Pith. sign in

REVIEW 3 major objections 5 minor 91 references

Learning with Bilevel-Minimax Optimization for Efficient and Reliable Transfer Attacks

T0 review · 3 major / 5 minor · reviewed 2026-08-16 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read A bilevel-minimax recipe lifts adversarial transfer by 23 points

desk verdict The empirical study is broad and the formulation is novel, but the stated IGA update for learning the initialization is algebraically invalid as written because the inner objective has no dependence on the initialization variable. read the letter →

arxiv 2608.11815 v1 pith:WED4OSS2 submitted 2026-08-12 cs.LG cs.CV

Yaohua Liu , Yifan Guo , Jiaxin Gao This is my paper · ORCID
classification cs.LGcs.CV
keywords transferattacksadversarialexamplesbileveloptimizationminimaximplicitgradientinitializationperturbationsurrogateadaptationsemanticsegmentation
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper argues that transferability of adversarial examples is not a property of the perturbation alone: it emerges from how the attack is initialized, how the surrogate is adapted, and how the perturbation is optimized, all three interacting. It proposes BMAT, a bilevel optimization framework whose inner minimax problem co-adapts the perturbation and surrogate soft weights, and whose outer level learns the initialization perturbation through an implicit-gradient approximation. If correct, BMAT shows that transfer attacks can be treated as a principled hierarchical optimization problem instead of a set of heuristic tricks, and it reports average classification attack-success gains of about 23 percentage points across 24 method combinations, plus roughly halved segmentation mIoU on some victims. The reader should care because transfer attacks are the practical black-box threat model, and the paper claims a unified formulation that makes existing single-level attacks stronger when combined with it.

What carries the argument

Two components carry the algorithm. First, the Soft Weight Modulator (SWM) performs single-step alternating updates of the perturbation and surrogate weights $\tilde{K}$ times inside the inner loop, using only one backward pass, so the surrogate is locally adapted to produce more universal gradients. Second, the Implicit Gradient Approximator (IGA) computes the outer hypergradient with respect to the initialization $\delta$ via the implicit function theorem, solving the linear system $\nabla^2_{\phi\phi} f\, h = \nabla_\phi F$ with a Fletcher-Reeves conjugate gradient method and a damping term $\rho I$ to ensure invertibility, avoiding unrolling of the inner trajectory. The theoretical analysis (Lemma 1, Lemma 2, Theorem 1) shows a descent inequality and an averaged stationarity bound with error terms from IGA and from the finite inner steps $\tilde{K}$, framing the solver as a stable regularized bilevel method.

What would settle it

On a small model pair, compute the true hypergradient by unrolling the inner trajectory and compare its inner product with the IGA approximation; if the average cosine similarity is not positive, or if the outer loss decreases only when the damping term dominates the Hessian, the implicit gradient is not capturing the true coupling. Alternatively, train BMAT with $\tilde{K}=1$ inner step and with $\tilde{K}=50$; if the learned initialization's transfer gain vanishes or reverses at the larger $\tilde{K}$, the method is overfitting to the finite-step dynamics.

Watch

Extended reading notes

Core claim

BMAT claims that replacing the vanilla single-level attack objective with a bilevel-minimax problem, in which the inner level solves min over perturbation $\phi$ and max over surrogate weights $\omega$, and the outer level optimizes the initialization $\delta$ via implicit differentiation, yields consistently more transferable adversarial examples. Concretely, the paper reports that BMAT, as a wrapper around nine base attackers, raises average attack success rate by 23.28% across 24 combinations on ImageNet over 10 victim models spanning CNNs, robust ensembles, and transformers, and on Cityscapes it reduces mIoU by up to roughly 2x, with a 46.4% relative mIoU drop on ADE20K. The claim is that the learned initialization encodes task-agnostic trajectory seeds while the inner minimax flattens the surrogate's loss landscape, jointly producing gradients that transfer across architectures without query access to the victim.

Load-bearing premise

The whole scheme assumes that the implicit-function-theorem hypergradient, computed after only a handful of non-convex inner steps and with a damping patch, is a genuine descent direction for the outer objective rather than an artifact of the finite-step trajectory.

Editorial extensions

If this is right

  • If BMAT is correct, existing gradient-based transfer attacks (PGD, MI, SI, SGM, Ghost, etc.) can be upgraded by learning an initialization perturbation, with gains on both CNN and transformer victims.
  • BMAT's gains persist under normalized backward-pass budgets, meaning the learned seed is more efficient than simply running more attack iterations.
  • In a single-surrogate setting with no additional victim supervision, BMAT still improves average ASR by 30-58%, implying that the bilevel coupling itself, not the auxiliary pseudo-surrogate, drives transferability.
  • The mechanism analysis shows SWM flattens the surrogate loss landscape and the learned initialization raises feature shift on held-out models, consistent with the claim that transferability comes from coordinated variable evolution.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If the implicit-function hypergradient is reliable, the same bilevel-minimax recipe could apply to other black-box transfer settings like object detection or video models, where the inner minimax could adapt different surrogate components.
  • The dependence on only $\tilde{K}$ finite inner steps suggests the learned initialization may be specialized to that exact inner step count; varying $\tilde{K}$ at test time could change effectiveness, a testable extension.
  • The paper's framing implies that any improvement in surrogate adaptation, not just Bayesian weight sampling, could be plugged into the inner minimax to push cross-architecture transfer further, potentially making transfer attacks scale with surrogate diversity rather than attack iterations.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. The manuscript proposes BMAT, a bilevel-minimax formulation for transfer-based adversarial attacks. The outer level is said to learn an initialization perturbation δ through an implicit-gradient approximator (IGA), while the inner level uses a soft-weight modulator (SWM) to jointly update the perturbation and surrogate parameters. The paper reports extensive classification and segmentation experiments with large ASR gains and mIoU reductions across many victims, plus stability-oriented lemmas and a theorem. The empirical breadth is substantial, and the experimental protocol is generally careful. However, the central algorithmic derivation is invalid as written: the inner objective f does not depend on δ, so the cross-Hessian used to update δ is identically zero and the described IGA update cannot move δ.

