Uncovering Universal Features: How Adversarial Training Improves Adversarial Transferability
Abstract
Adversarial examples for neural networks are known to be transferable: examples optimized to be misclassiﬁed by a “source” network are often misclassiﬁed by other “destination” networks.
Here, we show that training the source network to be “slightly robust”—that is, robust to smallmagnitude adversarial examples—substantially improves the transferability of targeted attacks, even between architectures as different as convolutional neural networks and transformers.
In fact, we show that these adversarial examples can transfer representation (penultimate) layer features substantially better than adversarial examples generated with non-robust networks.
We argue that this result supports a non-intuitive hypothesis: slightly robust networks exhibit universal features—ones that tend to overlap with the features learned by all other networks trained on the same dataset.
This suggests that the features of a single slightlyrobust neural network may be useful to derive insight about the features of every non-robust neural network trained on the same distribution.
1. Introduction
Neural-network image classiﬁers are well-known to be susceptible to adversarial examples—images that are perturbed in a way that is largely imperceptible to humans but that cause the neural network to make misclassiﬁcations.
Many explanations have been offered for this susceptibility as well as for the transferability of adversarial examples across network architectures and even training sets; however, the ML community’s understanding of these phenomena remains incomplete.
Here, we ﬁnd that the features of slightly-robust convolu- Accepted by the ICML 2021 workshop on A Blessing in Disguise: The Prospects and Perils of Adversarial Machine Learning. Copy- tional neural networks substantially overlap with the features of every tested non-robust network, including transformer networks (ViT and CLIP (Dosovitskiy et al., 2020;
Radford et al., 2021)), which differ substantially in architecture, and in the case of CLIP, in the training objective.
As a practical matter, this means that targeted adversarial examples—which aim to fool a network into misclassifying the example as a chosen class—constructed with slightlyrobust “source” networks are highly transferable to nonrobust “destination” networks, regardless of architecture.
In other words, the features of slightly-robust networks are universal with respect to the features of non-robust networks (Olah et al., 2020).
This notion of universality can explain why slightly-robust networks give rise to more transferable attacks and have better weight initialization for downstream transfer-learning tasks (Liang et al., 2020;
Salman et al., 2020; Terzi et al., 2020; Utrera et al., 2020).
In addition, the phenomenon suggests that the features of a single slightlyrobust network may be useful to derive insight about the features of every non-robust network.
2. The Exceptional Transferability of Adversarial Examples Generated with Slightly-Robust Classiﬁers
In this section, we describe the methodology and results of our experiments on the transferability of adversarial examples when generated with a adversarially-trained source networks.
Adversarial training involves adversarially perturbing the input at the training step (Madry et al., 2017).
The training is parameterized by a value ε , which speciﬁes the maximum (cid:96) 2 norm of the adversarial perturbation.
We call this parameter the robustness parameter of the network and say that a network is ε -robust when it has a robustness parameter of ε .
Our goal is to quantify how the robustness parameter of the source network affects the transferability of adversarial examples.
We evaluate the targeted transferability of adversarial examples to destination convolutional networks Xception (Chollet, 2017), VGG (Simonyan &
Zisserman, 2014), ResNet (He et al., 2016a;b), Inception (Szegedy et al., 2016), MobileNet (Howard et al., 2017),
DenseNet (Huang et al., 2017), NASNetLarge (Zoph et al., 2018), and EfﬁcientNet (Tan & Le, 2019), as well as two
Xception 0.
VGG 0. ResNet50V 0. InceptionV 0. MobileNetV 0.
1.0 DenseNet 0. NasNetLarge 0. EfficientNetB 0. ViT 0.
[Figure]
CLIP
[Figure]
[Figure]
[Figure]
[Figure]
[Figure]
T a r g e t e d t r a n s f e r s
[Figure]
e ss
[Figure] Destination [Figure] transformer-based networks, ViT (Dosovitskiy et al., 2020) and CLIP (Radford et al., 2021).
Generating Adversarial Examples.
We generate targeted adversarial examples using 1000 randomly selected images from the ImageNet validation dataset and 1000 randomly selected target classes.
We generate adversarial examples for each image-target pair, for each source network (of different ε -robustness).
We run the TMDI-FGSM algorithm for 300 iterations to generate each perturbation (Zhao et al., 2020).
We detail the exact process in the appendix.
Transferability to Convolutional Networks.
In Figure 1, we plot the transfer success rate for the targeted adversarial examples.
We include the baseline performance of the attacks that would be measured if the images were unperturbed.
