that BlurPool and dilated convolutions both contribute to improving adversarial transferability, which validate the design of our method.
Besides, we perform experiments on datasets with lower resolution. Following previous efforts 11 [3), choose the CIFAR- 10 and C10 datasets [24], which consist of 60000 images

---

from 10 and 100 classes, respectively. They are both officially divided into training set of 50000 images and a test set of 10000 images. We use their test sets to generate adversarial samples and their training sets to fine-tune the modified BD model. We choose ResNet-20 (RN20) and ResNet-56 (RN56) [23] as the source models for the CIFAR-10 10 and CIFAR-100 datasets, respectively. For target models, we choose widely applied DNN models, including Wide Residual Network (the WRN-28-10 10 version) [37]. ResNeXI-29 [38, VGG19 (26). and DenseNet-BC (DN-BC) 227.
We use open-source
pretrained models that are collected from a GitHub repository
Table presents the results. We can see that our method can still consistently improve the adversarial transterability of the source model by a large margin, which confirms that our method is also effective on datasets with lower resolution.
5 Conclusion and Discussion
In this paper, we propose a novel model modification-bart -based transfer attack: Blurred-Dilated method (BD). BD reduces downsampling operations and adds BlurPool and dilated convolutions in the original source model. It then employs the modified source model to generate adversarial samples. Extensive experiments on the ImageNet dataset validate that BD can be conveniently applied to different popular source models to generate highly transferable adversarial examples. Our proposed method can also obtain significantly better adversarial transferability than the state-of-the-art baselines. Besides, our method can be conveniently combined with other transfer attacks to further improve their performance.
Limitations and future work. Our proposed model modification method mainly based on domain knowledge and empiricism. Therefore, although there is general strategy, it still requires manual trial and error to attain the final model structures that can generate highly transferable adversarial samples. Moreover, the final model structure that we obtain is only the optimal one among the candidate structures that we consider in this work. We leave it to future work to automate the search for model structures that can manufacture highly transferable adversarial examples. Our work also mainly focuses on CNN models that have convolutional and pooling layers. We plan to extend our method to more non-CNN models, like Vision Transformers (3] in the future work.
Broader impacts. Our work not only offers a new way to effectively evaluate the robustness of deep learning models, but also provides further insights into the relationship between model structures and adversarial transfcrability. Additionally, our work calls the attention of both researchers and practitioners this new security issue. We believe that our method be utilized to generate more transferable adversarial samples for adversarial training, which can better improve the robustness of a model.
Acknowledgments and Disclosure of Funding
The authors are grateful to the anonymous reviewers for their valuable comments and suggestions, which helped to improve this paper. This work was supported by the National Natural Science Foundation of China (Grant No. 62206318).
References
[1] Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Good- fellow, and Rob Fergus. Intriguing properties of neural networks. In International Conference on Learning Representations, 2014.
[2] Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversar- ial examples. In International Conference on Learning Representattinss, 2015.
[3] Weibin WU, Yuxin Su, Xixian Chen, Shenglin Zhao, Irwin King, Michael R Lyu, and Yu- Wing Tai. Towards global explanations of convolutional neural networks with concept attribution. In IEFF/CV Conference Computer Vision and Pattern Recognition, pages 8652-8661, 2020.
10

---

[4] Alexey Kurakin, Ian Goodfellow, and Samy Bengio. Adversarial examples in the physical world. In International Conference on Learning Representations Workshop, 2017.
[5] Weibin Wu, Jianping Zhang, Victor Junqiu Wei, Xixian Chen, Zibin Zheng, Irwin King, and Michael R Lyu. Practical and efficient model extraction of sentiment analysis APIs. In IEEE/ACM International Conferencee on Software Engineering, pages 524-536, 2023.
[6] Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant adversarial attacks. In International Conference Learning Representations, 2018.
[7] Yanpei Liu, Xinyun Chen, Chang Liu, and Dawn Song. Delving into transferable adversarial examples and black-box attacks. In International Conference Learning Representations, 2017.
[8] Weibin Wu, Yuxin Su, Xixian Chen, Shenglin Zhao, Irwin King, Michael R Lyu, and Yu- fu-Wing Tai. Boosting the transferability of adversarial samples via attention. In IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 1161-1170, 2020.
