Boosting Adversarial Transferability via Ensemble Non-Attention

TL;DR

This paper introduces NAMEA, a novel ensemble attack method that leverages gradients from non-attention areas of models to improve adversarial transferability across heterogeneous architectures, especially CNNs and ViTs.

Contribution

It pioneers integrating non-attention area gradients into ensemble attacks and employs meta-learning to fuse transfer information, enhancing attack effectiveness across diverse models.

Findings

NAMEA outperforms state-of-the-art ensemble attacks by 15.0% and 9.6%.

Decoupling and merging attention and non-attention gradients improves transferability.

The approach provides new insights into ensemble attack strategies across different architectures.

Abstract

Ensemble attacks integrate the outputs of surrogate models with diverse architectures, which can be combined with various gradient-based attacks to improve adversarial transferability. However, previous work shows unsatisfactory attack performance when transferring across heterogeneous model architectures. The main reason is that the gradient update directions of heterogeneous surrogate models differ widely, making it hard to reduce the gradient variance of ensemble models while making the best of individual model. To tackle this challenge, we design a novel ensemble attack, NAMEA, which for the first time integrates the gradients from the non-attention areas of ensemble models into the iterative gradient optimization process. Our design is inspired by the observation that the attention areas of heterogeneous models vary sharply, thus the non-attention areas of ViTs are likely to be the focus of CNNs and vice versa. Therefore, we merge the gradients respectively from the attention and non-attention areas of ensemble models so as to fuse the transfer information of CNNs and ViTs. Specifically, we pioneer a new way of decoupling the gradients of non-attention areas from those of attention areas, while merging gradients by meta-learning. Empirical evaluations on ImageNet dataset indicate that NAMEA outperforms AdaEA and SMER, the state-of-the-art ensemble attacks by an average of 15.0% and 9.6%, respectively. This work is the first attempt to explore the power of ensemble non-attention in boosting cross-architecture transferability, providing new insights into launching ensemble attacks.