Abstract:Quantized neural networks (QNNs) have received increasing attention in resource-constrained scenarios due to their exceptional generalizability. However, their robustness against realistic black-box adversarial attacks has not been extensively studied. In this scenario, adversarial transferability is pursued across QNNs with different quantization bitwidths, which particularly involve unknown architectures and defense methods. Previous studies claim that transferability is difficult to achieve across QNNs with different bitwidths on the condition that they share the same architecture. However, we discover that under different architectures, transferability can be largely improved by using a QNN quantized with an extremely low bitwidth as the substitute model. We further improve the attack transferability by proposing quantization aware attack (QAA), which fine-tunes a QNN substitute model with a multiple-bitwidth training objective. In particular, we demonstrate that QAA addresses the two issues that are commonly known to hinder transferability: 1) quantization shifts and 2) gradient misalignments. Extensive experimental results validate the high transferability of the QAA to diverse target models. For instance, when adopting the ResNet-34 substitute model on ImageNet, QAA outperforms the current best attack in attacking standardly trained DNNs, adversarially trained DNNs, and QNNs with varied bitwidths by 4.3% ~ 20.9%, 8.7% ~ 15.5%, and 2.6% ~ 31.1% (absolute), respectively. In addition, QAA is efficient since it only takes one epoch for fine-tuning. In the end, we empirically explain the effectiveness of QAA from the view of the loss landscape. Our code is available at https://github.com/yyl-github-1896/QAA/.

DANAA: Towards transferable attacks with double adversarial neuron attribution

Improving Adversarial Transferability via Neuron Attribution-Based Attacks

Improving the Transferability of Adversarial Examples Through Neighborhood Attribution

Intermediate-Layer Transferable Adversarial Attack With DNN Attention

A Survey on Transferability of Adversarial Examples across Deep Neural Networks

Improving the transferability of adversarial examples with path tuning

Improving Adversarial Transferability by Stable Diffusion

Benchmarking Transferable Adversarial Attacks

Channel-augmented Joint Transformation for Transferable Adversarial Attacks

Enhance Domain-Invariant Transferability of Adversarial Examples via Distance Metric Attack

Understanding and Enhancing the Transferability of Adversarial Examples

Towards Evaluating Transfer-based Attacks Systematically, Practically, and Fairly

Enhancing the Transferability of Adversarial Examples with Noise Injection Augmentation

Enhancing Adversarial Transferability with Adversarial Weight Tuning

Improving Adversarial Transferability Via Frequency-based Stationary Point Search

An Approach to Improve Transferability of Adversarial Examples

Promoting Adversarial Transferability via Dual-Sampling Variance Aggregation and Feature Heterogeneity Attacks

Boosting Adversarial Transferability via Fusing Logits of Top-1 Decomposed Feature

Quantization Aware Attack: Enhancing Transferable Adversarial Attacks by Model Quantization

Boosting Adversarial Transferability Via Logits Mixup with Dominant Decomposed Feature

Enhancing the transferability of adversarial samples with random noise techniques