Advancing Generalized Transfer Attack with Initialization Derived Bilevel Optimization and Dynamic Sequence Truncation

1 Introduction

Adversarial attack introduces imperceptible yet artificial perturbations into the clean image, potentially leading to incorrect outputs even serious security concerns [Goodfellow et al., 2014; Xie et al., 2017b; Jiao et al., 2023]. Among these black-box attack techniques, transfer attacks [Dong et al., 2018; Xie et al., 2019] generates Adversarial Examples (AE) by attacking a surrogate model, which leads to better attack performance against these victim models with unknown network structures and gradient information. Due to its ability to initiate attacks without requiring direct access to the victim models, transfer attack has garnered extensive attention and research in various real-world applications such as autonomous driving [Deng et al., 2020] and surveillance systems [Alparslan et al., 2020].

∗Corresponding author

Building upon this foundation, an extensive array of transfer attack methods has been studied, principally including strategies such as input transformation [Wang et al., 2021; Long et al., 2022], momentum-based [Lin et al., 2019; Wang and He, 2021; Dong et al., 2018], objective-based [Huang et al., 2019] methods, and modification of network structural properties [Wang et al., 2023; Guo et al., 2020]. The above transfer attack methods essentially optimize a single-variable single-level objective w.r.t. surrogate model, thereby overlooking the explicit formulation and evaluation for the attack performance w.r.t. victim models. This deficiency has significantly limited the generalization performance of the AEs across varying victim models. Meanwhile, several studies [Yuan et al., 2021; Fang et al., 2022] have also focused on designing meta-learning based methods to improve the attack transferability of AEs with model ensembles or data augmentation techniques. Whereas, they always require multiple sampling iterations from the white-box model zoo and pose challenges in integrating with various types of transfer attack methods. Meanwhile, there is a notable lack of interpretability of attack mechanism along with comprehensive theoretical analysis for these methods.

In this work, we establish the BilEvel Transfer AttacK (BETAK) framework to address the above limitations. Specifically, by revisiting the optimization process of transfer attack based on its single-level objective of surrogate model, we propose a new initialization derived bilevel optimization paradigm to explicitly reformulate the nested constraint relationship between the Upper-Level (UL) pseudovictim attacker (w.r.t. perturbation initialization variable) and the Lower-Level (LL) surrogate attacker (w.r.t. perturbation variable). The LL subproblem corresponds to the same attack objective as the single-level transfer attack, while the UL subproblem essentially reflects the ultimate objective function to achieve better generalization performance over unknown victim models. As for the solution strategy, we first explicitly calculate the Hyper-Gradient Response (HGR) as an effective feedback of transferability against one or more pseudo-victim models. Then we further introduce the Dynamic Sequence Truncation (DST) technique to dynamically adjust the backpropagation path for HGR, which also effectively relieves the computation burden. Besides, we provide convergence analysis of the BETAK framework where the LL subproblem has non-convex propertity due to complex network structures and objectives. Finally, we not only verify the attack performance of BETAK against various victim models and defense methods, but also consider both targeted and untargeted scenarios for thorough evaluation. Comprehensive ablation studies are also conducted to analyze the effectiveness of BETAK and DST technique. The main contributions are summarized as follows:

• Different from directly optimizing a single-variable single-level surrogate objective, we propose the BilEvel Transfer AttacK (BETAK) framework based on the established initialization-derived bilevel optimization paradigm, to analyze and explicitly reformulate the nested constraint relationship between the UL pseudovictim attacker and the LL surrogate attacker.
• Algorithmically, we propose the Hyper-Gradient Response (HGR) estimation as an effective feedback of the transferability against the pseudo-victim models. Meanwhile, we introduce the Dynamic Sequence Truncation (DST) technique to dynamically adjust the backpropagation pathway for HGR computation, simultaneously alleviating the computational burden.
• We provide detailed algorithmic analysis of BETAK with convergence guarantees to support non-convex property of surrogate attackers. This demonstrates its compatibility with a broader spectrum of surrogate models, characterized by intricate non-convex network architectures and objective functions.
• In-depth experimental analysis reveals that the BETAK framework exhibits substantial improvements against various victim models and defense methods (i.e., 53.41% increase of attack success rates against the IncRes-v2ens model). The ablation study also validates the effectiveness of DST technique to enhance performance and relieve computational burden.

2 Methodology

We first briefly revisit the single-level transfer attack process w.r.t. the surrogate attacker, and then we introduce the initialization derived bilevel optimization paradigm and propose two core techniques of BETAK, including the HGR estimation and DST operation.

