Enhancing Adversarial Transferability via Component-Wise Transformation

TL;DR

The paper tackles the limited cross-architecture transferability of adversarial examples by introducing Component-Wise Transformation (CWT), a block-wise input transformation that uses per-block interpolation and selective rotation to diversify attention across models. By integrating CWT into MI-FGSM and averaging gradients over $N$ transformed copies, the method improves transferability to both CNN- and Transformer-based targets on ImageNet. Experiments show CWT achieving state-of-the-art attack success rates and reduced standard deviation across defenses, with ablations guiding recommended settings such as $n=2$, $s_{max}=1.3$, $r=26^{\circ}$, $k=2$, and $N=20$. This work provides a novel perspective on input transformations, highlighting how localized, diverse perturbations can generalize better across architectures and defenses while remaining computationally efficient.

Abstract

Deep Neural Networks (DNNs) are highly vulnerable to adversarial examples, which pose significant challenges in security-sensitive applications. Among various adversarial attack strategies, input transformation-based attacks have demonstrated remarkable effectiveness in enhancing adversarial transferability. However, existing methods still perform poorly across different architectures, even though they have achieved promising results within the same architecture. This limitation arises because, while models of the same architecture may focus on different regions of the object, the variation is even more pronounced across different architectures. Unfortunately, current approaches fail to effectively guide models to attend to these diverse regions. To address this issue, this paper proposes a novel input transformation-based attack method, termed Component-Wise Transformation (CWT). CWT applies interpolation and selective rotation to individual image blocks, ensuring that each transformed image highlights different target regions, thereby improving the transferability of adversarial examples. Extensive experiments on the standard ImageNet dataset show that CWT consistently outperforms state-of-the-art methods in both attack success rates and stability across CNN- and Transformer-based models.

Figures (7)

• Figure 1: There shows our CWT process for image transformation. The heatmaps generated on ResNet-18. Our method successfully enables a single surrogate model to focus on different regions of an object.
• Figure 2: The heatmaps generated on ResNet-18 of raw image and its transformed images by DIM, SIM, Adimx, MaskBlock, US-MM, BSR, and our proposed CWT. Notably, CWT successfully shifts the surrogate model's attention toward the central region of the object.
• Figure 3: Demonstration of the different discriminative regions of the different models. We adopt Grad-CAM selvaraju2016grad to visualize the attention maps of four CNN-based models—ResNet-18, ResNext-50, ResNet-101, DenseNet-121 and two Transformer-base models-Swin,Vit.
• Figure 4: Attack success rates (%) of various models on the adversarial examples generated by CWT with different numbers of blocks, maximum resize rates, maximum rotate angles, numbers of rotation blocks and numbers of transformed copies. The adversarial examples are crafted using the RN-101 model and tested on seven other models under the black-box setting.
• Figure 5: Attack success rates (%) of various models on the adversarial examples generated by CWT with and without Pre-interpolation. The surrogate model is RN-101.