# Learning to Transform Dynamically for Better Adversarial Transferability

Rongyi Zhu ∗†Zeliang Zhang Susan Liang Zhuo Liu Chenliang Xu
University of Rochester
{rongyi.zhu, zeliang.zhang, susan.liang, zhuo.liu<EMAIL_ADDRESS>Equal contributionProject leadCorresponding author

###### Abstract

Adversarial examples, crafted by adding perturbations imperceptible to humans,
can deceive neural networks. Recent studies identify the adversarial
transferability across various models, i.e., the cross-model attack ability of
adversarial samples. To enhance such adversarial transferability, existing
input transformation-based methods diversify input data with transformation
augmentation. However, their effectiveness is limited by the finite number of
available transformations. In our study, we introduce a novel approach named
Learning to Transform (L2T). L2T increases the diversity of transformed images
by selecting the optimal combination of operations from a pool of candidates,
consequently improving adversarial transferability. We conceptualize the
selection of optimal transformation combinations as a trajectory optimization
problem and employ a reinforcement learning strategy to effectively solve the
problem. Comprehensive experiments on the ImageNet dataset, as well as
practical tests with Google Vision and GPT-4V, reveal that L2T surpasses
current methodologies in enhancing adversarial transferability, thereby
confirming its effectiveness and practical significance. The code is available
at https://github.com/RongyiZhu/L2T.

##  1 Introduction

Neural networks have been adopted as the building block for various real-world
applications, such as face detection [39, 44, 28], autonomous driving [12,
25], and medical diagnosis [1, 37]. However, neural networks are vulnerable to
adversarial examples, which contain human imperceptible adversarial
perturbations on the benign input. This issue is increasingly concerning
researchers, as it is essential for ensuring the trustworthy use of neural
networks [3, 73, 19, 70, 69, 72, 71].

Figure 1: For input transformation-based attacks, most works design a fixed
transformation and use it to craft the adversarial perturbation. The learning-
based methods preliminarily predict augmentation strategies for current images
for better adversarial transferability. These methods cannot respond to the
distribution shifts between benign images and adversarial examples. We propose
Learning to Transform (L2T), which uses the dynamic of the optimal
transformation in each iteration to further boost the adversarial
transferability.

In real-world scenarios of adversarial attacks [56, 42, 29], the target model
is usually inaccessible. To attack these inaccessible models, many studies
instead rely on surrogate models to generate adversarial examples [61, 7, 74]
and use generated samples to mislead the target model. This cross-model attack
ability of samples generated on the surrogate models is called “adversarial
transferability.” Numerous research studies are dedicated to enhancing
adversarial transferability, which can be classified into four categories:
gradient-based methods [7, 26, 47, 50], input transformation-based methods
[61, 8, 26, 49], architecture-based methods [23, 55], and ensemble-based
methods [30, 64]. Among these attack methodologies, input transformation-based
methods gain much popularity because of their plug-n-play advantage, which can
be seamlessly integrated into other attack techniques [47, 7]. However, we
discover that existing input transformation-based methods adopt the same
transformation when crafting adversarial examples, limiting the flexibility of
transformation operations. We hypothesize that we should select the optimal
transformation dynamically in each iteration to enhance the adversarial
transferability.

As shown in Fig. 1, prior input transformation-based methods often revolve
around designing fixed augmentation strategies like resizing inputs [61],
block masking [10], or mix-up [49]. A more dynamic approach is presented by
[67], advocating the precomputation of various sequences of augmentation
strategies to apply to each iteration to enhance the attack performance.
Complementing this, Wu et al. [57] proposes the use of generative models for
image augmentation to boost the adversarial transferability. Some studies go
further, combining multiple augmentation strategies to amplify input diversity
to improve the performance. For example, Yuan et al. [68] introduces a neural
network that generates a prediction of the optimal transformation strategy and
applies the strategy to improve performance. A further improvement is hindered
by the limited number of transformations.

To fully utilize the limited number of transformations, a natural idea is to
use a combination of operations. However, it is not always efficient to
combine different transformations together for attack, as reported in [53]. We
expect to find an optimal combination of transformations to achieve a trade-
off between operation diversity and adversarial transferability. Nonetheless,
the enormity of the search space presents a significant challenge, impeding
the identification of the most efficacious combination of transformations
during an attack for optimal adversarial transferability. To surmount this
hurdle, we conceptualize the search process of the optimal combination of
transformations as a problem of optimal trajectory search. Each node within
this trajectory represents an individual transformation, and each directed
edge means a transfer of the optimal transformation from the current step to
the next step. To effectively obtain the optimal trajectory in such a large
search space, we design a reinforcement learning-based approach, capitalizing
on its demonstrated efficacy in navigating expansive search domains.

In this paper, we introduce a novel framework called Learning to Transform
(L2T) to improve the adversarial transferability of generated adversarial
examples. L2T dynamically learns and applies the optimal input transformation
in each iteration. Instead of exhaustively enumerating all possible input
transformation methods, we employ a reinforcement learning-based approach to
reduce the search space and better utilize the transformations to improve the
diversity. In each iteration of the adversarial attack, we sample a subset of
transformations and apply them to the adversarial examples. Subsequently, we
update the sampling probabilities by conducting gradient ascent to maximize
the loss. Our method effectively learns the dynamics of optimal
transformations in attacks, leading to a significant enhancement in
adversarial transferability. Additionally, compared to other learn-based
adversarial attack methods, our approach is more efficient for adversarial
example generation, as it obviates the need for additional training modules.

We summarize our contributions as follows,

  * •

We formulate the problem of optimal transformation in adversarial attacks,
which studies finding the optimal combination of transformations to increase
the input diversities, thus improving the adversarial transferability.

  * •

We propose Learning to Transform (L2T) that exploits the optimal
transformation in each iteration and dynamically adjusts transformations to
boost adversarial transferability.

  * •

Extensive experiments on the ImageNet dataset demonstrate that L2T outperforms
other baselines. We also validate L2T’s superiority in real-world scenarios,
such as Google Vision and GPT-4V.

##  2 Related Work

###  2.1 Adversarial Attack

Various adversarial attacks have been proposed, _e.g_., gradient-based attack
[13, 20, 34], transfer-based attack [7, 61, 54, 33], score-based attack [18,
22, 4], decision-based attack [2, 21, 52], generation-based attack [58, 48].
Among these, transfer-based attacks do not require the information of the
victim models, making it popular to attack the deep models in the real world
and raise more research interests. To improve adversarial transferability,
various momentum-based attacks have been proposed, such as MI-FGSM [7], NI-
FGSM [26], VMI-FGSM [47], EMI-FGSM [50], _etc_. Several input transformation
methods are also proposed, such as DIM [61], TIM [8], SIM [26], Admix [49],
SIA [53], STM [11], BSR [46], _etc_., which augment images used for
adversarial perturbation computation to boost transferability. The input
transformation-based methods can be integrated into the gradient-based attacks
for better performance.

Delving into the input transformation-based methods, most works are limited to
designing a fixed transformation to augment the images, which limits the
diversity of transformed images and the adversarial transferability. To
address this issue, some researchers [57, 68, 67] propose to augment the
images with a set of multiple transformations predicted by a pre-trained
network. Automatic Model Augmentation (AutoMA) [67] adopts a Proximal Policy
Optimization (PPO) algorithm in search of a strong augmentation policy.
Adversarial Transformation-enhanced Transfer Attack (ATTA) [57] proposes to
employ an adversarial transformation network in modeling the most harmful
distortions. Adaptive Image Transformation Learner (AITL) [68] incorporates
different image transformations into a unified framework to learn adaptive
transformations for each benign sample to boost adversarial transferability.
By applying optimal multiple transformations, the adversarial attack
performance is largely improved.

###  2.2 Adversarial Defense

Various defense approaches have been proposed to mitigate the threat of
adversarial attacks, such as adversarial training [34, 43, 51], input
preprocessing [59, 35], feature denoising [24, 60, 66], certified defense [36,
14, 6], _etc_. Liao et al. [24] train a denoising autoencoder, namely the
High-level representation guided denoiser (HGD), to purify the adversarial
perturbations. Xie et al. [59] propose to randomly resize the image and add
padding to mitigate the adversarial effect, namely the Randomized resizing and
padding (R&P). Xu et al. [65] propose the Bit depth reduction (Bit-Red)
method, which reduces the number of bits for each pixel to squeeze the
perturbation. Liu et al. [31] defend against adversarial attacks by applying a
JPEG-based compression method to adversarial images. Cohen  _et al_. [6] adopt
randomized smoothing (RS) to train a certifiably robust classifier. Naseer et
al. [35] propose a Neural Representation Purifier (NRP) to eliminate
perturbation.

##  3 Learning to Transform

###  3.1 Task definition

The crafting of adversarial examples usually takes an iterative framework to
update the adversarial perturbation. Given a benign sample $\bm{x}$ and the
corresponding label $y$, a transferable attack takes a surrogate classifier
$f_{\bm{\theta}}$ and iteratively updates the adversarial example
$\bm{x}^{adv}$ to maximize the loss of classifying $f_{\theta}(\bm{x}^{adv})$
to $y$. Take I-FGSM [40] as an example. The adversarial example
$\bm{x}^{adv}_{t}$ at the $t$-th iteration can be formulated as follows:

$\bm{x}^{adv}_{t}=\bm{x}^{adv}_{t-1}+\alpha\cdot{\text{sign}}(\nabla_{\bm{x}^{adv}_{t-1}}J(f_{\bm{\theta}}(\bm{x}^{adv}_{t-1},y))),$
(1)

where we denote $\alpha$ as the step size, $J(\cdot,\cdot)$ as the
classification loss function. As identified by previous studies, the
adversarial example exhibits a characteristic of transferability, where the
adversarial examples generated by the surrogate model can fool other neural
networks.

Input transformation-based methods are one of the most effective methods to
boost adversarial transferability. With these methods, the adversarial samples
are firstly transformed by a set of image transformations and then proceeded
to gradient calculation. Let $\varphi$ denote a set of image transformations
operation $o$, where $\varphi=\\{o^{i}|i\in\\{1,2,...,k\\}\\}$. At the $t$-th
iteration, the adversarial example $\bm{x}^{adv}_{t}$ is transformed
sequentially by $o^{i}$ as follows,

$\varphi(\bm{x}^{adv}_{t})=o^{k}\oplus o^{k-1}\oplus\cdots\oplus
o^{1}(\bm{x}^{adv}_{t}),$ (2)

where $o^{2}\oplus o^{1}(\bm{x})$ denotes the operation
$o^{2}(o^{1}(\bm{x}))$, $o^{1},o^{2}\in\varphi$. We use the gradient of
$\varphi(\bm{x}^{adv}_{t})$ with respect to the loss function to update the
adversarial perturbation as Eq. 1.

There are two categories for selecting the operation set $\varphi$ in the
previous study. One line of research focuses on designing fixed
transformation-based methods, which use a pre-defined transformation
$\varphi$. For example, Admix chooses mixup and scaling for transformation
$\varphi$. The other line of research proposes the learning-based
transformation methods, which usually use a generative model to directly
generate the transformed $\varphi(x)$. Compared with the fixed transformation-
based methods, learning-based methods enjoy more diversity of transformed
images, leading to a better performance in adversarial transferability. In our
work, we study the learning-based transformation methods.

###  3.2 Motivation

Figure 2: Comparsion for different operations in boosting the adversarial
transferability. The number in the box denotes the number of fooled models
(Maximum: 9). In (a), the horizontal axis denotes different transformation
operations and the vertical axis denotes different benign examples. In (b),
the vertical axis denotes the transformation used in the first iteration and
the horizontal axis denotes the transformation used in the second iteration

Previous research designs lots of transformations to improve the diversity of
images, thus guiding the adversarial attacks to focus more on the invariant
robust features. However, it does not always work by increasing the number of
transformed images for attacks to boost the adversarial transferability.
Because some combination of transformations can cause damage to original
examples, losing massive amounts of information used for transferable attacks.
A natural question occurs to us, for one image, does there exist the optimal
combination of transformations for the best adversarial transferability?

To answer this question, we start by generating adversarial examples in one
iteration. We take an example of crafting adversarial examples using ResNet-18
to attack other $9$ models111ResNet-101, DenseNet-121, ResNext-50,
Inception-v3, Inception-v4, ViT, PiT, Visformer, Swin. We denote $5$
operations for input transformation methods, namely the crop, rotation,
shuffle, scaling, and mix-up. We use these operations on five images for
attacks and report the number of models fooled. We report the results in Fig.
2. It can be seen that by shuffle, we can achieve the maximum transferable
attack success rates on a dog image, indicating the optimal transformations in
all possible $5$ operations.

We continue our discussion in the two-iteration scenario. Following the same
setting in one iteration, we report the number of fooled models. It can be
seen that by choosing crop in the first iteration and scaling for the second
iteration, which successfully fooled $6$ models out of $9$. We also notice
that shuffle, the optimal transformation in one iteration, can not maintain
the optimal performance. The average fooled model for shuffle is less than
crop in $0.2$.

Figure 3: There exists an optimal transformation trajectory for boosting
adversarial transferability. However, the search space increases exponentially
with iteration number and operation number.

Following the aforementioned discussion, we move on to generating adversarial
examples in $3$ iterations, where we only take one operation as the image
transformation to attack the image. As exemplified in Fig. 3, there are
$5\times 5\times 5$ possible trajectories to transform the image for attacks.
Among these trajectories, it can achieve the best performance by first
shuffling, then rotating, and last shuffling the image. It should be noted it
cannot consistently achieve the best performance by increasing the number of
transformations for a higher diversity. As shown in Fig. 3, we respectively
take the scaling, shuffle, and rotation operations at each iteration in
trajectory 2. However, it has the worst attack success rate among the
presented results.