We ﬁnd that across every convolutional destination network, a source network with a small robustness parameter ( ε ≈ 0 . 1 ) improves the transfer success rate when compared to the non-robust ( ε = 0 ) and more-robust ( ε > 0 .
5 ) source networks (Figure 1).
Transferability to Transformer-Based Classiﬁers.
Few studies have addressed the robustness of transformer-based classiﬁers to transfer attacks (Shao et al., 2021).
To our knowledge, our paper is the ﬁrst to address targeted transfer attacks against transformer architectures.
We ﬁnd a striking result: targeted adversarial examples constructed with non-robust convolutional source networks are almost entirely non-transferable to transformer networks (Figure 1).
This suggests that the features learned by transformer-based models and non-robust convolutional models are largely different.
However, we ﬁnd that using a slightly-robust
ResNet50 classiﬁer as a source network dramatically im4 0.
1.0 DenseNet161, =
VGG16, =
MobileNetV2, =
ResNeXT50, =
ShuffleNetV2, = 0.
1.0 Source model -robustness 0.
T a r g e t e d t r a n s f e r
s u cc e ss r a t e
[Figure]
proves the transferability of targeted adversarial examples to transformer-based classiﬁers.
The optimal robustness parameter to maximize transferability is larger when the destination network is a transformer ( ε ≈ 1 than when it is convolutional ( ε ≈ 0 . 1 ).
Attacking Adversarially-Trained Models.
Adversarial training has been shown to improve robustness to transfer attacks (Madry et al., 2017).
We evaluate the transferability of adversarial examples on adversarially trained destination networks.
Even though the adversarial perturbations which we use to attack each adversarially-trained network are larger than the magnitude for which the destination networks are trained to be robust, the adversarial examples generated using non-robust ( ε = 0 ) networks do not transfer to the robust networks.
However, as the robustness of the source network increases, the attack success rate increases substantially.
Similarly to Figure 1, Figure 2 includes the baseline performance of the attacks that would be measured if the images were unperturbed.
3. Universality of Slightly-Robust Features
The previous section established that slightly-robust networks can be used as source networks to construct highly transferable adversarial examples.
In this section, we examine the reason why adversarial examples transfer successfully.
It has been previously shown that robust and non-robust features overlap to some degree (Springer et al., 2021).
Intuitively, this overlap is speculated to arise, for example, when a non-robust feature identiﬁes a local pattern, such as the texture of a dog ear, and when a robust feature identiﬁes a more global pattern, such as an entire dog.
However, there may be many equally-predictive local features.
For example two local features, one which responds to a dog nose and one a dog ear, may be equally predictive.
Both would overlap with a more global feature that responds to an entire dog, but not with each other.
Since there may be many nonoverlapping features that are equally predictive, a classiﬁer may only learn a subset of them.
A classiﬁer which learns features that overlap substantially with the features of every other standard classiﬁer of a certain type (e.g., non-robust and trained on the same distribution) is said to have features that are universal with respect to this type (Olah et al., 2020).
We speculate that non-robust and robust neural networks learn local and global features, respectively, for example, due to the association between non-robust features and texture bias, and robust features and shape bias (Geirhos et al., 2018).
Thus, we expect that the features of robust networks are universal with respect to non-robust networks trained on the same distribution.
If true, this means not only that robust networks would transfer the classiﬁcation, but also the features (i.e., representation layer activations).
3.1. Testing Universality of Slightly-Robust Features
We aim to address the question, to what extent do adversarial examples transfer representation-layer features transfer across networks—that is, evoke analogous patterns of activation?
In particular, we show that adversarial examples constructed to attack slightly-robust source networks transfer features substantially more effectively to every tested destination network than non-robust networks.
This result supports our hypothesis that slightly-robust networks rely on universal features.
Our experiments rely on two types of adversarial examples: (1) class-targeted , which are optimized to produce a speciﬁc incorrect class in a source network, and (2) representationtargeted , which are optimized to produce a similar pattern of activation in the representation layer as a speciﬁc input of a different class.
We refer to the degree to which adversarial examples of a source model can analogously affect the features that are computed by the representation layer of the destination model as the representation transferability from source to destination.
By contrast, class transferability (what is commonly referred to as just transferability ) refers to the degree to which adversarial examples can analogously affect the output of the destination network.
Measuring Representation Transferability and Universality.
