Title: Dual-Flow: Transferable Multi-Target, Instance-Agnostic Attacks via $\textit{In-the-wild}$ Cascading Flow Optimization
Venue: NeurIPS 2025
Accepted: yes
Keywords: adversarial attacks

diffusion models
Abstract: Adversarial attacks are widely used to evaluate model robustness, and in black-box scenarios, the transferability of these attacks becomes crucial. Existing generator-based attacks have excellent generalization and transferability due to their instance-agnostic nature. However, when training generators for multi-target tasks, the success rate of transfer attacks is relatively low due to the limitations of the model's capacity. To address these challenges, we propose a novel Dual-Flow framework for multi-target instance-agnostic adversarial attacks, utilizing Cascading Distribution Shift Training to develop an adversarial velocity function. Extensive experiments demonstrate that Dual-Flow significantly improves transferability over previous multi-target generative attacks. For example, it increases the success rate from Inception-v3 to ResNet-152 by 34.58%. Furthermore, our attack method shows substantially stronger robustness against defense mechanisms, such as adversarially trained models.


Peer reviews:
{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThe paper introduces Dual-Flow, a novel framework for generating transferable, multi-target adversarial attacks in black-box settings. Unlike existing methods that struggle with low transferability or high computational costs, Dual-Flow leverages a two-stage flow-based approach: 1) Forward Flow: Uses a pretrained diffusion model to create an intermediate perturbed distribution; 2) Reverse Flow: Fine-tunes a LoRA-based velocity function for targeted adversarial refinement.\n\nSTRENGTHS AND WEAKNESSES:\nStrengths:\n- The introduction of the Dual-Flow framework is a significant advancement, combining diffusion models with adversarial velocity functions for improved attack performance. The dual-flow pipeline (forward + reverse) elegantly balances perturbation generality and specificity.\n- Propositions and theorems (e.g., cascading improvement in adjoint timesteps) provide a solid foundation for the approach.\n- The authors provide extensive experiments demonstrating the effectiveness of their method across multiple benchmarks, showing clear improvements in attack success rates.\n\nWeaknesses:\n- The Dual-Flow framework may be complex for practical implementation, which could limit its accessibility for practitioners in the field.\n- The paper could benefit from a more detailed analysis of the computational costs associated with the proposed method compared to existing approaches.\n- Focused solely on image classification. Extensions to other domains (e.g., object detection, NLP) are unexplored but noted as future work.\n\nQUESTIONS:\n- Are there any plans to extend the Dual-Flow framework to other domains or types of data beyond the current focus on image classification?\n- Besides the attack success rate, could the authors consider including additional metrics (e.g., precision, recall) to provide a more comprehensive evaluation of the method's performance?\n\nLIMITATIONS:\nyes", "TITLE": "Official Review", "RECOMMENDATION": 4, "REVIEWER_CONFIDENCE": 1, "CLARITY": 3, "IMPACT": 3, "ORIGINALITY": 3, "DATE": "2025-06-29"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper introduces Dual-Flow framework for multi-target instance-agnostic adversarial attacks, utilizing Cascading Distribution Shift Training to develop an adversarial velocity function.\n\nSTRENGTHS AND WEAKNESSES:\nStrengths:\n\nThe topic of this paper is both interesting and important. The combination of a frozen diffusion ODE with a learnable reverse flow is conceptually appealing.\n\n\nWeaknesses:\n\n1. The selection of victim models is not clearly explained. It is unclear whether the victim models used in this paper are the same as those adopted in other baseline methods. The authors do not report the clean accuracy of the original classifiers, whether adversarially trained or not. In addition, the training details and procedures of these models are not provided and should be made transparent. Similarly, the selection of robust models and their relevant configurations should also be clearly stated.\n\n2. The baseline methods selected by the authors are not very recent. For example, the CGNC method used for multi-target generative attacks is from 2023. The authors should include more recent baseline methods from the past two years for a fair and up-to-date comparison.\n\n3. The baseline methods reported in Table 2 are fewer than those in Table 1. However, many methods applicable to multi-target attacks can also be adapted to the single-target setting. The authors should align the methods used in both tables for consistency. Additionally, the evaluation of the proposed method on adversarially trained models in the single-target setting is missing and should be included.\n\n4. Only two input preprocessing defense methods (Gaussian smoothing and JPEG compression) are considered in the main paper. The authors should include more recent and advanced defense methods published in the past two years for a more comprehensive comparison.\n\n5. The training efficiency of the proposed method is not reported. There is no comparison in training time or parameter count with baselines such as C-GSP or CGNC. Given that the multi-target model requires one day of training on dual RTX 3090 GPUs, such a comparison is necessary to evaluate cost-effectiveness.\n\n6. The selection criteria for target classes in multi-target and single-target black-box attacks are unclear. The authors should clarify whether these classes were randomly selected or chosen based on vulnerability. In addition, the results only report mean success rates; standard deviation or confidence intervals should be provided to reflect the method’s stability.\n\n7. The paper lacks more comprehensive ablation studies. For example, the number of target classes and the sampling steps should be ablated. Moreover, the effect of different perturbation budgets (e.g., 4/255, 8/255) is not explored. Without this, it is difficult to evaluate performance under low-budget attack constraints. In addition, the ablation experiments should include comparisons with more baseline methods. For example, in Figure 3, only the CGNC method is used for comparison, but other effective baselines should also be included.\n\n8. The authors do not provide a theoretical explanation of why the proposed Dual-Flow sampling is effective in generating adversarial examples. A theoretical analysis should be included to demonstrate why adversarial examples generated in this way exhibit better transferability in black-box settings.\n\nQUESTIONS:\nThe questions are the same as those mentioned in the weaknesses.\n\nLIMITATIONS:\nPlease see the weaknesses.", "TITLE": "Official Review", "RECOMMENDATION": 4, "REVIEWER_CONFIDENCE": 5, "CLARITY": 2, "IMPACT": 2, "ORIGINALITY": 3, "DATE": "2025-07-02"}