Generalizing the previous problem to common cases, we are motivated to
identify an optimal transformation trajectory $\mathcal{T}$, which is defined
as the sequence of transformation used in each iteration as
$(\varphi_{1},\varphi_{2},\dots,\varphi_{T})$, for the best adversarial
transferability. Each element $\varphi_{T}$ denotes the transformation used in
iteration $t$. It can be formulated as follows:

$\displaystyle\mathcal{T}^{*}=\operatorname*{argmax}_{\mathcal{T}}(\mathbb{E}[\mathcal{L}(f_{\bm{\theta}}(\bm{x}^{adv}_{\mathcal{T}}),y)]),$
(3)

where we denote $\bm{x}^{adv}_{\mathcal{T}}$ as the adversarial example
generated by the surrogate model under transformation trajectory
$\mathcal{T}$.

However, finding $\mathcal{T}^{*}$ is hard. First, the search space is large.
For example, supposing five candidate transformations, even if we only take
one operation in one iteration to transform the image, we will still have an
enormous search space for ten iterations that will be $5^{10}$. The number of
possible transformation trajectories grows exponentially with increasing the
number of iterations and candidate transformations. Second, we can not access
the black-box model $f$, making it hard to optimize the Eq. 3 directly.
Besides, as identified in the previous work [68], each image has a different
optimal transformation to boost the adversarial transferability. There is no
optimal transformation trajectory shared for all images.

###  3.3 Methodology

The problem of Eq. 3 can be transformed into an optimal trajectory search
problem, on which reinforcement learning has shown great compatibility. We are
inspired to take a reinforcement learning-based approach in solving this
optimization problem to enhance adversarial transferability.

Supposing we have $M$ operations $\\{o^{1},o^{2},\dots,o^{M}\\}$ in total, the
optimal transformation trajectory $\mathcal{T}$ is a temporal sequence of the
combination of different operations. The probability $\bm{p}$ contains $M$
possibilities $\\{p_{o^{1}},p_{o^{2}},...,p_{o^{M}}\\}$ for each iteration.
Each element $p_{o^{m}}$ denotes the possibility of sampling operation
$o^{m},m\in\\{1,2,...,M\\}$. And $p_{o^{m}}$ follows
$\sum\limits_{m=1}^{M}p_{o^{m}}=1$. A transformation $\varphi$ consists $K$
operations $o^{k},k\in\\{1,2,...,M\\}$. We sampled $K$ operations from
$\bm{p}$. We have the possibility of a transformation $\varphi$ by
$P(\varphi)=\prod\limits_{k=1}^{K}p_{o^{k}}$.

For each iteration $t$, we sample a combination of transformation
$\varphi_{t}$. Each transformation in $\varphi_{t}$ is sampled from candidates
depending on $\bm{p}$. To get an optimal trajectory
$\mathcal{T}=(\varphi_{1},...,\varphi_{T})$, we need to dynamically optimize
the sampling distribution $\bm{p}$ in each iteration $t$. We formulate the
problem of searching optima $\bm{p}^{*}$ in each iteration as follows,

$\displaystyle\bm{p}^{*}$
$\displaystyle=\arg\max\limits_{\bm{p}}\mathbb{E}_{\varphi\sim\textbf{p}}[\mathcal{L}(f_{\bm{\theta}}(\varphi(\tilde{\bm{x}}^{adv})),y)]$
(4) $\displaystyle\textit{s.t.}\quad\tilde{\bm{x}}^{adv}$
$\displaystyle=\arg\max\limits_{\bm{x}^{adv}}\mathbb{E}_{\varphi\sim\textbf{p}}[\mathcal{L}(f_{\bm{\theta}}(\varphi(\bm{x}^{adv})),y)],$

which is a bi-level optimization. The inner optimization targets to optimize
the adversarial example, and the outer optimization tries to find the optimal
sampling probability. Following [27], we adopt an one-step optimization
strategy to derive the approximated $\bm{p}^{*}$:

$\bm{p}^{*}\approx\bm{p}+\rho\cdot\bm{g}_{\bm{p}},$ (5)

where the $\rho$ is the learning rate and $\bm{g}_{\bm{p}}$ is the gradient
for $\bm{p}$.

Algorithm 1 Gradient policy for optimal augmentation search.

Classifier $f(\cdot)$;The benign sample $\bm{x}$ with ground-truth label $y$;
Loss function $\mathcal{L}(\cdot,\cdot)$; candidate operation pool $\Gamma$,
the number of iterations $T$, perturbation scale $\epsilon$, policy learning
rate $\rho$, number of operations $K$, number of transformations $L$, decay
factor $\mu$;

$\alpha=\epsilon/T$, $\bm{g}_{0}=0$, $\bm{x}^{adv}_{0}=\bm{x}$,
$\bm{p}\sim\mathcal{N}(0,1)$

while $t=1\leftarrow T$ do

1\. Under the distribution $\bm{p}$, sample $L$ transformation $\varphi_{t}$,
each consisting of $K$ operations.

2\. Transform adversarial examples:

$\varphi^{l}_{t}(x^{adv}_{t})=o^{K}\oplus o^{K-1}\oplus\cdots\oplus
o^{1}(\bm{x}^{adv}_{t})$.

3\. Calculate the average gradient:

$\bar{\bm{g}}=\frac{1}{L}\sum\limits_{l=1}^{L}\nabla_{\bm{x}^{adv}_{t-1}}\mathcal{L}(\varphi^{l}_{t}(\bm{x}^{adv}_{t-1}),y)$.

4\. Update the momentum:

$\bm{g}_{t}=\mu\bm{g}_{t-1}+\frac{\bar{\bm{g}}}{||\bar{\bm{g}}||_{1}}$.

5\. Update the adversarial example:

$\bm{x}^{adv}_{t}=\text{clip}(\bm{x}^{adv}_{t-1}+\alpha\cdot\text{sign}(\bm{g}_{t}),0,1)$.

6\. Calculate the probability gradient:

$\bm{g}_{\bm{p}}=\frac{\partial\left(\frac{1}{L}\sum\limits_{l=1}^{L}\mathbf{P}(\varphi^{l}_{t})\mathcal{L}(f_{\bm{\theta}}(\varphi^{l}_{t}(\mathbf{x}_{t}^{adv})),y)]\right)}{\partial\mathbf{P}(\varphi^{l}_{t})}$.

7\. Update the probability:

$\bm{p}=\bm{p}+\rho\cdot\bm{g_{p}}$.

end while

$\bm{x}^{adv}_{T}$.

Implementation details. We present the overview of our method in Fig. 4.
First, we sample $L$ sequences of transformation
$\varphi^{l}_{t},l\in[1,2,...,L]$, depending on the sampling distribution
$\bm{p}$. Next, we get the transformed examples denoted as
$\varphi^{l}_{t}(x^{adv}_{t})$. The probability of each sequence
$\varphi^{l}_{t}$ is $\bm{P}(\varphi^{l}_{t})$. We use $\varphi_{t}$ to
denotes all $L$ transformation,
$\varphi_{t}=\\{\varphi^{1}_{t},\varphi^{2}_{t},...,\varphi^{L}_{t}\\}$. Then,
we use Eq. 1 to update the adversarial examples for each iteration. The
gradient is calculated by loss between $L$ transformed examples and their
corresponding labels. Last, after updating the adversarial example, we
recompute the approximate $\bm{p}$. Specifically, we compute the gradient
$g_{o^{k}}$ of each sampled operation $o^{k}$ as:

$\displaystyle g_{o^{k}}$
$\displaystyle=\frac{\partial\mathbb{E}_{\varphi_{t}\sim\textbf{p}}[\mathcal{L}(f_{\bm{\theta}}(\varphi_{t}(\mathbf{x}^{adv}_{t})),y)]}{\partial\mathbf{P}(\varphi_{t})}\cdot\frac{\partial\mathbf{P}(\varphi_{l})}{\partial
p_{o^{k}}}$ (6)
$\displaystyle=\frac{\partial\sum\limits_{l=1}^{L}\mathbf{P}(\varphi^{l}_{t})\mathcal{L}(f_{\bm{\theta}}(\varphi^{l}_{t}(\mathbf{x}^{adv}_{t})),y)])}{\partial\mathbf{P}(\varphi^{l}_{t})}\cdot\frac{\partial\mathbf{P}(\varphi_{l})}{\partial
p_{o^{k}}}$
$\displaystyle=\sum\limits_{l=1}^{L}\mathcal{L}(f_{\bm{\theta}}(\varphi^{l}_{t}(\mathbf{x}^{adv}_{t}),y))\cdot\frac{\partial\mathbf{P}(\varphi^{l}_{t})}{\partial
p_{o^{k}}}.$

Figure 4: Overview of the pipeline in L2T. We use probability in sampling $L$
transformations and update this probability through gradient ascent.

We concat the gradients for each operation as
$[g_{o^{1}},g_{o^{2}},\dots,g_{o^{K}}]$, which is denoted as
$\bm{g}_{\bm{p}}$. We use gradient ascent to update $\bm{p}$ by
$\bm{g}_{\bm{p}}$ with the learning rate $\rho$.

##  4 Experiments

###  4.1 Setup

Figure 5: Average attack success rates (%) of ten models on the adversarial
examples crafted on each model. The x-axis of each sub-figure denotes
different attack methods. We include the detail number in our supplementary
material.

Models. We evaluate the proposed method in three categories of target models.
(1) Normally trained model: We select ten well-known models for experiments.
ResNet-18 [15], ResNet-101 [15], ResNext-50 [63], DenseNet-121 [17],
Inception-v3 [41], and Inception-v4 [41], ViT-B [9], PiT [16], Visformer [5],
and Swin [32]. All of these models are pre-trained on the ImageNet dataset.
(2) Adversarial trained models: we select four defense methods in our
experiments. They are adversarial training (AT) [43], high-level
representation guided denoiser (HGD) [24], neural representation purifier
(NRP) [35], and randomized smoothing (RS) [6]. (3) Vision API: to imitate a
practical scenario, we compare the attack performance on popular vision API.
We chose Google Vision, Azure AI, GPT-4V, and Bard. For categories (2) and
(3), we use ensemble-based attack. We choose two CNN-based models, ResNet18
and Inception-v4, and two transformer-based models, Visformer and Swin, to
construct the ensemble surrogate model.

Dataset. Following previous works [61, 53, 49], we randomly choose $1,000$
images from ILSVRC 2012 validation set [38]. All images are classified
correctly by the models.

Baseline. We compare L2T with other input transformation adversarial methods.
There are two categories of previous methods. The fixed transformation attack
followed a fixed transformation scheme. We select TIM [8], SIM [26], Admix
[49], DEM [75], IDE [62], Mask [10], $\rm S^{2}$IM [33], BSR [45], and SIA
[53] for comparison. The learned transformation attack followed a set of
transformations predicted by a trained network to generate adversarial
examples. We also compare our method with learned transformation attacks, such
as AutoMA [67], ATTA [57], and AITL [68]. All these methods are integrated
with MI-FGSM [7] to generate adversarial examples.

Evaluation Settings. We follow the hyper-parameter setting of MI-FGSM and set
the perturbation budget $\epsilon=16$, number of iteration $T=10$, step size
$\alpha=\epsilon/T=1.6$ and decay factor $\mu=1$. For our method, we adopt the
number of operations as $2$, the number of samples as $10$, and the learning
rate $\rho$ as $0.01$. For the candidate operation, we chose ten categories of
transformations. Each category contains ten specific operations with different
parameters. We will discuss the detailed settings of our method and other
baselines in the supplementary materials.

Figure 6: Attack success rates (ASR) (%) of adversarial examples generated by
L2T with various number of operations $K$. We include the detail number in our
supplementary material.  Figure 7: We integrate the ensemble-based attack with
input transformation and evaluate the performance on defense methods and
popular vision APIs. We include the detail number in our supplementary
material.

###  4.2 Evaluations on single models

Our proposed L2T exhibits better adversarial transferability to various input
transformation based attacks. We take a single model as the surrogate model
and evaluate the average attack success rate (ASR), _i.e_., the average
misclassification rates across ten models. We summarized our results in Figure
5. Each subfigure denotes the attacker generates the adversarial examples on
the corresponding models and its x-axis denotes the attack algorithm used.

First, we observe that L2T consistently outperforms all other attackers,
regardless of the surrogate model. Other baseline methods have various
adversarial transferability according to the surrogate models. For example,
the BSR performs to be the strongest baseline on ResNet-18. However, the BSR
cannot remain efficient when the surrogate model is changed to Swin or PiT. In
contrast, our proposed L2T is suitable for all the surrogate models being
tested. These results also strengthen our argument that we should dynamically
choose the transformation to fit the surrogate models. Specifically, in the
worst case (subfig. c), our proposed L2T still outperforms the strongest
baseline ($S^{2}$IM) by $2.1\%$. Overall, L2T outperforms the other baseline
by 22.9% on average ASR.

###  4.3 Evaluations on defense methods

L2T is also capable of adversarial robust mechanisms. We test the attack
performance of L2T against several defense mechanisms, including AT, HGD, NRP,
and RS. We choose the ensemble setting to attack these defense approaches. We
use the ensemble of four models, ResNet-18, Inception-v4, Visformer, and Swin,
as the surrogate model. We summarized our results in Figure 7 (a), (b), (c),
and (d). Each subfigure denotes the model to be attacked and its x-axis
denotes the attack algorithm used.

From Fig. 7, it is clear that L2T remains efficient. L2T consistently
outperforms other methods against various defense methods. Notably, it
achieves the attack success rate of $47.9\%$, $98.5\%$, $87.2\%$, and $46.7\%$
on AT, HGD, NRP, and RS, respectively. Even on the certified defense RS, the
strongest defense among the four, L2T achieves the attack success rate of
$46.7\%$, which exceeds the best baseline (AITL) by $4.6\%$. This is also the
biggest improvement L2T made compared to other defenses. This indicates that
the dynamic of iteration also exists in the adversarial robust mechanism,
which can be used to dimish the its performance.

