An Intermediate-level Attack Framework on The Basis of Linear Regression

TL;DR

This paper introduces an intermediate-level attack framework based on linear regression that enhances transferability of adversarial examples, achieving state-of-the-art results in transfer-based attacks.

Contribution

It proposes a novel linear regression-based framework for intermediate-level attacks, improving transferability and attack performance over previous methods.

Findings

Linear regression models effectively map intermediate discrepancies to prediction loss.

Larger intermediate discrepancies correlate with higher transferability.

Multiple attack runs with random initialization further boost attack success.

Abstract

This paper substantially extends our work published at ECCV, in which an intermediate-level attack was proposed to improve the transferability of some baseline adversarial examples. Specifically, we advocate a framework in which a direct linear mapping from the intermediate-level discrepancies (between adversarial features and benign features) to prediction loss of the adversarial example is established. By delving deep into the core components of such a framework, we show that 1) a variety of linear regression models can all be considered in order to establish the mapping, 2) the magnitude of the finally obtained intermediate-level adversarial discrepancy is correlated with the transferability, 3) further boost of the performance can be achieved by performing multiple runs of the baseline attack with random initialization. In addition, by leveraging these findings, we achieve new state-of-the-arts on transfer-based $\ell_\infty$ and $\ell_2$ attacks. Our code is publicly available at https://github.com/qizhangli/ila-plus-plus-lr.