Tuning for Two Adversaries: Enhancing the Robustness Against Transfer and Query-Based Attacks using Hyperparameter Tuning

AI summary

Overview

• Research area: Adversarial machine learning — specifically black-box robustness of deep neural network classifiers, and the role of training hyperparameters as an implicit defense.
• Technical level: Intermediate. The paper combines formal propositions about loss-surface smoothness and Hessian eigenvalues with a large empirical hyperparameter sweep, but the framing and takeaways are accessible to readers with basic knowledge of training neural networks.
• Scope: A first systematic study of how learning rate, weight decay, momentum, and batch size trade off robustness against transfer-based versus query-based black-box attacks across centralized, ensemble, and distributed training setups on CIFAR-10 and ImageNet.

What This Paper Is About

Modern image classifiers are vulnerable to black-box adversarial attacks, and existing defenses (chiefly adversarial training) are expensive and are usually designed for only one attack family. The authors ask whether ordinary training hyperparameters — which are cheap to change, model-specific rather than attack-specific, and already part of every training pipeline — can be tuned to improve robustness. Their goal is to quantify which hyperparameters help against which attack type, and whether a single configuration can defend against both at once.

Key Contributions

1. First precise analysis of hyperparameters for black-box robustness. The paper presents what the authors describe as the first detailed analysis of how learning rate (η), weight decay (λ), momentum (μ), and batch size (B) affect robustness against both transfer-based and query-based attacks, across centralized training, ensemble learning, and distributed training with i.i.d. and non-i.i.d. data.
2. A theoretical account of the opposing trends. Supported by Proposition 1 and the perturbation bound from prior work, the authors show that model smoothness helps against query-based attacks but hurts against transfer-based attacks, explaining why the two attack types demand opposite hyperparameter directions.
3. A joint hyperparameter search (RQ3). Using the NSGA-II genetic algorithm over 100 configurations, the authors search for hyperparameter settings that simultaneously improve robustness against both attack types while preserving clean accuracy, and compare the resulting Pareto fronts across deployment setups.
4. Benchmarking against state-of-the-art defenses. The recommended configurations are compared to JPEG compression and adversarial training, with reported gains in robustness, clean accuracy, and training time.

Main Findings

• Opposite directions for the two attack types. Decreasing η, λ, and μ while increasing B improves robust accuracy against transfer-based attacks. Increasing η and λ while decreasing μ and B improves robust accuracy against query-based attacks. The abstract reports gains of up to 64% against transfer attacks and up to 28% against query-based attacks; the results section also reports an aggregate improvement of up to 55% in robust accuracy against transfer-based attacks across multiple ML instantiations.
• Distributed training is the strongest setting. Distributed models benefit most from hyperparameter tuning, achieving better tradeoffs against both attack types than centralized or deep-ensemble setups. Distributed ML consistently yields higher transfer-attack robust accuracy than deep ensembles trained on the full dataset, with a slight impact on clean accuracy, attributed to increased ensemble heterogeneity from disjoint data and reduced smoothness (hence lower gradient similarity between members).
• Learning rate effects in detail (transfer). For deep ensembles, reducing η starts to improve robust accuracy at η = 0.01, reaching RA = 0.5 at η = 0.0001 while clean accuracy stays as high as 86%. Distributed ML already holds RA = 42% at the default η = 0.1 and improves to RA = 67% at η = 0.001, with CA = 0.78. The largest improvement, up to 64%, is reported for the i.i.d. distributed ML instance at N = 3 with η = 0.001.
• Other hyperparameters (transfer). For weight decay, deep ensembles reach RA of only around 27%, while distributed ML reaches RA = 65% at CA = 77% for λ = 2e-6. For momentum, deep ensembles see almost no improvement (maximum RA = 4%), while distributed ML reaches RA = 51% and CA = 87% at μ = 0.8. For batch size, improvement appears only at B = 2048 with RA = 26% for deep ensembles, while distributed ML reaches RA as high as 64% at B = 2048.
• Query-attack results (RQ2). Deep ensembles peak at RA = 36% at η = 0.2, decline to RA = 27% at η = 0.004, rise slightly to RA = 32% at η = 0.0008, and then drop as low as 24%. Distributed ML shows a smoother relationship, with the highest RA = 0.46 at η = 0.2. For weight decay, deep ensembles fluctuate between 36% and 42% across λ until λ = 0.008, with at most a 5% reduction in clean accuracy; distributed ML ranges from 32% to 46% RA with CA between 76% and 90%. For momentum, CA/RA stay roughly constant across the range for both setups, with a slight decrease at μ = 0.99. Batch size follows the η trend in inverted form for distributed ML.
• Pareto search outcomes (RQ3). Deep ensembles improve both CA and RA as node count grows, reaching CA = 0.90 and RA = 0.46 at N = 7, with gains saturating beyond N = 3. Under i.i.d. distributed ML, N = 5 achieves the highest RA of 55% while N = 3 gives the best CA at 90%. Under non-i.i.d. data, results vary widely; N = 5 performs worst in CA, staying below 80%, and the best Pareto front appears at N = 3. Overall, tuned configurations improve RA_T by up to 43%, RA_Q by up to 10%, and CA by up to 4% relative to the average over all hyperparameter combinations from RQ1 and RQ2.
• Comparison to defenses. The recommended hyperparameters improve robustness over JPEG compression by up to 16% while using 78% fewer epochs (186 down to 41 on the same architecture). Against adversarial training, the paper reports that adversarial training can require up to 40 GPU hours per model for an average increase of 21% in robustness over the authors' approach.
• Practical tuning direction. Takeaway 1: reduce η, λ, μ and increase B for transfer robustness with minimal CA impact. Takeaway 2: increase η and λ, and decrease μ and B, for query robustness, with deep ensembles showing more stable RA_Q due to full-dataset access and flatter minima.