###  4.4 Evaluations on vision API

Our proposed L2T can also perform well in realistic scenarios. To imitate the
real-world application, we test the performance of L2T on Vision API. We use
the same setting in sec. 4.3 to craft adversarial examples. We choose Google
Vision (Figure 7 (e)) and Azure AI (Figure 7 (f)) to evaluate attacks on
vision-only API. We also choose ChatGPT-4V (Figure 7 (g)) and Gemini (Figure 7
(f)) to evaluate attacks on the foundation model API.

Table 1: Attack success rates (%) of adversarial examples by L2T and Rand
(randomly choose transformation in each iteration).

ResNet-18 | ResNet-101 | ResNeXt-50 | DenseNet-121 | Inception-v3 | Inception-v4 | ViT | PiT | Visformer | swin
---|---|---|---|---|---|---|---|---|---
Rand | 52.35 | 59.06 | 53.19 | 56.64 | 43.01 | 44.41 | 58.41 | 54.48 | 65.08
L2T (Ours) | 90.00 | 91.90 | 91.00 | 92.80 | 78.80 | 82.40 | 90.10 | 93.50 | 96.20

As shown in Fig. 7, L2T is generally the best attacker to the real-world API.
All attacks perform better on foundation model API than vision-only API. For
vision-only API, L2T outperforms the strongest baseline by $8.7\%$ and
$12.6\%$, respectively. For foundation model API, L2T achieves nearly $100\%$
attack success rate on both GPT-4V and Gemini.

Figure 8: Attack success rates (ASR) (%) of adversarial examples generated by
L2T with various number of transformations $L$. We include the detail number
in our supplementary material.

###  4.5 Ablation study

On the numbers of operation $K$. As shown in Fig. 6, we study the impact of
$K$ on adversarial transferability. We craft the adversarial example on
ResNet-18 and evaluate them on the other nine models. There is a clear
difference between one operation and two operations. The average attack
success rate increases by $8.09\%$, from $80.89\%$ to $88.98\%$. However, when
the $K\geq 3$, the improvement becomes marginal. The average attack success
rate only increases by $2.29\%$ when $K$ is increased from $2$ to $5$. Thus,
$K$ should be moderately settled as $2$.

Figure 9: Average attack success rates (ASR) (%) of adversarial examples
generated by L2T with various number of steps $T$. We include the detail
number in our supplementary material.

On the number of transformations $L$. We conducted experiments on the number
of transformations $L$. We craft the adversarial example on ResNet-18 and
evaluate them on the other nine models. We choose $L$ from 1 to 50. From Fig.
8, we observe that the adversarial transferability improves steadily with the
number of transformations. The increase is significant when the number of
transformations grows from 1 to 20, which improves from an average attack
success rate of $75.7\%$ to an average attack success rate of $91.1\%$.
However, transferability does not increase significantly after the number
exceeds $20$, where the average attack success rate only increases $1.5\%$. To
keep the balance between computation efficiency and adversarial
transferability, we suggest the number of samples set to 20.

On the number of iterations $T$. We discuss the number of iterations among
different attack approaches. We craft the adversarial example on ResNet-18 and
compare the average attack success rate of 10 models. As shown in Fig. 9, for
all the attack methods, the attack success rate increased steadily for the
first $10$ iterations. L2T achieves the fastest speed of increase, which
reaches $89.47\%$ at iteration $10$. After $10$ iterations, most of the
methods struggled to make improvements. For example, the Admix goes around
$71\%$. The performance of $\rm S^{2}$IM even decreases from $73\%$ to $70\%$.
Meanwhile, L2T still maintains a stable increase, from $89.47\%$ to $94.77\%$.

Figure 10: The average attack success rates (%) of adversarial examples
crafted by L2T and L2T without a single transformation. $-$ indicates removing
such transformation.

Comparison with random sampling. We compare the learnable strategy with random
sampling. As shown in Tab. 1, there is a clear gap of the attack success rate
between random sampling and gradient-guided sampling. The minimum difference
is $31.12\%$ with setting Visformer as the surrogate model. For other
surrogate models, the gap is even larger. This experiment indicates random
sampling cannot effectively sample the best transformation trajectory, and the
transformation in each iteration needs to be chosen carefully.

Operation candidates analysis. We conducted an ablation study for the
operation candidates. We subtract each operation in the candidates and conduct
L2T on the updated operation candidates. From Fig. 10, we observe that
subtracting any operations will lead to a performance decrease. For example,
by subtracting the scale operation, the performance decreases for $23.5\%$.
Meanwhile, subtracting mixup and translation only results in a $3.1\%$
decrease.

##  5 Conclusion

In this paper, we study the dynamic property for input transformation.
Utilizing this property, we propose L2T to optimize the input transformation
in each iteration. By updating a sampling probability, our method provides an
approximate solution to input transformation optimization. Our experiments
further study the effectiveness of our methods. Our method performs
consistently well among different targeted models. This paper provides a new
perspective to understand the transferability of adversarial examples.

Acknowledgement. This work was supported by NSF under grant 2202124 and the
Center of Excellence in Data Science, an Empire State Development-designated
Center of Excellence. The content of the information does not necessarily
reflect the position of the Government, and no official endorsement should be
inferred.