2.1 Preliminary of Transfer Attack

We first review the single-level problem definition of transfer attacks to evaluate the transferability of AEs. We denote the dataset as D = {ui, vi}Mi=1 , where Di = (ui, vi) represents the image and paired label. Then the fundamental objective function of transfer attack could be described as

where Lsur(δ; Di, R) = Lsur(R(ui + δ), vi)), R denotes the surrogate model. δ is the perturbation variable optimized based on various attackers subject to C = {δ|∥δ∥ρ ≤ ϵ}, where C represents the range of values for the perturbations generated by the attack, and ρ denotes the norm used for attack generation. Typically speaking, we use δk to denote the generated perturbation at k-th step maximization:

where k = 0, 1, · · · ,K - 1, and Π is the projection operation. To this end, various gradient based attackers (singlestep [Goodfellow et al., 2014] or multi-step [Dong et al., 2018]) could be combined to improve attack performance.

Therefore, existing methods have explored various techniques to facilitate the maximization optimization in Eq. (1) w.r.t. δ to enhance the transferability of AEs to unknown victimmodels, denoted as V. In this case, the ultimate objective function of transfer attacks should be written as

where Lvicn represents the objective of n-th victim models, i.e., Vn, n = 1, . . . ,N. Cvic denotes the constraint for the victim model. Typically, Cvic is set as the same as C for simplicity. Note that this objective reflects the essential goal of transfer attacks, i.e., enhancing the generalization performance of δK when transferred to black-box victim models.

2.2 Initialization Derived Bilevel Paradigm

We first introduce ϕ(δ) to denote the perturbation generated by certain types of attackers with δ as the perturbation initialization. When we remove the sgn operation [Cheng et al., 2021], and take single-step gradient ascent as an example, ϕ(δ) can be written as

Then we construct the initialization derived bilevel optimization paradigm to capture the nested constrained relationship between Eq. (1) and Eq. (3), which can be written as:

ϕ⋆ (δ) denotes the 'best' perturbation derived by iteratively solving Eq. (4). In the following, the models utilized to construct the UL objective will be referred to as the pseudovictim attacker. Accordingly, the LL surrogate attacker aims to generate the 'best' adversarial perturbation to attack the surrogate model, which shares similar motivation with Eq. (1). While the UL pseudo-victim attacker is optimized to achieve better generalization performance with the perturbation derived from δ.

Bilevel optimization [Liu et al., 2023a; Liu et al., 2024] is well recognized for modeling and solving various hierarchical applications problems, such as hyperparameter optimization [Franceschi et al., 2017; Liu et al., 2021a] and meta learning [Hospedales et al., 2020; Liu and Liu, 2021]. The proposed initialization derived bilevel paradigm clearly illustrates the constrained relationship between the UL pseudovictim attacker and LL surrogate attacker, and offers a new perspective to generate AEs with better generalization capability when transferred to unknown victim models.

2.3 Hyper-Gradient Response (HGR) Estimation

As shown in Eq. (5), the UL objective continuously optimizes δ, which is defined as the initial state of the LL variable ϕ. Then we introduce the HGR estimation to update δ in Eq. (5). Specifically, we first construct the iterative dynamical system by extending Eq. (4) as

where k = 1, · · · ,K. Therefore, ϕ⋆ (δ) could be approximated by

Following the chain rule, the hyper-gradient w.r.t. δ can be explicitly calculated with auto differentiation as follows

The hyper-gradient contains second-order gradient information as effective feedback of the transferability of ϕK(δ). Then we adopt the estimated hyper-gradient to update δ by

where β denotes the learning rate. As the UL and LL objectives converge, ϕ⋆ (δ) is supposed to obtain better generalization performance on the victim models.

In addition, it should be emphasized that we have no access to the gradient information about unknown victimmodels in the scenario of transfer attacks. To define the UL victim attacker in Eq. (5), we assume that one or more arbitrary known models, in addition to R, could serve as pseudovictim models to imitate the victim models during transfer process. These pseudo-victim models, denoted as Vn, inherently satisfy the black-box attack nature for evaluating adversarial transferability of ϕK and update its initialization, i.e., δ, which finally leads to ϕ⋆ with better generalization performance. We also conduct extensive experiments to investigate the influence of pseudo-victim model selection on transferability of AEs.

From another perspective, existing transfer attack methods always obtain ϕK with empirically chosen or randomly initialized δ in Eq. (6), while we estimate the HGR to optimize the initialization used for attacking R, which finally leads to better generalization performance over unknown victim models. We provide more details to discuss the influence of alternative victim models in the ablation part.