Significance. If the method worked as described, the reported gains would be meaningful for transfer attacks: the evaluation spans classification and segmentation, more than 30 victim models, multiple base attackers, and normalized computational budgets. The direct comparison with the closely related BETAK method and the extensive ablations are strengths, as is the stated intention to release code. However, the load-bearing IGA mechanism is algebraically vacuous in the stated formulation, and the theoretical statements are unproven and depend on undefined quantities. Consequently, the paper does not currently establish that BMAT learns an initialization or that the observed empirical gains arise from the described bilevel-minimax coupling.

major comments (3)
  1. [§3.2, Eqs. (3)–(7); Algorithm 1, line 11] The hypergradient update is not valid. The inner objective f in Eq. (3) is -L_s(\phi,S_\omega;D_i) - \tau R(S_\omega;D_i), which contains no δ; δ appears only as the initial condition \phi_0 = δ in Eq. (4). Hence the cross-Hessian \nabla^2_{\delta\phi} f in Eq. (6) is identically zero, and the update in Algorithm 1 line 11 cannot change δ. The implicit-function theorem does not apply here, because it requires the inner problem to depend on δ as a parameter; δ is not such a parameter. The finite-step response \phi^*(\delta) does depend on δ through the initial condition, but its derivative must be obtained by differentiating through the \tilde K SWM iterations, not from the stated IFT expression. This is a load-bearing error: the learned-initialization mechanism is the paper's central algorithmic contribution.
  2. [§3.2, 'Algorithm Analysis'; Lemmas 1–2; Theorem 1] The theoretical statements are not usable in their current form. Lemma 1 asserts a descent inequality involving \nabla_\delta F and a gradient norm, while Algorithm 1 updates δ with sign(·) and projection; no argument connects the two. Lemma 2 and Theorem 1 involve error terms \epsilon_IGA, \epsilon_\phi^{(\tilde K)}, \epsilon_\omega^{(\tilde K)} and constants L_\phi, L_\omega, G_F that are never defined, and no proofs are supplied in the manuscript or an appendix. Moreover, Lemma 2's bounds grow with \tilde K as (1+\beta^2 L_\phi^2)^{\tilde K}, which is the opposite of the convergence needed to replace the finite-step response by an implicit optimum. The claimed theoretical insights are therefore unverifiable and do not support the algorithm as described.
  3. [§3.2, Eq. (4) and the IGA paragraph] Even if the zero cross-Hessian issue were set aside, applying the implicit-function theorem at an 'approximate inner optimum' is not justified. Eq. (4) explicitly defines \phi^*(\delta) as a finite-step response rather than a stationary point of f, whereas Eq. (6) requires \nabla_\phi f(\phi^*(\delta)) = 0 in a neighborhood. No such condition is proved, and with only \tilde K inner steps the inner trajectory need not be near any stationary point. The damping term (\nabla^2_{\phi\phi} f + \rho I)^{-1} is introduced without derivation and cannot repair the missing δ-dependence of f.
minor comments (5)
  1. [§3.2, Eq. (5)] Please clarify how the SWM obtains both \nabla_\phi f and \nabla_\omega f in a single backward pass; standard backprop can provide gradients with respect to both groups of variables, but the memory and ordering assumptions should be stated explicitly.
  2. [Figure 5] The hyperparameter ablation figure is not readable because the axis labels are shown as escaped '/uni000000...' sequences; the font encoding needs to be fixed.
  3. [§3.1, Eqs. (1) and (3)] The surrogate-loss notation is inconsistent: Eq. (1) writes L_s(\phi; S_\omega, D_i) while Eq. (3) writes L_s(\phi, S_\omega; D_i). Please use one convention throughout.
  4. [Algorithm 2] The conjugate-gradient iteration computes \eta_\nu as r_\nu^\top r_\nu / (p_\nu^\top (\nabla^2_{\phi\phi} f \cdot p_\nu)); if the denominator is near zero the iteration is undefined, and the later note about damping does not appear in the pseudocode. A safeguard or a reference to the damping variant should be added.
  5. [§4.2, Table 8 caption and text] The sentence 'BMAT improves ASR by +25.87% and +41.45% over PGD on average' should state whether these are absolute percentage-point gains or relative gains; the surrounding numbers suggest percentage points, but the wording is ambiguous.

Circularity Check

0 steps flagged · score 1.0 of 10

No significant circularity: evaluation is against held-out victims and the core derivation is not fitted to its success criteria; the IGA hypergradient issue is a correctness concern rather than a circularity.

full rationale

I walked the derivation chain from Eq. (1) through Algorithm 1. The inner minimax objective f(phi,omega) in Eq. (3) and the outer objective F(delta, phi*(delta)) in Eq. (4) are not fitted to the reported transfer metrics: phi*(delta) is evaluated on a pseudo-surrogate P, and all ASR/mIoU results are measured on held-out victim models not used for IP learning. The SWM co-update (Eq. 5) and the IGA linear solve (Alg. 2, Eq. 7) are algorithmic components whose outputs feed the IP update; they are not re-statements of the evaluation criteria. Self-citations exist (e.g., BETAK [51] and the authors' bilevel papers [44,45,49]), but they are not load-bearing: BETAK is benchmarked directly in Table 3, and the implicit-function-theorem citation in Eq. (6) points to a standard general result rather than a self-issued uniqueness theorem. I therefore find no case where a prediction or first-principles result reduces to its own input by construction. I do flag, as a correctness risk rather than circularity, that the displayed hypergradient in Eq. (6)/(7) is problematic: f in Eq. (3) has no explicit delta-dependence, so the cross-Hessian (nabla^2_{delta phi} f) is identically zero and Algorithm 1 line 11 would not move delta as written. This is an algebraic-validity / omitted-support issue that should be weighed in a technical review, but it is not an equivalence-of-prediction-to-input and therefore does not raise the circularity score.