[9] Weibin Wu, Yuxin Su. Michael R Lyu, and Irwin King. Improving the transferability of adversarial samples with adversarial transformations. In /EEE/CVF Conference on Computer Vision and Puttern Recognition, pages
2021.
[10] Jianping Zhang, Weibin Wu, Jen-tse Huang, Yizhan Huang, Wenxuan Wang, Yuxin Su, and Michael R Lyu. Improving adversarial transferability via Neuron Attribution Attacks. In IEEE/CVF Conference on Computer Vision and Patlern Recognition, pages 14993-15002, 2022.
[11] Jianping Zhang, Yizhan Huang, Weibin Wu, and Michael Lyu. Transferable adversarial attacks vision transformers with Token Gradient Regularization. In /EEE/CVF Conference on Computer Vision and Pattern Recognition, pages 16415-16424, 2023.
[12] Qian Huang, Isay Katsman, Horace He, Zeqi Gu, Serge Belongie, and Ser-Nam Lim. En- hancing adversarial example transferability with Intermediate Level Attack. In IEEE/CVF International Conference on Computer Vision, pages 4733-4742, 2019.
[13] Qizhang Li, Yiwen Guo, and Hao Chen. Yet another intermediate-Ievel attack. In European Conference on Computer Vision, pages 241-257, 2020.
[14] Dongxian Wu, Yisen Wang, Shu-Tao Xia, James Bailey, and Xingjun Ma. Skip connections matter: On the transferability of adversarial examples generated with ResNets. In International Conference on Learning Representations, 2020.
[15) Yiwen Guo, Qizhang Li, and Hao Chen. Backpropagating linearly improves transferability of adversarial examples. In Advances in Neural Information Processing Systems, pages 85-95, 2020.
[16] Richard Zhang. Making convolutional networks shift-invariant again. In International Confer- ence Machine Learning. pages 7324-7334, 2019.
[17] Fisher Yu and Vladlen Koltun. Multi-scale context aggregation by dilated convolutions. In International Conference on Learning Representations, 2016.
[18] Yinpeng Dong, Fangzhou Liao, Tianyu Pang, Hang Su, Jun Zhu, Xiaolin Hu, and Jianguo Li. Boosting adversarial attacks with momentum. In IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 9185 9185-9193, 2018.
[19] Cihang Xie, Zhishuai Zhang, Yuyin Zhou, Song Bai, Jianyu Wang, Zhou Ren, and Alan L Yuille. Improving transferability of adversarial examples with input diversity. In IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 2730-2731 2019.
[20] Jiadong Lin, Chuanbiao Song, Kun He, Liwei Wang, and John E Hopcroft. Nesterov Accelerated Gradient and scale invariance for adversarial attacks. International Conference on Learning Representations, 2019.
11

---

[21] Yinpeng Dong, Tianyu Pang, Hang Su, and Jun Zhu. Evading defenses to transferable adversarial examples by translation-invariee attacks. In JEEE/CVF Conference on Computer Vision and Pultern Recognition, pages 4312-4321, 2019.
[22] Yingwei Li, Song Bai, Yuyin Zhou, Cihang Xie, Zhishuai Zhang, and Alan Yuille. Learning transferable adversarial examples via Ghost Networks. In AAAI Conference on Artificial Intelligence, pages 11458-11465, 2020.
[23] Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In IEEF/CVF Conference on Computer Vision and Pattern Recognition, pages 770-778, 2016.
[24] Alex Krizhevsky. Learning multiple layers of features from tiny images. Technical report, 2009.
[25] Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. ImageNet: A large- scale hierarchical image database, In JEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 248-255, 2009.
[26] Karen Simonyan and Andrew Zisserman. Very deep convolutional networks for large-scale image recognition. In International Conference on Learning Representations, 2015.
[27] Gao Huang, Zhuang Liu, Laurens Van Der Maaten, and Kilian Q Weinberger. Densely connected convolutional networks. In JEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 4700-4708, 2017.
[28] Mark Sandler, Andrew Howard, Menglong Zhu, Andrey Zhmoginov, and Liang-Chiel Chen. MobileNetV2: Inverted residuals and linear bottlenecks. In IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 45 4510-4520, 2018.