## References

  * Bakator and Radosav [2018] Mihalj Bakator and Dragica Radosav.  Deep learning and medical diagnosis: A review of literature.  _Multimodal Technologies and Interaction_ , 2(3):47, 2018.
  * Brendel et al. [2018] Wieland Brendel, Jonas Rauber, and Matthias Bethge.  Decision-Based Adversarial Attacks: Reliable Attacks Against Black-Box Machine Learning Models.  In _Proceedings of the International Conference on Learning Representations_ , 2018.
  * Chatila et al. [2021] Raja Chatila, Virginia Dignum, Michael Fisher, Fosca Giannotti, Katharina Morik, Stuart Russell, and Karen Yeung.  Trustworthy ai.  _Reflections on Artificial Intelligence for Humanity_ , pages 13–39, 2021.
  * Chen et al. [2017] Pin-Yu Chen, Huan Zhang, Yash Sharma, Jinfeng Yi, and Cho-Jui Hsieh.  Zoo: Zeroth order optimization based black-box attacks to deep neural networks without training substitute models.  In _Proceedings of the 10th ACM workshop on artificial intelligence and security_ , pages 15–26, 2017.
  * Chen et al. [2021] Zhengsu Chen, Lingxi Xie, Jianwei Niu, Xuefeng Liu, Longhui Wei, and Qi Tian.  Visformer: The vision-friendly transformer.  In _Proceedings of the IEEE/CVF international conference on computer vision_ , pages 589–598, 2021.
  * Cohen et al. [2019] Jeremy Cohen, Elan Rosenfeld, and J. Zico Kolter.  Certified Adversarial Robustness via Randomized Smoothing.  In _Proceedings of the International Conference on Machine Learning_ , pages 1310–1320, 2019.
  * Dong et al. [2018] Yinpeng Dong, Fangzhou Liao, Tianyu Pang, Hang Su, Jun Zhu, Xiaolin Hu, and Jianguo Li.  Boosting adversarial attacks with momentum.  In _Proceedings of the IEEE conference on computer vision and pattern recognition_ , pages 9185–9193, 2018.
  * Dong et al. [2019] Yinpeng Dong, Tianyu Pang, Hang Su, and Jun Zhu.  Evading Defenses to Transferable Adversarial Examples by Translation-Invariant Attacks.  In _Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition_ , pages 4312–4321, 2019.
  * Dosovitskiy et al. [2020] Alexey Dosovitskiy, Lucas Beyer, Alexander Kolesnikov, Dirk Weissenborn, Xiaohua Zhai, Thomas Unterthiner, Mostafa Dehghani, Matthias Minderer, Georg Heigold, Sylvain Gelly, et al.  An image is worth 16x16 words: Transformers for image recognition at scale.  _arXiv preprint arXiv:2010.11929_ , 2020.
  * Fan et al. [2022] Mingyuan Fan, Cen Chen, Ximeng Liu, and Wenzhong Guo.  Maskblock: Transferable adversarial examples with bayes approach.  _arXiv preprint arXiv:2208.06538_ , 2022.
  * Ge et al. [2023] Zhijin Ge, Fanhua Shang, Hongying Liu, Yuanyuan Liu, Liang Wan, Wei Feng, and Xiaosen Wang.  Improving the Transferability of Adversarial Examples with Arbitrary Style Transfer.  _arXiv preprint arXiv:2308.10601_ , 2023.
  * Geiger et al. [2012] Andreas Geiger, Philip Lenz, and Raquel Urtasun.  Are we Ready for Autonomous Driving? The KITTI Vision Benchmark Suite.  In _Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition_ , pages 3354–3361, 2012.
  * Goodfellow et al. [2014] Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy.  Explaining and harnessing adversarial examples.  _arXiv preprint arXiv:1412.6572_ , 2014.
  * Gowal et al. [2019] Sven Gowal, Krishnamurthy Dvijotham, Robert Stanforth, Rudy Bunel, Chongli Qin, Jonathan Uesato, Relja Arandjelovic, Timothy Arthur Mann, and Pushmeet Kohli.  Scalable Verified Training for Provably Robust Image Classification.  In _Proceedings of the IEEE/CVF International Conference on Computer Vision_ , pages 4841–4850, 2019.
  * He et al. [2016] Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun.  Deep Residual Learning for Image Recognition.  In _Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition_ , pages 770–778, 2016.
  * Heo et al. [2021] Byeongho Heo, Sangdoo Yun, Dongyoon Han, Sanghyuk Chun, Junsuk Choe, and Seong Joon Oh.  Rethinking spatial dimensions of vision transformers.  In _Proceedings of the IEEE/CVF International Conference on Computer Vision_ , pages 11936–11945, 2021.
  * Huang et al. [2017] Gao Huang, Zhuang Liu, Laurens van der Maaten, and Kilian Q. Weinberger.  Densely Connected Convolutional Networks.  In _Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition_ , pages 2261–2269, 2017.
  * Ilyas et al. [2018] Andrew Ilyas, Logan Engstrom, Anish Athalye, and Jessy Lin.  Black-box Adversarial Attacks with Limited Queries and Information.  In _Proceedings of the International Conference on Machine Learning_ , pages 2142–2151, 2018.
  * Jiang et al. [2023] Jinyang Jiang, Zeliang Zhang, Chenliang Xu, Zhaofei Yu, and Yijie Peng.  One forward is enough for neural network training via likelihood ratio method.  In _The Twelfth International Conference on Learning Representations_ , 2023.
  * Kurakin et al. [2018] Alexey Kurakin, Ian J Goodfellow, and Samy Bengio.  Adversarial examples in the physical world.  In _Artificial intelligence safety and security_ , pages 99–112. Chapman and Hall/CRC, 2018.
  * Li et al. [2020a] Huichen Li, Xiaojun Xu, Xiaolu Zhang, Shuang Yang, and Bo Li.  QEBA: Query-Efficient Boundary-Based Blackbox Attack.  In _Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition_ , pages 1218–1227, 2020a.
  * Li et al. [2019] Yandong Li, Lijun Li, Liqiang Wang, Tong Zhang, and Boqing Gong.  NATTACK: Learning the Distributions of Adversarial Examples for an Improved Black-Box Attack on Deep Neural Networks.  In _Proceedings of the International Conference on Machine Learning_ , pages 3866–3876, 2019.
  * Li et al. [2020b] Yingwei Li, Song Bai, Yuyin Zhou, Cihang Xie, Zhishuai Zhang, and Alan L. Yuille.  Learning Transferable Adversarial Examples via Ghost Networks.  In _Proceedings of the AAAI Conference on Artificial Intelligence_ , pages 11458–11465, 2020b.
  * Liao et al. [2018] Fangzhou Liao, Ming Liang, Yinpeng Dong, Tianyu Pang, Xiaolin Hu, and Jun Zhu.  Defense Against Adversarial Attacks Using High-Level Representation Guided Denoiser.  In _Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition_ , pages 1778–1787, 2018.
  * Lillicrap et al. [2016] Timothy P. Lillicrap, Jonathan J. Hunt, Alexander Pritzel, Nicolas Heess, Tom Erez, Yuval Tassa, David Silver, and Daan Wierstra.  Continuous Control with Deep Reinforcement Learning.  In _Proceedings of the International Conference on Learning Representations_ , 2016.
  * Lin et al. [2019] Jiadong Lin, Chuanbiao Song, Kun He, Liwei Wang, and John E Hopcroft.  Nesterov accelerated gradient and scale invariance for adversarial attacks.  _arXiv preprint arXiv:1908.06281_ , 2019.
  * Liu et al. [2021a] Aoming Liu, Zehao Huang, Zhiwu Huang, and Naiyan Wang.  Direct differentiable augmentation search.  In _Proceedings of the IEEE/CVF international conference on computer vision_ , pages 12219–12228, 2021a.
  * Liu et al. [2024] Pinxin Liu, Luchuan Song, Daoan Zhang, Hang Hua, Yunlong Tang, Huaijin Tu, Jiebo Luo, and Chenliang Xu.  Emo-avatar: Efficient monocular video style avatar through texture rendering.  _arXiv preprint arXiv:2402.00827_ , 2024.
  * Liu et al. [2023] Xiao-Yang Liu, Rongyi Zhu, Daochen Zha, Jiechao Gao, Shan Zhong, and Meikang Qiu.  Differentially private low-rank adaptation of large language model using federated learning.  _arXiv preprint arXiv:2312.17493_ , 2023.
  * Liu et al. [2017] Yanpei Liu, Xinyun Chen, Chang Liu, and Dawn Song.  Delving into Transferable Adversarial Examples and Black-box Attacks.  In _Proceedings of the International Conference on Learning Representations_ , 2017.
  * Liu et al. [2019] Zihao Liu, Qi Liu, Tao Liu, Nuo Xu, Xue Lin, Yanzhi Wang, and Wujie Wen.  Feature Distillation: DNN-Oriented JPEG Compression Against Adversarial Examples.  In _Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition_ , pages 860–868, 2019.
  * Liu et al. [2021b] Ze Liu, Yutong Lin, Yue Cao, Han Hu, Yixuan Wei, Zheng Zhang, Stephen Lin, and Baining Guo.  Swin transformer: Hierarchical vision transformer using shifted windows.  In _Proceedings of the IEEE/CVF international conference on computer vision_ , pages 10012–10022, 2021b.
  * Long et al. [2022] Yuyang Long, Qilong Zhang, Boheng Zeng, Lianli Gao, Xianglong Liu, Jian Zhang, and Jingkuan Song.  Frequency domain model augmentation for adversarial attack.  In _European Conference on Computer Vision_ , pages 549–566. Springer, 2022.
  * Madry et al. [2018] Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu.  Towards Deep Learning Models Resistant to Adversarial Attacks.  In _Proceedings of the International Conference on Learning Representations_ , 2018.
  * Naseer et al. [2020] Muzammal Naseer, Salman H. Khan, Munawar Hayat, Fahad Shahbaz Khan, and Fatih Porikli.  A Self-supervised Approach for Adversarial Robustness.  In _Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition_ , pages 259–268, 2020.
  * Raghunathan et al. [2018] Aditi Raghunathan, Jacob Steinhardt, and Percy Liang.  Certified Defenses against Adversarial Examples.  In _Proceedings of the International Conference on Learning Representations_ , 2018.
  * Richens et al. [2020] Jonathan G Richens, Ciarán M Lee, and Saurabh Johri.  Improving the accuracy of medical diagnosis with causal machine learning.  _Nature communications_ , 11(1):3923, 2020.
  * Russakovsky et al. [2015] Olga Russakovsky, Jia Deng, Hao Su, Jonathan Krause, Sanjeev Satheesh, Sean Ma, Zhiheng Huang, Andrej Karpathy, Aditya Khosla, Michael Bernstein, Alexander C. Berg, and Li Fei-Fei.  ImageNet Large Scale Visual Recognition Challenge.  _International Journal of Computer Vision (IJCV)_ , 115(3):211–252, 2015.
  * Schroff et al. [2015] Florian Schroff, Dmitry Kalenichenko, and James Philbin.  FaceNet: A Unified Embedding for Face Recognition and Clustering.  In _Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition_ , pages 815–823, 2015.
  * Song et al. [2018] Dawn Song, Kevin Eykholt, Ivan Evtimov, Earlence Fernandes, Bo Li, Amir Rahmati, Florian Tramer, Atul Prakash, and Tadayoshi Kohno.  Physical adversarial examples for object detectors.  In _12th USENIX workshop on offensive technologies (WOOT 18)_ , 2018.
  * Szegedy et al. [2017] Christian Szegedy, Sergey Ioffe, Vincent Vanhoucke, and Alexander A. Alemi.  Inception-v4, Inception-ResNet and the Impact of Residual Connections on Learning.  In _Proceedings of the AAAI Conference on Artificial Intelligence_ , pages 4278–4284, 2017.
  * Tang and Li [2004] Xiaoou Tang and Zhifeng Li.  Video based face recognition using multiple classifiers.  In _IEEE International Conference on Automatic Face and Gesture Recognition_. IEEE, 2004.
  * Tramèr et al. [2018] Florian Tramèr, Alexey Kurakin, Nicolas Papernot, Ian J. Goodfellow, Dan Boneh, and Patrick D. McDaniel.  Ensemble Adversarial Training: Attacks and Defenses.  In _Proceedings of the International Conference on Learning Representations_ , 2018.
  * Wang et al. [2018] Hao Wang, Yitong Wang, Zheng Zhou, Xing Ji, Dihong Gong, Jingchao Zhou, Zhifeng Li, and Wei Liu.  CosFace: Large Margin Cosine Loss for Deep Face Recognition.  In _Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition_ , pages 5265–5274, 2018.
  * Wang et al. [2023a] Kunyu Wang, Xuanran He, Wenxuan Wang, and Xiaosen Wang.  Boosting adversarial transferability by block shuffle and rotation.  _arXiv preprint arXiv:2308.10299_ , 2023a.
  * Wang et al. [2023b] Kunyu Wang, Xuanran He, Wenxuan Wang, and Xiaosen Wang.  Boosting Adversarial Transferability by Block Shuffle and Rotation.  _arXiv preprint arXiv:2308.10299_ , 2023b.
  * Wang and He [2021] Xiaosen Wang and Kun He.  Enhancing the transferability of adversarial attacks through variance tuning.  In _Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition_ , pages 1924–1933, 2021.
  * Wang et al. [2019] Xiaosen Wang, Kun He, Chuanbiao Song, Liwei Wang, and John E Hopcroft.  AT-GAN: An adversarial generator model for non-constrained adversarial examples.  _arXiv preprint arXiv:1904.07793_ , 2019.
  * Wang et al. [2021a] Xiaosen Wang, Xuanran He, Jingdong Wang, and Kun He.  Admix: Enhancing the Transferability of Adversarial Attacks.  In _Proceedings of the IEEE/CVF International Conference on Computer Vision_ , pages 16138–16147, 2021a.
  * Wang et al. [2021b] Xiaosen Wang, Jiadong Lin, Han Hu, Jingdong Wang, and Kun He.  Boosting Adversarial Transferability through Enhanced Momentum.  In _Proceedings of the British Machine Vision Conference_ , page 272, 2021b.
  * Wang et al. [2021c] Xiaosen Wang, Chuanbiao Song, Liwei Wang, and Kun He.  Multi-stage Optimization Based Adversarial Training.  _arXiv preprint arXiv:2106.15357_ , 2021c.
  * Wang et al. [2022] Xiaosen Wang, Zeliang Zhang, Kangheng Tong, Dihong Gong, Kun He, Zhifeng Li, and Wei Liu.  Triangle Attack: A Query-Efficient Decision-Based Adversarial Attack.  In _Proceedings of the European Conference on Computer Vision_ , pages 156–174, 2022.
  * Wang et al. [2023c] Xiaosen Wang, Zeliang Zhang, and Jianping Zhang.  Structure Invariant Transformation for better Adversarial Transferability.  In _Proceedings of the IEEE/CVF International Conference on Computer Vision_ , 2023c.
  * Wei et al. [2019] Xingxing Wei, Siyuan Liang, Ning Chen, and Xiaochun Cao.  Transferable Adversarial Attacks for Image and Video Object Detection.  In _Proceedings of the International Joint Conference on Artificial Intelligence_ , pages 954–960, 2019.
  * Wu et al. [2020] Dongxian Wu, Yisen Wang, Shu-Tao Xia, James Bailey, and Xingjun Ma.  Skip Connections Matter: On the Transferability of Adversarial Examples Generated with ResNets.  In _Proceedings of the International Conference on Learning Representations_ , 2020.
  * Wu and Ruan [2021] Han Wu and Wenjie Ruan.  Adversarial Driving: Attacking End-to-End Autonomous Driving Systems.  _arXiv preprint arXiv:2103.09151_ , 2021.
  * Wu et al. [2021] Weibin Wu, Yuxin Su, Michael R Lyu, and Irwin King.  Improving the transferability of adversarial samples with adversarial transformations.  In _Proceedings of the IEEE/CVF conference on computer vision and pattern recognition_ , pages 9024–9033, 2021.
  * Xiao et al. [2018] Chaowei Xiao, Bo Li, Jun-Yan Zhu, Warren He, Mingyan Liu, and Dawn Song.  Generating Adversarial Examples with Adversarial Networks.  In _Proceedings of the International Joint Conference on Artificial Intelligence_ , pages 3905–3911, 2018.
  * Xie et al. [2018] Cihang Xie, Jianyu Wang, Zhishuai Zhang, Zhou Ren, and Alan L. Yuille.  Mitigating Adversarial Effects Through Randomization.  In _Proceedings of the International Conference on Learning Representations_ , 2018.
  * Xie et al. [2019a] Cihang Xie, Yuxin Wu, Laurens van der Maaten, Alan L. Yuille, and Kaiming He.  Feature Denoising for Improving Adversarial Robustness.  In _Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition_ , pages 501–509, 2019a.
  * Xie et al. [2019b] Cihang Xie, Zhishuai Zhang, Yuyin Zhou, Song Bai, Jianyu Wang, Zhou Ren, and Alan L Yuille.  Improving transferability of adversarial examples with input diversity.  In _Proceedings of the IEEE/CVF conference on computer vision and pattern recognition_ , pages 2730–2739, 2019b.
  * Xie et al. [2021] Pengfei Xie, Linyuan Wang, Ruoxi Qin, Kai Qiao, Shuhao Shi, Guoen Hu, and Bin Yan.  Improving the transferability of adversarial examples with new iteration framework and input dropout.  _arXiv preprint arXiv:2106.01617_ , 2021.
  * Xie et al. [2017] Saining Xie, Ross B. Girshick, Piotr Dollár, Zhuowen Tu, and Kaiming He.  Aggregated Residual Transformations for Deep Neural Networks.  In _Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition_ , pages 5987–5995, 2017.
  * Xiong et al. [2022] Yifeng Xiong, Jiadong Lin, Min Zhang, John E Hopcroft, and Kun He.  Stochastic variance reduced ensemble adversarial attack for boosting the adversarial transferability.  In _Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition_ , pages 14983–14992, 2022.
  * Xu et al. [2018] Weilin Xu, David Evans, and Yanjun Qi.  Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networks.  In _Proceedings of the Network and Distributed System Security Symposium_ , 2018.
  * Yang et al. [2022] Yichen Yang, Xiaosen Wang, and Kun He.  Robust Textual Embedding against Word-level Adversarial Attacks.  In _Proceedings of the Conference on Uncertainty in Artificial Intelligence_ , page 2214–2224, 2022.
  * Yuan et al. [2021] Haojie Yuan, Qi Chu, Feng Zhu, Rui Zhao, Bin Liu, and Neng-Hai Yu.  Automa: towards automatic model augmentation for transferable adversarial attacks.  _IEEE Transactions on Multimedia_ , 2021.
  * Yuan et al. [2022] Zheng Yuan, Jie Zhang, and Shiguang Shan.  Adaptive image transformations for transfer-based adversarial attack.  In _European Conference on Computer Vision_ , pages 1–17. Springer, 2022.
  * Zhang et al. [2023a] Yechao Zhang, Shengshan Hu, Leo Yu Zhang, Junyu Shi, Minghui Li, Xiaogeng Liu, Wei Wan, and Hai Jin.  Towards understanding adversarial transferability from surrogate training.  _arXiv preprint arXiv:2307.07873_ , 2023a.
  * Zhang et al. [2023b] Zeliang Zhang, Jinyang Jiang, Minjie Chen, Zhiyuan Wang, Yijie Peng, and Zhaofei Yu.  A novel noise injection-based training scheme for better model robustness.  _arXiv preprint arXiv:2302.10802_ , 2023b.
  * Zhang et al. [2024a] Zeliang Zhang, Mingqian Feng, Jinyang Jiang, Rongyi Zhu, Yijie Peng, and Chenliang Xu.  Forward learning for gradient-based black-box saliency map generation.  _arXiv preprint arXiv:2403.15603_ , 2024a.
  * Zhang et al. [2024b] Zeliang Zhang, Mingqian Feng, Zhiheng Li, and Chenliang Xu.  Discover and mitigate multiple biased subgroups in image classifiers.  _arXiv preprint arXiv:2403.12777_ , 2024b.
  * Zhang et al. [2024c] Zeliang Zhang, Wei Yao, Susan Liang, and Chenliang Xu.  Random smooth-based certified defense against text adversarial attack.  In _Findings of the Association for Computational Linguistics: EACL 2024_ , pages 1251–1265, 2024c.
  * Zhang et al. [2024d] Zeliang Zhang, Rongyi Zhu, Wei Yao, Xiaosen Wang, and Chenliang Xu.  Bag of tricks to boost adversarial transferability.  _arXiv preprint arXiv:2401.08734_ , 2024d.
  * Zou et al. [2020] Junhua Zou, Zhisong Pan, Junyang Qiu, Xin Liu, Ting Rui, and Wei Li.  Improving the transferability of adversarial examples with resized-diverse-inputs, diversity-ensemble and region fitting.  In _European Conference on Computer Vision_ , pages 563–579. Springer, 2020.

##  Appendix A Experiments Settings

###  A.1 Baseline methods

  * •

TIM: TIM adopts a translation operation that shifts the benign example by $i$
and $i$ pixels along the two dimensions, respectively. TIM uses a kernel
matrix in gradient calculation to replace the translation. In our experiments,
we chose the Gaussian kernel as
$\tilde{W}_{i,j}=\frac{1}{2\pi\sigma^{2}}\exp\left(-\frac{i^{2}+j^{2}}{2\sigma^{2}}\right)$
and $W_{i,j}=\frac{\tilde{W}_{i,j}}{\sum_{i,j}\tilde{W}_{i,j}}$.

  * •

SIM: The scale-invariant method (SIM) scales every pixel by a set of levels
and uses these scaled images for gradient calculation. In our experiments, we
choose the number of scale samples $m=5$ and the scale factor
$\gamma_{i}=1/2^{i}$.

  * •

Admix: Admix randomly mixes the benign examples with images from other
categories and scales the mixed examples in different scales. We set the scale
copies $m_{1}=5$ and scale factor $\gamma_{i}=1/2^{i}$ and random sample
images $m_{2}=3$ and mixup strength as $0.2$.