Assumptions & free parameters 6 free parameters · 4 assumptions · 0 invented entities

The method introduces no invented entities; the pseudo-surrogate P is a reused model. The main free parameters are tau, step sizes, IGA damping and tolerance, and iteration counts; only tau and the iteration counts are disclosed with ablation. The central assumptions are that the inner minimax yields transferable gradients, that the implicit-function hypergradient is valid despite a finite-step inner loop, and that the pseudo-surrogate is a reliable proxy.

free parameters (6)
  • tau (regularizer coefficient) = 0.1 or 0.5 (ablated in Fig. 5)
    Balances adversarial loss and natural-accuracy regularizer in Eq. (3); selected by ablation on segmentation benchmarks without a stated validation split.
  • T (outer IP iterations) = 2-3 in main results (Fig. 5, Tab. 8)
    Chosen by ablation; larger T improves ASR but increases runtime.
  • K_tilde (inner SWM steps) = 5-10 in main results
    Ablated in Fig. 5 and Tab. 10; gains saturate quickly.
  • alpha, beta, gamma (step sizes) = not reported
    Attack, perturbation, and weight step sizes; theory sets them proportional to 1/sqrt(T), but experimental values are not disclosed.
  • rho (IGA damping) = not reported
    Added to (H_phiphi f) to ensure invertibility; value not stated.
  • zeta (CG tolerance) and N (CG max iterations) = not reported
    Termination criteria for the IGA conjugate-gradient solver in Algorithm 2.
assumptions (4)
  • domain assumption The inner minimax objective f(phi, omega) = -L_s(phi, S_omega) - tau R(S_omega) with max over omega produces surrogate weights whose gradients generalize across architectures.
    Section 3.2, Eq. (3): the paper assumes a robustified surrogate yields universal gradient features. This is the core design intuition and is not proven.
  • standard math The implicit function theorem applies to the inner minimax: the inner response phi*(delta) is differentiable and (H_phiphi f) is invertible.
    Section 3.2, Eqs. (6)-(7): the IGA hypergradient uses (H_phiphi f)^{-1}; a damped variant (H_phiphi f + rho I)^{-1} is used because invertibility is not guaranteed for this non-convex, non-concave game.
  • ad hoc to paper The finite-step inner response after K~ SWM iterations is close enough to the implicit optimum phi*(delta) for the implicit-function-based hypergradient to be a valid descent direction.
    Section 3.2 states 'at the approximate inner optimum'; Algorithm 1 uses K~ = 5-10 inner steps. Tab. 8 shows marginal gains for larger K~, but no bound on the approximation error is given in terms of K~.
  • domain assumption The pseudo-surrogate P (white-box surrogate, Bayesian version, or auxiliary Inception-v3) provides a transferable signal for learning the initialization delta.
    Section 3.2 'Bilevel Modeling': the outer objective F(delta) = -L_p(phi*(delta)) assumes optimizing the trajectory against P improves transfer to held-out victims. This is tested empirically but not proven.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Learning with Bilevel-Minimax Optimization for Efficient and Reliable Transfer Attacks." pith.science (2026). https://pith.science/paper/WED4OSS2

@misc{pith2026260811815,
  author       = {Pith},
  title        = {Pith review of: Learning with Bilevel-Minimax Optimization for Efficient and Reliable Transfer Attacks},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/WED4OSS2}},
  note         = {Machine review of arXiv:2608.11815}
}
read the original abstract

Transfer-based adversarial attacks craft adversarial examples using surrogate models to mislead black-box victim models. Beyond perturbation generation, transferability is fundamentally governed by the coupling of initialization, surrogate adaptation, and gradient dynamics. We revisit this challenge from a bilevel-minimax perspective and propose BMAT (Bilevel-Minimax Adversarial Transfer). The bilevel formulation captures the dependency between initialization and perturbation, while the inner minimax problem promotes surrogate robustness for cross-architecture generalization. Algorithmically, we develop an integrated bottom-up solver that combines a Soft Weight Modulator and an Implicit Gradient Approximator to enable ternary coupling among initialization, surrogate adaptation, and perturbation optimization. We further provide theoretical insights into the optimization dynamics of the proposed bilevel-minimax framework. Extensive experiments on classification and segmentation benchmarks show that BMAT outperforms more than 10 strong baselines across more than 30 victim models, improving both intra- and cross-architecture transfer and yielding up to a 2x reduction in mIoU. Code is available at https://github.com/callous-youth/BMAT.

Figures

Figures reproduced from arXiv: 2608.11815 by the authors.

Figure 1
Figure 1. Landscape (Top Left): We visualize the loss L(u + xι + yo) along sign￾gradient direction ι and random direction o, centered at the original image u. Com￾pared with VTA, BMAT reaches a higher loss region with stronger cross-model transfer behavior. Classification (Bottom Left): BMAT achieves a 26.2% ASR gain on Im￾ageNet [65] across 10 victims with 16 base attackers. Segmentation (Right): BMAT reduces mIoU by 46.4% o… view at source ↗
Figure 2
Figure 2. BMAT pipeline. Left: Bilevel-Minimax formulation illustrating the ternary coupling interaction across three variables. Top: Overall data flow and supervision in BMAT. Middle: SWM showing inner-loop single-pass co-update of perturbation and soft surrogate weights to obtain cross-architecture gradients. Right: IGA depicting hypergradient calculation of IP using Fletcher-Reeves Conjugation. e.g., SGM [77] and Ghost [39… view at source ↗
Figure 3
Figure 3. Visualization of the attack results generated by 4 victim models on the Cityscapes dataset, including (a) DLV3-R101, (b) PSP-R101, (c) Segformer, and (d) Setr. We adopt Segformer as the surrogate model. the attack trajectory instead of merely strengthening perturbation updates on a fixed surrogate. Qualitative Comparison. In [PITH_FULL_IMAGE:figures/full_fig_p011_3.png] view at source ↗
Figures from the paper (3 more)
Figure 4
Figure 4. Figure 4: We visualize the tri-coupled coordination process of BMAT. Left Panel: It shows that SWM flattens the loss landscape of surrogate within ∼10 steps. Right Panel: It demonstrates that δ guides the trajectory toward a better feature-shift region. tation outputs, rendering…
Figure 5
Figure 5. Figure 5: Ablation results of 3 key hyperparameters across 7 CNN-based victim models on the semantic segmentation task. We adopt DLV3-R50 as the surrogate. 0 1 2 3 4 5 6 7 8 9 Attack Iteration k 0 5 10 15 Loss Upper-level Iteration T MI T = 1 T = 3 T = 5 T = 7 [PITH_FULL_IMAGE:…
Figure 6
Figure 6. Figure 6: Illustrating the loss convergence behav￾ior. We employ MI as the base attacker. Convergence Behavior. In [PITH_FULL_IMAGE:figures/full_fig_p015_6.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