[29] Matthew D Zeiler and Rob Fergus. Visualizing and understanding convolutional networks. In European Conference on Computer Vision, pages 818-833, 2014.
[30] Ian Goodfellow, Yoshua Bengio, and Aaron Courville. Deep learning. MIT press, 2016.
[31] Carolina Galleguillos and Serge Belongie. Context based object categorization: A critical survey, Computer Vision and Image Understanding, 1 114(6):712-72,, 2010.
[32] Alexey Kurakin, Ian Goodfellow, Samy Bengio, Yinpeng Dong, Fangzhou Liao, Ming Liang, Tianyu Pang, Jun Zhu, Xiaolin Hu, Cihang Xie, et al. Adversarial attacks and defences competition. In The NIPS Competition: Building Intelligent Systems, pages 195-231, 2018.
[33] Christian Szegedy, Vincent Vanhoucke, Sergey Ioffe, Jon Shlens, and Zbigniew Wojna. Re- thinking the Inception architecture for computer vision. In IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 281 2818-2826, 2016.
[34] Christian Szegedy, Sergey Ioffe, Vincent Vanhoucke, and Alexander Alemi. Inception-v4, Inception-Reshl and the impact of residual connections on learning. In AAAI Conference on Artificial Intelligence, pages 027844244 2017.
[35] Jie Hu, Li Shen, and Gang Sun. purreze-aad--Exitaaii Networks. In JEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 7132-7141, 2018
[36] Chenxi Liu, Barret Zoph, Maxim Neumann, Jonathon Shlens, Wei Hua, Li-Jia Li, Li Fei-Fei, Alan Yuille, Jonathan Huang, and Kevin Murphy. Progressive Neural Architecture Search. In European Conference on Computer Vision, pages 19-34, 2018.
[37] Sergey Zagoruyko and Nikos Komodakis. Wide residual networks. In British Machine Vision Conference, 2016.
[38] Saining Xie, Ross Girshick, Piotr Dollár, Zhuowen Tu, and Kaiming He. Aggregated residual transformations for deep neural networks. In JEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 1492-1500, 2017.
[39] Alexey Dosovitskiy, Lucas Beyer, Alexander Kolesnikov, Dirk Weissenborn, Xiaohua Zhai, Thomas Unterthiner, Mostafa Dehghani, Matthias Minderer, Georg Heigold, Sylvain Gelly, et al. An image worth 16x 16 words: Transformers for image recognition at scale. In International Conference Learning Representations, 2020. 2020..
12


Reviews:
[{"review_id": "mtmfgoPk5W", "reviewer": "Reviewer_hwet", "summary": "The paper investigates a modification to vision networks that causes adversarial examples generated by attacking them to be more transferable. In particular, the paper suggests using dilated convolutions + blurred downsampling, which the authors motivate as retaining a maximum amount of original feature information.", "questions": "N/A", "limitations": "N/A", "rating": 5, "confidence": 2, "soundness": 3, "presentation": 3, "contribution": 2, "strengths": "Overall, the paper seems reasonable and solid. It proposes a new approach (albeit with a somewhat handwavy motivation), shows that it works well in a variety of settings, and performs ablations to ensure that the components of their approach are necessary.", "weaknesses": "As alluded to above, although the paper is solid, it's not a particularly standout paper either. The motivation for why this approach is useful is quite vague and is not explored thoroughly, except for some light analysis of salience maps and the method itself is not very novel. The results, however, are quite good. Overall, i feel somewhat lukewarm on this paper.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Q1. The motivation of our approach.\n\n(1) We observed that: 1) The adversarial samples generated by ResNet usually have better transferability than those generated by other models. We think the reason may be that the skip connections of ResNet connect the lower-layer feature maps to the higher-layer feature maps, which helps to transfer more low-level features and reduce the information loss caused by downsampling. 2) Due to the large resolutions of the images on ImageNet, models need to do downsampling multiple times, resulting in a large amount of information loss. Besides, due to the structural differences between models, the discarded features are different. Therefore, preserving more low-level features, as ResNet does, can improve adversarial transferability. 3) On CIFAR-10/100, the adversarial transferability between models are usually better than that on ImageNet. Since the resolutions of the images on CIFAR-10/100 are smaller, there are fewer downsampling in the CIFAR-10/100 models. Therefore, different CIFAR-10/100 models all maintain more low-level features, making the generated adversarial sample easy to transfer.