Enabling Heterogeneous Adversarial Transferability Via Feature Permutation Attacks

Author

Tao Wu
Tie Luo, Missouri University of Science and TechnologyFollow

Abstract

Adversarial attacks in black-box settings are highly practical, with transfer-based attacks being the most effective at generating adversarial examples (AEs) that transfer from surrogate models to unseen target models. However, their performance significantly degrades when transferring across heterogeneous architectures—such as CNNs, MLPs, and Vision Transformers (ViTs)—due to fundamental architectural differences. To address this, we propose Feature Permutation Attack (FPA), a zero-FLOP, parameter-free method that enhances adversarial transferability across diverse architectures. FPA introduces a novel feature permutation (FP) operation, which rearranges pixel values in selected feature maps to simulate long-range dependencies, effectively making CNNs behave more like ViTs and MLPs. This enhances feature diversity and improves transferability both across heterogeneous architectures and within homogeneous CNNs. Extensive evaluations on 14 state-of-the-art architectures show that FPA achieves maximum absolute gains in attack success rates of 7.68% on CNNs, 14.57% on ViTs, and 14.48% on MLPs, outperforming existing black-box attacks. Additionally, FPA is highly generalizable and can seamlessly integrate with other transfer-based attacks to further boost their performance. Our findings establish FPA as a robust, efficient, and computationally lightweight strategy for enhancing adversarial transferability across heterogeneous architectures.

Recommended Citation

T. Wu and T. Luo, "Enabling Heterogeneous Adversarial Transferability Via Feature Permutation Attacks," Lecture Notes in Computer Science, vol. 15873 LNAI, pp. 39 - 51, Springer, Jan 2025.

The definitive version is available at https://doi.org/10.1007/978-981-96-8183-9_4

Department(s)

Computer Science

Second Department

Electrical and Computer Engineering

Keywords and Phrases

Adversarial Examples; Adversarial Machine Learning; Black-Box Attacks; Heterogeneous Adversarial Transferability

International Standard Book Number (ISBN)

978-981968182-2

International Standard Serial Number (ISSN)

1611-3349; 0302-9743

Document Type

Article - Conference proceedings

Document Version

Citation

File Type

text

Language(s)

English

Rights

© 2025 Springer, All rights reserved.

Publication Date

01 Jan 2025