91 extracted references · 54 canonical work pages

  1. [1]

    In: Forty-first International Conference on Machine Learning (2024)

    Agnihotri, S., Jung, S., Keuper, M.: Cospgd: an efficient white-box adversarial attack for pixel-wise prediction tasks. In: Forty-first International Conference on Machine Learning (2024)

    2024

  2. [2]

    In: Proceedings of the AAAI Conference on Artificial Intelligence

    Bai, F., Liu, R., Du, Y., Wen, Y., Yang, Y.: Rat: Adversarial attacks on deep rein- forcement agents for targeted behaviors. In: Proceedings of the AAAI Conference on Artificial Intelligence. vol. 39, pp. 15453–15461 (2025)

    2025

  3. [3]

    In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition

    Cai, Z., Tan, Y., Asif, M.S.: Ensemble-based blackbox attacks on dense prediction. In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. pp. 4045–4055 (2023)

    2023

  4. [4]

    In: Proceedings of the IEEE International Con- ference on Computer Vision Workshops

    Cao, Y., Xu, J., Lin, S., Wei, F., Hu, H.: Gcnet: Non-local networks meet squeeze- excitation networks and beyond. In: Proceedings of the IEEE International Con- ference on Computer Vision Workshops. pp. 0–0 (2019)

    2019

  5. [5]

    In: 2017 ieee symposium on security and privacy (sp)

    Carlini, N., Wagner, D.: Towards evaluating the robustness of neural networks. In: 2017 ieee symposium on security and privacy (sp). pp. 39–57. Ieee (2017)

    2017

  6. [6]

    arXiv preprint arXiv:2303.09105 (2023)

    Chen, H., Zhang, Y., Dong, Y., Yang, X., Su, H., Zhu, J.: Rethinking model ensem- ble in transfer-based adversarial attacks. arXiv preprint arXiv:2303.09105 (2023)

    arXiv 2023

  7. [7]

    In: Proceedings of the AAAI Conference on Artificial Intelligence

    Chen, J., Feng, Z., Zeng, R., Pu, Y., Zhou, C., Jiang, Y., Gan, Y., Li, J., Ji, S.: En- hancing adversarial transferability with adversarial weight tuning. In: Proceedings of the AAAI Conference on Artificial Intelligence. vol. 39, pp. 2061–2069 (2025)

    2025

  8. [8]

    arXiv preprint arXiv:1706.05587 (2017)

    Chen, L.C., Papandreou, G., Schroff, F., Adam, H.: Rethinking atrous convolution for semantic image segmentation. arXiv preprint arXiv:1706.05587 (2017)

    arXiv 2017

Show all 91 references
  1. [9]

    In: Proceedings of the IEEE/CVF international conference on com- puter vision

    Chen, Z., Xie, L., Niu, J., Liu, X., Wei, L., Tian, Q.: Visformer: The vision-friendly transformer. In: Proceedings of the IEEE/CVF international conference on com- puter vision. pp. 589–598 (2021)

    2021

  2. [10]

    Contributors, M.: Mmsegmentation: Openmmlab semantic segmentation toolbox and benchmark (2020)

    2020

  3. [11]

    In: Proceedings of the IEEE conference on computer vision and pattern recognition

    Cordts, M., Omran, M., Ramos, S., Rehfeld, T., Enzweiler, M., Benenson, R., Franke, U., Roth, S., Schiele, B.: The cityscapes dataset for semantic urban scene understanding. In: Proceedings of the IEEE conference on computer vision and pattern recognition. pp. 3213–3223 (2016)

    2016

  4. [12]

    In: Proceedings of the IEEE conference on computer vision and pattern recognition

    Dong, Y., Liao, F., Pang, T., Su, H., Zhu, J., Hu, X., Li, J.: Boosting adversarial attacks with momentum. In: Proceedings of the IEEE conference on computer vision and pattern recognition. pp. 9185–9193 (2018)

    2018

  5. [13]

    In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition

    Dong, Y., Pang, T., Su, H., Zhu, J.: Evading defenses to transferable adversar- ial examples by translation-invariant attacks. In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. pp. 4312–4321 (2019)

    2019

  6. [14]

    arXiv preprint arXiv:2010.11929 (2020)

    Dosovitskiy, A., Beyer, L., Kolesnikov, A., Weissenborn, D., Zhai, X., Unterthiner, T., Dehghani, M., Minderer, M., Heigold, G., Gelly, S., et al.: An image is worth 16x16 words: Transformers for image recognition at scale. arXiv preprint arXiv:2010.11929 (2020)

    2020 arXiv

  7. [15]

    arXiv preprint arXiv:1906.02398 (2019)

    Du, J., Zhang, H., Zhou, J.T., Yang, Y., Feng, J.: Query-efficient meta attack to deep neural networks. arXiv preprint arXiv:1906.02398 (2019)

    2019 arXiv

  8. [16]

    In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition

    Fan, X., Wang, X., Gao, J., Wang, J., Luo, Z., Liu, R.: Bi-level learning of task- specific decoders for joint registration and one-shot medical image segmentation. In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. pp. 11726–11735 (2024)