\n\n(2) Given the above observations, we think that employing a source model that can preserve more low-level features of an image during forward propagation can help to craft adversarial samples, which can more thoroughly and precisely destroy the low-level features of a clean image. Such adversarial samples are more transferable, since different models all use low-level features to extract high-level semantics and then make predictions. Since downsampling discards image features, which will reduce the details of an image (i.e., the low-level features) during forward propagation, we propose our Blurred-Dilated method to reduce downsampling in the original models, and preserve more low-level features of an image. Therefore, the proposed Blurred-Dilated method can generate more transferable adversarial samples.\n\n\n\n\nQ2. The novelty of our method.\n\nThe novelty of our approach can be summarized as follows: \n\n(1) We find that existing transfer attacks based on model modification only focus on modifying the back propagation. Different from them, we are the first to consider forward propagation. \n\n(2) Our method is built upon a new perspective to improve adversarial transferability: keeping more low-level features during forward propagation. Besides, our method outperforms the state-of-the-art baselines by a significant margin. Therefore, our work sheds some light on studying the transferability of adversarial samples.\n"}, {"review_id": "zPoWzgJ2vq", "reviewer": "Reviewer_VEyj", "summary": "The paper proposes a novel transfer-based black box adversarial attack called Blurred-Dilated method. They authors consider the model modification approach and propose to reduce downsampling operations on the source model for the attack. They conduct extensive experimenting and compare with the previously proposed methods to show the superior transferrability of their generated adversarial examples. ", "questions": "What is the effect of the introduced architectural elements on the model inference time?", "limitations": "Limitations and Broader Impact are adequately discussed in the Appendix", "rating": 6, "confidence": 3, "soundness": 3, "presentation": 4, "contribution": 3, "strengths": "1. Originality. The paper proposes a novel approach for the black-box attacks. I am not aware of other black-box attacks that focus on the forward propagation in the model.\n2. Quality. The paper provides reasonable experimental support and justification of their proposed methodology.\n3. Clarity. The paper is well-written and easy to follow.\n4. Significance. Improving the transferability of the adversarial examples allows to raise awareness for the vulnerabilities of the models deployed in safety-critical domains. \n", "weaknesses": "The BD method proposed in this work seems to be specific for the CNN architecture and cannot be applied to other popular vision archictectures such as Vision Transformer [1]\n\n[1] Dosovitsky et al. “An Image is Worth 16x16 Words: Transformers for Image Recognition at Scale”, ICLR 2021\n", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "\nQ1. Can the BD method be applied to other popular vision architectures such as Vision Transformer?\n\nWe can first add CNN blocks to Vision Transformers as in (Dosovitsky et al. 2021). We can then apply our BD method to the CNN blocks in the hybrid  model to improve the transferability of adversarial attacks. We plan to extend our method to more architectures in the future work.\n\n\nQ2. What is the effect of the introduced architectural elements on the model inference time?\n\nWe compared the inference time of Resnet50 and BD-Resnet50 for 300 iterations and obtained the average time. The result is that the inference time of Resnet50 is 7.85ms, and the inference time of BD-Resnet50 is 15.69ms. The above result is tested on a Nvidia Tesla T4.\n\nCompared to other methods, our method can still quickly generate adversarial samples with a higher attack success rate.\n"}, {"review_id": "H51Uf1lVnk", "reviewer": "Reviewer_1sbs", "summary": "This paper proposes a new Blurred-Dilated method for generating transfer attacks. The authors focus on generating transfer attacks as a more realistic attack model by looking at how the substitute model's architecture can be changed to increase the transferability of adversarial attacks. By introducing blurred downsampling and dilated convolutions in the substitute network, the authors try to focus on preserving important features to increase transferability. The authors evaluate transferability on ImageNet across several naturally trained architectures.\n\n\n======= POST REBUTTAL =========\nAfter the rebuttal, I have raised my score due to experiments on transfer-based defenses.", "questions": "1. Why are dilated convolutions only applied at the later layers?\n\n2. Why are blurred-downsampling filters better than convolving with higher stride?\n\n3. How does BD perform against defenses trained to stop transfer attacks?", "limitations": "The paper is an attack paper and does not extensively talk about the implications of such a method. A discussion on possible countermeasures and how this impacts the overall aim of creating robust and reliable machine learning models would be helpful.", "rating": 5, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 2, "strengths": "1. Interesting idea. The paper proposes an interesting approach, which is whether or not transfer attacks can be carried out on the substitute model side. If there are techniques we can do on the substitute model side, this makes the attacks more possible and practical.