To measure representation transferability, we generate representation-targeted adversarial examples by choosing two examples from a dataset, y 0 and x , with different classes, and applying the TMDI-FGSM algorithm (Zhao et al., 2020) to minimize the (cid:96) 2 distance between the representation-layer activations in the source network evoked by the adversarial example, y
= y
+ δ , and the target input x .
We limit the (cid:96) ∞ norm of δ to the standard 16 / 255 .
Both x and y share similar representation-layer activations in the source network.
If x and y also produce similar representation-layer activations in the destination network,
Targets
Source network robustness parameter
D e s t i n a t i o n n e t w o r k
X c e p t i o n = =0.
=0.
=0.
= =
V GG
I n c V
D N
NN L
V i T
C L I P then the representation transferability of the source network to the destination network is high.
We select 990 initial images ( y 0 ) and 10 targets ( x ), and construct representationtargeted adversarial examples for each pair, for a total of 9900.
By measuring the similarity of the representations for each pair ( x, y ) in the destination network, we can measure the representation transferability of the source network.
3.2. Results
We plot the t -distributed stochastic neighbor embedding (t-SNE) of the representation vectors of each representationtargeted adversarial example y in the destination network (Figure 3).
Each color corresponds to one of the 10 target images ( x ).
The 10 stars in each plot correspond to the t-SNE embedding of the destination-network representation of each target x .
When representation transferability is high, points associated with representation-targeted adversarial examples group tightly next to the star associated with their target (in Figure 3, points group by color).
We observe that slightly-robust source networks exhibit a high degree of representation transferability across every tested model,
[Table]
in comparison with non-robust and more-robust source networks.
This suggests that slightly-robust source networks rely on universal features—features that are useful to every tested non-robust destination model, regardless of architecture, and, strikingly, useful even to CLIP, whose training objective seeks to associate images to textual descriptions rather than to a discrete set of labels.
Our results provide empirical evidence that universal features exist and that networks can use adversarial training with a small robustness parameter to learn these universal features.
As a second similarity metric, we report the mean cosine similarity of the representations (in destination networks) between ( x, y ) pairs, averaged over all 9900 such pairs for each source network (Table 1).
This similarity peaks for destination CNNs when the source network has ε = 0 . 1 , except for ResNet50v2, which peaks at ε = 0 . 5 .
Destination network ViT peaks at ε ∈ { 0 . 25 , 0 . 5 } and CLIP when ε ∈ 0 .
These peaks are consistent with our t-SNE results (Figure 3), and are included primarily for the purpose of quantitatively conﬁrming the visual results of our t-SNE plots.
4. Related Work
The vulnerable features learned by neural networks have been studied both empirically (Aubry & Russell, 2015;
Dosovitskiy & Brox, 2016; Geirhos et al., 2020; Ilyas et al., 2019; Jo & Bengio, 2017; Mahendran & Vedaldi, 2015;
McCoy et al., 2019; Olah et al., 2017; Simonyan et al., 2013; Wang et al., 2020; Wei, 2020; Zhang & Zhu, 2018) and theoretically (Allen-Zhu & Li, 2020; Arpit et al., 2017;
De Palma et al., 2019; Hermann et al., 2020; Nakkiran et al., 2019; Shah et al., 2020; Valle-Pérez et al., 2018; Wu et al., 2017).
There has been some research related to similarity of learned features across networks (Kornblith et al., 2019;
Li et al., 2015; Olah et al., 2020; Raghu et al., 2017).
In addition, robust networks have been shown to have a number of valuable properties, including serving as a good starting point for transfer learning (Liang et al., 2020;
Salman et al., 2020; Terzi et al., 2020; Utrera et al., 2020) and gradient interpretability (Engstrom et al., 2019b).
In addition, there has been substantial work on transferable adversarial example (Carlini & Wagner, 2017;
Dong et al., 2018; 2019; Goodfellow et al., 2014; Guo et al., 2020;
Huang et al., 2019;
Inkawhich et al., 2019; 2020a;b; Kurakin et al., 2016;
Li et al., 2020; Liu et al., 2016; Papernot et al., 2016; Rozsa et al., 2017; Sharma et al., 2019; Song et al., 2018; Tramèr et al., 2018; Wu et al., 2020; Xie et al., 2019; Zhao et al., 2017; 2020; Zhou et al., 2018).
5. Conclusion
In this paper, we have shown that slightly-robust models learn features that overlap substantially with every tested non-robust model; such features have been termed universal (Olah et al., 2020).
This overlap leads to representation transferability, which can be used to construct targeted transferable adversarial examples that transfer to across substantially different architectures (ViT) and even training objectives (CLIP).
