Learning with Bilevel-Minimax Optimization for Efficient and Reliable Transfer Attacks

2026-08-12

AI Summary

This work addresses the limited transferability in black-box adversarial attacks caused by suboptimal initialization, inadequate surrogate model adaptation, and weak gradient dynamics coupling. To overcome these limitations, the authors propose BMAT, a novel framework that introduces bilevel min-max optimization into transfer-based adversarial attacks for the first time, jointly optimizing initialization, surrogate model adaptation, and perturbation generation through a tripartite coupling mechanism. Efficient bottom-up optimization is achieved via a soft weight modulator and an implicit gradient approximator, supported by theoretical analysis of the optimization dynamics. Extensive experiments demonstrate that BMAT significantly outperforms over ten strong baselines on both classification and segmentation tasks, achieving substantially higher transfer success rates across more than 30 target models, with mIoU degradation up to twice as severe as competing methods.

Abstract

Transfer-based adversarial attacks craft adversarial examples using surrogate models to mislead black-box victim models. Beyond perturbation generation, transferability is fundamentally governed by the coupling of initialization, surrogate adaptation, and gradient dynamics. We revisit this challenge from a bilevel-minimax perspective and propose BMAT (Bilevel-Minimax Adversarial Transfer). The bilevel formulation captures the dependency between initialization and perturbation, while the inner minimax problem promotes surrogate robustness for cross-architecture generalization. Algorithmically, we develop an integrated bottom-up solver that combines a Soft Weight Modulator and an Implicit Gradient Approximator to enable ternary coupling among initialization, surrogate adaptation, and perturbation optimization. We further provide theoretical insights into the optimization dynamics of the proposed bilevel-minimax framework. Extensive experiments on classification and segmentation benchmarks show that BMAT outperforms more than 10 strong baselines across more than 30 victim models, improving both intra- and cross-architecture transfer and yielding up to a 2x reduction in mIoU. Code is available at https://github.com/callous-youth/BMAT.

Problem

• transfer-based adversarial attacks
• bilevel-minimax optimization
• surrogate models
• cross-architecture generalization
• adversarial transfer

Innovation

• bilevel-minimax optimization
• transfer-based adversarial attack
• surrogate model adaptation
• implicit gradient approximation
• cross-architecture generalization