\n\n2. Compared to ILA, ILA++, and LinBP, the BD attacks seem to do quite well, transferring across naturally trained architectures at a higher rate than these other attacks.\n\n3. Examining the attention maps in the experiments is interesting, and helps add some insight into what would otherwise be an empirical paper.", "weaknesses": "1. Some design choices could be defended stronger. For example, why are the dilated convolutions only applied at the later layers? Why is blurred-downsampling better than convolving with higher stride? Also, the blurred filters would still lose information. What formally is being preserved with the BD filters and not with the regular convolutions or max pooling or average pooling? More formal one-to-one comparisons between each choice may be helpful. I am still a bit unsure about what fundamentally is important about these operations.\n\n2. Unstated practicality concerns. While the results are good against naturally trained models, what if the defense is trained to stop transfer attacks? E.g., \"Ensemble Adversarial Training: Attacks and Defenses\" (Tramer et al. 2018) or \"TRS: Transferability Reduced Ensemble via Encouraging Gradient Diversity and Model Smoothness\" (Yang et al. 2021). The introduction of such defenses may render these attacks ineffective. I wonder how effective these defenses would be in stopping BD attacks. In addition, the assumption is that ImageNet as the domain is known but the architecture may be different. How realistic is this in the real world? One might not know the dataset that a machine learning model was trained on, and then would have to extract a substitute with model extraction. Then, the practical cost of extracting a model and then performing a transfer attack would have to be compared with the cost of performing query-based black-box attacks.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Q1. Why are dilated convolutions only applied at the later layers? \n\n(1) We introduce dilated convolutions to reduce downsampling in the model, since we want to preserve more low-level features of an image during forward propagation (Please see the answer to Q1 of Reviewer hwet for the motivation of our method). However, merely removing downsampling can degrade the model's performance on capturing the global information of an image, since downsampling can enlarge the model's receptive field. Therefore, in addition to removing downsampling, we add dilated convolutions to enlarge the model's receptive field while maintaining more low-level features.\n\n(2) We do not apply dilated convolutions to reduce downsampling at the earlier layers, since applying dilated convolutions at the earlier layers will maintain the large dimensionality of earlier features, which makes the forward computation too expensive to complete. \n\n\nQ2. Why are blurred-downsampling filters better than convolving with higher strides? \n\nIn addition to adding blurred-downsampling, we change convolving with higher strides to convolving with stride 1. Such a combination (ConvBlurPool, please see Line 163 of the main paper) is better than convolving with higher strides in terms of preserving more low-level and low-frequency features. The reasons are:\n\n(1) Convolving with higher strides would skip pixels and potentially miss features in the original image. Therefore, we first change the stride to 1, which can preserve more low-level features.\n\n(2) We then add blurred-downsampling. Although it reduces the dimensionality of features, the output of blurred-downsampling still considers all features in its receptive field. Therefore, it will not cause more information loss than convolving with higher strides.  Besides, since blurred-downsampling is a Gaussian filter, it can keep more low-frequency features, which can help to generate more transferable adversarial samples [6]. \n\n\n\nQ3. How does BD perform against defenses trained to stop transfer attacks?\n\nWe have tested three adversarially trained models: IncV3\\textsubscript{ens3}, IncV3\\textsubscript{ens4}, and IncRes\\textsubscript{ens} (Tramer et al. 2018). The detailed results are shown in Table 9 of our appendix due to space limit. TRS (Yang et al. 2021) does not provide a pre-trained defense model, and we cannot complete the model training for TRS due to the limited rebuttal period. Therefore, we tested more widely-used defenses to stop transfer attacks: JPEG [R1], FD [R2], FAT [R3], RS [R4] and NRP [R5]. The results are shown in Table R3 of the uploaded PDF file. We can see that these defenses cannot effectively stop our BD attacks, and we outperform the state-of-the-art baselines by a large margin of 14.7\\% on average.