Methodology in Plain English

The authors train ResNet-family models (ResNet-18 by default, with MobileNetV2 results in the appendix) on CIFAR-10 and ImageNet using SGD with a CosineAnnealing scheduler for 200 epochs with early stopping, holding out 20% of CIFAR-10 as validation data. They use the four standard SGD hyperparameters listed in Table 1 — learning rate, weight decay, momentum, and batch size — with defaults of 0.1, 0.0005, 0.9, and 128, and ranges of [0.0001, 0.4], [0.000001, 0.01], [0.8, 0.99], and [32, 2048] respectively.

To isolate effects, they vary one hyperparameter at a time while keeping the others fixed at their defaults, then measure clean accuracy on benign images and robust accuracy on adversarial images. Each data point is averaged over three independent runs and across the number of nodes.

Two attacks are used. For transfer-based attacks, they use the Common Weakness attack, which builds an ensemble of 10 surrogate models on various architectures and applies sharpness-aware minimization to find adversarial examples in smooth, high-loss regions. For query-based attacks, they use SquareAttack from AutoAttack with a query budget of Q = 500. Both use an l∞ perturbation budget of ε = 8/255, with adversarial examples generated for 1000 randomly sampled test images.

They evaluate four deployment patterns: centralized training (N = 1), deep ensembles on the full dataset with different initializations, distributed i.i.d. ensembles on disjoint data, and distributed non-i.i.d. ensembles using a Dirichlet distribution with α = 0.9. Node counts are N = 3, 5, and 7. Inference for ensembles uses logit averaging before softmax.

For the joint robustness question, they run the NSGA-II genetic algorithm adapted from Optuna (integrated via Ray), with a population size of 20 over 5 generations, giving 100 distinct hyperparameter combinations, and analyze the resulting Pareto fronts over clean accuracy and the minimum of the two robust accuracies.

Hardware and software: Ubuntu 24.04, two NVIDIA A40 GPUs, two AMD EPYC 9554 64-core processors, 512 GB RAM, Python 3.11.11, CUDA 12.5, Lightning 2.5.0, and Ray Tune 2.40.0. Code is available at the linked GitHub repository.

Why This Matters

The paper reframes adversarial robustness as partly a hyperparameter-selection problem rather than one that necessarily requires expensive adversarial training. It shows that different black-box attack families pull model geometry in opposite directions — smoothness helps against query attacks but hurts against transfer attacks — so defenses developed for one threat model may weaken the other. It also shows that distributed training setups are unusually well positioned to exploit this tuning, which matters for federated and sharded training deployments.

Real-world applications:

• Machine-learning-as-a-service (MLaaS): providers exposing prediction APIs face query-based attacks by design; the query-attack tuning findings apply directly.
• Federated and distributed learning systems: the paper's strongest results come from distributed instances with disjoint data, matching real federated deployments.
• Safety-critical perception systems such as autonomous driving and facial recognition, where adversarial inputs are a stated threat.
• Resource-constrained model training pipelines: the reported 78% epoch reduction versus JPEG-based defenses (186 down to 41) and avoidance of adversarial training's up-to-40 GPU hours per model translate to direct compute and cost savings.

Industry relevance: the recommended interventions require no change to model architecture and no adversarial data generation, making them cheap to adopt in existing training pipelines. The comparison against adversarial training and JPEG compression gives practitioners concrete time-versus-robustness baselines.

Future Directions

• Configurations and appendix details. The paper references the best-performing hyperparameter configurations and average results in the appendix; the truncated content does not include them, so exact tuned values are not reported here.
• Extending beyond ResNet and the two datasets. Results for MobileNetV2 are deferred to the appendix, and the study covers CIFAR-10 and ImageNet; broader architecture and dataset coverage remains open.
• Understanding saturation and node count. Deep-ensemble gains saturate beyond N = 3, and non-i.i.d. results vary widely with class splits, including N = 5 dropping below 80% clean accuracy — the interaction between data heterogeneity and tuning is not fully resolved.
• Combining hyperparameter tuning with existing defenses. The paper compares against adversarial training and JPEG compression; whether tuning stacks additively with adversarial training or input transformations is left unaddressed in the available content.
• Attack-aware adaptive adversaries. The findings assume fixed state-of-the-art attacks (Common Weakness and SquareAttack); whether an attacker aware of the tuned configuration could re-optimize surrogates or query strategies against it is not reported.

Target Audience

• Machine learning robustness and security researchers studying black-box adversarial attacks and training-time defenses.
• Practitioners who train and deploy image classifiers and want low-cost robustness improvements without adversarial training.
• Federated learning and distributed training engineers, given the paper's emphasis on distributed setups.
• Graduate students and engineers with working knowledge of SGD, hyperparameter tuning, and adversarial examples who want an accessible entry point into how training dynamics affect robustness.

Authors’ abstract

In this paper, we present the first detailed analysis of how training hyperparameters -- such as learning rate, weight decay, momentum, and batch size -- influence robustness against both transfer-based and query-based attacks. Supported by theory and experiments, our study spans a variety of practical deployment settings, including centralized training, ensemble learning, and distributed training. We uncover a striking dichotomy: for transfer-based attacks, decreasing the learning rate significantly enhances robustness by up to $64\%$. In contrast, for query-based attacks, increasing the learning rate consistently leads to improved robustness by up to $28\%$ across various settings and data distributions. Leveraging these findings, we explore -- for the first time -- the training hyperparameter space to jointly enhance robustness against both transfer-based and query-based attacks. Our results reveal that distributed models benefit the most from hyperparameter tuning, achieving a remarkable tradeoff by simultaneously mitigating both attack types more effectively than other training setups.