2.4 Dynamical Sequence Truncation (DST)

We further introduce the DST operation to facilitate the HGR estimation, which improves the theoretical properties and relieve the hyper-gradient computation burden simultaneously.

Algorithm 1 BETAK Framework

Require: UL iteration T , LL attack iteration K, perturbation δ, LL learning rate α and UL learning rate β.

• 1: Initialize δ0 .
• 2: for t = 0 → T -1 do
• 3: ϕ0(δ) = δt .
• 4: for k = 0 → K - 1 do
• 5: % Iterative attack with ϕk (δ).
• 6: ϕk+1 (δ) = ΠC (ϕk (δ) -α · ∇ϕf (ϕk (δ))).
• 7: end for
• 8: %Calculate ˜K with DST technique.
• 9: ˜K = argmax1≤k≤K {F (ϕk (δ))}.
• 10: %Calculate the HGR estimation.
• 11: ∇δF (ϕ ˜K (δ))= (∇δϕ ˜K (δ))⊤∇ϕF (ϕ ˜K (δ)).
• 12: %Update δ with ϕ ˜K .
• 13: δt+1 = ΠC (δt -β · sgn∇δF (ϕ ˜K (δ))).
• 14: end for

In Eq. (7), the whole historical sequence of ϕ, i.e., {ϕk}Kk=1 , is used to estimate HGR and find better perturbation initialization. Whereas, since the LL subproblem is mostly nonconvex due to the complex network structure of surrogate models and varying objectives, there is no guarantee that the obtained {ϕk}Kk=1 could uniformly lead to the convergence of both subproblems. Meanwhile, although K is crucial for proper approximation of ϕ⋆ (δ), it is always impractical for us to empirically choose ideal fixed K for HGR estimation.

In this paper, we propose to dynamically truncate the historical sequence in Eq. (6) according to the change of the UL objective. We first introduce the variable ˜K to replace fixed K for HGR, calculated by

Theoretically, ˜K is chosen to minimize the worst case of ϕk(δ) in terms of F (ϕk(δ)) so as to ensure that the sequence of solutions for f is consistently optimized with F. This idea originates from the non-convex first-order optimization methods [Liu et al., 2020; Liu et al., 2021b; Liu et al., 2023b], and we extend this technique to relax the theoretical properties of BETAK under the LL non-convex scenario. Therefore, ϕ⋆ (δ) is further approximated by ϕ ˜K , and HGR can be estimated as

It should be noted that since ˜K is always selected from the range of [1,K], the DST technique naturally saves the computation cost for calculating the hyper gradient in Eq. (7). We summarize the BETAK framework with HGR and DST techniques in Alg. 1. By combining HGR estimation with the DST operation, we further establish the convergence guarantee of BETAK framework, which effectively handles the nonconvex property of LL surrogate attacker caused by complex network structure and diverse loss functions.

2.5 Algorithmic Analysis of BETAK

We delve into the theoretical foundations of BETAK, focusing particularly on the convergence properties in nonconvex scenarios. Following previous assumptions [Liu et al.,

2021b], when the UL variables only contain the initialization variable of ϕk, i.e., δ, without including additional parameters, we have that the initialization-based bilevel optimization paradigm, depicted in Eq. (5), is actually a special case of the explicit gradient-based methods [Liu et al., 2023b]. Consequently, with the LL non-convex property, by introducing ˜K to dynamically truncate the historical sequence (i.e., {F (ϕk(δ))}Kk=1 ) obtained from the gradient based attack iterations, we demonstrate that any limit point of the UL sequence is guaranteed to converge to a stationary point satisfying the first-order optimality conditions of Eq. (5). This above convergence analysis ensures that despite the non-convex nature of LL surrogate attackers, BETAK can reliably find solutions that are robust and practically effective to improve the transferability across unknown victim models. When we derive the optimized perturbation initialization, BETAK could flexibly combined various attack methods to perform the surrogate attack process and obtain the optimal perturbation. In the experimental part, we demonstrate the flexibility of BETAK combined with different basic iterative attackers.

3 Experiments

We evaluate the performance improvement of BETAK compared with representative transfer attack methods against various victim models and defense techniques under both targeted and untargeted attacks.