  * •

DEM: DEM provided an ensemble version of diversity invariant methods, which
uses five transformed copies for gradient calculation. In our experiments, we
set the diversity list to [340, 380, 420, 460, 500].

  * •

Masked: Maskblock separates the images into several blocks and sequentially
masks every block in the benign examples. Thus, the number of transformed
copies is equal to the number of blocks. We set the number of blocks to 16 in
our experiments.

  * •

IDE: IDE conducts input dropout on a being example at different rates and gets
multiple transformed examples to form an ensemble attack. In our experiments,
we choose the dropout rate to be 0.0, 0.1, 0.2, 0.3, 0.4, and the weight
factor as equal.

  * •

$\rm{S}^{2}$IM: $\rm{S}^{2}$IM provides a frequency domain perspective of
input transformation, which utilizes DCT and IDCT techniques in
transformation. In our experiments, we set the tuning factor $\rho$ = 0.5 and
the standard deviation $\sigma$ the same with perturbation scale $\epsilon$
and the number of spectrum transformations $N=20$.

  * •

BSR: BSR splits the input image into several blocks and then randomly shuffles
and rotates these blocks. In our experiments, we split the image into $2x2$
blocks with the maximum rotation angle $24\%$ and calculate the gradients on
$N=20$ transformed images.

  * •

SIA: SIA decomposed the images into several blocks and transformed each block
with an input transformation choosing from seven transformation candidates
222Vertical Shift, Horizontal Shift, Vertical Flip, Horizontal Flip, Rotate,
Scale, Add noise, Resize, DCT, Dropout. We followed the suggested settings in
the paper and chose splitting number $s=3$, number of transformed images for
gradient calculation $N=20$.

  * •

AutoMA: AutoMA targeted finding a strong model augmentation policy to boost
adversarial transferability. Following the setting in the paper, we trained
the augmentation policy search network on 1000 images from ImageNet [38]
validation set, which does not overlap with the benign example set. We adopt
the transformation number $m=5$ and set the ten operation types and their
corresponding magnitude the same as the original paper.

  * •

ATTA: ATTA uses a two-layer network to mimic the transformation function. The
benign examples are first passed through this transformation network and then
sent for calculating the adversarial perturbations. We use the data from
ImageNet [38] training partition to train the transformation network. We
trained different transformation networks according to the surrogate models.
For the training hyperparameters, we follow the settings from the authors.

  * •

AITL: AITL introduces selecting input transformations by different benign
examples. AITL trains three networks to predict the input transformations for
every image. We adopt the 20 image transformations in the same paper and use
the pre-train model weights from the authors to initialize the above networks.
We set the number of iterations during optimizing the image transformation
feature to $1$, the corresponding step size to $15$, and the number of image
transformation operations to $4$.

###  A.2 Learning to Transform

We decomposed the existing methods and concluded their input transformation
methods. We formulate the transformation candidates in 10 categories.

  * •

(1) Rotate: Rotate refers to turning the image around a fixed point, usually
its center, by a certain angle. The domain of angle is $[0,360]$. We choose 10
angles from the domain, and the interval between the two angles is identical.
Thus, we form 10 operations for the rotate category. The smallest rotation
angle is $36^{\circ}$, and the biggest rotation angle is $360^{\circ}$.

  * •

(2) Scale: the scale category comes from SIM. we form 10 operations in our
experiments. Each operation differs in scale factor
$\gamma=1/2^{i},i\in[1,2,...,10]$.

  * •

(3) Resize: Resize refers to removing the margin part of examples and resizing
the main body of the benign examples. We chose 10 resize rates for our
experiments, which are $0$,$0.1$, $0.2$, $0.3$, $0.4$, $0.5$, $0.6$, $0.7$,
$0.8$, and $0.9$ respectively.

  * •

(4) Pad: the pad category comes from DIM. We choose to pad the bengin examples
to different sizes where the size of the padded example will be $[size\times
size]$. We chose 10 different sizes, which are 246.5, 257.6, 268.8, 280.0,
291.2, 302.4, 313.6, 324.8, 336.0, and 347.2.

  * •

(5) Mask: The mask category comes from Masked, which separates the examples
into several blocks and randomly blocks one of the blocks. We control the
number of blocks and choose 4,9,16,25,36,49,64,81,100,121 in specific.

  * •

(6) Translate: the translated category comes from TIM. We shift the benign
examples into 10 levels, which are 10pixel, 20pixel, 30pixel, 40pixel,50pixel,
60pixel, 70pixel, 80pixel, 90pixel, 100pixel, along the x-axis and y-axis.

  * •

(8) Shuffle: The shuffle category comes from BSR, which separates the examples
into several blocks and randomly reorders these blocks. We control the number
of blocks and choose 4,9,16,25,36,49,64,81,100,121 in specific.

  * •

(9) Spectrum: the spectrum category comes from $\rm{S}^{2}$IM, which adds
noise in the spectrum domain of benign examples determined by strength $\rho$.
We set ten different $\rho$ as 0.1, 0.2, 0.3, 0.4, 0.5, 0.6, 0.7, 0.8, 0.9,
1.0.

  * •

(10) Mixup: the mixup category comes from Admix. We choose two mixup
strengths, 0.2 and 0.4, and five mixup numbers as 1, 2, 3, 4, 5. Thus, we form
10 operations by combining the two settings.

##  Appendix B Numerical Results

Comparison with advanced methods: We include detailed results of the
comparison with different baselines in Tab. 2, Tab. 3, Tab. 4, Tab. 5, Tab. 7,
Tab. 6, Tab. 8, Tab. 9, Tab. 10, Tab. 11. For each table, we choose one model
from ten models as the surrogate model and use the adversarial examples to
attack all these ten models.

We show the attack success rate on adversarial examples crafted on ten
different models corresponding to Fig. 5. Tab. 2 is the detailed results for
Fig. 5(a). Tab. 3 is the detailed results for Fig. 5(b). Tab. 6 is the
detailed results for Fig. 5(c). Tab. 5 is the detailed results for Fig. 5(d).
Tab. 7 is the detailed results for Fig. 5(e). Tab. 4 is the detailed results
for Fig. 5(f). Tab. 8 is the detailed results for Fig. 5(g). Tab. 9 is the
detailed results for Fig. 5(h). Tab. 11 is the detailed results for Fig. 5(i).
Tab. 10 is the detailed results for Fig. 5(j). The effectiveness of each
attack varies significantly across different models. The L2T attack shows
remarkably high effectiveness across all models, which outperforms all the
other methods on all ten models.

Evaluation on the defense methods and cloud APIs: We include the detailed
results across different defense methods and vision API in Tab. 12
corresponding to Fig. 7. The L2T attack, highlighted in gray, shows
exceptionally high success rates across almost all defense methods and APIs,
particularly against Bard and GPT-4V.

Ablation study on the number of iterations: We include the detailed results on
the different iterations in Tab. 13 corresponding to Fig. 9. For most attacks,
success rates increase as the number of iterations increases. This indicates
that more iterations generally lead to more effective adversarial examples.
After a certain number of iterations (around 20-30 for many attacks), the
increase in success rate slows down or plateaus. For example, the L2T attack’s
success rate increases significantly up to about 30 iterations and then grows
more slowly.

Ablation study on the number of samples: We include the detailed results on
the different iterations in Tab. 15 corresponding to Fig. 8. This suggests
that using more samples to generate adversarial examples can lead to more
effective attacks.

Ablation study on the number of operations: We include the detailed results on
the different iterations in Tab. 14 corresponding to Fig. 6. As the number of
operations increases, there is a general trend of increasing success rates
across most models. However, the increase is not significant after the number
of operations exceeds $2$.

##  Appendix C Examples on attacking the Multi-modal Large Language Models

To show the scalability of L2T, we also conducted experiments on multi-modal
large language models (MLLMs). As shown in Fig. 13Fig. 11, both GPT-4V and
Bard can classify the benign example correctly into the “bee-eater”. We use
L2T to generate the adversarial examples against ResNet-18. As shown in Fig.
14Fig. 12, the Bard classified the adversarial example as a crocodile, and
GPT-4V classified it as a dragonfly. It shows the vulnerability of MLLMs,
posing great challenges in developing robust MLLMs.

Table 2: Attack success rate (%) across ten models on the adversarial examples
crafted on ResNet-18 by different attack

Attack | Res-18 | Res-101 | NeXt-50 | Dense-121 | Inc-v3 | Inc-v4 | ViT | PiT | Visformer | Swin | Average
---|---|---|---|---|---|---|---|---|---|---|---
I-FGSM | 100.0 | 30.3 | 28.5 | 36.2 | 25.9 | 20.6 | 7.2 | 8.9 | 11.6 | 16.8 | 28.6
MI-FGSM | 100.0 | 66.6 | 71.1 | 77.7 | 54.8 | 50.6 | 18.6 | 25.5 | 35.3 | 42.7 | 54.3
Admix | 100.0 | 89.6 | 90.5 | 94.6 | 80.3 | 77.3 | 31.8 | 38.5 | 56.0 | 60.4 | 71.9
BSR | 100.0 | 95.8 | 96.6 | 98.1 | 88.9 | 90.2 | 46.1 | 58.7 | 77.7 | 77.6 | 83.0
DEM | 100.0 | 95.5 | 95.8 | 98.1 | 92.2 | 90.4 | 46.9 | 45.0 | 67.7 | 64.3 | 79.6
DIM | 100.0 | 84.6 | 87.8 | 93.6 | 77.6 | 73.3 | 31.1 | 37.7 | 53.1 | 56.8 | 69.6
SIA | 100.0 | 96.5 | 97.1 | 98.6 | 90.0 | 89.2 | 44.4 | 56.8 | 74.3 | 76.0 | 82.3
IDE | 99.9 | 66.0 | 68.4 | 75.5 | 56.3 | 51.3 | 18.8 | 23.4 | 34.2 | 40.9 | 53.5
Masked | 100.0 | 71.6 | 76.2 | 80.5 | 58.7 | 54.7 | 20.1 | 26.1 | 37.4 | 44.4 | 57.0
SIM | 100.0 | 83.0 | 85.9 | 90.7 | 74.0 | 69.3 | 26.2 | 35.2 | 48.4 | 52.4 | 66.5
$\rm{S}^{2}$IM | 100.0 | 90.4 | 92.6 | 94.1 | 83.8 | 80.4 | 32.9 | 41.6 | 56.2 | 62.4 | 73.4
TIM | 100.0 | 58.7 | 67.4 | 72.4 | 52.1 | 48.6 | 18.3 | 17.4 | 26.8 | 34.6 | 49.6
ATTA | 88.0 | 47.9 | 50.1 | 58.3 | 42.7 | 35.4 | 14.0 | 17.7 | 24.6 | 30.7 | 40.9
AutoMA | 100 | 93.2 | 95.1 | 97.4 | 86.4 | 87.0 | 41 | 50.7 | 67.7 | 67.8 | 78.6
AITL | 99.6 | 93.3 | 95.2 | 96.8 | 91.8 | 91.2 | 47.5 | 51.8 | 68.9 | 71.2 | 80.7
L2T (Ours) | 100.0 | 99.3 | 99.2 | 99.6 | 96.9 | 97.4 | 63.7 | 71.1 | 86.6 | 86.0 | 90.0

Table 3: Attack success rate (%) across ten models on the adversarial examples
crafted on ResNet-101 by different attack

Attack | Res-18 | Res-101 | NeXt-50 | Dense-121 | Inc-v3 | Inc-v4 | ViT | PiT | Visformer | Swin | Average
---|---|---|---|---|---|---|---|---|---|---|---
I-FGSM | 36.6 | 100.0 | 35.4 | 33.2 | 25.8 | 20.6 |  8.0 | 10.3 | 13.0 | 16.3 | 29.9
MI-FGSM | 72.6 | 100.0 | 73.8 | 71.7 | 54.1 | 49.6 | 22.7 | 27.2 | 34.5 | 38.3 | 54.4
Admix | 94.6 | 100.0 | 94.0 | 94.6 | 82.9 | 78.0 | 38.2 | 46.9 | 57.9 | 60.3 | 74.7
BSR | 97.4 | 100.0 | 97.9 | 97.8 | 89.2 | 90.9 | 56.4 | 67.4 | 80.6 | 81.1 | 85.9
DEM | 97.6 | 100.0 | 96.8 | 97.5 | 91.7 | 89.5 | 52.2 | 51.9 | 66.8 | 68.4 | 81.2
DIM | 86.0 | 99.9 | 89.9 | 89.3 | 75.1 | 74.5 | 38.5 | 45.6 | 56.8 | 57.3 | 71.3
SIA | 98.1 | 100.0 | 97.9 | 98.0 | 87.8 | 89.4 | 48.9 | 58.9 | 75.0 | 74.3 | 82.8
IDE | 78.5 | 96.4 | 72.8 | 73.6 | 59.9 | 56.6 | 23.8 | 25.6 | 34.7 | 43.0 | 56.5
Masked | 80.9 | 100.0 | 80.9 | 80.2 | 58.8 | 54.5 | 25.0 | 30.4 | 40.2 | 43.2 | 59.4
SIM | 86.8 | 100.0 | 88.0 | 89.2 | 74.9 | 68.7 | 33.1 | 39.1 | 50.1 | 51.7 | 68.2
$\rm{S}^{2}$IM | 95.9 | 100.0 | 94.8 | 94.7 | 88.3 | 84.3 | 45.7 | 51.7 | 62.3 | 67.1 | 78.5
TIM | 69.3 | 100.0 | 72.8 | 67.2 | 50.9 | 47.8 | 23.2 | 23.2 | 30.7 | 36.8 | 52.2
ATTA | 51.7 | 73.1 | 50.7 | 49.6 | 41.2 | 35.8 | 15.9 | 19.8 | 25.4 | 27.8 | 39.9
AutoMA | 95.5 | 99.7 | 95.4 | 95.2 | 85.6 | 86.1 | 50.5 | 59.8 | 70.3 | 70.9 | 80.9
AITL | 96.6 | 99.1 | 96.5 | 97.8 | 92.0 | 92.5 | 57.1 | 64.9 | 76.0 | 76.3 | 84.9
L2T (Ours) | 99.3 | 100.0 | 99.2 | 99.5 | 97.1 | 96.8 | 72.3 | 77.9 | 88.9 | 88.1 | 91.9

