Boosting Adversarial Transferability via Ensemble Non-Attention

AI summary

Overview

Research area: Adversarial machine learning in computer vision, specifically black-box transferable adversarial attacks built from ensembles of surrogate models (CNNs and Vision Transformers).

Technical level: Advanced. The paper assumes familiarity with gradient-based attacks (I-FGSM, MI-FGSM, DI-MI-FGSM), ensemble attacks, Grad-CAM attention extraction, and meta-learning.

Scope: The paper introduces NAMEA, an ensemble attack that decouples the gradients of attention and non-attention regions of heterogeneous surrogate models and merges them through meta-learning, evaluated primarily on ImageNet with supplementary results on CIFAR-10 and CIFAR-100.

What This Paper Is About

Adversarial examples crafted on surrogate models often transfer to unknown black-box models, and ensembling several surrogates usually improves that transfer. The problem is that when the surrogates have different architectures (for example, a CNN and a ViT), their gradient update directions disagree sharply, so existing ensemble attacks either smooth away model diversity (AdaEA) or optimize each model independently without stabilizing the direction (SMER). The goal of this paper is to fuse the two sides of that trade-off by exploiting the observation that the regions a CNN attends to are often the regions a ViT ignores, and vice versa.

Key Contributions

1. A new ensemble attack named NAMEA (Non-Attention enhanced Meta Ensemble Attack) that simultaneously preserves a stable update direction and model diversity, producing stronger cross-architecture transferability than prior ensemble attacks.
2. The concept of "ensemble non-attention." The authors decouple the gradients of non-attention areas from those of attention areas in ensemble models and merge them through meta-learning, rather than treating all ensemble gradients uniformly.
3. Two supporting modules: a non-attention extraction (NAE) module built on Grad-CAM that masks attention areas of each selected surrogate, and a gradient scaling optimization (GSO) module that scales gradients layer-wise for CNNs and channel-wise for ViTs.
4. Plug-and-play compatibility and broad empirical validation. NAMEA improves performance when combined with I-FGSM, MI-FGSM, and DI-MI-FGSM, and reportedly outperforms AdaEA and SMER on ImageNet by an average of 15.0% and 9.6%, respectively.

Main Findings

• Cross-architecture transferability: Under three base attacks (I-FGSM, MI-FGSM, DI-MI-FGSM), NAMEA achieves the highest attack success rates (ASRs) across 9 ViT targets and 8 CNN targets. Under DI-MI-FGSM, NAMEA reaches an average ASR of 77.5% on the ViT targets and 83.7% on the CNN targets, versus 72.1% and 78.5% for SMER; the paper states NAMEA improves the average ASR by 5.3% over SMER under this base attack.
• Base attack ordering: All methods perform best under DI-MI-FGSM, then MI-FGSM, then I-FGSM. SMER shows a large jump under DI-MI-FGSM, but NAMEA still leads.
• Robustness to defenses: Against 6 defense models under DI-MI-FGSM, NAMEA reaches an average ASR of 74.2% (best competitor SMER: 69.1%). Against 9 defense methods, NAMEA averages 63.3% versus 56.8% for SMER. For the diffusion-based defense DiffPure, NAMEA records 50.3% versus 39.9% for SMER, which the paper describes as outperforming baselines by 10%.
• Real-world API attacks: Using top-5 success criteria against Google, Alibaba, and Baidu image recognition APIs, NAMEA leads all baselines. Relaxing to top-1, its average ASRs under DI-MI-FGSM are 60%, 56%, and 68% for Google, Alibaba, and Baidu respectively, which the paper reports as 4%, 3%, and 5% higher than SMER.
• Masking experiment (motivation): Masking attention areas of ResNet-18 on 1,000 random ImageNet images causes CNN classification accuracy to drop by up to 30%, while ViT accuracy drops only within 10%, supporting the claim that attention regions differ sharply between the two architecture families. Masked images also induced high ratios of attention overlap across both homogeneous and heterogeneous models.
• Ablation, meta-learning steps: Removing the meta-testing step drops the average ASR by 9.2%; removing the meta-training step drops it by 7.4%; removing the GSO module drops it by 2%.
• Ablation, padding values: Filling masked attention areas with random Gaussian noise outperforms filling with all 0s or all 1s. With I-FGSM as the base attack, random noise beats the other two by approximately 2.7% in average ASR.
• Ablation, threshold: η = 0.6 gives the best ASR; performance declines when η decreases or increases.
• Ablation, model and area selection: Different meta-testing model selection strategies (diff-arch, same-arch, ran-arch) barely change ASRs. Extracting non-attention areas beats extracting attention areas or random 56×56 patches.
• Comparison with input diversity: Across four settings that hold the number of copies per inner loop constant, NAMEA performs best, suggesting the gain comes from ensemble non-attention rather than merely from having diverse inputs. Under DI-MI-FGSM, SMER_BSR drops dramatically while NAMEA_BSR declines only slightly.

Methodology in Plain English

The attack follows the standard iterative ensemble framework: at each outer iteration, the attacker perturbs the image using gradients from several surrogate models, clipping the perturbation within an ℓ∞ ball of size 8/255.

