Library

Boosting Adversarial Transferability by Achieving Flat Local Maxima

Transfer-based attack adopts the adversarial examples generated on the surrogate model to attack various models, making it applicable in the physical world and attracting increasing interest. Recently, various adversarial attacks have emerged to boost adversarial transferability from different perspectives. In this work, inspired by the observation that flat local minima are correlated with good generalization, we assume and empirically validate that adversarial examples at a flat local region tend to have good transferability by introducing a penalized gradient norm to the original loss function. Since directly optimizing the gradient regularization norm is computationally expensive and intractable for generating adversarial examples, we propose an approximation optimization method to simplify the gradient update of the objective function. Specifically, we randomly sample an example and adopt a first-order procedure to approximate the curvature of Hessian/vector product, which makes computing more efficient by interpolating two neighboring gradients. Meanwhile, in order to obtain a more stable gradient direction, we randomly sample multiple examples and average the gradients of these examples to reduce the variance due to random sampling during the iterative process. Extensive experimental results on the ImageNet-compatible dataset show that the proposed method can generate adversarial examples at flat local regions, and significantly improve the adversarial transferability on either normally trained models or adversarially trained models than the state-of-the-art attacks. Our codes are available at: https://github.com/Trustworthy-AI-Group/PGN.

Health & medicineML methodsSecurity & robustnesscs.CVcs.CRcs.LGAdversarial Robustness in Machine LearningCOVID-19 diagnosis using AIAdvanced Neural Network ApplicationsComputer ScienceMathematics
View graphSource

Paper

Similar papers

Boosting the Transferability of Adversarial Examples Through Gradient AggregationFuquan Gan, Yan Wo2025 · IEEE Transactions on Information Forensics and Security · 9 citations In Library
Boosting Adversarial Transferability with Low-Cost Optimization via Maximin Expected FlatnessChunlin Qiu, Li, Ang, Yiheng Duan et al.2024 · arXiv (Cornell University) In Library
Boosting Adversarial Transferability With Low-Cost Optimization via Maximin Expected FlatnessChunlin Qiu, Ang Li, Yiheng Duan et al.2026 · IEEE Transactions on Information Forensics and Security In Library
Promoting adversarial transferability with enhanced loss flatnessYan Fang, Zhongyuan Wang, Jikang Cheng et al.2023 In Library
Beyond Deceptive Flatness: Dual-Order Solution for Strengthening Adversarial TransferabilityZhixuan Zhang, Pingyu Wang, Xingjian Zheng et al.2025 · Pattern Recognition · 0 citations In Library
Enhancing Adversarial Transferability through Dual-Domain Gradient Flatness OptimizationKaibo Zhang, Tong Jia, Wei‐Hua Chen2025 · The Visual Computer In Library
Prompting Adversarial Transferability via Path Flatness AttackZeze Tao, Jinjia Peng, Huibing Wang2026 · Proceedings of the AAAI Conference on Artificial Intelligence · 1 citation In Library
Improving Flat Maxima with Natural Gradient for Better Adversarial TransferabilityYunfei Long, Huosheng Xu2026 · Big Data and Cognitive Computing In Library
GNP Attack: Transferable Adversarial Examples Via Gradient Norm PenaltyTao Wu, Tie Luo, Donald C. Wunsch2023 In Library
GNP Attack: Transferable Adversarial Examples via Gradient Norm PenaltyTom Wu, Tie Luo, Donald C. Wunsch2023 · arXiv (Cornell University) · 18 citations In Library

Peer review

Accept (poster)NeurIPS 2023 · via OpenReview
Reviewer 2kUx5/10 · confidence 4/52023-07-02

Summary

The authors empirically observed that the adversarial data lies on the flat local maxima yields enhanced attack transferability. Inspired by this observation, this paper proposes a regularization to help the gradient-based attacks to find the adversarial data at the flat local maxima. This regularization penalizes the gradient norm around the adversarial data and can be efficiently computed via the finite difference method. The empirical results validate the effectiveness of the proposed method in improving attack transferability.

Strengths

1. The motivation of the proposed method is clear. The observation in Figure 1 is interesting and inspiring. 2. The authors utilized the finite difference method to make the computation more efficient. 3. It seems that the proposed method can significantly improve attack transferability.