Since most previous transferable adversarial generation techniques rely on optimizing adversarial examples over a non-robust source network, our technique can be combined with virtually any previously existing optimization technique by replacing the non-robust source network with a slightly-robust network.
More generally, our paper reveals a phenomenon that is signiﬁcant for the broader ﬁeld of deep learning: we ﬁnd that different non-robust networks, even when trained with similar convolutional architectures, do not necessarily have many features that substantially overlap.
This can have important implications for the reliability of neural networks; when different networks rely on different features, they are susceptible to different types of errors.
In addition, we present an argument that, for a given task, there are features that are useful to every tested neural network, and that these features can be learned with small- ε adversarial training, even when the source network architecture and learning objective are dissimilar to those of the destination network.
Thus, by studying the features of a single slightly-robust network, we can empirically discover properties that will be applicable across all non-robust networks.
We speculate that this phenomenon can explain why slightly-robust networks are successful at transfer-learning tasks (Liang et al., 2020;
Salman et al., 2020; Terzi et al., 2020; Utrera et al., 2020).
With applications across the ﬁeld of machine learning, the contributions of this paper provide an important stepping stone towards discovering a general understanding of the features learned by neural networks.
Acknowledgements
Research presented in this article was supported by the
Laboratory Directed Research and Development program of Los Alamos National Laboratory under project number 20210043DR.
Melanie Mitchell’s contributions were supported by the National Science Foundation under Grant No. 2020103.
Any opinions, ﬁndings, and conclusions or recommendations expressed in this material are those of the author and do not necessarily reﬂect the views of the National Science
Foundation.
A. Detailed Methods
Adversarial Examples.
In this paper we are primarily concerned with properties of source networks that facilitate transferability of adversarial examples.
Let f : X → Y denote a “white-box” network (i.e., one whose architecture and weights are known to the adversary) and let g : X → Y denote a “black-box” network (weights and architecture are unknown to the adversary).
Let ( x, y ) ∈
X
× Y be an (unperturbed) input-label pair, where X is the input-space and Y is the label-space.
Given a maximum perturbation size ε , our goal is to optimize over f to construct a transferable adversarial example x + δ where (cid:107) δ (cid:107) ∞ ≤ ε and such that g ( x + δ ) (cid:54) =
y for the untargeted case, and g ( x + δ )
=
t for some target class t ∈ Y for the targeted case.
Optimizers.
Prior research has identiﬁed a number of methods for optimizing adversarial examples given a white-box classiﬁer f , many of which are based on the Iterative Fast Gradient Sign Method (I-FGSM)
(Goodfellow et al., 2014;
Kurakin et al., 2016), in which a perturbation δ i is iteratively updated to maximize the loss of the network while obeying an (cid:96) ∞ norm constraint:
[Equation]
where L represents the adversarial loss function, α is a tunable step-size parameter, and x + δ n is the ﬁnal adversarial example after n steps.
At each step, δ i is clipped such that (cid:107) δ (cid:107) ∞
≤
ε and x + δ
i is a valid image.
We adopt the state-of-the-art method recently proposed by (Zhao et al., 2020), which combines three variants of I-FGSM and optimizes over many steps:
Diverse Input Iterative Fast Gradient Sign Method (DI 2 -FGSM), which applies a random afﬁne transformation to the input at each step prior to computing the gradient (Xie et al., 2019), 2.
Translation-Invariant Iterative Fast Gradient Sign Method (TI-FGSM), which convolves the gradient with a Gaussian ﬁlter (Dong et al., 2019), 3.
Momentum Iterative Fast Gradient Sign Method (MI-FGSM), in which a momentum term is added to the gradient (Dong et al., 2018).
Together called TMDI-FGSM, this optimization method can be described by the following process:
[Equation]
where L again represents the adversarial loss function, T i represents a random afﬁne transformation, N represents a Gaussian convolutional ﬁlter, µ is a tunable momentum parameter, and α is a tunable step-size parameter, and x + δ n is the ﬁnal adversarial example over n steps.
For targeted adversarial examples, the loss function L should be maximized when the target label is predicted with high conﬁdence.
For untargeted adversarial examples, this occurs when the predicted label differs from the true label, and when the true label is given a low conﬁdence.
A number of adversarial loss functions have been proposed, including standard cross-entropy loss (Szegedy et al., 2014), CW loss (Carlini & Wagner, 2017), and feature-disruption loss (Inkawhich et al., 2020a).