3.1 Experimental Setting

Dataset and Models. We follow the commonly used settings to randomly select 5000 images from 1000 categories of the ImageNet (ISLVRC2012) validation set, all of which could be correctly classified by the victim models. For fair comparison, we choose the commonly used ResNet-50 backbone as the surrogate model. We select 9 victim models with different network structures, including 6 standardly trained models, i.e., Inception (Inc)-v3 [Szegedy et al., 2016], IncResv2 [Szegedy et al., 2017], DenseNet [Huang et al., 2017], MobileNet-v2 [Sandler et al., 2018], PNASNet [Liu et al., 2018], SENet [Hu et al., 2018] and 3 robustly trained models, i.e., Inc-v3ens3, In-v3ens4 and IncRes-v2ens [Tram`er et al., 2017]. As for the implementation of BETAK, we consider Inception-v3 and IncRes-v2 as the pseudo-victim model since they are proposed earlier. Besides, it can be clearly observed from the ablation results that introducing either one as the pseudo model will significantly improve the attack performance against other victim models. We adopt the Attack Success Rate (ATR) as the evaluation criterion for the performance of transfer attacks.

Baselines and Training Details. We choose 5 representative attackers including the basic multi-step attacker (i.e., PGD [Kurakin et al., 2018b]), 2 momentum based attackers (i.e., MI-FGSM [Dong et al., 2018] and VMI-FGSM [Wang and He, 2021]), objective based attacker (i.e., ILA [Huang et al., 2019]) and input transformation based attacker ( i.e., SSA [Long et al., 2022]). Besides, we also consider various model-related methods including SGM [Wu et al., 2020], LinBP [Guo et al., 2020], Ghost [Li et al., 2020] and BPA [Wang et al., 2023]. We follow the hyper parameter setting in BPA to implement the above methods. In the untargeted scenario, we set the UL iteration T = 10, ϵ = 8/255 and UL learning rate β = 1.6/255 for all the methods. As for the targeted attacks, we set T = 300, ϵ = 16/255 and β = 16/255. As for the hyper parameter of BETAK, since we omit the sgn operation, we set the LL learning rate α = 2.0 and LL iteration K = 10.

3.2 Experimental Results

Quantitative Results with Untargeted Attacks. We first evaluate the attack performance of BETAK against various victim models in comparison with state-of-the-art attack methods. In Tab. 1, we test the ATR with 2 pseudo-victim models and 7 victim models. As it is excepted, BETAK improves the ATR on Inception-v3 and IncRes-v2, since these pseudo-victim models provide the feedback of generalization performance by participating in the HGR estimation w.r.t. δ. More importantly, it is shown that BETAK also significantly improves the attack performance against other 7 victim models. Therefore, by continuously optimizing the pseudo-victim attacker w.r.t. δ, the generated AEs are supposed to have better generalization performance to unknown victim models.

Evaluation with Defense Strategies. We implement 5 representative defense methods for evaluation, including HGD [Liao et al., 2018], R&P [Xie et al., 2017a], NIPSr3 [Kurakin et al., 2018a], JPEG [Guo et al., 2017] and RS [Cohen et al., 2019]. We compare the ATR of BETAK and these methods against different defense strategies based on the PGD and MI-FGSM in Fig. 3. It can be observed that BETAK generates AEs that have consistently stronger attack performance against different defense techniques.

Visualization of Adversarial Loss Landscapes. In Fig. 1, we also plot the adversarial loss landscapes of different victimmodels for the same clean image and two adversarial images generated by SSA+BPA and BETAK in Fig. 2. The adversarial loss is calculated with Lvic(u + x⃗ι + y⃗o), where u denotes the original clean image or adversarial image, ⃗ι = sgn(∇uLatk(u)) and ⃗o ∼ Rademacher(0, 0.5) are the sign gradient direction and random direction (x and y are the corresponding linear coefficients). To be general, when the original adversarial image exhibits stronger attack performance, the loss near the origin of the adversarial loss landscape should be larger and exhibit a steeper variation trend.

We can easily observe that the adversarial loss landscapes of the adversarial image generated by SSA+BPA for different victimmodels are more similar to these landscapes of the clean image. In comparison, adversarial landscapes of BETAK for different victim models have greater loss and are significantly steeper than the clean image and the adversarial image of SSA+BPA, demonstrating stronger attack performance against the surrogate model, pseudo-victimmodel and two victim models.

Analysis of the CAM Results. To explained the mechanism of BETAK more vividly, we compare the Class Activation Mapping (CAM) [Selvaraju et al., 2017] results of 6 victim models for the clean image and the AEs generated by SSA+BPA and our BETAK in Fig. 2. Darker red regions indicate that these pixels are more important for the classification output, and darker blue indicates that these pixel regions are less important. The white rectangular dashed box and the dashed lines highlight the regions that the model focuses on the most in both clean samples and AEs, significantly influencing the classification outputs. We can draw the following conclusions.

