Quantized neural networks (QNNs) have received increasing attention in resource-constrained scenarios due to their exceptional generalizability. However, their robustness against realistic black-box adversarial attacks has not been extensively studied. In this scenario, adversarial transferability is pursued across QNNs with different quantization bitwidths, which particularly involve unknown architectures and defense methods. Previous studies claim that transferability is difficult to achieve across QNNs with different bitwidths on the condition that they share the same architecture. However, we discover that under different architectures, transferability can be largely improved by using a QNN quantized with an extremely low bitwidth as the substitute model. We further improve the attack transferability by proposing \textit{quantization aware attack} (QAA), which fine-tunes a QNN substitute model with a multiple-bitwidth training objective. In particular, we demonstrate that QAA addresses the two issues that are commonly known to hinder transferability: 1) quantization shifts and 2) gradient misalignments. Extensive experimental results validate the high transferability of the QAA to diverse target models. For instance, when adopting the ResNet-34 substitute model on ImageNet, QAA outperforms the current best attack in attacking standardly trained DNNs, adversarially trained DNNs, and QNNs with varied bitwidths by 4.3\% $\sim$ 20.9\%, 8.7\% $\sim$ 15.5\%, and 2.6\% $\sim$ 31.1\% (absolute), respectively. In addition, QAA is efficient since it only takes one epoch for fine-tuning. In the end, we empirically explain the effectiveness of QAA from the view of the loss landscape. Our code is available at https://github.com/yyl-github-1896/QAA/

翻译：量化神经网络（QNN）在资源受限场景中因卓越的泛化性日益受到关注，但其面对现实黑盒对抗攻击的鲁棒性尚未得到充分研究。在此场景中，对抗迁移性需跨越不同量化位宽的QNN，这些网络尤其涉及未知架构与防御方法。先前研究声称，在共享相同架构的条件下，不同位宽QNN间难以实现迁移性。然而我们发现，当架构不同时，采用极低比特量化QNN作为替代模型可大幅提升迁移性。我们进一步提出量化感知攻击（QAA），通过多比特训练目标微调QNN替代模型，从而提升攻击迁移性。具体而言，我们证明QAA解决了通常阻碍迁移性的两大问题：1）量化偏移；2）梯度失配。大量实验结果验证了QAA对多样目标模型具有高迁移性。例如，在ImageNet上采用ResNet-34替代模型时，QAA在攻击标准训练DNN、对抗训练DNN及不同位宽QNN方面，分别以4.3%~20.9%、8.7%~15.5%和2.6%~31.1%（绝对差值）的指标超越当前最优攻击。此外，QAA仅需一个周期微调即可实现高效性。最后，我们从损失景观视角实证解释了QAA的有效性。代码可在https://github.com/yyl-github-1896/QAA/获取。