Dynamic Parameter Optimization for Highly Transferable Transformation-Based Attacks

2025/11/15 by Jiaming Liang, Liang, Jiaming, Chi‐Man Pun +1
Computer Science · #Advanced Malware Detection Techniques #Adversarial Robustness in Machine Learning #Computer Vision and Pattern Recognition (cs.CV) #FOS: Computer and information sciences #Machine Learning (cs.LG) #Network Security and Intrusion Detection

paper · pdf · doi:10.48550/arxiv.2511.11993

openalex publication_date 2025/11/15 · openalex created_date 2025/11/19 · openalex updated_date 2026/07/28

Abstract

Despite their wide application, the vulnerabilities of deep neural networks raise societal concerns. Among them, transformation-based attacks have demonstrated notable success in transfer attacks. However, existing attacks suffer from blind spots in parameter optimization, limiting their full potential. Specifically, (1) prior work generally considers low-iteration settings, yet attacks perform quite differently at higher iterations, so characterizing overall performance based only on low-iteration results is misleading. (2) Existing attacks use uniform parameters for different surrogate models, iterations, and tasks, which greatly impairs transferability. (3) Traditional transformation parameter optimization relies on grid search. For n parameters with m steps each, the complexity is O(mn). Large computational overhead limits further optimization of parameters. To address these limitations, we conduct an empirical study with various transformations as baselines, revealing three dynamic patterns of transferability with respect to parameter strength. We further propose a novel Concentric Decay Model (CDM) to effectively explain these patterns. Building on these insights, we propose an efficient Dynamic Parameter Optimization (DPO) based on the rise-then-fall pattern, reducing the complexity to O(nlogm). Comprehensive experiments on existing transformation-based attacks across different surrogate models, iterations, and tasks demonstrate that our DPO can significantly improve transferability.

Citations

• Improving Adversarial Transferability on Vision Transformers via Forward Propagation Refinement
• GSBA^K: top-K Geometric Score-based Black-box Attack
• Characterizing Model Robustness via Natural Input Gradients
• MeanSparse: Post-Training Robustness Enhancement Through Mean-Centered Feature Sparsification
• Learning to Transform Dynamically for Better Adversarial Transferability
• Adversarial Machine Learning Threats to Spacecraft
• Boosting Adversarial Transferability across Model Genus by Deformation-Constrained Warping
• MixedNUTS: Training-Free Accuracy-Robustness Balance via Nonlinearly Mixed Classifiers
• MIMIR: Masked Image Modeling for Mutual Information-based Adversarial Robustness
• Structure Invariant Transformation for better Adversarial Transferability
• Robust Principles: Architectural Design Principles for Adversarially Robust CNNs
• Boosting Adversarial Transferability by Block Shuffle and Rotation
• Improving the Transferability of Adversarial Samples by Path-Augmented Method
• Revisiting Adversarial Training for ImageNet: Architectures, Training and Generalization across Threat Models
• A Comprehensive Study on Robustness of Image Classification Models: Benchmarking and Rethinking
• Frequency Domain Model Augmentation for Adversarial Attack
• MetaFormer Is Actually What You Need for Vision
• XCiT: Cross-Covariance Image Transformers
• Admix: Enhancing the Transferability of Adversarial Attacks
• An Image is Worth 16x16 Words: Transformers for Image Recognition at Scale
• Nesterov Accelerated Gradient and Scale Invariance for Adversarial Attacks
• Evading Defenses to Transferable Adversarial Examples by Translation-Invariant Attacks
• Improving Transferability of Adversarial Examples with Input Diversity
• Simple Black-Box Adversarial Perturbations for Deep Networks
• Xception: Deep Learning with Depthwise Separable Convolutions
• Densely Connected Convolutional Networks
• Towards Evaluating the Robustness of Neural Networks
• Transferability in Machine Learning: from Phenomena to Black-Box Attacks using Adversarial Samples
• Wide Residual Networks
• Deep Residual Learning for Image Recognition
• Explaining and Harnessing Adversarial Examples
• Intriguing properties of neural networks

Related

• Bag of Tricks to Boost Adversarial Transferability
• Towards Transferable Adversarial Attacks with Centralized Perturbation
• How to choose your best allies for a transferable attack?
• Enhancing Adversarial Transferability with Adversarial Weight Tuning
• Diversifying the High-level Features for better Adversarial Transferability