StrucTrans: Zero-Query Structural Adversarial Attack Transferred from Masked Autoencoders to Image Classifiers

We present StrucTrans, a structure-based transferred adversarial attack operating under the most restricted black-box setting: No query access to the model, no knowledge of the model internals or its training data is required. Under a more challenging threat model with only the target architecture information available, StrucTrans can fool neural image classifiers on par with poisoning- and query-based adversarial attacks, and achieve lower computational costs than pure ensemble methods. StrucTrans consists of transferring the adversarial perturbation from an independently trained masked autoencoder sharing the same architecture to substitute for the target model, and an adversarial masking function to reduce internal dependence and generalize on data samples. Experiments show that our attack method performs effectively on various architectures, demonstrating competitive robustness against state-of-the-art adversarial defense techniques. We examine the structural sensitivity of our transferred attack in ablation studies and reveal the invariance of transferability on the local latent details, while emphasizing the relevance to geometric interpretation in representation learning perspectives.