Weaknesses

1. The proposed method is not theoretically motivated, which degrades its soundness. The authors claimed the optimization of perturbation equals the model training process using an analogy. However, it lacks supportive theoretical results to support this claim. Since the aforementioned claim is not solidly proven, the reason for the adversarial data at flat local maxima yielding better transferability seems unclear. 2. The paper does not provide the standard variance of the reported results to validate their significance. 3. The paper lacks some empirical and theoretical analyses of the effectiveness of the finite difference method in speeding up optimization. I think the optimization of the gradient norm is very important for the proposed method. Therefore, the effect of the acceleration method is worth studying.

Questions

1. Could the authors provide the error bar? 2. Could the authors provide a comparison between the proposed method and the previous work [1]? 3. Could the authors discuss how the effectiveness of the finite difference method in speeding up optimization empirically/theoretically? What are the computational consumption and the attack success rate with/without the finite difference method? 4. What is the performance of the proposed method compared the baseline methods evaluated on the transformer-based models (i.e., vision transformers)? [1] Skip Connections Matter: On the Transferability of Adversarial Examples Generated with ResNets, ICLR 2020.

Rating

5: Borderline accept: Technically solid paper where reasons to accept outweigh reasons to reject, e.g., limited evaluation. Please use sparingly.

Confidence

4: You are confident in your assessment, but not absolutely certain. It is unlikely, but not impossible, that you did not understand some parts of the submission or that you are unfamiliar with some pieces of related work.

Soundness

2 fair

Presentation

3 good

Contribution

2 fair

Limitations

The motivation of the proposed method lacks theoretical support.

Reviewer 8Bpx3/10 · confidence 4/52023-07-05

Summary

The paper proposes a method called Penalizing Gradient Norm (PGN) to improve the transferability of adversarial perturbations. The method is motivated by the observation that encouraging the flatness of the local landscape for adversarial examples can lead to better transferability, and thus PGN regulates the process of gradient-based adversarial attack algorithms by penalizing the magnitude of the loss gradient with respect to the input. Since such a regularization process requires the input Hessian which is a computationally expensive process, PGN utilizes the finite difference method to approximate the Hessian matrix. Experiments on the ImageNet-compatible dataset demonstrate that the proposed method can improve the transferability of untargeted attacks in comparison to other baseline methods.

Strengths

Originality: The proposed method is original and intuitive. Clarity: The general structure of the paper is very clear: moving from validating an assumption to proposing an algorithm, and finally evaluating the proposed method with empirical results. Significance: The proposed method addresses a practical security concern of deep learning models. The proposed method improves the transferability of the adversarial perturbations compared to existing gradient-based methods. Extensive empirical evaluations were performed to demonstrate the efficacy of the proposed method.

Weaknesses

Reverse adversarial perturbation (RAP) is a closely related work that encourages adversarial examples to be located at a region with low loss values. To demonstrate the novelty and significance of the proposed method, the paper needs a detailed discussion of the differences and similarities compared to RAP. One of the major contributions claimed by the paper is the empirical validation that "adversarial examples located in flat regions have good transferability", and it is mainly covered in Sec. 3.2. Putting aside the significance of the contribution, the authors should be very careful about the claims and statements in Sec 3.2. The assumption and the followed empirical validation both suffer from the lack of rigor and thus weaken the significance of the contributions. Please see the Questions section for additional discussions. Some technical details in Sec 3.3 require clarifications.

Questions

The issue around Sec. 3.2 stems from the lack of rigor in Assumption 1. How is a local region defined? What is the definition of flatness, and how to measure it? Following the assumption, why is the maximum l2 norm used in (3)? not a value averaged over l2 norm of data points sampled around x? Consider inputs that fail to transfer, but now are transferable because of the modified objective. Are they indeed situated in a flat region? More importantly, why is (3) necessary to validate the assumption? Since the assumption is agnostic to the attack algorithm, it should be true to any adversarial attack methods: I-FGSM, MI-FSGM, VIM-FGSM, etc. As such, given any attack algorithm, we should compare the flatness between adversarial examples that are transferable and those which fail to transfer. Ln 163 requires clarification, why do we have such expectations? The FD method circumvents the expensive computation of the input Hessian, and the approximation becomes accurate with decreasing value of \alpha. Why is the \alpha used in FD the same as the \alpha used in the iterative process of generating adversarial examples? To achieve an accurate approximation of the Hessian, shouldn't the stepsize used in FD be very small? \alpha = \eps/T seems to be a large value to me. With the current choice of \alpha, how close is the approximation (5) to the actual Hessian? Evaluation: Is PGN based on standard ifgsm, or one of the momentum variants? Since RAP is the closes method to PGN, is RAP used in the evaluation based on the standard ifgsm as well? Ln303: The statement of "flat local minima result in better generalization" being a fact is quite strong. Also, I would suggest the author proofread the paper. There are several very noticeable typos. For instance, even the name of the method is spelled incorrectly as "Penalizing" (Ln48, Ln55)

