mlsanityData to 14 Oct 2026

Anchoring Adversarial Trajectories to Data Manifolds: A Bilevel Transfer Optimization Framework

arXiv 2609.38991 ↗First posted 30 Sep 2026cs.LG cs.CR cs.CVcited by 0

Not on the map. Why?

Abstract (arXiv)

A key bottleneck in adversarial transfer is a trajectory-level geometric disconnect: ambient gradients often drift away from the intrinsic data manifold, causing surrogate-specific overfitting. To rectify this, we propose Manifold Anchored Bilevel Transfer (MABT), a unified framework that anchors adversarial trajectories to the shared semantic subspace. MABT introduces a relaxed manifold-anchoring operator as a semantic rectifier to suppress off-manifold noise. With this constraint, we cast transfer attack generation as a distributional bilevel optimization problem that learns a geometry-aligned initialization by minimizing expected transfer risk under a surrogate uncertainty distribution. We further develop a Hessian-free solver with linear-time complexity to handle the resulting hierarchy. Experiments demonstrate improved transferability for 10 baseline attackers across 28 attack configurations, diverse victim architectures, and defense mechanisms.

Key facts. No citing papers in the map yet (data through 14 Oct 2026). Builds on 53 of its 64 references that are in the map. First posted on arXiv 30 Sep 2026.

Builds on

53 of 64 references.

References · 53

  1. 2021High-Resolution Image Synthesis with Latent Diffusion Modelscited by 18,863
  2. 2016Densely Connected Convolutional Networkscited by 6,720
  3. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,415
  4. 2015Rethinking the Inception Architecture for Computer Visioncited by 5,475
  5. 2018MobileNetV2: Inverted Residuals and Linear Bottleneckscited by 4,795
  6. 2017Squeeze-and-Excitation Networkscited by 4,789
  7. 2020Training data-efficient image transformers & distillation through attentioncited by 4,586
  8. 2016Towards Evaluating the Robustness of Neural Networkscited by 2,998
  9. 2018DARTS: Differentiable Architecture Searchcited by 1,798
  10. 2016Adversarial examples in the physical worldcited by 1,769
  11. 2016Inception-v4, Inception-ResNet and the Impact of Residual Connections on Learningcited by 1,512
  12. 2016Beyond a Gaussian Denoiser: Residual Learning of Deep CNN for Image Denoisingcited by 1,358
38 more
  1. 2019Certified Adversarial Robustness via Randomized Smoothingcited by 1,340
  2. 2017Ensemble Adversarial Training: Attacks and Defensescited by 840
  3. 2018Improving Transferability of Adversarial Examples with Input Diversitycited by 599
  4. 2016Delving into Transferable Adversarial Examples and Black-box Attackscited by 536
  5. 2017Countering Adversarial Images using Input Transformationscited by 520
  6. 2017Progressive Neural Architecture Searchcited by 487
  7. 2021ConViT: Improving Vision Transformers with Soft Convolutional Inductive Biasescited by 484
  8. 2016Transferability in Machine Learning: from Phenomena to Black-Box Attacks using Adversarial Samplescited by 446
  9. 2019Evading Defenses to Transferable Adversarial Examples by Translation-Invariant Attackscited by 442
  10. 2018Bilevel Programming for Hyperparameter Optimization and Meta-Learningcited by 405
  11. 2017Mitigating Adversarial Effects Through Randomizationcited by 383
  12. 2019Nesterov Accelerated Gradient and Scale Invariance for Adversarial Attackscited by 355
  13. 2017Defense against Adversarial Attacks Using High-Level Representation Guided Denoisercited by 329
  14. 2021Enhancing the Transferability of Adversarial Attacks through Variance Tuningcited by 244
  15. 2020Bilevel Optimization: Convergence Analysis and Enhanced Designcited by 222
  16. 2021Admix: Enhancing the Transferability of Adversarial Attackscited by 156
  17. 2017Generative Adversarial Perturbationscited by 153
  18. 2019Enhancing Adversarial Example Transferability with an Intermediate Level Attackcited by 140
  19. 2021Visformer: The Vision-friendly Transformercited by 137
  20. 2022Frequency Domain Model Augmentation for Adversarial Attackcited by 130
  21. 2018Adversarial Attacks and Defences Competitioncited by 96
  22. 2021Revisiting and Advancing Fast Adversarial Training Through The Lens of Bi-Level Optimizationcited by 76
  23. 2022SegPGD: An Effective and Efficient Adversarial Attack for Evaluating and Boosting Segmentation Robustnesscited by 74
  24. 2023Content-based Unrestricted Adversarial Attackcited by 73
  25. 2018Learning Transferable Adversarial Examples via Ghost Networkscited by 70
  26. 2021A Value-Function-based Interior-point Method for Non-convex Bi-level Optimizationcited by 60
  27. 2019FDA: Feature Disruptive Attackcited by 56
  28. 2021Meta Gradient Adversarial Attackcited by 55
  29. 2021Boosting Adversarial Transferability through Enhanced Momentumcited by 54
  30. 2020Dual Manifold Adversarial Robustness: Defense against Lp and non-Lp Adversarial Attackscited by 45
  31. 2023Making Substitute Models More Bayesian Can Enhance Transferability of Adversarial Examplescited by 32
  32. 2023Ensemble-based Blackbox Attacks on Dense Predictioncited by 16
  33. 2024RAT: Adversarial Attacks on Deep Reinforcement Agents for Targeted Behaviorscited by 16
  34. 2021Learning to Learn Transferable Attackcited by 13
  35. 2024Overcoming Lower-Level Constraints in Bilevel Optimization: A Novel Approach with Regularized Gap Functionscited by 12
  36. 2024Enhancing Adversarial Transferability with Adversarial Weight Tuningcited by 5
  37. 2025Harnessing the Computation Redundancy in ViTs to Boost Adversarial Transferabilitycited by 4
  38. 2025Boosting Generative Adversarial Transferability with Self-supervised Vision Transformer Featurescited by 3

50 most cited of 53 All 53 (JSON)

Built on by

Not cited yet.