We use the highly-effective logit loss, proposed by (Zhao et al., 2020), which is maximized for targeted examples when the logit score for a target class (i.e., the value of the output neuron associated with the target class prior to the softmax operation) is maximized.
Similarly, the untargeted version aims to minimize the logit score associated with the true class.
For the DI 2 component of the optimization algorithm, we use a random resize and crop operation where each image is resized by a factor selected uniformly between 3 / 4 and 4 / 3 , and then cropped to be 224 × 224 pixels randomly, with 0 -valued padding where appropriate.
Then, a random horizontal ﬂip is applied.
This is equivalent to the PyTorch code: transforms
.Compose ([ transforms.
RandomResizedCrop
[Equation]
scale=(3/4, 4/3), ratio=(1., 1.)),
transforms.RandomHorizontalFlip() ])
For the TI component, we apply a Gaussian ﬁlter to the gradient at each step, with the ﬁlter size of 5 × 5 , and the standard deviation of the ﬁlter 1 .
For the MI component, we use a momentum of 0 . 9 .
For generating representation-targeted adversarial examples, we exclude the TI step, as we found that the representationtargeted adversarial examples were less transferable when it was included.
Constructing Robust Source Networks.
We construct robust source networks by performing adversarial training (Goodfellow et al., 2014; Madry et al., 2017).
We use projected gradient descent in order to ﬁnd model parameters θ ∗ that minimize the following expression:
[Equation]
where L ( θ, x, y ) represents the cross-entropy loss of a network with parameters θ evaluated on input x with label y .
We subject the adversarial examples constructed in the inner optimization procedure to an (cid:96) 2 norm constraint.
We will call this constraint ε the robustness parameter of a classiﬁer, as it represents the ( (cid:96) 2 ) magnitude of the adversarial examples with respect to which the classiﬁer is trained to be robust.
Due to the high computational cost of adversarial training, we rely on pre-trained robust ResNet50 models that have been pre-trained on ImageNet (Russakovsky et al., 2015).
For our experiments, we test classiﬁers with robustness parameters ε ∈ { 0 , 0 . 01 , 0 .
Model Details.
We use a number of models for our experiments.
For all robust networks trained on ImageNet, we use the pre-trained weights that are available on the GitHub page associated with Salman et al.
For all convolutional destination models, we use pre-trained weights that are included with Keras (Chollet et al., 2015).
For the ViT model trained on ImageNet, we use pre-trained weights from Melas-Kyriazi (2020).
For the CLIP model, we use the code and weights associated with (Radford et al., 2021).
We train robust CIFAR-10 models with the Robustness library (Engstrom et al., 2019a).
We train for 100 epochs using a batch size of 128.
We include data augmentation.
We optimize using standard stochastic gradient descent with momentum, using a learning rate of 0.01 and a momentum parameter of 0.9, as well as a weight decay of 0.0001.
For adversarial training, we generate each adversarial example with 7 steps, using a step-size of 0 .
3 × ε for the given robustness parameter of ε .
For the ViT model trained on CIFAR-10, we use pre-trained weights associated with Dosovitskiy et al.
(2020) and ﬁnetune on
CIFAR-10 for 10 epochs.
All convolutional destination CIFAR-10 models were ﬁnetuned for 20 epochs from the pre-trained ImageNet weights that are included with Keras (Chollet et al., 2015).
B. Comparison to Previously Published Transfer Attack Methods
We directly compare the targeted transfer attack success rate to previous state-of-the-art black-box attacks and ﬁnd that our method substantially outperforms the previous methods under similar constraints (Table 2).
In particular, we evaluate our method’s attack performace with three different loss functions: standard cross-entropy loss (Xent), Poincaré distance with a triplet loss term (Po+Trip) (Li et al., 2020), and logit loss.
We include a comparison with the feature distribution attack (FDA) (Inkawhich et al., 2019), however, FDA requires that we train multiple supplemental models for each individual target class, which would require thousands of supplemental models to attack all thousand classes of ImageNet.
Thus, we do not perform a direct comparison and instead report the targeted transfer attack success rate that is reported in the original
FDA paper (Inkawhich et al.
[Table]
C. Extended ImageNet Data
In this section, we present extended data from the ImageNet.
Untargeted Adversarial Examples.
We use the 1000 transferable adversarial examples generated to transfer to ImageNet classiﬁers and plot the transfer success rate when we treat the adversarial examples as untargeted, i.e., we consider every adversarial example which is misclassiﬁed by the destination classiﬁer as a success (Figure 4).
In addition, we include analogous results for adversarially trained models (Figure 5).