Rating

3: Reject: For instance, a paper with technical flaws, weak evaluation, inadequate reproducibility and incompletely addressed ethical considerations.

Confidence

4: You are confident in your assessment, but not absolutely certain. It is unlikely, but not impossible, that you did not understand some parts of the submission or that you are unfamiliar with some pieces of related work.

Soundness

2 fair

Presentation

3 good

Contribution

2 fair

Limitations

I suggest the author include a brief discussion of the limitation of the proposed work.

Reviewer xHRb5/10 · confidence 5/52023-07-06

Summary

This paper aims to boost adversarial transferability by using the Penelizing Gradient Norm, which can restrict adversarial examples located in flat regions. The writing is good, and it is easy to read. The experiments demonstrate that the proposed method achieves good results.

Strengths

- The motivation is clear, and the writing is well. - The analysis in Sec.3.2 is interesting, which can verify the assumption. - The proposed method is simple but effective.

Weaknesses

1. In Theorem 1, the authors briefly introduce the finite difference method, which is fundamental for efficiently approximating a second-order Hessian matrix. Although this is an interesting solution, it is better to verify this approximation in experiments if Eq. 6 is a good approximate solution to the objective function in Eq. 4. On one hand, I think the results of solving Eq. 4 directly should be reported, which can show that the approximated solution will not affect the performance. On the other hand, the running time and complexity analysis are also considered, which can show that this key design of PGN actually works well.  2. In Table 1, we first observe that PGN is a good solution for boosting transferability. But, we can also observe that the source model IncRes-v2 can achieve the best average score. Does this mean that the loss surface of this model is in a more smooth region? 3. I understand this paper focuses on boosting adversarial transferability. However, for black-box attacks, query-based adversarial attacks are also widely studied. Therefore, I am interested in if the Penelizing Gradient Norm is a generally method for black-box attacks, not limited to transfer attacks.

Questions

See above weakness.

Rating

5: Borderline accept: Technically solid paper where reasons to accept outweigh reasons to reject, e.g., limited evaluation. Please use sparingly.

Confidence

5: You are absolutely certain about your assessment. You are very familiar with the related work and checked the math/other details carefully.

Soundness

4 excellent

Presentation

4 excellent

Contribution

3 good

Limitations

The proposed method is similar to the previous work [a]. [a] Penalizing gradient norm for efficiently improving generalization in deep learning. ICML 2022.

Reviewer PZXp7/10 · confidence 4/52023-07-07

Summary

In this work, the authors first assume and empirically validate that adversarial examples at flat local minima tend to have better adversarial transferability. Based on this finding, they introduce a regularizer on the gradients in the neighborhood of the input sample to achieve flat local minima. To make the attack more computationally efficient, they propose Penalizing Gradient Norm (PGN) attack, which approximates the second-order Hessian matrix by interpolating two Jacobian matrixes.

Strengths

It is the first work that empirically validates that adversarial examples at flat local minima have better adversarial transferability. The approximation on the second-order Hessian matrix is reasonable with theoretical support. The proposed method is simple yet effective. Extensive experiments have shown that PGN can significantly boost adversarial transferability compared with existing methods. The visualization in Figure 2 validates that PGN can achieve better flat local minima than existing attacks, which further supports their motivation.

Weaknesses

Results on vision transformers, such as ViT, Swin, etc. would better be included. Evaluations on more defense methods, such as randomized smoothing and denoising should be conducted.