comments: SUMMARY:
The paper tackles the problem of transferable multi-target instance-agnostic adversarial attack. To do so, it leverages the generative power of diffusion models via a Dual-flow framework. Specifically, it combines a pre-trained diffusion model and a LoRA-based adversarial velocity function. It also proposes the Cascading Distribution Shift Training, which is designed to improve the efficacy of adversarial attack. The proposed method outperforms existing multi-target adversarial attacks in diverse settings.

STRENGTHS AND WEAKNESSES:
Strengths:
1. The paper proposes a novel concept of applying flow-based ODE velocity for adversarial attacks.
2. The paper achieves state-of-the-art performance on multi-target adversarial attack.
3. The paper provides an extensive number of empirical evaluations on the proposed attack.

Weaknesses:
1. The visualizations in Fig. 2 show that the perturbations are highly visible. Also, these perturbations seem to be semantically structured and resemble features of the target class. This suggests that the attack may rely on large, structured perturbations rather than subtle changes. The paper needs more visualization and evaluation on smaller perturbation budgets where such semantic structures would be less visible.
2. The paper lacks evaluation on transferability across CNN-based and transformer-based models, which are more popular recently. How does the transferability of the attack perform across these models with larger discrepancies?

QUESTIONS:
N/A

LIMITATIONS:
Yes.
TITLE: Official Review
CLARITY: 3
IMPACT: 3
ORIGINALITY: 3
DATE: 2025-07-02

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper introduces Dual-Flow, a novel framework for generating multi-target, instance-agnostic adversarial attacks with high transferability in black-box settings. The method integrates a pretrained diffusion model (forward flow) with a trainable reverse flow, optimized via a new Cascading Distribution Shift Training algorithm. This reverse flow is designed to refine perturbations toward a target class using ODE-based integration. The method is empirically shown to outperform previous state-of-the-art attacks in both black-box transferability and robustness against defenses, particularly in multi-target settings.\n\nSTRENGTHS AND WEAKNESSES:\n## Strengths\n\n1. **Innovative Dual-Flow Architecture:**  \n   The separation of forward and reverse flows—leveraging pretrained diffusion and a fine-tuned LoRA-based velocity function—is conceptually elegant and practically effective for structured adversarial perturbation.\n\n2. **Cascading Distribution Shift Training:**  \n   This novel optimization strategy addresses the difficulty of training with in-the-wild trajectories and enables progressive, semantically meaningful perturbation refinement.\n\n3. **Strong Empirical Results:**  \n   The method demonstrates significant improvements (e.g., +34.58% success rate from Inc-v3 to ResNet-152) over existing multi-target generative attacks across multiple black-box and robust models.\n\n## Weaknesses\n\n1. **Limited Architectural Diversity in Transfer Evaluation:**  \n   - Two surrogate models, ResNet-152 and Inception-v3, are used in training, and all target models are CNN-based. The method’s effectiveness against architecturally diverse models (e.g., Vision Transformers) is not evaluated. If the target model differs significantly from the surrogate models, transferability may be substantially reduced.  \n   - There is no detailed ablation study comparing the individual versus combined contributions of the two surrogate models. This limits the generalizability of the claimed transferability.\n\n2. **Training Cost and Practical Scalability:**  \n   While the Dual-Flow framework is positioned as a scalable alternative to single-target generative attacks, the actual training cost undermines this motivation. According to the paper:  \n   - Training the multi-target model (for 8 target classes) takes approximately 1 day on 2 RTX 3090 GPUs (about 48 GPU-hours).  \n   - In contrast, training a single-target model requires about 4 hours on 1 GPU, so training 8 single-target models would take roughly 32 GPU-hours in total.  \n   Thus, multi-target training is actually more expensive than training individual single-target models, despite the higher architectural complexity and parameter sharing across classes. This contradicts the presumed efficiency advantage of multi-target approaches and raises concerns about practical scalability, especially when extending to more target classes or higher input resolutions.  \n   Moreover, Table 2 shows that single-target fine-tuned variants (Dual-Flow†) actually outperform the multi-target model, indicating that the multi-target setup sacrifices both efficiency and performance for flexibility. The paper does not fully address or justify this trade-off.\n\n3. **No Limitation Section:** The paper claims to discuss its limitations in the Appendix, but no such section or detailed discussion is provided.\n\n4. **Terminology Confusion Regarding “Victim Model”:**  \n   - Algorithm 1 refers to the training model \\( f \\) as the \"victim model,\" which is used to compute gradients.  \n   - However, in a true black-box setting, attackers do not have access to victim gradients.  \n   - This introduces confusion: in reality, \\( f \\) should be a surrogate model, not the actual target. This inconsistency should be clarified.\n\nQUESTIONS:\nPlease address the questions highlighted in the weaknesses.\n\nLIMITATIONS:\nNo", "TITLE": "Official Review", "RECOMMENDATION": 4, "REVIEWER_CONFIDENCE": 5, "CLARITY": 3, "IMPACT": 3, "ORIGINALITY": 3, "DATE": "2025-07-06"}