mlsanityData to 14 Oct 2026

Backpropagation Path Search On Adversarial Transferability

arXiv 2308.07625 ↗First posted 15 Aug 2023cs.CV cs.CR cs.LGcited by 4

Not on the map. Why?

Abstract (arXiv)

Deep neural networks are vulnerable to adversarial examples, dictating the imperativeness to test the model's robustness before deployment. Transfer-based attackers craft adversarial examples against surrogate models and transfer them to victim models deployed in the black-box situation. To enhance the adversarial transferability, structure-based attackers adjust the backpropagation path to avoid the attack from overfitting the surrogate model. However, existing structure-based attackers fail to explore the convolution module in CNNs and modify the backpropagation graph heuristically, leading to limited effectiveness. In this paper, we propose backPropagation pAth Search (PAS), solving the aforementioned two problems. We first propose SkipConv to adjust the backpropagation path of convolution by structural reparameterization. To overcome the drawback of heuristically designed backpropagation paths, we further construct a DAG-based search space, utilize one-step approximation for path evaluation and employ Bayesian Optimization to search for the optimal path. We conduct comprehensive experiments in a wide range of transfer settings, showing that PAS improves the attack success rate by a huge margin for both normally trained and defense models.

Key facts. Cited by 4 papers in the map (data through 14 Oct 2026). Builds on 42 of its 46 references that are in the map. First posted on arXiv 15 Aug 2023.

Builds on

42 of 46 references.

References · 42

  1. 2015Deep Residual Learning for Image Recognitioncited by 52,096
  2. 2018BERT: Pre-training of Deep Bidirectional Transformers for Language Understandingcited by 40,399
  3. 2020An Image is Worth 16x16 Words: Transformers for Image Recognition at Scalecited by 30,186
  4. 2014Very Deep Convolutional Networks for Large-Scale Image Recognitioncited by 15,364
  5. 2014Explaining and Harnessing Adversarial Examplescited by 7,364
  6. 2016Densely Connected Convolutional Networkscited by 6,720
  7. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,415
  8. 2015Rethinking the Inception Architecture for Computer Visioncited by 5,475
  9. 2013Intriguing properties of neural networkscited by 5,155
  10. 2017Squeeze-and-Excitation Networkscited by 4,789
  11. 2016Towards Evaluating the Robustness of Neural Networkscited by 2,998
  12. 2018DARTS: Differentiable Architecture Searchcited by 1,798
30 more
  1. 2016Adversarial examples in the physical worldcited by 1,769
  2. 2016Inception-v4, Inception-ResNet and the Impact of Residual Connections on Learningcited by 1,512
  3. 2020Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attackscited by 1,451
  4. 2016Practical Black-Box Attacks against Machine Learningcited by 903
  5. 2017Ensemble Adversarial Training: Attacks and Defensescited by 840
  6. 2016Hyperband: A Novel Bandit-Based Approach to Hyperparameter Optimizationcited by 699
  7. 2017DeepFM: A Factorization-Machine based Neural Network for CTR Predictioncited by 676
  8. 2018Improving Transferability of Adversarial Examples with Input Diversitycited by 599
  9. 2017One pixel attack for fooling deep neural networkscited by 582
  10. 2016Delving into Transferable Adversarial Examples and Black-box Attackscited by 536
  11. 2021RepVGG: Making VGG-style ConvNets Great Againcited by 522
  12. 2019Evading Defenses to Transferable Adversarial Examples by Translation-Invariant Attackscited by 442
  13. 2019Nesterov Accelerated Gradient and Scale Invariance for Adversarial Attackscited by 355
  14. 2020Skip Connections Matter: On the Transferability of Adversarial Examples Generated with ResNetscited by 167
  15. 2021Admix: Enhancing the Transferability of Adversarial Attackscited by 156
  16. 2021Feature Importance-aware Transferable Adversarial Attackscited by 127
  17. 2018Adversarial Attacks and Defences Competitioncited by 96
  18. 2022Improving Adversarial Transferability via Neuron Attribution-Based Attackscited by 93
  19. 2021Stochastic Variance Reduced Ensemble Adversarial Attack for Boosting the Adversarial Transferabilitycited by 84
  20. 2020Backpropagating Linearly Improves Transferability of Adversarial Examplescited by 79
  21. 2015Scalable Gradient-Based Tuning of Continuous Regularization Hyperparameterscited by 71
  22. 2018Learning Transferable Adversarial Examples via Ghost Networkscited by 70
  23. 2019FDA: Feature Disruptive Attackcited by 56
  24. 2022DiffusionInst: Diffusion Model for Instance Segmentationcited by 49
  25. 2023Transferable Adversarial Attacks on Vision Transformers with Token Gradient Regularizationcited by 42
  26. 2021Boosting Fast Adversarial Training with Learnable Adversarial Initializationcited by 40
  27. 2023Improving the Transferability of Adversarial Samples by Path-Augmented Methodcited by 36
  28. 2023On the Robustness of Latent Diffusion Modelscited by 21
  29. 2021Learning to Learn Transferable Attackcited by 13
  30. 2022A2: Efficient Automated Attacker for Boosting Adversarial Trainingcited by 10

Built on by

Cited by year

Citing papers per year: 2023: 1; 2024: 3.

4 papers.

  1. 2024Rethinking Impersonation and Dodging Attacks on Face Recognition Systemscited by 8
  2. 2023SoK: Pitfalls in Evaluating Black-Box Attackscited by 6
  3. 2024Adversarial Attacks on Both Face Recognition and Face Anti-spoofing Modelscited by 4
  4. 2024Improving the Transferability of Adversarial Attacks on Face Recognition with Diverse Parameters Augmentationcited by 4