Backpropagation Path Search On Adversarial Transferability

TL;DR

This paper introduces PAS, a novel method to improve adversarial transferability by optimizing backpropagation paths in CNNs through structural reparameterization and Bayesian search, significantly boosting attack success rates.

Contribution

It proposes a new backpropagation path search method that explores convolution modules and uses Bayesian optimization for effective adversarial attacks.

Findings

PAS significantly increases attack success rates.

It outperforms existing structure-based attackers.

Effective on both trained and defended models.

Abstract

Deep neural networks are vulnerable to adversarial examples, dictating the imperativeness to test the model's robustness before deployment. Transfer-based attackers craft adversarial examples against surrogate models and transfer them to victim models deployed in the black-box situation. To enhance the adversarial transferability, structure-based attackers adjust the backpropagation path to avoid the attack from overfitting the surrogate model. However, existing structure-based attackers fail to explore the convolution module in CNNs and modify the backpropagation graph heuristically, leading to limited effectiveness. In this paper, we propose backPropagation pAth Search (PAS), solving the aforementioned two problems. We first propose SkipConv to adjust the backpropagation path of convolution by structural reparameterization. To overcome the drawback of heuristically designed backpropagation paths, we further construct a DAG-based search space, utilize one-step approximation for path evaluation and employ Bayesian Optimization to search for the optimal path. We conduct comprehensive experiments in a wide range of transfer settings, showing that PAS improves the attack success rate by a huge margin for both normally trained and defense models.