\n\n\n[R1] Guo, C., Rana, M., Cisse, M., & Van Der Maaten, L. (2017). Countering adversarial images using input transformations. arXiv preprint arXiv:1711.00117.\n\n[R2] Liu, Z., Liu, Q., Liu, T., Xu, N., Lin, X., Wang, Y., & Wen, W. (2019, June). Feature distillation: Dnn-oriented jpeg compression against adversarial examples. In 2019 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) (pp. 860-868). IEEE.\n\n[R3] Wong, E., Rice, L., & Kolter, J. Z. (2020). Fast is better than free: Revisiting adversarial training. arXiv preprint arXiv:2001.03994.\n\n[R4] Cohen, J., Rosenfeld, E., & Kolter, Z. (2019, May). Certified adversarial robustness via randomized smoothing. In international conference on machine learning (pp. 1310-1320). PMLR.\n\n[R5] Naseer, M., Khan, S., Hayat, M., Khan, F. S., & Porikli, F. (2020). A self-supervised approach for adversarial robustness. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (pp. 262-271).\n\nQ4. What formally is being preserved with the BD filters?\n\n(1) At the earlier layers, we change MaxPool, Conv, and AveragePool to MaxBlurPool, ConvBlurPool, and Blurpool, respectively (Lines 161-166 of the main paper). At the later layers, we introduce dilated convolutions in order to remove MaxPool or AveragePool. \n\n(2) Compared to the original filters, our BD filters preserve more low-level and low-frequency features (Please see the answer to Q1 and Q2). Compared to max pooling, which keeps only one feature in its receptive field, MaxBlurPool considers all features in its receptive field. Besides, compared to AveragePool, since we use a Blurpool with a larger kernel size, with the same stride, Blurpool can keep more low-level features.\n\n\n\n\nQ5. Threat model. \n\n(1) The threat model adopted in our work is consistent with the well-recognized work in this field (e.g., [6, 9]), which assumes that attackers know the training dataset of the target model.\n\n(2) We plan to study transfer attacks in more realistic settings in the future work.\n\n\n\nQ6. Implication of our method. \n\nOur method can be utilized to generate more transferable adversarial samples for adversarial training, which can better improve the robustness of a model.\n\n"}, {"review_id": "w1D66nHIza", "reviewer": "Reviewer_MuF1", "summary": "In this work, the author generates adversarial examples to attack other models by using BlurPools and dilated convolutions on the source model. The results show that increasing the model with BlurPools and dilated convolutions can generate more transferable adversarial examples.", "questions": "See weakness.", "limitations": "See weakness.", "rating": 5, "confidence": 3, "soundness": 3, "presentation": 2, "contribution": 2, "strengths": "The work is well-written and easy to follow. The work performs comprehensive experiments and validates the effectiveness of BlurPools and dilated convolutions regarding improving the transferability of adversarial examples.", "weaknesses": "Although the author has demonstrated the effectiveness of the proposed method through experiments, my main point is still that this work lacks sufficient novelty. In my opinion, adding a blur layer inside the network and methods based on input augmentation (such as padding and resizing) are not fundamentally different. Moreover, the former method actually has more model dependence and cannot be used as plug-and-play as the latter.\n\nAdditionally, some other concerns include:\n1. \"They mostly focus on backpropagation while neglecting forward propagation.\" This limitation is not entirely correct. According to the author's classification, input augmentation can also be considered an improvement from forward propagation. I believe this statement should be further explained in more detail.\n\n2. \"It is crucial to retain as many comprehensive features as possible.\" This statement may not be entirely rigorous. The best transferability comes from category-related features, and background features sometimes provide false information.\n\n3. In terms of experimental results, there is still some gap compared to some existing sota methods.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Q1. The novelty of the proposed method. \n\nPlease see Q2 of Reviewer hwet.\n\nQ2.  \"In my opinion, adding a blur layer inside the network and methods based on input augmentation (such as padding and resizing) are not fundamentally different.\"\n\t\n(1) Our method can help to preserve more low-level features during forward propagation of the modified source model. Therefore, employing such a source model can guide adversarial samples to more thoroughly and precisely destroy the low-level features of a clean image. Such adversarial samples are more transferable, since different models all use low-level features to extract high-level semantics and then make predictions (Please see Q1 of Reviewer hwet). \n\n(2) In contrast, input augmentation improves adversarial transferability by offering less noisy gradients to escape from the poor local optimal of a source model. Therefore, our method and attacks based on input augmentation are fundamentally different. Besides, we can combine our method with input augmentation based attacks to further improve the performance.