• Although these models have totally different network
• structures, they all payed much attention to similar area of the clean image around the key item for classification.
• These victim models reacted absolutely different to the AE of SSA+BPA. In particular, Inc-v3 still correctly classified the shower cap, and both IncRes-v2 and DenseNet still payed much attention to the critical area of the AE as same as the clean image.
• In comparison, all the victim models misclassified the AE generated by BETAK, and they also turn their attention to totally different areas distant from the clean image. More importantly, the critical areas of the AE that these victim models focus on are concentrated in similar locations, which indicates that a better perturbation initialization is provided by BETAK.

Targeted Transfer Attack Scenario. We evaluate the generalization performance of BETAK on the targeted transfer attacks. Practically, we follow previous works [Zhao et al., 2021] to optimize the logits loss based on the PGD and MIFGSM attacker. In Tab. 2, we report the ATR of BETAK against different victimmodels under the targeted attack scenario. It can be observed that BETAK also consistently improves the attack performance under the more challenging targeted attack scenario.

3.3 Ablation Study

Influence of Pseudo-victim Models. We conduct the ablation study to evaluate the attack performance of BETAK by selecting different pseudo-victim models to construct the UL victim attacker in Tab. 4. We have the following observations.

• We first evaluate the ATR of BETAK with a single victimmodel, i.e., Inception-v3 or IncRes-v2. We can easily find that even with a single pseudo-victim model participating in the UL objective, BETAK also significantly improves the ATR again the left 8 victim models.
• Integrating IncRes-v2 exhibits higher performance improvement compared with Inception-v3, which can be explained by the fact that IncRes-v2 is more advanced by combing ResNet and Inception-v4 with higher performance and more complex structure.

• When we integrate both models to construct the UL objective, BETAK obtains better attack performance across all the 9 victim models. Therefore, combining more pseudo-victim models essentially helps generate AEs with more effective feedback of the transferability, which will facilitate the generalization performance by optimizing Eq. (5).

Influence of K and T. We conduct the ablation study to analyze the influence of UL and LL iteration. In Fig. 3, we compare the ATR of BETAK with PGD+BPA by changing T, K or removing the DST operation. As for the influence of T, we can observe that even 1-step update of δ also significantly enhance the attack performance of generated AEs, which demonstrate the effectiveness of BETAK. When we adopt more UL iterations for update, the adversarial perturbation converges with a better initialization by continuously optimizing F(δ), thus the attack performance are further improved. From this perspective, implementing BETAK with larger T improves the convergence results, thereby facilitating the transferability of AEs. As for the influence of K, the larger K leads to better approximation of ϕ⋆ (δ) to benefit the HGR estimation, which is demonstrated by the performance improvement of ATR with larger K.

Influence of the DST Operation. From Fig. 3, it is observed that the introduction of the DST operation does not have a significant impact on the attack performance when K = 10. However, as K increases to 20, the absence of the DST operation results in the degradation of the attack performance on certain victim models compared to K = 10. In comparison, incorporating DST operation yields the highest attack performance across various victim models. Furthermore, the influence of DST has also been analyzed with different K in Tab. 4. The observation could be summarized as follows.

Figure 4: Ablation results of the time for Backpropagation (BP) for the first 10 batches of images and the average ˜K of DST operation as the UL iteration increases. Note that when DST operation is removed, ˜K is set to the same value as K.

• The variation of ˜K with and without DST operation as T increases was examined in the first subfigure. The values depicted were calculated using the average value of first 10 batches during training. It is evident that ˜K with DST operation are significantly reduced relative to the fixed K and tend to stabilize as T increases.
• We also calculate the runtime time for Backpropagation (BP) across the first 10 batches. Note that higher BP time of the first batch is attributable to one-time initialization such as computation graph construction.
• As indicated in the second subfigure, DST operation enables the BP cost at K = 20 to be even lower than at K = 10 without DST. In summary, ˜K with DST operation not only assists BETAK in achieving superior attack performance but also effectively reduces the computational overhead for HGR estimation.sh

4 Conclusion

This paper introduces an initialization derived optimization paradigm to enhance the transferability of AEs, along with two efficient techniques to improve theoretical properties and computation efficiency under the BETAK framework. Comprehensive experimental evaluations validate BETAK's effectiveness with substantial ATR increase across diverse victim models and defense techniques.

Acknowledgments

This work is partially supported by the National Key R&D Program of China (No. 2022YFA1004101), the National Natural Science Foundation of China (Nos. U22B2052, 62302078 and 61936002) and the Liaoning Revitalization Talents Program (No. 2022RG04).