Preprint

Learning with Bilevel-Minimax Optimization for Efficient and Reliable Transfer Attacks

Yao-Hua Liu Yi-Fan Guo Jia-Xin Gao

Aug 2026 · 0 citations · 89 references

Computer Science

TL;DR

This work proposes BMAT (Bilevel-Minimax Adversarial Transfer), an integrated bottom-up solver that combines a Soft Weight Modulator and an Implicit Gradient Approximator to enable ternary coupling among initialization, surrogate adaptation, and perturbation optimization.

Abstract

Transfer-based adversarial attacks craft adversarial examples using surrogate models to mislead black-box victim models. Beyond perturbation generation, transferability is fundamentally governed by the coupling of initialization, surrogate adaptation, and gradient dynamics. We revisit this challenge from a bilevel-minimax perspective and propose BMAT (Bilevel-Minimax Adversarial Transfer). The bilevel formulation captures the dependency between initialization and perturbation, while the inner minimax problem promotes surrogate robustness for cross-architecture generalization. Algorithmically, we develop an integrated bottom-up solver that combines a Soft Weight Modulator and an Implicit Gradient Approximator to enable ternary coupling among initialization, surrogate adaptation, and perturbation optimization. We further provide theoretical insights into the optimization dynamics of the proposed bilevel-minimax framework. Extensive experiments on classification and segmentation benchmarks show that BMAT outperforms more than 10 strong baselines across more than 30 victim models, improving both intra- and cross-architecture transfer and yielding up to a 2x reduction in mIoU. Code is available at https://github.com/callous-youth/BMAT.

arXiv Semantic Scholar

View source

Similar papers

Aug 2026

Rethinking robust generalization with energy minimization.

A novel energy-based optimization strategy to improve the robust generalization of machine learning models against adversarial attacks by incorporating the principles of energy-based models and shows strong and competitive performance across three extensively utilized datasets.

Zhuang Qian, Penglei Gao, Shufei Zhang et al. · Neural Networks · 0 citations

Improving Adversarial Transferability with Local Perturbation Augmentation

This paper reveals that the iterative optimization process tends to over-specialize adversarial perturbations to the local gradient characteristics of the surrogate model, thereby hindering their transferability to other models, and proposes a novel attack method called Local Perturbation Augmentation Attack.

Jian-Xun Mi, Xuanhui Zhong, Weisheng Li · 0 citations

Conference Open access Sep 2026

Parameter-Efficient Dual-Loss Adaptation with Logit Divergence: A Unified Approach for Adversarial Example Detection and Robust Inference

D3Adapter is presented, a threat-aware framework that unifies adversarial example detection (AED) and robust inference and scalability across datasets with varying numbers of classes is studied, showing that unified detection and robust inference can be achieved with predictable overhead proportional to the number of a...

Zi-Rui Fu, Marco Donato · Proceedings of the Thirty-Fi... · 0 citations

Jul 2026

Efficient LLM Adversarial Training via Low-Rank Defense and Circuit-Guided Surrogates

This work comprehensively investigates computation-efficient strategies to speed up latent adversarial training from two complementary perspectives, and reduces per-step adversarial-training FLOPs by 48.1% while requiring only 0.0118% trainable parameters.

Weiyi He, Yuping Lin, Jiliang Tang et al. · arXiv.org · 0 citations

Conference Open access Sep 2026

Diverge to Converge: Mutual Heterogeneous Learning for Robust Pruning

Mutual Heterogeneous Learning (MHL) is proposed, a framework enabling robust pruning via single-model inference that significantly outperforms single-model baselines in both adversarial robustness and corruption robustness, while maintaining competitive clean accuracy.

Jin-Hui Yu, Zikai Zhang, Khaled A. Harras et al. · Proceedings of the Thirty-Fi... · 0 citations

Aug 2026

Balancing clean accuracy and gradient robustness via mask-guided mixup and adaptive label refinement

A robustness-oriented training framework that integrates Mask-Guided Adversarial Mixup (MGAM) and Adaptive Timescale Exponential Moving Average (AT-EMA) that provides a practical data-regularization strategy for improving training stability in adversarial learning is proposed.

Guo Niu, Huanlin Mo, Shengjun Deng et al. · Signal, Image and Video Proc... · 0 citations