# Quantization Aware Attack: Enhancing Transferable Adversarial Attacks by Model Quantization

arXiv: https://arxiv.org/abs/2305.05875 · HTML: https://mlsanity.com/paper/2305.05875/

## Key facts

- Cited by 14 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 10 May 2023.

## Built on by (most cited first, 14 of 14)

- [Physical 3D Adversarial Attacks against Monocular Depth Estimation in Autonomous Driving](https://mlsanity.com/paper/2403.17301/) (2024)
- [Towards Model Resistant to Transferable Adversarial Examples via Trigger Activation](https://mlsanity.com/paper/2504.14541/) (2025)
- [Adversarial Example Soups: Improving Transferability and Stealthiness for Free](https://mlsanity.com/paper/2402.18370/) (2024)
- [JMA: a General Algorithm to Craft Nearly Optimal Targeted Adversarial Example](https://mlsanity.com/paper/2401.01199/) (2024)
- [Enhancing Adversarial Robustness via Uncertainty-Aware Distributional Adversarial Training](https://mlsanity.com/paper/2411.02871/) (2024)
- [Revisiting Adversarial Patch Defenses on Object Detectors: Unified Evaluation, Large-Scale Dataset, and New Insights](https://mlsanity.com/paper/2508.00649/) (2025)
- [Breaking the Limits of Quantization-Aware Defenses: QADT-R for Robustness Against Patch-Based Adversarial Attacks in QNNs](https://mlsanity.com/paper/2503.07058/) (2025)
- [TRAIL: Transferable Robust Adversarial Images via Latent diffusion](https://mlsanity.com/paper/2505.16166/) (2025)
- [TriQDef: Disrupting Semantic and Gradient Alignment to Prevent Adversarial Patch Transferability in Quantized Neural Networks](https://mlsanity.com/paper/2508.12132/) (2025)
- [Advantage-based Temporal Attack in Reinforcement Learning](https://mlsanity.com/paper/2602.19582/) (2026)
- [Devling into Adversarial Transferability on Image Classification: Review, Benchmark, and Evaluation](https://mlsanity.com/paper/2602.23117/) (2026)
- [The Scissors Effect: When Resize-Based Input Diversity Helps or Hurts Transfer Attacks](https://mlsanity.com/paper/2606.22516/) (2026)
- [Securing LLMs in the Wild: Privacy and Security Challenges at the Edge](https://mlsanity.com/paper/2607.13088/) (2026)
- [Investigating Adversarial Robustness of Heterogeneous Cooperative Perception](https://mlsanity.com/paper/2609.17856/) (2026)

## Abstract (arXiv)

Quantized neural networks (QNNs) have received increasing attention in resource-constrained scenarios due to their exceptional generalizability. However, their robustness against realistic black-box adversarial attacks has not been extensively studied. In this scenario, adversarial transferability is pursued across QNNs with different quantization bitwidths, which particularly involve unknown architectures and defense methods. Previous studies claim that transferability is difficult to achieve across QNNs with different bitwidths on the condition that they share the same architecture. However, we discover that under different architectures, transferability can be largely improved by using a QNN quantized with an extremely low bitwidth as the substitute model. We further improve the attack transferability by proposing textitquantization aware attack (QAA), which fine-tunes a QNN substitute model with a multiple-bitwidth training objective. In particular, we demonstrate that QAA addresses the two issues that are commonly known to hinder transferability: 1) quantization shifts and 2) gradient misalignments. Extensive experimental results validate the high transferability of the QAA to diverse target models. For instance, when adopting the ResNet-34 substitute model on ImageNet, QAA outperforms the current best attack in attacking standardly trained DNNs, adversarially trained DNNs, and QNNs with varied bitwidths by 4.3% ~ 20.9%, 8.7% ~ 15.5%, and 2.6% ~ 31.1% (absolute), respectively. In addition, QAA is efficient since it only takes one epoch for fine-tuning. In the end, we empirically explain the effectiveness of QAA from the view of the loss landscape. Our code is available at https://github.com/yyl-github-1896/QAA/