Boosting cross-architecture adversarial transferability by enhanced deformation attack.

Abstract

Adversarial examples generated on convolutional neural network (CNN) surrogates often transfer less effectively to vision transformer (ViT) targets than to CNN targets, creating a cross-architecture bottleneck for transfer-based black-box attacks. Existing input-transformation attacks diversify gradient estimation, yet the evaluated baselines still exhibit substantial CNN-to-ViT transfer gaps, motivating a deformation strategy that varies both control-point geometry and boundary support. To address this limitation, this paper proposes the Enhanced Deformation Attack (EDA), which estimates attack gradients over stochastically transformed views of the current adversarial image. Each view samples either a full control-point grid with movable boundary points or an interior center grid, and the displaced control points are remapped to a reflection-padded canvas before thin-plate spline (TPS) resampling. Gaussian noise or brightness adjustment provides complementary appearance variation. All transformations are confined to gradient estimation, so the final adversarial example remains in the original coordinate system and satisfies the prescribed ℓ_∞ perturbation budget. On the ImageNet-Compatible dataset, EDA achieves the highest mean attack success rate (ASR) on ViT targets for all four CNN sources, outperforming the strongest source-specific baseline by 5.8, 11.2, 8.7, and 8.0 percentage points under ResNet-18, Inception-v3, Inception-v4, and Inception-ResNet-v2, respectively. The gains also persist on the full ImageNet validation set and ImageNet-V2 across all evaluated source and target groups. Additional evaluations across four perturbation budgets, targeted settings, five random seeds, defended models, and modern robust models further support the stability and scope of the observed transfer gains. The source code is publicly available at https://github.com/wjc2400136/EDA.