\n\n\nQ3. Explaining \"They mostly focus on backpropagation while neglecting forward propagation.\" \n\nWe are sorry about that. \"They\" here refer to the attack methods based on model modification. Many existing transfer attacks based on model modification mainly focus on modifying the back propagation.\n\n\nQ4. Fixing \"It is crucial to retain as many comprehensive features as possible.''\n\nWe will change it to \"It is crucial to retain as much low-level features as possible.'' Please see Q1 of Reviewer hwet for explanations. \n\nQ5. Comparing with existing SOTA methods in terms of the experimental results.\n\n(1) Our work is focused on model-modification based attacks. LinBP and ILA family are SOTA methods in this category, and we have compared with them. \n\n(2) Perhaps the SOTA method you mentioned is based on other mechanisms such as input augmentation. To address your concerns, we compared our method with the state-of-the-art input-augmentation based method SSA [R6] with a maximum perturbation of 16, using MI as the attack method. Table R2 of the uploaded PDF file shows the attack results. We can see that our method can achieve an average attack success rate of 95.3\\%, outperforming SSA by 1.6\\%. Moreover, our method can be combined with SSA to further improve the attack success rates of SSA by 4.7\\% on average.\n\n\n[R6] Long, Y., Zhang, Q., Zeng, B., Gao, L., Liu, X., Zhang, J., & Song, J. (2022, October). Frequency domain model augmentation for adversarial attack. In European Conference on Computer Vision (pp. 549-566). Cham: Springer Nature Switzerland.\n\n"}, {"review_id": "2N7oF1HAet", "reviewer": "Reviewer_eif6", "summary": "The authors propose the Blurred-Dilated method (BD), which utilizes BlurPools and dilated convolutions on the source model when an adversarial attack is applied, to increase the transferability of the transfer-based attack. The method replaces the MaxPool layer with MaxBlurPool, Conv with ConvBlurPool and AveragePool with BlurPool, in both forward and backward computation. The author conducts experiments and find that BD can outperform multiple SOTA. On top of that, Combining BD with existing black-box attacks can further improve the attack success rate.", "questions": "1. If we consider replacing max pooling with BlurPool, can we interpret it as replacing a non-linear function with a linear function? Thus, does the Linearity Hypothesis in LinBP apply to BD as well?\n\n2. I suppose the replacement of model layers takes place during test time (actually it is better to clarify in the paper), when the source models are already pre-trained similar to SGM and LinBP. However, unlike SGM and LinBP, BD also modifies forward propagation. As the architecture is changed, I wonder if we can retrain/finetune the modified model and uses the new one as the source model instead?\n", "limitations": "The authors admit Weakness #2 in the paper. However, can the authors advise some guidelines on the 'early stop' strategy and what is the proportion of the low-level features to be discarded/retained?", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1. The paper is written very clearly with a detailed introduction to the preliminary works. The actual modifications to the models are detailedly reported in tables. \n2. A large variety of experiments are covered, such as comparison with SOTA, success rates against robustly trained models, ablation study, hyper-parameters, etc. A lot of potential concerns can be addressed with the reported results.\n3. The proposed method is simple yet effective. Replacing model layers does not introduce extra computation time compared with methods like GhostNet.\n", "weaknesses": "#### 1. Datasets with lower resolution are not tested with\nIn the paper, all the experiments are performed on ImageNet. Since BD modifies the downsampling operation, which can make a huge difference with different image resolutions. ImageNet has a relatively high resolution (3x299x299), enabling dilated convolution to be applied without much issue. However, I wonder if BD can still generate transferable attacks for datasets with lower resolution, such as CIFAR-10 and CIFAR-100. \n\n#### 2. The proposed method is specific to some model components\nThis limitation is also brought up by the authors, \"*Our proposed model modification is based on domain knowledge and empiricism.*\" Besides, there is no general guideline on the \"early stop\" strategy on how many downsampling layers to be removed. Summing up these points, it can be difficult to extend the proposed methods to new models.