Table 4: Attack success rate (%) across ten models on the adversarial examples
crafted on DenseNet-121 by different attack

Attack | Res-18 | Res-101 | NeXt-50 | Dense-121 | Inc-v3 | Inc-v4 | ViT | PiT | Visformer | Swin | Average
---|---|---|---|---|---|---|---|---|---|---|---
I-FGSM | 44.5 | 34.0 | 36.6 | 100.0 | 28.6 | 23.9 | 8.1 | 11.3 | 14.7 | 20.8 | 32.2
MI-FGSM | 78.6 | 68.9 | 74.8 | 100.0 | 56.6 | 53.6 | 24.5 | 31.1 | 44.0 | 45.6 | 57.8
Admix | 94.3 | 91.1 | 93.4 | 100.0 | 82.5 | 81.1 | 40.8 | 50.7 | 68.3 | 65.8 | 76.8
BSR | 97.4 | 85.7 | 97.3 | 100.0 | 89.7 | 91.5 | 52.2 | 68.3 | 84.7 | 80.0 | 84.7
DEM | 97.8 | 94.5 | 97.1 | 100.0 | 92.2 | 91.5 | 53.8 | 56.0 | 74.4 | 70.8 | 82.8
DIM | 88.4 | 84.1 | 89.7 | 100.0 | 76.4 | 75.5 | 36.5 | 44.0 | 62.0 | 59.5 | 71.6
SIA | 98.4 | 96.4 | 97.5 | 100.0 | 89.1 | 92.8 | 49.7 | 64.1 | 83.4 | 78.1 | 85.0
IDE | 87.8 | 77.3 | 80.6 | 99.4 | 70.6 | 68.5 | 26.3 | 35.0 | 49.5 | 51.8 | 64.7
Masked | 82.8 | 74.0 | 81.2 | 100.0 | 60.6 | 60.8 | 25.7 | 35.7 | 49.3 | 51.3 | 62.1
SIM | 89.7 | 84.2 | 88.3 | 100.0 | 75.3 | 74.2 | 32.6 | 42.8 | 59.2 | 57.3 | 70.4
$\rm{S}^{2}$IM | 97.2 | 94.9 | 96.9 | 100.0 | 90.7 | 90.2 | 50.7 | 61.6 | 78.5 | 76.9 | 83.8
TIM | 74.7 | 62.4 | 70.9 | 100.0 | 52.2 | 51.6 | 20.1 | 21.7 | 33.9 | 38.9 | 52.6
ATTA | 54.8 | 45.6 | 49.7 | 79.4 | 42.2 | 36.8 | 15.3 | 20.6 | 28.3 | 32.3 | 40.5
AutoMA | 95.3 | 93.8 | 95.2 | 99.9 | 85.4 | 86.9 | 46.5 | 59.6 | 73.0 | 71.3 | 80.7
AITL | 97.1 | 94.3 | 96.0 | 99.5 | 91.3 | 92.6 | 53.7 | 61.5 | 76.0 | 74.6 | 83.7
L2T (Ours) | 99.5 | 98.9 | 99.3 | 100.0 | 97.4 | 98.3 | 71.3 | 79.7 | 92.9 | 90.2 | 92.8

Table 5: Attack success rate (%) across ten models on the adversarial examples
crafted on ResNeXt-50 by different attack

Attack | Res-18 | Res-101 | NeXt-50 | Dense-121 | Inc-v3 | Inc-v4 | ViT | PiT | Visformer | Swin | Average
---|---|---|---|---|---|---|---|---|---|---|---
I-FGSM | 32.4 | 29.4 | 99.4 | 31.8 | 25.0 | 18.5 |  7.3 |  9.8 | 13.1 | 15.8 | 28.2
MI-FGSM | 64.7 | 62.9 | 99.9 | 69.2 | 49.3 | 45.7 | 19.1 | 27.0 | 35.6 | 38.8 | 51.2
Admix | 88.7 | 87.4 | 100.0 | 94.3 | 78.0 | 73.7 | 33.6 | 44.0 | 58.5 | 57.3 | 71.5
BSR | 95.8 | 95.7 | 100.0 | 97.5 | 83.3 | 86.9 | 47.9 | 66.8 | 79.5 | 74.5 | 82.8
DEM | 96.6 | 94.8 | 100.0 | 97.9 | 89.5 | 90.5 | 49.5 | 55.1 | 70.9 | 67.5 | 81.2
DIM | 81.7 | 80.7 | 99.8 | 85.1 | 67.7 | 69.0 | 33.7 | 42.4 | 53.1 | 54.2 | 66.7
SIA | 97.0 | 95.1 | 100.0 | 97.2 | 83.5 | 85.8 | 44.6 | 60.6 | 76.9 | 73.7 | 81.4
IDE | 76.2 | 66.1 | 96.3 | 71.0 | 54.8 | 55.0 | 20.7 | 26.8 | 36.1 | 42.6 | 54.6
Masked | 74.8 | 70.6 | 100.0 | 76.1 | 52.5 | 50.8 | 22.3 | 31.2 | 41.2 | 43.3 | 56.3
SIM | 79.3 | 76.9 | 100.0 | 86.3 | 66.2 | 62.2 | 25.9 | 36.6 | 48.0 | 47.5 | 62.9
$\rm{S}^{2}$IM | 95.5 | 94.3 | 99.9 | 96.6 | 86.2 | 85.3 | 45.5 | 56.3 | 67.3 | 71.4 | 79.8
TIM | 65.6 | 58.6 | 99.8 | 64.3 | 45.5 | 44.2 | 18.4 | 20.9 | 30.1 | 37.7 | 48.5
ATTA | 43.1 | 39.8 | 66.9 | 42.9 | 34.3 | 29.9 | 14.0 | 17.5 | 22.9 | 25.1 | 33.6
AutoMA | 89.6 | 91.0 | 99.7 | 93.4 | 78.4 | 80.8 | 42.3 | 57.7 | 67.7 | 66.9 | 76.8
AITL | 94.0 | 92.4 | 98.9 | 96.6 | 88.7 | 88.9 | 47.5 | 59.8 | 72.5 | 70.1 | 80.9
L2T (Ours) | 99.4 | 99.2 | 100.0 | 99.3 | 95.6 | 97.2 | 67.2 | 78.2 | 88.1 | 85.8 | 91.0

Table 6: Attack success rate (%) across ten models on the adversarial examples
crafted on Inception-v3 by different attack

Attack | Res-18 | Res-101 | NeXt-50 | Dense-121 | Inc-v3 | Inc-v4 | ViT | PiT | Visformer | Swin | Average
---|---|---|---|---|---|---|---|---|---|---|---
I-FGSM | 19.7 | 13.7 | 14.6 | 16.8 | 98.5 | 21.9 |  6.7 |  7.7 |  8.8 | 13.4 | 22.2
MI-FGSM | 48.0 | 37.5 | 38.5 | 42.9 | 98.7 | 49.3 | 16.4 | 20.7 | 23.8 | 29.0 | 40.5
Admix | 66.7 | 57.6 | 58.5 | 67.2 | 99.8 | 76.5 | 23.5 | 28.8 | 34.4 | 41.1 | 55.4
BSR | 88.4 | 81.9 | 84.3 | 88.2 | 99.8 | 91.7 | 39.3 | 48.4 | 60.8 | 64.0 | 74.7
DEM | 77.5 | 68.7 | 71.4 | 75.3 | 99.5 | 85.0 | 34.8 | 34.1 | 43.7 | 50.5 | 64.0
DIM | 59.4 | 48.2 | 51.7 | 57.4 | 99.0 | 66.4 | 21.5 | 24.3 | 31.2 | 37.9 | 49.7
SIA | 82.9 | 73.0 | 76.0 | 81.6 | 99.3 | 88.2 | 31.9 | 41.4 | 51.7 | 55.6 | 68.2
IDE | 56.4 | 41.9 | 44.9 | 46.5 | 95.4 | 56.7 | 15.6 | 19.1 | 23.0 | 29.3 | 42.9
Masked | 55.7 | 45.8 | 45.1 | 50.4 | 100.0 | 58.3 | 17.5 | 22.7 | 27.3 | 32.8 | 45.6
SIM | 60.2 | 47.7 | 46.8 | 54.1 | 99.8 | 64.2 | 19.6 | 23.7 | 26.4 | 33.1 | 47.6
$\rm{S}^{2}$IM | 71.5 | 64.5 | 66.1 | 70.7 | 99.6 | 82.7 | 27.6 | 36.4 | 42.1 | 50.2 | 61.1
TIM | 44.6 | 31.7 | 37.6 | 38.9 | 98.2 | 42.3 | 13.5 | 13.3 | 16.2 | 23.0 | 35.9
ATTA | 31.0 | 21.0 | 22.1 | 23.8 | 50.9 | 28 | 10.4 | 11.6 | 13.3 | 19.2 | 23.1
AutoMA | 65.6 | 58.0 | 62.2 | 65.6 | 98.5 | 76.1 | 27.1 | 32.6 | 38.8 | 44.2 | 56.7
AITL | 77.1 | 69.9 | 72.2 | 79.6 | 98.9 | 85.8 | 34.3 | 38.9 | 46.6 | 53.4 | 65.7
L2T (Ours) | 89.9 | 86.5 | 88.1 | 91.9 | 99.6 | 94.8 | 48.7 | 54.1 | 65.4 | 69.3 | 78.8

Table 7: Attack success rate (%) across ten models on the adversarial examples
crafted on Inception-v4 by different attack

Attack | Res-18 | Res-101 | NeXt-50 | Dense-121 | Inc-v3 | Inc-v4 | ViT | PiT | Visformer | Swin | Average
---|---|---|---|---|---|---|---|---|---|---|---
I-FGSM | 22.4 | 15.0 | 17.3 | 18.4 | 30.5 | 95.7 |  6.3 |  8.6 | 11.4 | 13.9 | 23.9
MI-FGSM | 50.1 | 41.3 | 43.7 | 47.6 | 58.2 | 97.1 | 17.4 | 21.4 | 28.4 | 31.5 | 43.7
Admix | 74.9 | 69.0 | 71.7 | 78.6 | 88.2 | 99.7 | 33.3 | 39.4 | 50.6 | 52.8 | 65.8
BSR | 87.3 | 79.1 | 85.6 | 89.3 | 89.3 | 99.9 | 38.5 | 52.4 | 66.6 | 65.2 | 75.3
DEM | 79.0 | 71.0 | 76.2 | 79.4 | 87.9 | 99.2 | 35.6 | 37.4 | 52.3 | 52.8 | 67.1
DIM | 63.0 | 55.4 | 60.4 | 63.8 | 73.2 | 96.8 | 24.7 | 31.5 | 39.6 | 40.8 | 54.9
SIA | 83.0 | 73.3 | 78.5 | 85.5 | 87.6 | 99.7 | 34.1 | 44.6 | 59.0 | 59.8 | 70.5
IDE | 56.8 | 45.8 | 48.5 | 54.9 | 64.2 | 92.5 | 17.4 | 23.3 | 28.0 | 33.6 | 46.5
Masked | 56.0 | 47.7 | 49.3 | 57.3 | 65.2 | 99.7 | 19.9 | 26.1 | 33.9 | 36.5 | 49.2
SIM | 66.3 | 60.2 | 64.4 | 71.1 | 80.8 | 99.5 | 28.9 | 35.0 | 44.0 | 44.6 | 59.5
$\rm{S}^{2}$IM | 76.5 | 69.9 | 72.9 | 77.8 | 85.4 | 99.4 | 33.6 | 42.4 | 50.6 | 54.7 | 66.3
TIM | 46.6 | 35.8 | 41.6 | 44.1 | 50.8 | 96.2 | 13.3 | 14.8 | 19.0 | 24.5 | 38.7
ATTA | 32.6 | 24.1 | 25.6 | 28.4 | 36.2 | 46.2 | 11.3 | 13.3 | 17.0 | 20.0 | 25.5
AutoMA | 71.8 | 63.8 | 69.4 | 75.1 | 84.1 | 97.9 | 32 | 39.5 | 50.3 | 49.8 | 63.4
AITL | 81.1 | 75.3 | 79.4 | 86.1 | 90.8 | 99.3 | 41 | 47.3 | 59.5 | 59.2 | 71.9
L2T (Ours) | 91.5 | 88.8 | 91.1 | 94.5 | 95.4 | 99.9 | 51.7 | 61.9 | 75.1 | 74.0 | 82.4

Table 8: Attack success rate (%) across ten models on the adversarial examples
crafted on ViT by different attacks