Representation-targeted Adversarial Examples.
We include the extended data for the t-SNE ﬁgure presented in the main paper.
We plot the destination-network representations of representation-targeted adversarial examples for every destination network and source network robustness parameter that we test (Figure 6).
Additional Tested Source-Network Robustness Parameters.
In the main paper, we exclude certain values of ε in the ﬁgures that illustrate the transferability of adversarial examples for clarity, so that the results from slightly-robust networks could be more easily seen.
We include the extended results for both targeted and untargeted adversarial examples (Figures 7 and 8).
We observe a decrease in transfer performance as robustness increases past the optimal point.
We speculate that this arises from the fact that as robustness increases, smaller features on which non-robust neural networks rely are gradually thrown away, thus reducing transfer performance.
Xception 0.
VGG 0.
ResNet50V 0.
InceptionV 0.
MobileNetV 0.
DenseNet 0.
NasNetLarge 0.
EfficientNetB 0.
ViT 0.
CLIP 0.
Source model -robustness 0.
E rr o r r a t e o n un t a r g e t e d a tt a c k s
Perturbation size:
Baseline
[Figure]
MobileNetV2, =
[Figure]
ResNeXT50, =
[Figure]
ShuffleNetV2, =
[Figure] [Figure]
[Figure] [Figure]
Source model -robustness
[Figure]
E rr o r r a t e o n un t a r g e t e d a tt a c k s
Perturbation size:
Baseline
Targets X c e p t i o n = =0. =0. =0.
=0.
=0.
=0. = = =
V GG
R N
I n c V
M N V
D N
NN L
E N B
V i T
C L I P
Xception 0.
VGG 0.
ResNet50V 0.
InceptionV 0.
MobileNetV 0.
DenseNet 0.
NasNetLarge 0.
EfficientNetB 0.
CLIP 0.
ViT 0. Source model robustness
[Figure]
T a r g e t e d t r a n s f e r
s u cc e ss r a t e Perturbation [Figure] Baseline
[Figure]
[Figure]
VGG
[Figure]
[Figure]
[Figure]
ResNet50V
[Figure]
[Figure]
[Figure]
InceptionV 0.
MobileNetV
[Figure] DenseNet 0.
NasNetLarge 0. EfficientNetB 0.
CLIP 0. ViT 0.
Source model -robustness
E rr o r r a t e o n un t a r g e t e d a tt a c k s
Perturbation size:
Baseline
D. CIFAR-10 Data
We extend our experiments to the CIFAR-10 dataset to conﬁrm that our results are general.
We present the effectiveness of targeted and untargeted transferable adversarial examples (Figures 9 and 10).
In addition, we present t-SNE plots of the destination-network representations of representation-targeted examples (Figure 11), as well as the cosine similarity between feature representations and the target images (Table 3).
For all experiments, our results are not as exaggerated as with the ImageNet data, but nonetheless, we observe an increase in transferability of both class-targeted, untargeted, and representation-targeted adversarial examples when we use slightly-robust source networks, conﬁrming that our claims generalize to networks trained on the CIFAR-10 dataset.
[Figure]
Xception
[Figure]
[Figure]
[Figure]
VGG
[Figure]
[Figure]
[Figure]
ResNet50V 0.
InceptionV 0.
MobileNetV
[Figure]
EfficientNetB
[Figure] [Figure]
[Figure]
ViT 0.
[Figure]
CLIP
[Figure]
[Figure]
Baseline
[Table]
Xception 0.
VGG 0.
ResNet50V 0.
InceptionV 0.
MobileNetV 0.
DenseNet 0.
NasNetLarge 0.
[Figure]
EfficientNetB
[Figure] [Figure]
ViT
[Figure] [Figure]
[Figure]
CLIP
[Figure] [Figure]
Source model -robustness
[Figure]
[Figure] [Figure]
[Figure]
E rr o r r a t e o n un t a r g e t e d a tt a c k s
Perturbation size:
Baseline
Targets
X c e p t i o n = =0. =0. =0. =0.
=0. =0. = V GG
R N I n c V M N V
D N NN L E N B V i T
C L I P
[Table]
E. Examples of Adversarial Examples
We include class- and representation-targeted adversarial examples that have a perturbation generated with TMDI-FGSM and an (cid:96) ∞ constraint of 16 / 255 (Figures 12 and 13).
== 0.
= 0. = 0.
= 0. = 0.
= 0.
===
== 0.
= 0. = 0.
= 0. = 0.
= 0.
===