    2024

  9. [17]

    In: Pro- ceedings of the AAAI Conference on Artificial Intelligence

    Fang, S., Li, J., Lin, X., Ji, R.: Learning to learn transferable attack. In: Pro- ceedings of the AAAI Conference on Artificial Intelligence. vol. 36, pp. 571–579 (2022) Bilevel-Minimax Adversarial Transfer 17

    2022

  10. [18]

    arXiv preprint arXiv:1806.04910 (2018)

    Franceschi, L., Frasconi, P., Salzo, S., Grazzi, R., Pontil, M.: Bilevel pro- gramming for hyperparameter optimization and meta-learning. arXiv preprint arXiv:1806.04910 (2018)

    2018 arXiv

  11. [19]

    The Visual Computer39(4), 1471–1484 (2023)

    Gao, J., Liu, X., Liu, R., Fan, X.: Learning adaptive hyper-guidance via proxy- based bilevel optimization for image enhancement. The Visual Computer39(4), 1471–1484 (2023)

    2023

  12. [20]

    In: Proceedings of the 32nd ACM International Conference on Multimedia

    Gao, J., Liu, Y.: Enhancing images with coupled low-resolution and ultra-dark degradations: A tri-level learning framework. In: Proceedings of the 32nd ACM International Conference on Multimedia. pp. 8642–8651 (2024)

    2024

  13. [21]

    arXiv preprint arXiv:2512.11453 (2025)

    Gao, J., Liu, Y., Cheng, R., Tan, K.C.: Learning to evolve for optimization via stability-inducing neural unrolling. arXiv preprint arXiv:2512.11453 (2025)

    2025

  14. [22]

    In: Proceedings of the 2026 International Conference on Multimedia Retrieval

    Gao, J., Liu, Y., Cui, D., Zhao, Z.: Snoc: Subtle nested objective configuration for joint ultra-low-light enhancement and super-resolution. In: Proceedings of the 2026 International Conference on Multimedia Retrieval. pp. 2172–2181 (2026)

    2026

  15. [23]

    Pattern Recognition 154, 110558 (2024)

    Gao, J., Liu, Y., Yue, Z., Fan, X., Liu, R.: Collaborative brightening and ampli- fication of low-light imagery via bi-level adversarial learning. Pattern Recognition 154, 110558 (2024)

    2024

  16. [24]

    IEEE transactions on neural networks and learning systems36(4), 7500–7513 (2024)

    Gao, J., Yue, Z., Liu, Y., Xie, S., Fan, X., Liu, R.: A dual-stream-modulated learning framework for illuminating and super-resolving ultra-dark images. IEEE transactions on neural networks and learning systems36(4), 7500–7513 (2024)

    2024

  17. [25]

    arXiv preprint arXiv:2310.17626 (2023)

    Gu, J., Jia, X., de Jorge, P., Yu, W., Liu, X., Ma, A., Xun, Y., Hu, A., Khakzar, A., Li, Z., et al.: A survey on transferability of adversarial examples across deep neural networks. arXiv preprint arXiv:2310.17626 (2023)

    2023 arXiv

  18. [26]

    In: European Conference on Computer Vision

    Gu, J., Zhao, H., Tresp, V., Torr, P.H.: Segpgd: An effective and efficient adver- sarial attack for evaluating and boosting segmentation robustness. In: European Conference on Computer Vision. pp. 308–325. Springer (2022)

    2022

  19. [27]

    Advances in neural information processing systems33, 85– 95 (2020)

    Guo, Y., Li, Q., Chen, H.: Backpropagating linearly improves transferability of adversarial examples. Advances in neural information processing systems33, 85– 95 (2020)

    2020

  20. [28]

    arXiv preprint arXiv:2307.16572 (2023)

    He, M., Zhang, J., Yang, Z., He, M., Barnes, N., Dai, Y.: Transferable attack for semantic segmentation. arXiv preprint arXiv:2307.16572 (2023)

    2023 arXiv

  21. [29]

    In: Proceedings of the IEEE conference on computer vision and pattern recognition

    Hu, J., Shen, L., Sun, G.: Squeeze-and-excitation networks. In: Proceedings of the IEEE conference on computer vision and pattern recognition. pp. 7132–7141 (2018)

    2018

  22. [30]

    In: Proc

    Hu, Q., Wang, B., Yang, T.: A stochastic momentum method for min-max bilevel optimization. In: Proc. 13th Annu. Workshop Optim. Mach. Learn (2021)

    2021

  23. [31]

    arXiv preprint arXiv:1907.12273 (2019)

    Huang, L., Yuan, Y., Guo, J., Zhang, C., Chen, X., Wang, J.: Interlaced sparse self-attention for semantic segmentation. arXiv preprint arXiv:1907.12273 (2019)

    2019 arXiv

  24. [32]

    arXiv preprint arXiv:1911.07140 (2019)

    Huang, Z., Zhang, T.: Black-box adversarial attack with transferable model-based embedding. arXiv preprint arXiv:1911.07140 (2019)

    2019 arXiv

  25. [33]

    In: International conference on machine learning

    Ji, K., Yang, J., Liang, Y.: Bilevel optimization: Convergence analysis and en- hanced design. In: International conference on machine learning. pp. 4882–4892. PMLR (2021)

    2021

  26. [34]

    In: Pro- ceedings of the 31st ACM International Conference on Multimedia

    Jiao, X., Liu, Y., Gao, J., Chu, X., Fan, X., Liu, R.: Pearl: Preprocessing enhanced adversarial robust learning of image deraining for semantic segmentation. In: Pro- ceedings of the 31st ACM International Conference on Multimedia. pp. 8185–8194 (2023)

    2023

  27. [35]

    In: 2020 IEEE/CVF Conference on Computer Vision and Pattern Recog- nition Workshops (CVPRW)

    Klingner, M., Bär, A., Fingscheidt, T.: Improved noise and attack robustness for semantic segmentation by using multi-task training with self-supervised depth es- timation. In: 2020 IEEE/CVF Conference on Computer Vision and Pattern Recog- nition Workshops (CVPRW). pp. 1299–13...