Attack | Res-18 | Res-101 | NeXt-50 | Dense-121 | Inc-v3 | Inc-v4 | ViT | PiT | Visformer | Swin | Average
---|---|---|---|---|---|---|---|---|---|---|---
I-FGSM | 26.3 | 19.8 | 21.7 | 23.6 | 23.4 | 20.6 | 99.7 | 20.0 | 20.6 | 33.1 | 30.9
MI-FGSM | 52.9 | 44.7 | 48.3 | 51.3 | 45.6 | 42.2 | 99.7 | 44.6 | 45.7 | 60.6 | 53.6
Admix | 64.9 | 59.8 | 61.2 | 64.1 | 62.1 | 57.3 | 99.2 | 60.6 | 62.2 | 74.4 | 66.6
BSR | 83.6 | 83.8 | 86.2 | 87.8 | 79.9 | 81.8 | 99.7 | 90.3 | 90.4 | 89.6 | 87.3
DEM | 76.6 | 78.5 | 80.8 | 81.8 | 79.6 | 79.0 | 99.9 | 82.1 | 81.7 | 81.0 | 82.1
DIM | 63.2 | 60.7 | 62.5 | 65.3 | 61.1 | 59.8 | 98.7 | 66.5 | 64.1 | 71.4 | 67.3
SIA | 82.0 | 79.9 | 82.0 | 83.4 | 75.2 | 78.1 | 99.7 | 85.4 | 85.8 | 88.4 | 84.0
IDE | 67.1 | 60.8 | 64.2 | 66.3 | 62.5 | 59.7 | 99.3 | 56.8 | 58.8 | 72.6 | 66.8
Masked | 55.6 | 47.5 | 50.9 | 54.8 | 49.3 | 44.5 | 99.8 | 49.2 | 49.7 | 65.6 | 56.7
SIM | 60.8 | 53.0 | 55.6 | 60.8 | 55.1 | 51.7 | 99.3 | 53.7 | 56.4 | 68.4 | 61.5
$\rm{S}^{2}$IM | 67.8 | 63.2 | 65.6 | 69.4 | 68.3 | 65.5 | 99.9 | 66.7 | 67.3 | 78.3 | 71.2
TIM | 49.1 | 42.3 | 46.3 | 47.1 | 40.3 | 37.6 | 98.9 | 34.5 | 37.7 | 46.5 | 48.0
ATTA | 41.9 | 33.6 | 36.1 | 39.3 | 39.3 | 32.9 | 79.8 | 32.7 | 32.6 | 42.0 | 41.0
AutoMA | 72.1 | 71.0 | 73.0 | 75.8 | 70.9 | 71.4 | 97.9 | 77.9 | 77.6 | 78.6 | 76.6
AITL | 76.8 | 74.4 | 77.7 | 78.6 | 77.7 | 75.8 | 94.9 | 79.5 | 78.9 | 79.6 | 79.4
L2T (Ours) | 89.7 | 87.3 | 88.7 | 89.6 | 87.4 | 86.8 | 98.2 | 90.6 | 90.8 | 92.3 | 90.1

Table 9: Attack success rate (%) across ten models on the adversarial examples
crafted on PiT by different attacks

Attack | Res-18 | Res-101 | NeXt-50 | Dense-121 | Inc-v3 | Inc-v4 | ViT | PiT | Visformer | Swin | Average
---|---|---|---|---|---|---|---|---|---|---|---
I-FGSM | 22.1 | 15.9 | 18.4 | 19.9 | 23.3 | 17.7 | 11.3 | 85.1 | 21.6 | 24.8 | 26.0
MI-FGSM | 52.3 | 41.8 | 48.3 | 51.8 | 46.4 | 43.0 | 30.9 | 97.6 | 53.1 | 55.9 | 52.1
Admix | 63.0 | 55.1 | 61.8 | 63.5 | 57.3 | 56.8 | 46.7 | 97.5 | 67.5 | 70.4 | 64.0
BSR | 80.9 | 77.6 | 84.0 | 85.0 | 74.7 | 76.8 | 70.9 | 99.2 | 89.5 | 90.0 | 82.9
DEM | 79.4 | 74.7 | 78.5 | 80.5 | 78.3 | 76.9 | 68.7 | 99.9 | 84.9 | 83.0 | 80.5
DIM | 63.3 | 58.7 | 64.6 | 64.8 | 61.5 | 62.4 | 50.9 | 94.3 | 70.1 | 71.7 | 66.2
SIA | 81.3 | 77.2 | 85.6 | 84.9 | 75.8 | 77.3 | 69.7 | 99.0 | 90.6 | 91.6 | 83.3
IDE | 68.8 | 61.5 | 64.0 | 68.4 | 66.1 | 64.0 | 53.1 | 94.2 | 70.2 | 71.2 | 68.2
Masked | 59.1 | 51.7 | 57.2 | 59.0 | 53.5 | 49.1 | 39.1 | 99.3 | 61.8 | 63.9 | 59.4
SIM | 62.0 | 54.2 | 59.9 | 61.6 | 55.7 | 53.6 | 43.6 | 99.2 | 65.1 | 68.5 | 62.3
$\rm{S}^{2}$IM | 71.6 | 68.9 | 70.9 | 73.8 | 71.7 | 69.9 | 61.2 | 96.4 | 76.1 | 78.3 | 73.9
TIM | 48.7 | 37.9 | 47.7 | 47.3 | 40.7 | 37.7 | 27.9 | 93.8 | 42.2 | 48.0 | 47.2
ATTA | 44.4 | 32.1 | 38.1 | 40.3 | 39.7 | 35.4 | 23.7 | 71.6 | 37.6 | 40.2 | 40.3
AutoMA | 71.1 | 67.9 | 74.8 | 76.2 | 69.8 | 67.5 | 62.8 | 96.6 | 80.4 | 81.2 | 74.8
AITL | 79.6 | 79.0 | 82.5 | 83.5 | 81.2 | 80.1 | 74.6 | 93.5 | 86.7 | 86.4 | 82.7
L2T (Ours) | 93.2 | 90.1 | 93.0 | 94.3 | 90.7 | 90.7 | 89.8 | 99.5 | 96.9 | 97.1 | 93.5

Table 10: Attack success rate (%) across ten models on the adversarial
examples crafted on Visformer by different attacks

Attack | Res-18 | Res-101 | NeXt-50 | Dense-121 | Inc-v3 | Inc-v4 | ViT | PiT | Visformer | Swin | Average
---|---|---|---|---|---|---|---|---|---|---|---
I-FGSM | 25.4 | 20.9 | 24.4 | 26.6 | 25.4 | 21.4 | 12.0 | 22.4 | 93.3 | 32.6 | 30.2
MI-FGSM | 59.8 | 50.1 | 55.3 | 60.2 | 50.2 | 50.8 | 34.5 | 54.6 | 98.3 | 64.3 | 57.8
Admix | 77.1 | 70.0 | 77.4 | 80.0 | 69.4 | 71.0 | 55.4 | 77.3 | 97.8 | 83.7 | 75.9
BSR | 86.0 | 82.9 | 88.8 | 90.5 | 79.5 | 83.7 | 65.7 | 90.4 | 99.5 | 91.7 | 85.9
DEM | 84.3 | 81.4 | 86.6 | 87.8 | 83.5 | 85.1 | 65.8 | 83.0 | 99.9 | 85.0 | 84.3
DIM | 71.9 | 68.5 | 74.9 | 79.1 | 69.2 | 70.5 | 52.2 | 75.1 | 96.8 | 79.5 | 73.8
SIA | 86.6 | 84.5 | 89.9 | 91.7 | 80.2 | 84.2 | 69.7 | 90.9 | 98.9 | 92.8 | 86.9
IDE | 77.9 | 71.6 | 75.8 | 79.6 | 73.5 | 73.8 | 57.4 | 73.7 | 97.0 | 81.2 | 76.2
Masked | 63.5 | 54.3 | 61.4 | 64.6 | 54.7 | 54.6 | 37.1 | 60.0 | 99.2 | 68.5 | 61.8
SIM | 71.1 | 65.7 | 71.2 | 75.3 | 64.5 | 66.5 | 49.5 | 71.6 | 97.8 | 79.6 | 71.3
$\rm{S}^{2}$IM | 82.1 | 78.3 | 81.6 | 86.1 | 81.6 | 82.2 | 66.4 | 81.7 | 97.2 | 87.3 | 82.5
TIM | 57.4 | 47.7 | 56.9 | 58.9 | 46.6 | 47.5 | 33.9 | 48.1 | 97.6 | 60.0 | 55.5
ATTA | 50.0 | 39.5 | 45.7 | 49.5 | 41.5 | 41.8 | 26.8 | 42.8 | 85.9 | 51.8 | 47.5
AutoMA | 79.3 | 78.0 | 85.4 | 86.7 | 77.3 | 80.9 | 66.8 | 85.4 | 98.2 | 87.8 | 82.6
AITL | 87.2 | 85.0 | 88.4 | 89.3 | 84.1 | 87.0 | 76.6 | 88.7 | 96.5 | 90.5 | 87.3
L2T (Ours) | 96.8 | 95.6 | 97.1 | 97.9 | 94.4 | 96.5 | 89.9 | 96.6 | 100.0 | 97.5 | 96.2

Table 11: Attack success rate (%) across ten models on the adversarial
examples crafted on Swin by different attacks

Attack | Res-18 | Res-101 | NeXt-50 | Dense-121 | Inc-v3 | Inc-v4 | ViT | PiT | Visformer | Swin | Average
---|---|---|---|---|---|---|---|---|---|---|---
I-FGSM | 14.3 | 10.8 |  9.9 | 13.2 | 17.5 | 11.6 |  5.9 |  8.1 | 10.8 | 72.3 | 17.4
MI-FGSM | 44.9 | 32.6 | 36.6 | 39.9 | 37.1 | 31.7 | 22.5 | 32.0 | 40.1 | 98.8 | 41.6
Admix | 56.0 | 41.6 | 47.2 | 51.7 | 45.0 | 41.6 | 31.4 | 43.8 | 53.7 | 99.2 | 51.1
BSR | 86.9 | 79.1 | 86.3 | 87.3 | 76.4 | 78.6 | 65.6 | 88.8 | 92.0 | 99.3 | 84.0
DEM | 79.4 | 75.6 | 78.3 | 80.0 | 76.5 | 77.2 | 61.5 | 79.1 | 81.4 | 100.0 | 78.9
DIM | 70.9 | 64.8 | 70.4 | 72.0 | 66.8 | 67.3 | 52.3 | 73.4 | 76.4 | 98.0 | 71.2
SIA | 82.7 | 74.5 | 79.3 | 84.2 | 70.5 | 72.1 | 59.3 | 82.5 | 88.7 | 99.1 | 79.3
IDE | 67.3 | 54.8 | 59.1 | 63.9 | 61.4 | 56.8 | 43.8 | 54.2 | 61.9 | 98.4 | 62.2
Masked | 46.5 | 33.4 | 39.7 | 43.8 | 39.7 | 33.2 | 26.7 | 35.0 | 44.8 | 99.5 | 44.2
SIM | 53.0 | 38.3 | 44.6 | 48.2 | 42.2 | 40.4 | 29.9 | 39.9 | 49.5 | 99.2 | 48.5
$\rm{S}^{2}$IM | 83.4 | 75.6 | 80.1 | 83.9 | 77.9 | 79.2 | 67.8 | 80.8 | 85.7 | 99.1 | 81.4
TIM | 58.7 | 46.9 | 58.0 | 58.9 | 48.1 | 46.2 | 33.5 | 45.0 | 51.7 | 99.0 | 54.6
ATTA | 38.3 | 28.1 | 32.1 | 34.6 | 34.6 | 28.2 | 20.3 | 28.2 | 34.9 | 92.0 | 37.1
AutoMA | 81.9 | 78.2 | 83.3 | 84.5 | 76.0 | 78.0 | 65.7 | 86.9 | 89.0 | 98.7 | 82.2
AITL | 87.8 | 84.0 | 89.8 | 90.9 | 86.9 | 88.5 | 72.0 | 89.4 | 90.5 | 97.1 | 87.7
L2T (Ours) | 94.4 | 91.9 | 94.2 | 95.9 | 90.7 | 93.1 | 85.9 | 94.5 | 96.3 | 99.6 | 93.6

Table 12: Attack success rate(%) on adversarial examples on ensemble attack across four defense methods and four vision API. Attack | AT | HGD | NRP | RS | Google | Azure | GPT-4V | Bard
---|---|---|---|---|---|---|---|---
SIM | 36.3 | 83.8 | 65.7 | 26.4 | 77.5 | 69.8 | 62.4 | 79.7
TIM | 36.6 | 63.8 | 56.0 | 35.7 | 55.3 | 52.6 | 64.1 | 71.4
Admix | 37.8 | 91.1 | 70.8 | 29.4 | 73.6 | 57.1 | 76.0 | 83.2
DEM | 40.3 | 88.9 | 74.9 | 37.8 | 76.4 | 69.3 | 83.3 | 91.3
AutoMA | 37.9 | 89.1 | 66.5 | 30.0 | 67.4 | 61.9 | 71.4 | 86.2
IDE | 40.9 | 73.1 | 68.0 | 38.0 | 71.0 | 64.8 | 57.1 | 73.1
ATTA | 30.3 | 49.9 | 47.8 | 18.4 | 49.0 | 47.9 | 39.4 | 75.9
Masked | 32.6 | 72.9 | 49.6 | 21.1 | 57.3 | 52.7 | 72.0 | 84.3
AITL | 44.3 | 91.1 | 79.9 | 42.1 | 79.4 | 65.2 | 79.6 | 90.2
$\rm{S}^{2}$IM | 41.1 | 90.6 | 80.1 | 37.0 | 67.0 | 65.1 | 86.2 | 93.6
BSR | 38.7 | 92.6 | 63.4 | 29.7 | 74.4 | 55.8 | 82.5 | 95.1
SIA | 37.6 | 91.5 | 63.1 | 28.9 | 77.5 | 69.1 | 89.6 | 94.2
L2T (Ours) | 47.9 | 98.5 | 87.2 | 46.7 | 86.5 | 82.7 | 96.7 | 99.9
Table 13: Attack success rate(%) on adversarial examples crafts on ResNet-18
by different iterations.

