A Simple DropConnect Approach to Transfer-based Targeted Attack

TL;DR

This work tackles targeted transfer-based adversarial attacks under a single-surrogate setting, where ASRs lag behind untargeted cases due to perturbation co-adaptation. It introduces Mitigating perturbation Co-adaptation by DropConnect (MCD), which randomly masks weights and normalization parameters to create diverse surrogate variants at each optimization step, effectively implementing a self-ensemble to improve transferability. Extensive experiments across CNN and Transformer targets show that MCD yields superior average ASRs, including large gains in CNN→Transformer transfers (about 13% higher) and strong performance when compute budgets are increased; MCD also demonstrates robustness against defenses and outperforms existing self-ensemble baselines. The findings highlight the importance of model-diversity strategies in attack design and suggest new directions for evaluating and strengthening defenses against perturbation co-adaptation.

Abstract

We study the problem of transfer-based black-box attack, where adversarial samples generated using a single surrogate model are directly applied to target models. Compared with untargeted attacks, existing methods still have lower Attack Success Rates (ASRs) in the targeted setting, i.e., the obtained adversarial examples often overfit the surrogate model but fail to mislead other models. In this paper, we hypothesize that the pixels or features in these adversarial examples collaborate in a highly dependent manner to maximize the success of an adversarial attack on the surrogate model, which we refer to as perturbation co-adaptation. Then, we propose to Mitigate perturbation Co-adaptation by DropConnect (MCD) to enhance transferability, by creating diverse variants of surrogate model at each optimization iteration. We conduct extensive experiments across various CNN- and Transformer-based models to demonstrate the effectiveness of MCD. In the challenging scenario of transferring from a CNN-based model to Transformer-based models, MCD achieves 13% higher average ASRs compared with state-of-the-art baselines. MCD boosts the performance of self-ensemble methods by bringing in more diversification across the variants while reserving sufficient semantic information for each variant. In addition, MCD attains the highest performance gain when scaling the compute of crafting adversarial examples.

Figures (9)

• Figure 1: An illustration of the proposed method MCD. We apply MCD to selected layers in the surrogate model to create multiple and diverse variants at each optimization iteration.
• Figure 2: ASRs(%) with increasing mask ratio.
• Figure 3: Average ASRs along optimization iterations. Here $S$ denotes the number of inferences per iteration.
• Figure 4: Average ASRs with different iterations (denoted by $T$) and different numbers of inferences per iteration (denoted by $S$).
• Figure 5: ASRs(%) with increasing mask ratio.