    2020

  28. [36]

    In: Artificial intelligence safety and security, pp

    Kurakin, A., Goodfellow, I.J., Bengio, S.: Adversarial examples in the physical world. In: Artificial intelligence safety and security, pp. 99–112. Chapman and Hall/CRC (2018)

    2018

  29. [37]

    In: The Eleventh International Conference on Learning Representations (2023)

    Li, Q., Guo, Y., Zuo, W., Chen, H.: Making substitute models more bayesian can enhance transferability of adversarial examples. In: The Eleventh International Conference on Learning Representations (2023)

    2023

  30. [38]

    In: International Conference on Machine Learning

    Li, Y., Li, L., Wang, L., Zhang, T., Gong, B.: Automa: A bayesian automation for adversarial attacks. In: International Conference on Machine Learning. pp. 5799–

  31. [39]

    In: Proceedings of the AAAI Conference on Artificial Intelligence

    Li, Y., Bai, S., Zhou, Y., Xie, C., Zhang, Z., Yuille, A.: Learning transferable adversarial examples via ghost networks. In: Proceedings of the AAAI Conference on Artificial Intelligence. vol. 34, pp. 11458–11465 (2020)

    2020

  32. [40]

    IEEE Transactions on Information Forensics and Security (2025)

    Li, Z., Li, Q., Ren, M., Ru, Y., Sun, Z.: Enhancing adversarial transferability with alignment network. IEEE Transactions on Information Forensics and Security (2025)

    2025

  33. [41]

    Lin, J., Song, C., He, K., Wang, L., Hopcroft, J.E.: Nesterov accelerated gradient andscaleinvarianceforadversarialattacks.arXivpreprintarXiv:1908.06281(2019)

    2019 arXiv

  34. [42]

    In: Proceedings of the European conference on computer vision (ECCV)

    Liu, C., Zoph, B., Neumann, M., Shlens, J., Hua, W., Li, L.J., Fei-Fei, L., Yuille, A., Huang, J., Murphy, K.: Progressive neural architecture search. In: Proceedings of the European conference on computer vision (ECCV). pp. 19–34 (2018)

    2018

  35. [43]

    arXiv preprint arXiv:2401.13205 (2024)

    Liu, J., Lyu, X.: Boosting the transferability of adversarial examples via local mixup and adaptive step size. arXiv preprint arXiv:2401.13205 (2024)

    2024 arXiv

  36. [44]

    IEEE Transactions on Pattern Analysis and Machine Intelligence46(7), 5026–5043 (2024)

    Liu, R., Gao, J., Liu, X., Fan, X.: Learning with constraint learning: New perspec- tive, solution strategy and various applications. IEEE Transactions on Pattern Analysis and Machine Intelligence46(7), 5026–5043 (2024)

    2024

  37. [45]

    IEEE Transactions on Pattern Analysis and Machine Intelligence44(12), 10045–10067 (2021)

    Liu, R., Gao, J., Zhang, J., Meng, D., Lin, Z.: Investigating bi-level optimization for learning and vision from a unified perspective: A survey and beyond. IEEE Transactions on Pattern Analysis and Machine Intelligence44(12), 10045–10067 (2021)

    2021

  38. [46]

    In: International Conference on Machine Learning

    Liu, R., Liu, X., Yuan, X., Zeng, S., Zhang, J.: A value-function-based interior- point method for non-convex bi-level optimization. In: International Conference on Machine Learning. pp. 6882–6892. PMLR (2021)

    2021

  39. [47]

    In: International Con- ference on Machine Learning

    Liu, R., Liu, Y., Yao, W., Zeng, S., Zhang, J.: Averaged method of multipliers for bi-level optimization without lower-level strong convexity. In: International Con- ference on Machine Learning. pp. 21839–21866. PMLR (2023)

    2023

  40. [48]

    Advances in Neural Information Processing Systems34, 8662–8675 (2021)

    Liu, R., Liu, Y., Zeng, S., Zhang, J.: Towards gradient-based bilevel optimization with non-convex followers and beyond. Advances in Neural Information Processing Systems34, 8662–8675 (2021)

    2021

  41. [49]

    IEEE Transactions on Pattern Analysis and Machine Intelligence (2025)

    Liu, R., Liu, Y., Zeng, S., Zhang, J.: Augmenting iterative trajectory for bilevel optimization: Methodology, analysis and extensions. IEEE Transactions on Pattern Analysis and Machine Intelligence (2025)

    2025

  42. [50]

    In: ICASSP 2026-2026 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP)

    Liu, Y., Gao, J.: Past as prior: Reweighted proxy guidance for stable adversar- ial training. In: ICASSP 2026-2026 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP). pp. 3356–3360. IEEE (2026)

    2026

  43. [51]

    In: Proceedings of the Thirty-Third International Joint Conference on Artificial Intelligence

    Liu, Y., Gao, J., Liu, X., Jiao, X., Fan, X., Liu, R.: Advancing generalized trans- fer attack with initialization derived bilevel optimization and dynamic sequence truncation. In: Proceedings of the Thirty-Third International Joint Conference on Artificial Intelligence. pp. 1...

