The paper introduces Manifold Anchored Bilevel Transfer (MABT), a framework that aligns adversarial attack trajectories with the intrinsic data manifold to reduce surrogate-specific overfitting. MABT employs a relaxed manifold-anchoring operator as a semantic rectifier and formulates transfer attack generation as a distributional bilevel optimization problem, learning geometry-aligned initializations that minimize expected transfer risk. A Hessian-free solver with linear-time complexity is developed to efficiently solve the resulting hierarchy, and experiments show improved transferability across 10 attackers, 28 configurations, various victim models, and defense mechanisms.
arXiv:2608. 11815v1 Announce Type: new Abstract: Transfer-based adversarial attacks craft adversarial examples using surrogate models to mislead black-box victim models.
The paper introduces Inverse Knowledge Distillation (IKD), an attack‑agnostic technique that enhances adversarial transferability by maximizing the discrepancy between benign and adversarial prediction distributions on a surrogate model. IKD employs a CE/KL‑equivalent soft‑label objective to push adversarial predictions away from a fixed benign anchor, leveraging Fisher‑sensitive surrogate directions. The authors provide theoretical analysis showing CE and KL induce identical gradients, derive a lower bound on Fisher‑subspace overlap, and demonstrate through extensive ImageNet experiments that IKD consistently improves black‑box attack performance across CNN, ViT, and defended models.
arXiv:2608. 10237v1 Announce Type: new Abstract: Contrastive learning and Siamese embedding models have become the foundation of modern verification systems, where decisions are governed not by discrete classification boundaries, but by relational geometry in embedding space.
arXiv:2605. 31219v2 Announce Type: replace-cross Abstract: While decision-based black-box adversarial attacks present a severe security threat, current methodologies suffer from fundamental limitations.
arXiv:2608.29054v1 Announce Type: new Abstract: Graph Neural Networks (GNNs) have emerged as a cornerstone for representing complex relational dependencies in diverse multimedia tasks, particularly i...
The paper introduces a penalized distributionally robust optimization framework that allows an adversary to choose any distribution while incurring a Wasserstein penalty for deviating from the empirical distribution. It shows that the adversary’s problem can be reformulated as optimizing transport maps that push empirical samples to adversarial ones, proving that optimal maps are cyclically monotone. The authors argue that standard per-sample adversarial training violates this property and propose two remedies—multi-start particle ascent and input-convex neural network parameterization—to enforce cyclical monotonicity, demonstrating improved robustness and generalization in experiments on regression, image classification, and control tasks.
arXiv:2607. 14737v1 Announce Type: cross Abstract: Vision-language pre-trained models (VLPs) are widely used in real-world applications.
arXiv:2509. 01235v2 Announce Type: replace Abstract: Balancing training accuracy and adversarial robustness has beeen a challenge since the birth of deep learning.
arXiv:2606. 20880v2 Announce Type: replace-cross Abstract: Decision-making under partial or adversarial observability requires accurate inference of the environment's latent state and its associated uncertainty.
arXiv:2608.29510v1 Announce Type: cross Abstract: Aerial object detection is increasingly deployed in real-world applications, but models remain vulnerable to physical, universal adversarial patches...
The paper introduces a detector‑based switched model to defend linear predictive models against stealthy false data injection attacks. It derives a convex formulation of the adversarial risk that incorporates protected features and a hyperparameter for attack probability, allowing an explicit trade‑off between clean and attacked data performance. Numerical experiments on real and synthetic datasets demonstrate improved performance on partially attacked data, even when the attack probability is misspecified.
The paper introduces a new framework for creating frequency‑based adversarial attacks that are grounded in an explicit optimization problem. By defining a perturbation constraint set linked to structured, non‑orthogonal transforms, the authors show that attacks can be generated as weighted σ‒projections onto this set, providing a clear geometric characterization. Experiments on standard datasets demonstrate that these attacks are highly effective across both pretrained and robust models, even on unseen architectures.