\n\nFor the same reason, claims like line 176 might be too broad. \"*BD (Blurred-Dilated method) is a universal technique that can be easily implemented in any DNN.*\" As BD requires specific CNN layers like Convolution with stride and pooling layers to work, it cannot be directly applied to non-CNN models like vision transformers and MLP mixers. This is also another limitation that is not discussed in the paper.\n\n#### 3. Minor formatting recommendations\n- I recommend inserting a space between the square bracket for citation and the previous word (e.g. word [1] instead of word[1])\n- The formatting of the norm is inconsistent in the main text (l$\\infty$) and the appendix ($l_\\infty$).\n", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Q1. If we consider replacing max pooling with BlurPool, can we interpret it as replacing a non-linear function with a linear function? Thus, does the Linearity Hypothesis in LinBP apply to BD as well? \n\nThank you for providing a new perspective to explain the effectiveness of our method. However, we actually replace max pooling with MaxBlurPool, which consists of max-pooling with a stride of 1 and blur-pooling (Line 161 of our main paper). Therefore, MaxBlurPool is still a non-linear function. \n\nFurthermore, LinBP proposes that the linear structure in the network is helpful for attack transferability, and removes the ReLU function in the network. Maybe it's because the ReLU function causes information loss when x<0?\n\nQ2. Can we retrain/finetune the modified model and uses the new one as the source model instead?\n\nSorry, we didn't explain this clearly. In fact, we have fine-tuned the model after modifying it with the BD method. Otherwise the accuracy of the modified model will decrease, degrading the attack performance as well. We will make it more clear in our final version.\n\n\nQ3. Experiments on lower-resolution datasets.\n\nWe experiment with lower-resolution datasets: CIFAR-10 and CIFAR-100. The experimental results are shown in Table R1 of the uploaded PDF file. The original source models for CIFAR-10 and CIFAR-100 are ResNet 20 and ResNet 56, respectively. We can see that our method can still be applied to lower-resolution datasets to generate transferable adversarial samples. Besides, we still consistently outperform the baseline method by about 4\\% on average. \n\nQ4. Can the authors advise some guidelines on the 'early stop' strategy and what is the proportion of the low-level features to be discarded/retained?\n\n(1) Through experiments, we found that retaining half of the downsampling operations in the model can be a guideline.\n\n(2) The input size of ResNet is $224\\times224$, and a $7\\times7$ feature map is obtained finally after 5 downsampling operations. Therefore, the proportion of the low-level features to be discarded/retained for the original ResNet is $(224^2-7^2)/7^2$. In contrast, in our BD ResNet, we only keep 2 or 3 downsampling operations, obtaining a $4^2$ times larger feature map ($28\\times28$) finally. Therefore, the proportion of the low-level features to be discarded/retained is $(224^2-28^2)/28^2$.\n\n\nQ5. Fixing the claims like line 176.\n\nOur claim is not accurate, we will change it to \"BD (Blurred-Dilated method) is ageneral technique that can be easily implemented in popular CNNs.\" \n\nQ6. Minor formatting recommendations. \n\nThanks for your careful review. We will fix this typo and thoroughly proofread the paper again.\n\n\n\n\n"}]

Author rebuttal:
Dear Reviewers,

We sincerely appreciate all of your precious time and constructive comments. We are greatly encouraged by the positive comments on our work. We will carefully revise our manuscript by adding the suggested experimental comparisons, presenting more detailed explanations, and fixing the typos. We are looking forward to receiving your valuable feedback to further improve our work. Thank you for your time!

Sincerely, 

Authors


Meta-review: This paper proposes a novel method for transfer attacks, which is termed Blurred-Dilated. The focus of the method is on how to change a model architecture so that attacks on this model are more transferable to other models. The proposed Blurred-Dilated models use blurred downsampling and dilated convolutions in the network, motivated by the idea that important features are better preserved. The transferability is evaluated on ImageNet for a representative range of architectures.
The proposed approach is novel and its simplicity is appealing. While the reviewers point out that more evaluation of the Blurred-Dilated approach in terms of its theoretical motivation would be helpful, the empirical results in practical attack scenarios are most appealing. We encourage the authors to take the reviewers comments into account when preparing the final camera ready version of the paper.
Decision: Accept (poster)