    2024

  44. [52]

    Liu, Z., Lin, Y., Cao, Y., Hu, H., Wei, Y., Zhang, Z., Lin, S., Guo, B.: Swin transformer:Hierarchical visiontransformerusingshiftedwindows.In:Proceedings Bilevel-Minimax Adversarial Transfer 19 of the IEEE/CVF international conference on computer vision. pp. 10012–10022 (2021)

    2021

  45. [53]

    In: European Conference on Computer Vision

    Long, Y., Zhang, Q., Zeng, B., Gao, L., Liu, X., Zhang, J., Song, J.: Frequency domain model augmentation for adversarial attack. In: European Conference on Computer Vision. pp. 549–566. Springer (2022)

    2022

  46. [54]

    arXiv preprint arXiv:2203.08725 (2022)

    Lord, N.A., Mueller, R., Bertinetto, L.: Attacking deep networks with surrogate- based adversarial black-box methods is easy. arXiv preprint arXiv:2203.08725 (2022)

    2022 arXiv

  47. [55]

    Advances in Neural Information Processing Systems32(2019)

    MacDonald, J., Wäldchen, S., Hauch, S., Kutyniok, G.: Adversarial training and robustness for multiple perturbations. Advances in Neural Information Processing Systems32(2019)

    2019

  48. [56]

    arXiv preprint arXiv:2007.00806 (2020)

    Miller, C., Vosoughi, S.: Query-free adversarial transfer via undertrained surro- gates. arXiv preprint arXiv:2007.00806 (2020)

    2020 arXiv

  49. [57]

    IEEE Transactions on Image Processing 31, 239–250 (2021)

    Mu, P., Liu, Z., Liu, Y., Liu, R., Fan, X.: Triple-level model inferred collaborative network architecture for video deraining. IEEE Transactions on Image Processing 31, 239–250 (2021)

    2021

  50. [58]

    In: European Conference on Computer Vision

    Nakka, K.K., Salzmann, M.: Indirect local attacks for context-aware semantic seg- mentation networks. In: European Conference on Computer Vision. pp. 611–628. Springer (2020)

    2020

  51. [59]

    Springer (2006)

    Nocedal, J., Wright, S.J.: Numerical optimization. Springer (2006)

    2006

  52. [60]

    Journal of Science Innovation and Technology Research (2025)

    Ododo, F.R., Sadiq, R.R.: Adversarial attacks in cybersecurity: A machine learning perspective. Journal of Science Innovation and Technology Research (2025)

    2025

  53. [61]

    arXiv preprint arXiv:1605.07277 (2016)

    Papernot, N., McDaniel, P., Goodfellow, I.: Transferability in machine learning: from phenomena to black-box attacks using adversarial samples. arXiv preprint arXiv:1605.07277 (2016)

    2016 arXiv

  54. [62]

    Symmetry13(5), 817 (2021)

    Pedraza, A., Deniz, O., Bueno, G.: On the relationship between generalization and robustness to adversarial examples. Symmetry13(5), 817 (2021)

    2021

  55. [63]

    Advances in neural information processing systems35, 29845–29858 (2022)

    Qin, Z., Fan, Y., Liu, Y., Shen, L., Zhang, Y., Wang, J., Wu, B.: Boosting the trans- ferability of adversarial attacks with reverse adversarial perturbation. Advances in neural information processing systems35, 29845–29858 (2022)

    2022

  56. [64]

    arXiv preprint arXiv:2210.04886 (2022)

    Rebuffi, S.A., Croce, F., Gowal, S.: Revisiting adapters with adversarial training. arXiv preprint arXiv:2210.04886 (2022)

    2022 arXiv

  57. [65]

    International journal of computer vision115(3), 211–252 (2015)

    Russakovsky, O., Deng, J., Su, H., Krause, J., Satheesh, S., Ma, S., Huang, Z., Karpathy, A., Khosla, A., Bernstein, M., et al.: Imagenet large scale visual recog- nition challenge. International journal of computer vision115(3), 211–252 (2015)

    2015

  58. [66]

    In: Proceedings of the IEEE conference on computer vision and pattern recognition

    Sandler, M., Howard, A., Zhu, M., Zhmoginov, A., Chen, L.C.: Mobilenetv2: In- verted residuals and linear bottlenecks. In: Proceedings of the IEEE conference on computer vision and pattern recognition. pp. 4510–4520 (2018)

    2018

  59. [67]

    IEEE transactions on pattern analysis and machine intelligence39(4), 640–651 (2017)

    Shelhamer, E., Long, J., Darrell, T.: Fully convolutional networks for semantic seg- mentation. IEEE transactions on pattern analysis and machine intelligence39(4), 640–651 (2017)

    2017

  60. [68]

    In: Proceedings of the AAAI conference on artificial intelligence

    Szegedy, C., Ioffe, S., Vanhoucke, V., Alemi, A.: Inception-v4, inception-resnet and the impact of residual connections on learning. In: Proceedings of the AAAI conference on artificial intelligence. vol. 31 (2017)

    2017

  61. [69]

    In: Proceedings of the IEEE conference on computer vision and pattern recognition

    Szegedy, C., Vanhoucke, V., Ioffe, S., Shlens, J., Wojna, Z.: Rethinking the incep- tion architecture for computer vision. In: Proceedings of the IEEE conference on computer vision and pattern recognition. pp. 2818–2826 (2016)

    2016

  62. [70]

    arXiv preprint arXiv:1705.07204 (2017) 20 Y

    Tramèr, F., Kurakin, A., Papernot, N., Goodfellow, I., Boneh, D., Mc- Daniel, P.: Ensemble adversarial training: Attacks and defenses. arXiv preprint arXiv:1705.07204 (2017) 20 Y. Liu et al

    2017 arXiv

  63. [71]

    IEEE Transactions on Neural Networks and Learning Systems (2025)

    Wang, D., Yao, W., Jiang, T., Zheng, X., Wu, J.: Improving the transferability of adversarial examples by feature augmentation. IEEE Transactions on Neural Networks and Learning Systems (2025)

    2025

  64. [72]

    Expert Systems with Applications255, 124757 (2024)

    Wang, J., Chen, Z., Jiang, K., Yang, D., Hong, L., Guo, P., Guo, H., Zhang, W.: Boosting the transferability of adversarial attacks with global momentum initial- ization. Expert Systems with Applications255, 124757 (2024)

    2024

  65. [73]

    In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition

    Wang, X., He, K.: Enhancing the transferability of adversarial attacks through variance tuning. In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. pp. 1924–1933 (2021)

    2021

  66. [74]

    In: Proceedings of the IEEE/CVF International Conference on Computer Vision

    Wang, X., He, X., Wang, J., He, K.: Admix: Enhancing the transferability of ad- versarial attacks. In: Proceedings of the IEEE/CVF International Conference on Computer Vision. pp. 16158–16167 (2021)

