Transfer attacks generate significant interest for real-world black-box
applications by crafting transferable adversarial examples through surrogate
models. Whereas, existing works essentially directly optimize the single-level
objective w.r.t. the surrogate model, which always leads to poor
interpretability of attack mechanism and limited generalization performance
over unknown victim models. In this work, we propose the
\textbf{B}il\textbf{E}vel \textbf{T}ransfer \textbf{A}ttac\textbf{K} (BETAK)
framework by establishing an initialization derived bilevel optimization
paradigm, which explicitly reformulates the nested constraint relationship
between the Upper-Level (UL) pseudo-victim attacker and the Lower-Level (LL)
surrogate attacker. Algorithmically, we introduce the Hyper Gradient Response
(HGR) estimation as an effective feedback for the transferability over
pseudo-victim attackers, and propose the Dynamic Sequence Truncation (DST)
technique to dynamically adjust the back-propagation path for HGR and reduce
computational overhead simultaneously. Meanwhile, we conduct detailed
algorithmic analysis and provide convergence guarantee to support non-convexity
of the LL surrogate attacker. Extensive evaluations demonstrate substantial
improvement of BETAK (e.g., $\mathbf{53.41}$\% increase of attack success rates
against IncRes-v$2_{ens}$) against different victims and defense methods in
targeted and untargeted attack scenarios. The source code is available at
this https URL

提出了一种基于双层优化框架的转移攻击方法 (BETAK)，通过引入超梯度响应 (HGR) 估计和动态序列截断 (DST) 技术，提供了算法分析和收敛保证，显著提升对不同受害者和防御方法的攻击成功率。