Learning with Bilevel-Minimax Optimization for Efficient and Reliable Transfer Attacks
Published in European Conference on Computer Vision (ECCV), 2026
Transfer-based adversarial attacks craft adversarial examples using surrogate models to mislead black-box victim models. Beyond perturbation generation, transferability is fundamentally governed by the coupling of initialization, surrogate adaptation, and gradient dynamics. BMAT (Bilevel-Minimax Adversarial Transfer) formulates transfer attacks as a bilevel-with-minimax problem: the inner minimax jointly adapts the perturbation and surrogate soft weights to surface robust transferable gradients, while the outer level learns an initialization perturbation using implicit feedback without unrolling. Evaluations across classification and semantic segmentation benchmarks show that BMAT improves intra- and cross-architecture transferability across a broad set of victim models.
Recommended citation: Yaohua Liu, Yifan Guo, Jiaxin Gao. Learning with Bilevel-Minimax Optimization for Efficient and Reliable Transfer Attacks[C]. European Conference on Computer Vision (ECCV), 2026.
Download Paper | Code Repository