Iteration | SIM | TIM | Admix | DEM | AutoMA | IDE | ATTA | Masked | AITL |  $\rm{S}^{2}$IM | BSR | SIA | L2T(Ours)
---|---|---|---|---|---|---|---|---|---|---|---|---|---
1 |  9.1 | 12.5 |  7.9 | 60.3 |  8.5 |  7.3 |  7.7 |  9.3 |  7.7 |  6.6 |  8.5 |  7.4 |  8.4
2 | 19.7 | 20.2 | 19.2 | 71.6 | 22.9 | 13.1 | 13.2 | 20.8 | 18.7 | 13.6 | 25.5 | 19.3 | 23.5
3 | 25.2 | 24.4 | 26.2 | 74.2 | 31.5 | 17.1 | 16.0 | 24.8 | 26.9 | 19.9 | 35.4 | 28.7 | 34.1
4 | 35.9 | 29.8 | 38.1 | 76.0 | 45.5 | 24.0 | 21.3 | 33.0 | 41.8 | 33.2 | 51.1 | 44.0 | 51.3
5 | 42.0 | 33.5 | 45.4 | 76.3 | 53.4 | 29.1 | 24.8 | 37.9 | 50.6 | 41.4 | 59.7 | 52.9 | 60.9
6 | 48.8 | 37.7 | 53.3 | 77.6 | 61.0 | 35.3 | 28.6 | 43.0 | 59.0 | 50.8 | 68.1 | 62.4 | 70.8
7 | 55.5 | 41.9 | 60.4 | 77.7 | 67.7 | 41.0 | 32.5 | 48.0 | 66.8 | 59.7 | 74.5 | 70.2 | 79.1
8 | 58.3 | 44.1 | 64.2 | 78.3 | 71.7 | 44.4 | 35.3 | 50.3 | 71.8 | 63.8 | 77.3 | 74.1 | 83.1
9 | 63.1 | 47.3 | 68.9 | 79.0 | 75.9 | 50.2 | 38.7 | 54.7 | 77.8 | 70.1 | 81.9 | 79.4 | 87.3
10 | 66.1 | 49.3 | 71.5 | 79.0 | 78.6 | 53.7 | 40.9 | 57.0 | 81.0 | 73.4 | 83.9 | 82.9 | 89.4
20 | 67.2 | 50.1 | 72.0 | 81.3 | 78.8 | 57.9 | 44.7 | 57.2 | 81.3 | 72.6 | 83.0 | 84.3 | 91.4
30 | 67.0 | 50.9 | 71.6 | 82.2 | 79.1 | 57.6 | 44.6 | 56.4 | 81.5 | 71.2 | 82.2 | 83.7 | 91.5
40 | 67.4 | 51.2 | 71.6 | 82.8 | 79.4 | 58.6 | 45.1 | 55.8 | 81.4 | 71.4 | 83.0 | 84.1 | 91.8
50 | 67.5 | 51.6 | 71.9 | 82.7 | 80.1 | 59.2 | 45.3 | 56.2 | 83.2 | 70.7 | 83.5 | 84.4 | 92.3
60 | 67.4 | 51.9 | 71.6 | 83.0 | 80.5 | 59.8 | 45.4 | 56.5 | 81.1 | 71.0 | 84.0 | 85.5 | 92.6
70 | 67.3 | 52.1 | 71.9 | 82.8 | 81.0 | 60.2 | 45.1 | 56.3 | 81.6 | 70.6 | 83.8 | 85.7 | 92.8
80 | 67.5 | 51.9 | 71.9 | 83.2 | 80.9 | 60.3 | 45.5 | 56.3 | 82.8 | 70.1 | 84.0 | 85.7 | 93.0
90 | 67.6 | 51.8 | 71.6 | 83.1 | 81.3 | 60.7 | 45.4 | 56.1 | 83.7 | 70.2 | 83.9 | 85.4 | 93.8
100 | 67.3 | 51.8 | 71.3 | 83.3 | 81.1 | 60.8 | 45.5 | 55.8 | 82.9 | 70.0 | 84.1 | 85.7 | 94.7

Table 14: Attack success rate (%) across ten models on adversarial examples
crafted on ResNet-18 by different operation number

Operation Number | Res-18 | Res-101 | NeXT-50 | Denset-121 | Inc-v3 | Inc-v4 | ViT | PiT | Visformer | Swin | Average
---|---|---|---|---|---|---|---|---|---|---|---
1 | 100.0 | 96.7 | 96.9 | 98.3 | 90.7 | 89.9 | 46.6 | 56.5 | 74.6 | 76.1 | 82.6
2 | 100.0 | 99.3 | 99.2 | 99.6 | 96.9 | 97.4 | 63.7 | 71.1 | 86.6 | 86.0 | 90.0
3 | 100.0 | 99.4 | 99.5 | 99.6 | 98.2 | 98.6 | 63.2 | 76.0 | 89.1 | 89.5 | 91.2
4 | 100.0 | 99.6 | 99.6 | 99.8 | 98.5 | 99.4 | 64.1 | 77.1 | 90.1 | 90.0 | 91.8
5 | 100.0 | 99.6 | 99.7 | 99.8 | 98.6 | 99.5 | 64.9 | 77.8 | 90.5 | 90.3 | 92.0

Table 15: Attack success rate (%) across ten models on adversarial examples
generated on Res-18 by different number of samples.

Sample Number | Res-18 | Res-101 | NeXt-50 | Dense-121 | Inc-v3 | Inc-v4 | ViT | PiT | Visformer | Swin | Average
---|---|---|---|---|---|---|---|---|---|---|---
1 | 100.0 | 90.6 | 92.3 | 95.3 | 85.5 | 82.5 | 38.9 | 46.4 | 61.0 | 64.9 | 75.7
2 | 100.0 | 95.4 | 95.7 | 98.0 | 91.3 | 90.0 | 47.9 | 55.9 | 72.7 | 74.1 | 82.1
3 | 100.0 | 96.7 | 97.1 | 98.6 | 93.1 | 93.4 | 51.6 | 59.4 | 78.6 | 77.7 | 84.6
4 | 100.0 | 97.3 | 98.3 | 98.9 | 94.4 | 94.0 | 55.3 | 62.7 | 79.0 | 80.7 | 86.1
5 | 100.0 | 98.3 | 98.3 | 99.4 | 95.4 | 95.1 | 57.4 | 65.7 | 82.6 | 83.1 | 87.5
6 | 100.0 | 99.1 | 98.7 | 99.6 | 96.0 | 96.5 | 59.3 | 67.2 | 83.1 | 82.2 | 88.2
7 | 100.0 | 99.3 | 98.4 | 99.6 | 96.1 | 96.3 | 61.2 | 67.9 | 85.0 | 83.5 | 88.7
8 | 100.0 | 99.1 | 98.9 | 99.6 | 97.2 | 96.0 | 59.5 | 68.9 | 84.4 | 85.1 | 88.9
9 | 100.0 | 99.2 | 99.2 | 99.5 | 97.0 | 96.4 | 62.3 | 70.5 | 86.3 | 86.3 | 89.7
10 | 100.0 | 99.3 | 99.2 | 99.6 | 96.9 | 97.4 | 63.7 | 71.1 | 86.6 | 86.0 | 90.0
11 | 100.0 | 99.2 | 99.0 | 99.7 | 96.5 | 97.2 | 64.7 | 72.7 | 87.1 | 86.5 | 90.3
12 | 100.0 | 99.1 | 98.8 | 99.8 | 96.7 | 96.6 | 63.8 | 72.7 | 86.6 | 86.0 | 90.0
13 | 100.0 | 99.3 | 99.0 | 99.7 | 96.0 | 97.5 | 65.4 | 72.1 | 87.6 | 86.7 | 90.3
14 | 100.0 | 99.4 | 99.4 | 99.6 | 96.9 | 97.2 | 65.4 | 73.8 | 88.5 | 89.2 | 90.9
15 | 100.0 | 99.2 | 99.5 | 99.6 | 97.3 | 97.5 | 65.4 | 73.0 | 88.1 | 86.8 | 90.6
16 | 100.0 | 99.3 | 99.4 | 99.7 | 97.4 | 97.6 | 67.2 | 74.7 | 88.6 | 87.8 | 91.2
17 | 100.0 | 99.4 | 99.3 | 99.7 | 97.9 | 98.1 | 66.4 | 73.0 | 89.1 | 87.9 | 91.1
18 | 100.0 | 99.2 | 99.3 | 99.5 | 97.2 | 97.3 | 66.7 | 74.5 | 89.3 | 88.1 | 91.0
19 | 100.0 | 99.3 | 99.2 | 99.6 | 97.4 | 97.9 | 66.1 | 73.9 | 88.4 | 87.9 | 91.1
20 | 100.0 | 99.3 | 99.6 | 99.7 | 96.6 | 97.5 | 66.4 | 74.2 | 88.8 | 89.3 | 91.1
21 | 100.0 | 99.4 | 99.4 | 99.5 | 97.0 | 98.2 | 66.1 | 75.0 | 89.0 | 87.8 | 91.1
22 | 100.0 | 99.3 | 99.6 | 99.7 | 97.0 | 97.8 | 67.8 | 75.0 | 89.3 | 88.8 | 91.4
23 | 100.0 | 99.4 | 99.3 | 99.6 | 97.0 | 98.0 | 68.3 | 74.2 | 89.6 | 88.9 | 91.4
24 | 100.0 | 99.5 | 99.4 | 99.7 | 97.6 | 97.9 | 67.4 | 75.4 | 89.6 | 89.7 | 91.6
25 | 100.0 | 99.3 | 99.5 | 99.5 | 97.4 | 98.1 | 67.3 | 75.1 | 88.8 | 88.4 | 91.3
26 | 100.0 | 99.3 | 99.4 | 99.6 | 97.3 | 98.5 | 68.1 | 76.1 | 89.6 | 88.9 | 91.7
27 | 100.0 | 99.4 | 99.4 | 99.8 | 97.6 | 97.7 | 67.7 | 76.3 | 90.0 | 89.7 | 91.8
28 | 100.0 | 99.3 | 99.2 | 99.8 | 97.6 | 98.0 | 68.4 | 76.8 | 90.3 | 89.6 | 91.9
29 | 100.0 | 99.3 | 99.4 | 99.6 | 97.5 | 98.4 | 67.8 | 75.5 | 89.5 | 89.8 | 91.7
30 | 100.0 | 99.4 | 99.6 | 99.6 | 97.6 | 98.4 | 68.3 | 76.1 | 90.3 | 88.7 | 91.8
31 | 100.0 | 99.5 | 99.5 | 99.6 | 97.5 | 98.4 | 68.2 | 76.2 | 89.7 | 90.4 | 91.9
32 | 100.0 | 99.5 | 99.5 | 99.5 | 98.0 | 98.4 | 68.6 | 75.9 | 90.2 | 89.5 | 91.9
33 | 100.0 | 99.3 | 99.5 | 99.7 | 97.6 | 98.4 | 68.0 | 76.6 | 90.2 | 90.1 | 91.9
34 | 100.0 | 99.5 | 99.5 | 99.8 | 97.9 | 98.2 | 69.3 | 76.7 | 90.4 | 90.2 | 92.2
35 | 100.0 | 99.5 | 99.4 | 99.8 | 98.0 | 98.8 | 69.9 | 76.6 | 90.3 | 90.2 | 92.2
36 | 100.0 | 99.4 | 99.6 | 99.8 | 97.7 | 98.2 | 70.1 | 76.9 | 90.0 | 90.1 | 92.2
37 | 100.0 | 99.6 | 99.6 | 99.8 | 97.6 | 98.2 | 68.8 | 76.9 | 90.6 | 90.6 | 92.2
38 | 100.0 | 99.4 | 99.5 | 99.8 | 97.6 | 98.3 | 69.5 | 76.0 | 91.3 | 89.8 | 92.1
39 | 100.0 | 99.4 | 99.4 | 99.5 | 97.3 | 98.1 | 70.5 | 77.8 | 90.6 | 90.2 | 92.3
40 | 100.0 | 99.3 | 99.6 | 99.8 | 97.9 | 98.6 | 67.7 | 76.1 | 90.4 | 90.0 | 91.9
41 | 100.0 | 99.5 | 99.6 | 99.7 | 97.6 | 98.5 | 69.0 | 77.4 | 90.4 | 90.8 | 92.2
42 | 100.0 | 99.5 | 99.6 | 99.8 | 97.6 | 98.4 | 69.7 | 76.5 | 90.7 | 90.2 | 92.2
43 | 100.0 | 99.5 | 99.3 | 99.7 | 98.0 | 98.8 | 70.1 | 77.2 | 91.3 | 89.7 | 92.4
44 | 100.0 | 99.5 | 99.6 | 99.8 | 98.2 | 98.3 | 69.5 | 76.6 | 90.3 | 89.8 | 92.2
45 | 100.0 | 99.6 | 99.6 | 99.8 | 97.7 | 98.4 | 69.7 | 77.2 | 90.6 | 90.4 | 92.3
46 | 100.0 | 99.5 | 99.7 | 99.8 | 97.7 | 98.5 | 69.6 | 77.1 | 91.6 | 90.4 | 92.4
47 | 100.0 | 99.7 | 99.8 | 99.8 | 97.9 | 98.9 | 69.9 | 77.0 | 91.4 | 90.9 | 92.5
48 | 100.0 | 99.5 | 99.5 | 99.7 | 97.6 | 98.4 | 69.5 | 76.9 | 90.9 | 91.3 | 92.3
49 | 100.0 | 99.6 | 99.6 | 99.8 | 97.8 | 98.7 | 69.9 | 76.9 | 91.3 | 90.8 | 92.2
50 | 100.0 | 99.5 | 99.5 | 99.8 | 98.2 | 98.6 | 69.7 | 77.4 | 91.5 | 91.4 | 92.6

Figure 11: The conversation with ChatGPT for the benign example Figure 12: The
conversation with ChatGPT for the adversarial example Figure 13: The
conversation with Bard for the benign example Figure 14: The conversation with
Bard for the adversarial example