    2021

  67. [75]

    In: Proceedings of the IEEE/CVF international conference on computer vision

    Wang, Z., Guo, H., Zhang, Z., Liu, W., Qin, Z., Ren, K.: Feature importance-aware transferable adversarial attacks. In: Proceedings of the IEEE/CVF international conference on computer vision. pp. 7639–7648 (2021)

    2021

  68. [76]

    arXiv preprint arXiv:2110.00476 (2021)

    Wightman, R., Touvron, H., Jégou, H.: Resnet strikes back: An improved training procedure in timm. arXiv preprint arXiv:2110.00476 (2021)

    2021 arXiv

  69. [77]

    In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition

    Wu, W., Su, Y., Chen, X., Zhao, S., King, I., Lyu, M.R., Tai, Y.W.: Boosting the transferability of adversarial samples via attention. In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. pp. 1161– 1170 (2020)

    2020

  70. [78]

    In: Proceedings of the European Conference on Computer Vision (ECCV)

    Xiao, T., Liu, Y., Zhou, B., Jiang, Y., Sun, J.: Unified perceptual parsing for scene understanding. In: Proceedings of the European Conference on Computer Vision (ECCV). pp. 418–434 (2018)

    2018

  71. [79]

    Advances in Neural Information Processing Systems36, 1905– 1922 (2023)

    Xiaosen, W., Tong, K., He, K.: Rethinking the backward propagation for adversar- ial transferability. Advances in Neural Information Processing Systems36, 1905– 1922 (2023)

    2023

  72. [80]

    In: Proceedings of the IEEE/CVF conference on computer vision and pattern recognition

    Xie, C., Zhang, Z., Zhou, Y., Bai, S., Wang, J., Ren, Z., Yuille, A.L.: Improving transferability of adversarial examples with input diversity. In: Proceedings of the IEEE/CVF conference on computer vision and pattern recognition. pp. 2730–2739 (2019)

    2019

  73. [81]

    arXiv preprint arXiv:2105.15203 (2021)

    Xie, E., Wang, W., Yu, Z., Anandkumar, A., Alvarez, J.M., Luo, P.: Segformer: Simple and efficient design for semantic segmentation with transformers. arXiv preprint arXiv:2105.15203 (2021)

    2021 arXiv

  74. [82]

    In: International Conference on Learning Representations

    Yao, W., Yin, H., Zeng, S., Zhang, J.: Overcoming lower-level constraints in bilevel optimization: A novel approach with regularized gap functions. In: International Conference on Learning Representations. vol. 2025, pp. 55516–55549 (2025)

    2025

  75. [83]

    In: Proceedings of the AAAI Conference on Artificial Intelligence

    Yin, J.L., Wang, W., Lin, W., Liu, X., et al.: Adversarial-inspired backdoor de- fense via bridging backdoor and adversarial attacks. In: Proceedings of the AAAI Conference on Artificial Intelligence. vol. 39, pp. 9508–9516 (2025)

    2025

  76. [84]

    In: International Conference on Learning Representations

    Yuan, J., Fangyuan, X., Nie, F., Li, X.: Riemannian optimization on relaxed indi- cator matrix manifold. In: International Conference on Learning Representations. vol. 2026, pp. 68665–68721 (2026)

    2026

  77. [85]

    In: Proceedings of the IEEE/CVF International Conference on Computer Vision

    Yuan, Z., Zhang, J., Jia, Y., Tan, C., Xue, T., Shan, S.: Meta gradient adversarial attack. In: Proceedings of the IEEE/CVF International Conference on Computer Vision. pp. 7748–7757 (2021)

    2021

  78. [86]

    In: Proceedings of the AAAI Conference on Artificial Intelligence

    Yue, Z., Gao, J., Su, Z.: Unveiling details in the dark: Simultaneous brightening and zooming for low-light image enhancement. In: Proceedings of the AAAI Conference on Artificial Intelligence. vol. 38, pp. 6899–6907 (2024) Bilevel-Minimax Adversarial Transfer 21

    2024

  79. [87]

    In: International Conference on Machine Learning

    Zhang, Y., Zhang, G., Khanduri, P., Hong, M., Chang, S., Liu, S.: Revisiting and advancing fast adversarial training through the lens of bi-level optimization. In: International Conference on Machine Learning. pp. 26693–26712. PMLR (2022)

    2022

  80. [88]

    In: Proceedings of the European Conference on Computer Vision (ECCV)

    Zhao, H., Zhang, Y., Liu, S., Shi, J., Change Loy, C., Lin, D., Jia, J.: Psanet: Point- wise spatial attention network for scene parsing. In: Proceedings of the European Conference on Computer Vision (ECCV). pp. 267–283 (2018)

    2018

  81. [89]

    arXiv preprint arXiv:2012.15840 (2020)

    Zheng, S., Lu, J., Zhao, H., Zhu, X., Luo, Z., Wang, Y., Fu, Y., Feng, J., Xiang, T., Torr, P.H., et al.: Rethinking semantic segmentation from a sequence-to-sequence perspective with transformers. arXiv preprint arXiv:2012.15840 (2020)

    2020 arXiv

  82. [90]

    Zhou, B., Zhao, H., Puig, X., Fidler, S., Barriuso, A., Torralba, A.: Scene parsing throughade20kdataset.In:ProceedingsoftheIEEEconferenceoncomputervision and pattern recognition. pp. 633–641 (2017)

    2017

  83. [91]

    IEEE Transactions on Image Processing31, 6487–6501 (2022)

    Zhu, Y., Chen, Y., Li, X., Chen, K., He, Y., Tian, X., Zheng, B., Chen, Y., Huang, Q.: Toward understanding and boosting adversarial transferability from a distri- bution perspective. IEEE Transactions on Image Processing31, 6487–6501 (2022)

    2022

Pith tools

Reviewed August 16, 2026 · model on record in the stance chip above.