Questions

In Line 9 of Algorithm 1, g’ and g* are only related to i-th sampled example x’. Is it a typo? I think it should accumulate all the gradients of N sampled examples. What is the difference between the two symbols L and J? I think they are both loss functions. Definitions of these two loss functions should be clarified.

Rating

7: Accept: Technically solid paper, with high impact on at least one sub-area, or moderate-to-high impact on more than one areas, with good-to-excellent evaluation, resources, reproducibility, and no unaddressed ethical considerations.

Confidence

4: You are confident in your assessment, but not absolutely certain. It is unlikely, but not impossible, that you did not understand some parts of the submission or that you are unfamiliar with some pieces of related work.

Soundness

3 good

Presentation

3 good

Contribution

3 good

Limitations

No.

Reviewer 2kUx2023-08-14

Understand

Thanks for your response. The empirical results seem to sufficiently support the effectiveness of the proposed method. However, from the theoretical perspective, this paper does not provide a rigorous theoretical guarantee of its effectiveness. Therefore, I still would like to lean toward Boraberline Accept. I will not defend for its acceptance.

Reviewer xHRb2023-08-18

Response to authors' rebuttal

I appreciate the authors' detailed response to the initial review. Having carefully considered their feedback in conjunction with the comments from other reviewers, I decided to maintain my initial rating.

Reviewer 8Bpx2023-08-18

I appreciate author's detailed response. One of my major concern with the paper is the lack of rigour, particularly in Sec 3. As such, I will maintain the initial score.

Authorsrebuttal2023-08-20

Thank you for responding to our comments. In terms of your remaining concern, "The issue around Sec. 3.2 stems from the lack of rigor in Assumption 1", we will address it as follows: **1. We provide a more rigorous description of Assumption 1 here.** > **Assumption 1**: Given the maximum radius $\zeta$ for the local region and two adversarial examples $x_1^{adv}$ and $x_2^{adv}$ for the same input image $x$, if $\max _{x' \in \mathcal{B} _{\zeta}(x _1^{adv})} \| \nabla _{x'}J(x', y;\theta) \| _2 < \max _{x' \in \mathcal{B} _{\zeta}(x _2^{adv})} \| \nabla _{x'}J(x', y;\theta) \| _2$, $x _1^{adv}$ tends to be more transferable than $x _2^{adv}$ across various models. > > Here we adopt the maximum gradient in the neighborhood to evluate the flatness of local region, which is more rigorous. **2. Regarding "The assumption and the followed empirical validation both suffer from the lack of rigor and thus weaken the significance of the contributions", we need to clarify again as follows.** >In this work, inspired by the observation that flat local minima can bring better generalization during the model training process, we try to explore whether flat local optimum can improve the adversarial transferability from a new perspective. Hence, we first propose the assumption that adversarial example at a flat local region tends to have better transferability. To validate Assumption 1, we introduce a regularizer to minimize the maximum gradient in the $\epsilon$-neighborhood of the original objective loss function. Intuitively, the smaller gradient also indicates a flatter location. By optimizing this new objective loss function (Eq.3), we find that adversarial examples have better transferability. Thus, when we verify that Eq.3 can improve the adversarial transferability, it naturally verifies that our assumption is valid, i.e., flat local optima have better transferability. Based on this assumption and verification, we propose a novel attack to boost adversarial transferability. **3. More clarifications using the finite difference methods for approximation** > In line 166, we have noted that existing adversarial attacks typically rely on the sign of the gradient, rather than requiring an exact gradient value. Thus, we approximate the second-order Hessian matrix using the finite difference method to accelerate the attack process. We also have compared the cosine similarity of perturbations generated by the Hessian matrix and finite differences method and measured an average similarity of 0.9035 for 1000 images. It can be observed that the current finite difference can effectively approximate the adversarial perturbation generated by the Hessian matrix. Thank you for your effort and reviews. We are looking forward to your further reply and happy to address your concerns if any.

Reviewer PZXp2023-08-20

I have carefully read the responses and the other reviews. I think the authors have addressed my concerns. Also, the assumption is reasonable with empirical verfication, which makes the proposed method novel and solid. Thus, I raise my score to 7.

Program Chairsdecision2023-09-21

Decision

Accept (poster)

© 2026 NYSGPT2525 LLC