What makes NAMEA different is what happens inside each outer iteration, which the authors frame as a meta-learning procedure with K = 16 inner loops. Each inner loop randomly picks one surrogate model, with the guarantee that every model is selected at least once in every N consecutive inner iterations.

• Attention meta-training: The adversarial example is updated using the model's ordinary gradient, i.e., gradients computed over the model's attention regions.
• Non-attention meta-testing: A Grad-CAM-based NAE module computes the selected model's attention map, thresholds it at η = 0.6 to build a binary mask, and replaces the masked (attention) pixels of the meta-testing example with random Gaussian noise. The gradient is then computed on this modified image, so it reflects the model's non-attention regions. Thresholding the attention map and masking with noise is intended to distract the model further.
• Final update: The two accumulated gradients are merged, with the meta-testing gradient masked by the non-attention mask so it does not interfere with transferable information already captured in the attention regions, and the merged gradient updates the adversarial example.

A GSO module additionally rescales gradients before merging: for CNNs, intermediate layers (between L/3 and 2L/3) get a scaling factor λ(l) = λ₁ + λ₂·(L/l), so shallower layers are amplified; for ViTs, channels whose gradient magnitude falls below the average across channels are shrunk using a tanh-based factor. The rationale is that CNN intermediate features transfer better, while ViT gradients tend to be small.

Why This Matters

Impact on research. The paper reframes ensemble attacks as a problem of decomposing the image into attention and non-attention regions rather than simply averaging or filtering model gradients. If the central hypothesis holds more broadly, non-attention areas become a reusable design principle that can be layered onto other ensemble and meta-learning attack pipelines, and the distinction between "reducing gradient variance" and "preserving model diversity" is shown to be reconcilable rather than a strict trade-off.

Real-world applications (as the paper frames them):

• Evaluating the robustness of image recognition APIs, as demonstrated against Google Vision, Alibaba Cloud, and Baidu Cloud.
• Auditing adversarially trained and defended models, since NAMEA is tested against 6 defense models and 9 defense methods including DiffPure.
• Red-teaming deployed computer-vision classifiers that mix CNN and transformer backbones, where a single-architecture surrogate may underestimate vulnerability.
• Benchmarking transferability of attacks in mixed CNN/ViT deployment stacks, where attackers and defenders rarely know the target architecture.

Industry relevance. Because NAMEA is described as plug-and-play with existing gradient-based base attacks (I-FGSM, MI-FGSM, DI-MI-FGSM), it can slot into existing attack tooling without redesigning the optimization loop. The paper notes CSA matches or approaches NAMEA on some targets only after expanding the ensemble to 28 checkpoints, which the authors characterize as incurring large time and memory costs (detailed in Appendix Table III, not included in the provided excerpt).

Future Directions

• Extending beyond CNNs and ViTs. The evaluation focuses on these two architecture families; whether ensemble non-attention helps for other heterogeneous families (for example, hybrid or state-space models) is not reported.
• Reducing the overhead of the meta-learning loop. NAMEA requires T = 10 outer iterations with K = 16 inner loops and Grad-CAM attention extraction on each selected model; the paper compares overheads to baselines in the appendix, but efficient approximations remain an open direction.
• Applying the framework to stronger base attacks. The paper tests three gradient-based base attacks; how NAMEA interacts with other attack families is not reported.
• Defenses informed by the finding. If non-attention regions carry substantial transferable information, defenses that only harden attention areas may be insufficient; the paper does not develop or evaluate such a defense.

Target Audience

Researchers and graduate students working on adversarial robustness, transferable black-box attacks, and model ensembles, particularly those interested in cross-architecture attacks spanning CNNs and Vision Transformers. Practitioners evaluating the security of deployed vision APIs would also benefit, though the paper assumes a working knowledge of gradient-based attack formulations and Grad-CAM. Readers looking for a beginner-level introduction to adversarial examples should start elsewhere, since the meta-gradient notation and module design are dense.

Authors’ abstract

Ensemble attacks integrate the outputs of surrogate models with diverse architectures, which can be combined with various gradient-based attacks to improve adversarial transferability. However, previous work shows unsatisfactory attack performance when transferring across heterogeneous model architectures. The main reason is that the gradient update directions of heterogeneous surrogate models differ widely, making it hard to reduce the gradient variance of ensemble models while making the best of individual model. To tackle this challenge, we design a novel ensemble attack, NAMEA, which for the first time integrates the gradients from the non-attention areas of ensemble models into the iterative gradient optimization process. Our design is inspired by the observation that the attention areas of heterogeneous models vary sharply, thus the non-attention areas of ViTs are likely to be the focus of CNNs and vice versa. Therefore, we merge the gradients respectively from the attention and non-attention areas of ensemble models so as to fuse the transfer information of CNNs and ViTs. Specifically, we pioneer a new way of decoupling the gradients of non-attention areas from those of attention areas, while merging gradients by meta-learning. Empirical evaluations on ImageNet dataset indicate that NAMEA outperforms AdaEA and SMER, the state-of-the-art ensemble attacks by an average of 15.0% and 9.6%, respectively. This work is the first attempt to explore the power of ensemble non-attention in boosting cross-architecture transferability, providing new insights into launching ensemble attacks.