Advancing Generalized Transfer Attack with Initialization Derived Bilevel Optimization and Dynamic Sequence Truncation

TL;DR

This paper introduces BETAK, a novel bilevel optimization framework for transfer attacks that improves attack success rates and generalization by explicitly modeling the interaction between pseudo-victim and surrogate attackers, with dynamic techniques to enhance efficiency.

Contribution

The paper proposes BETAK, a bilevel optimization approach with initialization derived from pseudo-victim models, Hyper Gradient Response estimation, and Dynamic Sequence Truncation for improved transfer attack performance.

Findings

Achieved 53.41% increase in attack success rates against IncRes-v2_ens.

Demonstrated substantial improvements over existing transfer attack methods.

Provided convergence guarantees for the non-convex bilevel optimization algorithm.

Abstract

Transfer attacks generate significant interest for real-world black-box applications by crafting transferable adversarial examples through surrogate models. Whereas, existing works essentially directly optimize the single-level objective w.r.t. the surrogate model, which always leads to poor interpretability of attack mechanism and limited generalization performance over unknown victim models. In this work, we propose the \textbf{B}il\textbf{E}vel \textbf{T}ransfer \textbf{A}ttac\textbf{K} (BETAK) framework by establishing an initialization derived bilevel optimization paradigm, which explicitly reformulates the nested constraint relationship between the Upper-Level (UL) pseudo-victim attacker and the Lower-Level (LL) surrogate attacker. Algorithmically, we introduce the Hyper Gradient Response (HGR) estimation as an effective feedback for the transferability over pseudo-victim attackers, and propose the Dynamic Sequence Truncation (DST) technique to dynamically adjust the back-propagation path for HGR and reduce computational overhead simultaneously. Meanwhile, we conduct detailed algorithmic analysis and provide convergence guarantee to support non-convexity of the LL surrogate attacker. Extensive evaluations demonstrate substantial improvement of BETAK (e.g., $\mathbf{53.41}$\% increase of attack success rates against IncRes-v$2_{ens}$) against different victims and defense methods in targeted and untargeted attack scenarios. The source code is available at https://github.com/callous-youth/BETAK.